ML20112F385
| ML20112F385 | |
| Person / Time | |
|---|---|
| Site: | Calvert Cliffs  |
| Issue date: | 05/16/2001 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| Hunter C (301) 415-1394 | |
| References | |
| LER No. 317/01-001 | |
| Download: ML20112F385 (12) | |
Text
1 Final Precursor Analysis Accident Sequence Precursor Program --- Office of Nuclear Regulatory Research Calvert Cliffs 1 Auxiliary feedwater pump turbine bearing failure caused by sealant intrusion (YHQW'DWH 05/16/200 /(5 317/01-001 &'3 7x10-6 (Internal Events) ve and 5x10-6 (External Events)
Events)
April 30, 2004 Condition Summary Description. LER 317/01-001-00 (Ref. 1) indicated that on May 16, 2001 at 1338 hours0.0155 days <br />0.372 hours <br />0.00221 weeks <br />5.09109e-4 months <br /> during a surveillance test, Calvert Cliffs Unit No. 1 experienced a failure of the Number 11 turbine-driven auxiliary feedwater pump (No. 11 AFWTDP) turbine outboard bearing. At the time of discovery, the plant was in Mode 1 with the reactor at 100 percent thermal power. The No. 11 AFWTDP was declared inoperable, but had no effect on plant power operation. Figure 1 shows a simplified flow diagram of the auxiliary feedwater system.
Cause. The cause of this event, as stated in both the LER (Ref. 1) and the NRC inspection report (Ref. 2), was attributed to inadequate vendor technical manual instructions for applying the proper thickness of sealant to the bearing cover. The thickness of sealant applied during the overhaul proved to be excessive. The excessive sealant can extrude into the bearing oil housing, where it can be dislodged and become a contaminant in the lubricating oil that supplies the babbited bearing. The sealant would then be able to migrate into the bearing and cause its failure.
Recovery opportunity. In the event that the No. 11 AFWTDP fails due to a bearing failure, this pump is not recoverable. However, the parallel (standby) No. 12 AFWTDP is available and can be started by the operator if it is not operating for the turbine-driven train. The Number 13 motor-driven pump (No. 13 AFWMDP) can also be started if it is not running. In addition, there is a cross-tie to the Unit 2 No. 23 AFWMDP. Only one pump is needed to provide the risk significant function for the AFW system (see Figure 1 for simplified flow diagram).
LER No. 317/01-001 1 Since this condition did not involve an actual initiating event, the parameter of interest is the measure of the incremental increase between the conditional probability for the period in which the condition existed and the nominal probability for the same period but with the condition nonexistent and plant equipment available. This incremental increase or importance is determined by subtracting the CDP from the CCDP. This measure is used to assess the risk significance of hardware unavailabilities especially for those cases where the nominal CDP is high with respect to the incremental increase of the conditional probability caused by the hardware unavailability.
2 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Analysis Results
Importance1 The risk significance of one turbine-driven AFW pump being unavailable due to potential failure for internal events analysis is determined by subtracting the nominal core damage probability from the conditional core damage probability. The point estimate is as follows:
Conditional core damage probability (CCDP) =
1.8 x 10-5 Nominal core damage probability (CDP) =
- 1.2 x 10-5 Importance ( CDP = CCDP - CDP) =
6.0 x 10-6 The mean value for importance (Mean CDP) for the condition was an increase of 7.3 x 10-6 over the nominal CDP for the 8760 hour0.101 days <br />2.433 hours <br />0.0145 weeks <br />0.00333 months <br /> period when the No. 11 AFWTDP was not available. The uncertainty about the mean: 5% bound, 2.2 x 10-6 and the 95% bound, 1.8 x 10-5. The Accident Sequence Precursor (ASP) Program acceptance threshold is an importance ( CDP) of 1 x 10-6.
External Events The sum of the means for external events indicated an increase in core damage probability contribution for fire and seismic external events, given the failure of the AFWTDP is 5.1 x 10-6. The analysis for external events is detailed in Appendix A. An uncertainty analysis for the sum of means was not performed for external events as the necessary parameters were not available.
Dominant sequence The dominant sequence is LDC11, Sequence 16 (see Figure 2), which consists of:
Loss of vital DC Bus 11 - initiating event, Successful Reactor Trip during Transient, Failure of auxiliary feedwater, and Loss of bleed portion of feed and bleed cooling, resulting in core damage.
Results tables
- Table 1 provides the point estimate importance values for the dominant sequences.
- Table 2a provides the event tree sequence logic for the dominant sequences.
