ML21048A388
| ML21048A388 | |
| Person / Time | |
|---|---|
| Site: | Cook  |
| Issue date: | 02/18/2021 |
| From: | Scott Wall Plant Licensing Branch III |
| To: | Gebbie J Indiana Michigan Power Co |
| Wall S | |
| References | |
| LER 316-2020-003 | |
| Download: ML21048A388 (11) | |
Text
February 18, 2021 Mr. Joel P. Gebbie Senior Vice President and Chief Nuclear Officer Indiana Michigan Power Company Nuclear Generation Group One Cook Place Bridgman, MI 49106
SUBJECT:
TRANSMITTAL OF FINAL DONALD C. COOK NUCLEAR PLANT, UNIT NO. 2 ACCIDENT SEQUENCE PRECURSOR REPORT (LICENSEE EVENT REPORT 316-2020-003)
Dear Mr. Gebbie:
By letter dated November 2, 2020, (Agencywide Documents Access and Management System (ADAMS) Accession No. ML20311A129), Donald C. Cook Nuclear Plant, Unit No. 2 (CNP, Unit 2) submitted licensee event report (LER) 316-2020-003, Manual Reactor Trip and Automatic Safety Injection Due to Failed Open Pressurizer Spray Valve, to the U.S. Nuclear Regulatory Commission (NRC) staff pursuant to Title 10 of the Code of Federal Regulations (10 CFR) Section 50.73. As part of the Accident Sequence Precursor (ASP) Program, the NRC staff reviewed the event to identify potential precursors and to determine the probability of the event leading to a core damage state. The results of the analysis are provided in the enclosure to this letter.
The NRC does not request a formal analysis review in accordance with Regulatory Issue Summary 2006-24, Revised Review and Transmittal Process for Accident Sequence Precursor Analyses (ADAMS Accession No. ML060900007), because the analysis resulted in a conditional core damage probability (CCDP) of less than 1x10-4.
Final ASP Analysis Summary. A brief summary of the final ASP analysis, including the results, is provided below.
Manual Reactor Trip and Automatic Safety Injection Due to Failed Open Pressurizer Spray Valve. This event is documented in LER 316-2020-003.
Executive Summary. On September 4, 2020, main control room operators completed a planned power reduction from 100 percent to 92 percent reactor power in preparation of main turbine valve testing. As reactor coolant system (RCS) pressure reached 2235 pounds per square inch gauge (psig), one pressurizer spray valve began to close as expected; however, the other spray valve unexpectedly opened fully. The operators were unable to close the open spray valve and subsequently manually tripped the reactor due to lowering RCS pressure. RCS pressure continued to lower below the safety injection (SI) actuation setpoint resulting in an automatic SI actuation.
J. Gebbie All automatic actions in response to the SI signal occurred as expected, includingall control rods fully inserted; all auxiliary feedwater (AFW) pumps started and supplied the steam generators (SGs); all emergency core cooling system (ECCS) components operated as required. In addition, both emergency diesel generators automatically started; however, they remained unloaded because offsite power remained available throughout the event. Decay heat was removed by the steam dump valves and ECCS was manually secured. Due to high RCS pressure as a result of the SI actuation, the pressurizer power-operated relief valves cycled seven times prior to operators securing pressurizer spray and terminating SI. The cause of the failed pressurizer spray valve was foreign material from the control air supply being stuck in the positioner spool valve.
The mean CCDP probability for this event is calculated to be 1x10-5. This ASP analysis reveals that the most likely core damage sequence is an SI initiating event with AFW successfully providing inventory makeup to the SGs; however, operators fail to terminate SI resulting in a loss-of-coolant accident via the pressurizer relief valves, and high-pressure recirculation failure (dominated by human error). This accident sequence accounts for approximately 84 percent of the total CCDP for this event.
Summary of Analysis Results. This operational event resulted in a mean CCDP of 1x10-5.
If you have any questions, please contact me at 301-415-2855, or at Scott.Wall@nrc.gov.