- Table 2b defines the nomenclature used in Table 2a.
- Table 3 provides the conditional cut sets for the dominant sequences.
- Table 4 provides the definitions and probabilities for selected events.
LER No. 317/01-001 3
SENSITIVE - NOT FOR PUBLIC DISCLOSURE Modeling Assumptions
Assessment summary Condition duration. The licensee identified that the No. 11 AFWTDP had a total fault exposure of 387 days with unit at full power (and an accumulated run time of 10.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />) in LER 317/01-001 (Ref. 1). This was also discussed in the SDP/EA-01-206 inspection report (Ref. 2). Since the maximum condition duration used in ASP analysis is 365 days, the duration used in this analysis is 365 days. The basis for this value is as follows:
The extrusion, migration, and depositing of sealant material appeared to show some evidence of increased viscosity of lube oil throughout early quarterly surveillance tests.
When a reactor trip actuated the No. 11 AFWTDP on 09/10/2000, the pump was manually secured after 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of operation due to high bearing temperature (196F). Two subsequent quarterly tests (11/08/2000 and 02/07/2001) of less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> duration each were successful, but the viscosity was still high. The last surveillance test on 05/16/2001 was declared unsuccessful when the bearing temperature rose rapidly to 211F after 88 minutes of run time. Therefore, there is no assurance that the No. 11 AFWTDP could meet a 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> mission time (station blackout sequence) for recovery of offsite power and preclude battery depletion.
Basic event probability changes Table 4 provides the basic events that were modified to reflect the condition being analyzed. Other basic events that were included in the dominant cutsets, but not revised are also included in Table 4. The changes to the basic events are as follows:
- 1) AFW TDP-11 fails to run (AFW-TDP-FR-11). The probability of failure to run was set to TRUE, as this reflects the specific failure mode (the pump did not fail to start). The SPAR model includes automatic update of the common cause failure probability and defaulted nonrecovery of the turbine-driven pump 11.
Model update The Revision 3i Standarized Plant Analysis Risk (SPAR) model for Calvert Cliffs 1 and 2 (Ref. 3) was updated with recent failure-to-start and failure-to-run data for turbine driven pumps (TDPs) and to add TRUE for probability of nonrecovery for each of these TDP failure mode (see Table 4). CCF parameters were added as follows:
Alpha 1 parameter for 2 TDPs fail to run (AFW-TDP-FR-02A01). The probability for this is 9.8 x 10-1.
Alpha 2 parameter for 2 TDPs fail to run (AFW-TDP-FR-02A02). The probability for this is 1.27 x 10-2.
Alpha 1 parameter for 2 TDPs fail to start (AFW-TDP-FS-02A01). The probability for this is 9.9 x 10-1.
Alpha 2 parameter for 2 TDPs fail to start (AFW-TDP-FS-02A02). The probability for this is 9.3 x 10-3.
LER No. 317/01-001 4
SENSITIVE - NOT FOR PUBLIC DISCLOSURE The mission time for the turbine-driven AFW pumps was changed from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for this specific analysis involving a loss of one turbine-driven pump, based on the following:
The Unit 1 motor-driven pump can be manually started if needed.
The Unit 2 motor-driven pump can be manually aligned if needed (for LOOP in Unit 1).
The emergency diesel or Unit 2 emergency diesel 2A can be aligned with the Unit 1 safety-related electrical train (for LOOP or loss of DC power after 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />).
The SBO emergency diesel can be aligned with any specific Unit 1 or Unit 2 vital bus (for Station Blackout).
The SPAR model 24-hour mission time for the turbine-driven auxiliary feedwater pump is a base case default that was not intended as applicable for all analyses, especially with the above basis for using a lower mission time.
Model update (see Figure 3) was also made to differentiate recovery for each turbine-driven AFW pumps by adding human factors for fail to start (AFW-XHE-TDPFS11 and AFW-XHE-TDP12) and fail to run (AFW-XHE-TDPFR11 and AFW-XHE-TDPFR12).
The SPAR model was not updated to include the Rhodes Model for reactor coolant pump (RCP) seal LOCAs because there were no RCP seal LOCAs in the dominant sequences of this analysis.
The following rule is added to event tree LOOP.
if /OP-SL then
/HPI = HPI-L; HPI = HPI-L;
/HPR = HPR-L; HPR = HPR-L; endif Flag (FLAG-SYS-LOSP) was deleted from HPI fault tree.
Flag (FLAG-SYS-LOSP) was added to HPI-L fault tree.
LER No. 317/01-001 5
SENSITIVE - NOT FOR PUBLIC DISCLOSURE References 1.
LER 317/01-001, Revision 00, Auxiliary Feedwater Pump Turbine Bearing Failure Caused by Sealant Intrusion, Event date: May 16, 2001 (ADAMS Accession Number MLO11980102).
2.
NRC Inspection Report, SDP/EA-01-206, Calvert Cliffs Unit 1 - NRC Inspection Report 50-317/01-009, August 24, 2001 (ADAMS Accession Number MLO12360493).
3.
J. K. Knudsen, et al., Standardized Plant Analysis Risk (SPAR) Model for Calvert Cliffs 1 and 2, Revision 3i, Idaho National Engineering and Environmental Laboratory, November 20, 2001.
4.
Idaho National Engineering and Environmental Laboratory Web site:
http//nrcoe.inel.gov/maiuLF/CCF/CCFParamWebHelp/CCFParamEST.htm, Common-Cause Parameter Estimates (data version 2002/01/01).
LER No. 317/01-001 6
SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table 1. Conditional probabilities associated with the highest probability sequences Event tree name Sequence no.
Conditional core damage probability (CCDP)
Core damage probability (CDP)
Importance (CCDP - CDP)2 LDC11 16 3.4E-006 1.0E-007 3.3E-006 LOOP 22 1.5E-006 1.3E-007 1.4E-006 LDC11 15 1.0E-006 3.1E-008 1.0E-006 LOOP 23-26 3.7E-007 1.700007 2.1E-007 Total (all sequences)1 1.8E-005 1.2E-005 6.0E-006 Notes:
- 2. Importance is calculated using the total CCDP and total CDP from all sequences. Sequence level importance measures are not additive. The importance value is the point estimate value, not the mean.
Table 2a. Event tree sequence logic for dominant sequence Event tree name Sequence no.
Logic
(/ denotes success; see Table 2b for top event names)
LDC11 16
/RT-L, /EP, AFW, BLEED LDC11 15
/RT, /BLEED, AFW, HPI LOOP 23-26
/RT-L, AFW, EP, ACP-ST Table 2b. Definitions of fault trees listed in Table 2a ACP-ST OFFSITE POWER RECOVERY IN SHORT TERM AFW NO OR INSUFFICIENT AFW FLOW BLEED FAILURE TO PROVIDE BLEED PORTION OF FILL AND BLEED EP FAILURE OF BOTH TRAINS OF EMERGENCY POWER HPI NO OR INSUFFICIENT HPI FLOW RT REACTOR FAILS TO TRIP DURING TRANSIENT RT-L REACTOR FAILS TO TRIP DURING LOOP
LER No. 317/01-001 7
SENSITIVE - NOT FOR PUBLIC DISCLOSURE Table 3. Conditional cut sets for LDC11, Sequence 16 and LOOP Sequence221 CCDP Percent contribution Minimal cut sets1 Event Tree: LDC11, Sequence 16 1.1E-06 32.0 HPI-XHE-XM-FB AFW-TDP-CF-RUN 5.9E-07 17.4 HPI-XHE-XM-FB AFW-TDP-TM-12 5.8E-07 17.0 HPI-XHE-XM-FB AFW-TDP-FS-12 4.0E-07 11.8 HPI-XHE-XM-FB AFW-TDP-FR-12 3.3E-07 9.9 AFW-XHE-XM-TDP12 HPI-XHE-XM-FB 3.4E-061 Event Tree: LOOP, Sequence 22 3.9E-08 2.6 AFW-PMP-CF-ALL HPI-XHE-XM-FB 1.9E-08 1.3 HPI-XHE-XM-FB AFW-CKV-CF-SGS 1.5E-061
- 1. Total CCDP includes all cut sets (including those not shown in this table).
Table 4. Definitions and probabilities for modified and dominant basic events Event name Description Probability/
Frequency Modified AFW-TDP-FR-11 AFW TDP 11 FAILS TO RUN TRUE YES1 AFW-TDP-FR-12 AFW TDP 12 FAILS TO RUN 4.8E-3 NO AFW-TDP-FS-12 AFW TDP 12 FAILS TO START 6.8E-3 NO AFW-TDP-TM-12 AFW TDP-12 UNAVAILABLE DUE TO TEST & MAINT.