Sincerely,
/RA/
Scott P. Wall, Senior Project Manager Plant Licensing Branch III Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-316
Enclosure:
Final Accident Sequence Precursor Analysis -
D.C. Cook Nuclear Plant (Unit 2), Manual Reactor Trip and Automatic Safety Injection Due to Failed Open Pressurizer Spray Valve (LER 316-2020-003) - Precursor cc: Listserv
ENCLOSURE Final Accident Sequence Precursor Analysis - D.C. Cook Nuclear Plant (Unit 2), Manual Reactor Trip and Automatic Safety Injection Due to Failed Open Pressurizer Spray Valve (LER 316-2020-003) - Precursor
Final ASP Analysis - Precursor Accident Sequence Precursor Program - Office of Nuclear Regulatory Research D.C. Cook Nuclear Manual Reactor Trip and Automatic Safety Injection Due to Plant, Unit 2 Failed Open Pressurizer Spray Valve LER: 316-2020-003 Event Date: 9/4/2020 CCDP = 1x10-5 IR: TBD Westinghouse Four-Loop Pressurized Water Reactor (PWR) with a Wet, Ice Plant Type:
Condenser Containment Plant Operating Mode Mode 1 (92% Reactor Power)
(Reactor Power Level):
Analyst: Reviewer: Completion Date:
Christopher Hunter Mehdi Reisi Fard 2/8/2021 1 EXECUTIVE
SUMMARY
On September 4, 2020, main control room (MCR) operators completed a planned power reduction from 100 percent to 92 percent reactor power in preparation of main turbine valve testing. As reactor coolant system (RCS) pressure reached 2235 psig, one pressurizer spray valve began to close as expected; however, the other spray valve unexpectedly opened fully.
The operators were unable to close the open spray valve and subsequently manually tripped the reactor due to lowering RCS pressure. RCS pressure continued to lower below the safety injection (SI) actuation setpoint resulting in an automatic SI actuation.
All automatic actions in response to the SI signal occurred as expected, includingall control rods fully inserted; all auxiliary feedwater (AFW) pumps started and supplied the steam generators (SGs); all emergency core cooling system (ECCS) components operated as required. In addition, both emergency diesel generators (EDGs) automatically started; however, they remained unloaded because offsite power remained available throughout the event. Decay heat was removed by the steam dump valves and ECCS was manually secured. Due to high RCS pressure as a result of the SI actuation, the pressurizer power-operated relief valves (PORVs) cycled seven times prior to operators securing pressurizer spray and terminating SI.
The cause of the failed pressurizer spray valve was foreign material from the control air supply being stuck in the positioner spool valve.
The mean conditional core damage probability for this event is calculated to be 1x10-5. This accident sequence precursor (ASP) analysis reveals that the most likely core damage sequence is an SI initiating event with AFW successfully providing inventory makeup to the SGs; however, operators fail to terminate SI resulting in a loss-of-coolant accident (LOCA) via the pressurizer relief valves, and high-pressure recirculation failure (dominated by human error). This accident sequence accounts for approximately 84 percent of the total CCDP for this event.
2 EVENT DETAILS 2.1 Event Description On September 4, 2020, MCR operators completed a planned power reduction from 100 percent to 92 percent reactor power in preparation of main turbine valve testing. As RCS pressure 1
LER 316-2020-003 reached 2235 psig, one pressurizer spray valve began to close as expected; however, the other spray valve unexpectedly opened fully. The operators were unable to close the open spray valve and subsequently manually tripped the reactor due to lowering RCS pressure. RCS pressure continued to lower below the SI actuation setpoint resulting in an automatic SI actuation.
All automatic actions in response to the SI signal occurred as expected, includingall control rods fully inserted; all AFW pumps started and supplied the SGs; all ECCS components operated as required. In addition, both EDGs automatically started; however, they remained unloaded because offsite power remained available throughout the event. Decay heat was removed by the steam dump valves and ECCS was manually secured. Due to high RCS pressure as the result of the SI actuation, the pressurizer PORVs cycled seven times prior to operator securing pressurizer spray and terminating SI. Additional information is provided in licensee event report (LER) 316-2020-002, Manual Reactor Trip and Automatic Safety Injection Due to Failed Open Pressurizer Spray Valve, (ADAMS Accession No. ML20311A129.).
2.2 Cause The licensee determined that the cause of the failed pressurizer spray valve was foreign material from the control air supply being stuck in the positioner spool valve.
3 MODELING 3.1 SDP Results/Basis for ASP Analysis The ASP Program performs independent analyses for initiating events. ASP analyses of initiating events account for all failures/degraded conditions and unavailabilities (e.g., equipment out for maintenance) that occurred during the event, regardless of licensee performance. 1 No 0F windowed events were identified.
3.2 Analysis Type An initiating event analysis was performed using a test/limited use (TLU) standardized plant analysis risk (SPAR) model for D.C. Cook Nuclear Plants 1 and 2 created in December 2020.
This TLU model includes an inadvertent SI actuation event tree to allow the modeling of this event.
3.3 SPAR Model Modifications The following SPAR model modifications were made to support this analysis:
- The event tree branch for the ISINJ (inadvertent SI) event tree was modified.