7.0E-3 NO AFW-XHE-XM-TDP12 AFW TDP 12 FAILS TO START AFW TDP-12 4.0E-3 NO AFW-TDP-FR-02A01 ALPHA 1 PARAMETER FOR 2 TDPs FAIL TO RUN 9.8E-1 YES2 AFW-TDP-FR-02A02 ALPHA 2 PARAMETER FOR 2 TDPs FAIL TO RUN 1.27E-2 YES2 AFW-TDP-FS-02A01 ALPHA 1 PARAMETER FOR 2 TDPs FAIL TO START 9.9E-1 YES2 AFW-TDP-FS-02A02 ALPHA 2 PARAMETER FOR 2 TDPs FAIL TO START 9.3E-3 YES2 HPI-MDP-FC-1C HPI MDP TRAIN 1C FAILURES 3.8E-3 NO HPI-MDP-TM-1C HPI MDP TRAIN iC UNAVAILABLE DUE TO TEST &
MAINTENANCE 6.1E-3 NO HPI-XHE-XM-FB OPERATOR FAILS TO INITIATE FEED AND BLEED COOL 4.0E-2 NO Notes:
1.
Basic event was changed to reflect condition being analyzed. TRUE has a failure probability of 1.0.
2.
TDP parameters were updated in the SPAR model in accordance with Ref. 4)..
Figure 1 Simplified Flow Diagram AFW System 8
SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER No. 317/01-001 Figure removed during SUNSI review.
HPR HIGH PRESSURE RECIRCULATION CSR CONTAINMENT COOLING SDC SHUTDOWN COOLING COOLDOWN SECONDARY SIDE RCS COOLDOWN HPI HIGH PRESSURE INJECTION BLEED BLEED PORTION OF F&B COOLING PORV-RES PORVs RESEAT PORV NO PORVs OPEN AFW AUXILIARY FEEDWATER SYSTEM RT REACTOR TRIP IE-LDC11 LOSS OF DC BUS 11 END-STATE 1
OK 2
OK 3
OK 4
OK 5
CD 6
CD 7
OK 8
CD 9
CD 10 CD 11 OK 12 OK 13 CD 14 CD 15 CD 16 CD 17 CD Figure 2 Calvert Cliffs LDC11, SEQUENCE 16 9
SENSITIVE - NOT FOR PUBLIC DISCLOSURE LER No. 317/01-001
AFW-TDP AFW-TDP-CF-RUN AFW-TDP-FR-11 AFW-TDPS-F AFW-TDP-FR-12 AFW-XHE-XM-TDP12 AFW-TDP11 AFW-TDP-TM-11 AFW-TDP12 AFW-TDP-TM-12 AFW-XHE-XM-TDPRM AFW-TDP-FS-11 AFW-TDP-FS-12 AFW-TDP-SBO LOSP-SBO AFW-XHE-XO-TDP AFW-CKV-CF-STMINL AFW-CKV-CF-TDPDIS AFW-CKV-CC-STM110 AFW-CKV-CC-DIS102 AFW-CKV-CC-STM108 AFW-CKV-CC-DIS116 AFW-TDP-CF-START AFW-TDP11-FR AFW-XHE-XL-TDPFR11 AFW-TDP11-FS AFW-XHE-XL-TDPFS11 AFW-TDP12-FR AFW-XHE-XL-TDPFR12 AFW-TDP12-FS AFW-XHE-XL-TDPFS12 AFW TDPs UNAVAILABLE COMMON CAUSE FAILURE OF TDPs TO RUN FAILURE OF AFW TDPs AFW TDP-11 FAILS TO RUN FAILURE OF AFW TDP-12 AFW TDP-12 FAILS TO RUN OPERATOR FAILS TO START AFW TDP-12 FAILURE OF AFW TDP-11 AFW TDP-11 UNAVAILABLE DUE TO T & M AFW TDP-12 UNAVAILABLE DUE TO T & M OPERATOR FAILS TO OPEN DOUBLE DOORS IN TUR. BUILD. OR ALIGN BACKUP COOLING AFW TDP-11 FAILS TO START AFW TDP-12 FAILS TO START STATION BLACKOUT OPERATOR ACTION TO CONTROL FLOW BECAUSE OF LOSS OF IA STATION BLACKOUT FLAG OPERATOR FAILS TO CONTROL AFW TDP FLOW GIVEN SBO AND LOSS OF INST. AIR CCF OF STEAM INLET CHECK VALVES MS-108/110 CCF OF AFW TDP DISCHARGE CHECK VALVES AF-102/116 FAILURE OF STEAM INLET CHECK VALVE MS-110 FAILURE OF AFW TDP DISCHARGE CHECK VALVE AF-102 FAILURE OF STEAM INLET CHECK VALVE MS-108 FAILURE OF AFW TDP DISCHARGE CHECK VALVE AF-116 COMMON CAUSE FAILURE OF TDPs TO START FAILURE OF AFW TDP-11 FAILS TO START FAILURE OF AFW TDP-11 TO RUN OPERATOR FAILS TO RECOVER AFW TDP (FAILS TO START) PUMP 11 OPERATOR FAILS TO RECOVER AFW TDP (FAILS TO RUN) PUMP 11 FAILURE OF AFW TDP-12 FAILS TO START FAILURE OF AFW TDP-12 TO RUN OPERATOR FAILS TO RECOVER AFW TDP (FAILS TO START) PUMP 12 OPERATOR FAILS TO RECOVER AFW TDP (FAILS TO RUN) PUMP 12 Figure 3 AFW TDP Fault Tree Revision 10 - NOT FOR PUBLIC DISCLOSURE OT F TIVE - NOT FOR PUBLIC DISCLOSURE LER No. 317/01-001 LER No. 317/01-001 11 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Appendix A External Events Methodology The external events seismic and fire adders to the ASP analysis are based on the methodology in NUREG/CR-6544, "A Methodology for Analyzing Precursors to Earthquake-Initiated and Fire-Initiated Accident Sequences," 1998, Section 3.7, Screening and Analysis Guidance for Fire-Related LERs.