Specifically, the transfers to the SLOCA (small LOCA) event tree were removed and replaced by branching within the parent event tree. These changes eliminate unnecessary queries in the SLOCA event tree. In addition, the OEP (consequential loss of offsite power) top event and transfer to the LOOPPC (plant-centered loss of offsite power) event tree was inserted to account for potential consequential LOOP during the event. The transfer for the failure of the reactor protection system sequence was 1 ASP analyses also account for any degraded condition(s) that were identified after the initiating event occurred if the failure/degradation exposure time(s) overlapped the initiating event date.
2
LER 316-2020-003 changed to the ATWS (anticipated transient without scram) event tree. The modified ISINJ event tree is provided in Figure A-1 of Appendix A.
- Basic event PPR-PRV-CO-TRANS (PORVs/SRVs open during transient) was changed to its complement under gate PORV-4 in the PORV (PORVs are closed) fault tree. This change was made to account for the pressurizer safety relief valves not being challenged if the PORVs lift during the SI actuation.
3.4 Analysis Assumptions The following modeling assumptions were determined to be significant to the modeling of this initiating event assessment:
- The probability of IE-ISINJ (inadvertent safety injection) was set to 1.0 due to automatic SI actuation. All other initiating event probabilities were set to zero.
- Basic event PPR-PRV-CO-TRANS was set to TRUE because the PORVs opened seven times during the event response.
- The pressurizer PORVs experience seven demands due to high RCS pressure as a result of the SI actuation. To account for the increased failure of these PORVs to successfully reclose after the opening, the associated failure probabilities were modified using binominal expansion to account for their greater likelihood of failure. Basic event ZT-PRV-OO-PZR-R1 (one pressurizer PORV fails to reclose after scram) was set to 1x10-2.
4 ANALYSIS RESULTS 4.1 Results The mean CCDP for this analysis is calculated to be 1x10-5. The ASP Program threshold for initiating events is a CCDP of 10-6 or the plant-specific CCDP of an uncomplicated reactor trip with a non-recoverable loss of feedwater or the condenser heat sink, whichever is greater. This CCDP equivalent for D.C. Cook Nuclear Plant (Unit 2) is 4x10-7. Therefore, this event is a precursor.
The parameter uncertainty results for this analysis provided below:
Table 1. Parameter Uncertainty Results 5% Median Pt. Estimate Mean 95%
8.3x10-9 1.3x10-6 1.3x10-5 1.3x10-5 5.4x10-5 4.2 Dominant Sequences 2 1F The dominant accident sequence is an inadvertent SI sequence 5 (CDP = 1.1x10-5), which contributes approximately 84 percent of the total CCDP. The sequences that contribute at least 5.0 percent to the total CCDP are provided in the following table. The event tree with the dominant sequence is shown graphically in Figure A-1 of Appendix A.
2 The CCDP in this section is a point estimate.
3
LER 316-2020-003 Table 2. Dominant Sequences Sequence CDP % Description ISINJ 5 1.1x10-5 83.9% SI initiating event with AFW successfully providing inventory makeup to the SGs; however, operators fail to terminate SI resulting in a LOCA via the pressurizer PORVs, and high-pressure recirculation fails (dominated by human error) resulting in core damage ISINJ 3 1.3x10-6 10.1% SI initiating event with AFW successfully providing inventory makeup to the SGs and operators successfully terminate SI; however, a pressurizer PORV fails to reclose resulting in a continued LOCA; and high-pressure recirculation fails resulting in core damage 4.3 Key Uncertainties A review of the analysis assumptions and results reveal the following key modeling uncertainties:
- The dominant contributors to this events CCDP are the human error probabilities (HEPs) associated with two human failure events: HPI-XHE-XM-THRTL (operators fail to terminate SI) and HPI-XHE-XM-RECIRC (operators fail to start/control high-pressure recirculation). While both of these HFEs use industry average HEP values like all SPAR model HFEs, there is greater uncertainty associated with the HEP for HPI-XHE-XM-THRTL because this event has not been evaluated in the same level of detail as recirculation HFEs. The SPAR model HEP for HPI-XHE-XM-THRTL is 2x10-3. To determine if this HEP is reasonable, a reevaluation of this HFE HP was performed using the IDHEAS-ECA methodology that is provided below.
Table 3. Qualitative HFE Information for HPI-XHE-XM-THRTL Name HPI-XHE-XM-THRTL Definition Operators fail to terminate SI During this event, the failed pressurizer spray valve resulted in a lowering RCS pressure and subsequent SI actuation. The SI would eventually cause a LOCA via Description/
the pressurizer relief valves. Procedures direct operators to secure spray by Event Context tripping applicable reactor coolant pumps (RCPs) to secure pressurizer spray and terminate SI once RCS pressure is recovered.
Operators successfully secure pressurizer spray and terminate SI prior to refueling Success Criteria water storage tank (RWST) depletion.
- E-0, Step 15b, check pressurizer spray valves closed
- E-0, Steps 16-18, check RCS intact Key Cue(s)
- E-0, Step 20, adequate subcooling, RCS pressure, feed flow, pressurizer level to secure SI Procedural
- E-0, Reactor Trip or SI Guidance
LER 316-2020-003 Table 4. IDHEAS-ECA Evaluation for HPI-XHE-XM-THRTL Critical Task(s) Operators fail to secure pressurizer spray and terminate SI Detection
- Scenario Familiarity-No impact
- Task Complexity-No impact
Understanding
- Scenario Familiarity-No impact
- Information Completeness and Reliability-No impact
- Task Complexity-No impact
Performance Decisionmaking Influencing
- Scenario Familiarity-No impact Factors (PIFs)
- Information Completeness and Reliability-No impact
- Task Complexity-No impact
Action
- Scenario Familiarity-No impact
- Task Complexity-C31: straightforward procedure with many steps
Inter-Team
- This cognitive failure mechanism was not evaluated because multiple teams would not be involved.
Pt is negligible because the operators would get to E-0 procedure steps within a few Time minutes and would have at least a few hours until RWST level decreases to below Consideration 30 percent.
Recovery Recovery credit is not provided for this HFE.
Calculated HEP 3x10-3 The IDHEAS evaluation of HPI-XHE-XM-THRTL results in a HEP of 3x10-3, which is only a minor difference from the industry average value used in the SPAR models.
However, a sensitivity analysis show that this small change in the HEP results in a mean CCDP of 1.8x10-5, which is an increase of approximately 38 percent from the best estimate analysis.
- No dependency between HFEs is considered in the base SPAR model for this initiating event. Specifically, the dominant cut set, which accounts for approximately 63 percent of the overall CCDP, contains the HFEs HPI-XHE-XM-THRTL and HPI-XHE-XM-RECIRC. Both NUREG/CR-6883, The SPAR H Human Reliability Analysis Method, (ADAMS Accession No. ML051950061) and INL/EXT-10-18533, SPAR-H Step-by-Step Guidance,(ADAMS Accession No. ML112060305) direct that the Technique for Human Error-Rate Prediction (THERP) dependency table should not be directly applied without performing an initial evaluation on whether dependence is likely. Unfortunately, explicit guidance on how to perform this initial evaluation does not currently exist. The analyst determined that there was no strong evidence for considering this key HFE pair as dependent for this analysis because the associated operator actions are associated with different functions that have different cues (RCS pressure, subcooling, pressurizer level versus RWST level) and significant time between actions (at least 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />). Due to the lack of explicit guidance and a widely accepted approach, a sensitivity analysis was performed applying the THERP dependency table, assuming moderate dependence 5
LER 316-2020-003 (i.e., same crew, not close in time, same location, additional cues) for this HFE pair.
This sensitivity results in a mean CCDP of 1.8x10-4, which is nearly a factor of 13 increase from the best estimate analysis.
6
LER 316-2020-003 Appendix A: Key Event Tree INADVERTENT SAFETY REACTOR SHUTDOWN CONSEQUENTIAL LOSS OF LOSS OF SEAL COOLING & AUXILIARY FEEDWATER TERMINATE OR CONTROL PORVS ARE CLOSED FEED AND BLEED HIGH PRESSURE # End State INJECTION OFFSITE POWER FAILURE OF SEALS (NOMINAL SAFETY INJECTION RECIRCULATION (Phase - CD)
& SDS)
FS = LOSC-FTF IE-ISINJ RPS OEP LOSC-SDS AFW CSI PORV FAB HPR 1 OK 2 OK 3 CD 4 OK 5 CD 6 OK 7 CD 8 CD 9 OK 10 CD 11 OK 12 CD 13 CD 14 LOOPPC 15 ATWS Figure A-1. Modified D.C. Cook Inadvertent SI Event Tree A-1
ML21048A400 (Package);
ML21048A388 (Letter);
ML21035A236 (ASP Report - final)
OFFICE NRR/DORL/LPL3/PM NRR/DORL/LPL3/LA NAME SWall SRohrer DATE 02/18/2021 02/18/2021 OFFICE NRR/DORL/LPL3/BC NRR/DORL/LPL3/PM NAME NSalgado SWall DATE 02/18/2021 02/18/2021