Fire External Events
- 1. The plant location areas that are candidates for fire external events and there initiating fire frequencies are as follows: The switch yard is excluded, because the LOOP initiating event frequency includes fires.:
Plant Location Area Fire Frequency (per year)
Applicable Initiating Event Diesel Generator Building A 2.6 x 10-3 LOOP Diesel Generator Building B 2.6 x 10-3 LOOP Cable Spreading Room A 1.0 x 10-3 TRANSIENT Cable Spreading Room B 1.0 x 10-3 TRANSIENT Switchgear Room A 3.4 x 10-3 TRANSIENT Switchgear Room B 3.4 x 10-3 TRANSIENT The fire frequencies are based on the proprietary fire events data from NRC/RES/OERAB report RES/OERAB/S02-01, "Fire Events - Update of U.S.Operating Experience, 1986-1999 and further updated to include 2000 and 2001. The fire frequencies are based on power operation severe fire events with durations greater than 5 minutes and that were not self-extinguished, including a jeffreys noninformative prior divided by the number of power operation reactor years for the 1986-2001 period.
- 2. Using the plant-specific Rev 3i SPAR model, perform an ASP Initiating Event Assessment for each plant location area to determine the CCDP, with:
Updated basic events per ASP Program Guidance.
Replace the applicable initiating event frequency with the initiating fire frequency (with a one-year duration).
Set the other initiating event frequencies to zero.
Set basic event failure probabilities to TRUE, given a postulated fire in the selected plant location are limited to one train of safety-related equipment and the AFWTDP 11 failed to run.
LER No. 317/01-001 12 SENSITIVE - NOT FOR PUBLIC DISCLOSURE Solve each plant location area analysis for CCDP (since the CDP is not significant, conservatively assume that the CDP is the same as the CCDP). Sum the plant location area CDPs. This is the external events adder due to fire.
3.
The contribution of fire external events, given failure of the AFWTDP 11 to run is 5.1 x 10-6.
Seismic External Events
- 1. For seismic external events, the switch yard is the only significant plant location for eastern seaboard plants per NUREG/CR-6544. For Calvert Cliffs, the seismic frequency is 4.1 x 10-5/year. For the switch yard, LOOP is the applicable initiating event.
- 2. Using the plant-specific SPAR model, perform an ASP Initiating Event Assessment for each plant location area to determine the CCDP, with:
Updated basic events per ASP Program Guidance.
Replace the applicable initiating event frequency with the seismic frequency for the plant location (assuming a one-year duration).
Set the other initiating event frequencies to zero.
Set basic event failures applicable to failure of the AFWTDP11 to TRUE.
Solve each plant location area analysis for CCDP and sum these values. This is the external events adder due to seismic.
- 3. The contribution of seismic external events, given failure of the AFWTDP11 is 3.5 x 10-9 (negligible).
Total External Events Adder Add the sum of external fire events and sum of external seismic events to obtain the total external events adder, For Calvert Cliffs, the CDP due to external events, given the failure of AFWTDP11 is 5.1 x 10-6.