ML18352B099

Final Accident Sequence Precursor Analysis - Peach Bottom Atomic Power Station (Unit 3), Reactor Core Isolation Cooling System Pressure Switch Failure Results in Condition Prohibited by Technical Specifications (LER 278-2018-001) - Precurso

ML18352B099
Person / Time
Site:	Peach Bottom
Issue date:	04/22/2018
From:	NRC/RES/DRA/PRAB
To:
Chris Hunter
References
LER 278-2018-001
Download: ML18352B099 (8)

Text

1 Final ASP Program Analysis - Precursor Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Peach Bottom Atomic Power Station, Unit 3 Reactor Core Isolation Cooling System Pressure Switch Failure Results in Condition Prohibited by Technical Specifications Event Date: 4/22/2018 LER(s):

278-2018-001 CDP =

3x10-6 IR(s):

TBD Plant Type:

General Electric Type 4 Boiling-Water Reactor (BWR) with a Mark I Containment Plant Operating Mode (Reactor Power Level):

Mode 1 (100% Reactor Power)

Analyst:

Reviewer:

Contributors:

Approval Date:

Christopher Hunter Matt Leech N/A 12/19/2018 EXECUTIVE

SUMMARY

On April 22, 2018, the reactor core isolation cooling (RCIC) pump turbine tripped approximately 28 seconds after startup during surveillance testing. The pump had failed to reach rated system pressure and flow. Concurrent with the RCIC pump trip, a turbine high exhaust pressure was received. Local exhaust pressure indicated a pressure of approximately 12 psig, which is well below the trip set point of 50 psig. The RCIC system was declared inoperable and Technical Specification (TS) 3.5.3 Condition A was entered, which requires RCIC to be restored within 14 days. Licensee troubleshooting determined one of the two pressure switches had failed, resulting in the RCIC turbine trip. Following replacement of the failed pressure switch and successful testing, the RCIC system was declared operable on April 23rd. The licensee determined that corrosion caused by water intrusion had failed the pressure switch sometime between the last successful surveillance test on January 16th and the RCIC pump failure on April 22nd (96 days). Due to the uncertainty of when (during the 96-day period) the pressure switch failed, a 48-day (t/2) exposure period was used in the best estimate analysis for this event.

This accident sequence precursor (ASP) analysis reveals that the most likely core damage scenarios are a transients that result in a loss of feedwater with RCIC unavailable and the postulated unavailability of the high-pressure coolant injection (HPCI) and failure of operators to depressurize the reactor. These accident sequences account for approximately 100 percent of the increase in core damage probability (CDP) for the event. The point estimate CDP for this event is 3x10-6 (internal events), which is considered a precursor under the ASP Program. The seismic contribution for 48-day unavailability of RCIC is CDP of 3x10-8 (approximately one percent of the internal events contribution).

To date, no performance deficiency associated with this event has been identified and, therefore, an ASP analysis was performed since a Significance Determination Process (SDP) evaluation was not performed.

LER 278-2018-001 2

EVENT DETAILS Event Description. On April 22, 2018, the RCIC pump turbine tripped approximately 28 seconds after startup during surveillance testing. The pump had failed to reach rated system pressure and flow. Concurrent with the RCIC pump trip, a turbine high exhaust pressure was received. Local exhaust pressure indicated a pressure of approximately 12 psig, which is well below the trip set point of 50 psig. The RCIC system was declared inoperable and TS 3.5.3 Condition A was entered, which requires RCIC to be restored within 14 days. Licensee troubleshooting determined one of the two pressure switches had failed, resulting in the RCIC turbine trip. Following replacement of the failed pressure switch and successful testing, the RCIC system was declared operable on April 23rd. Additional information is provided in licensee event report (LER) 278-2018-001 (Ref. 1).

Cause. Water intrusion within the switch enclosure resulted in corrosion and degradation of the switch internals, causing an electrical short of the pressure switch. A diaphragm normally isolates the switch from the instrument line that contains condensed steam from the RCIC turbine exhaust piping. However, a tear in the diaphragm resulted in a small amount of water entering the switch enclosure.

MODELING ASSUMPTIONS Analysis Type. The Peach Bottom Unit 3 standardized plant analysis risk (SPAR) model, Version 8.51 dated September 28, 2017, was used for this condition assessment. This SPAR model version includes seismic initiating events.

SDP Results/Basis for ASP Analysis. The ASP Program uses SDP results for degraded conditions when available (and applicable). To date, issued inspection reports for Peach Bottom do not provide additional information on this event. Discussions with Region 1 staff indicated that no performance deficiency has been identified to date; however, the LER remains open. An independent ASP analysis was performed given the lack of an identified performance deficiency and the potential risk significance of this event.

A search for additional Peach Bottom Unit 3 LERs was performed to determine if any initiating events or additional unavailabilities existed during the exposure period of RCIC pump. No windowed events or concurrent degraded conditions were identified.

Exposure Period. The licensee determined that corrosion caused by water intrusion had failed the pressure switch sometime between the last successful surveillance test on January 16th and the RCIC pump failure on April 22nd (96 days). The safety function for RCIC was restored on April 22nd, approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the pump failure, when the pressure switch was electrically isolated. Due to the uncertainty of when (during the 96-day period) the pressure switch failed, a 48-day (t/2) exposure period was used in the best estimate analysis for this event.

Key Modeling Assumptions. The following modeling assumptions were determined to be significant to the modeling of this event:

Basic event RCI-TDP-FS-TRAIN (RCIC pump fail to start) was set to TRUE due to the pump trip approximately 28 seconds after start up.

LER 278-2018-001 3

The RCIC system function was restored approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the pump trip when the failed pressure switch was electrically isolated. Core damage is expected to occur approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for the dominant accident sequences in this analysis and, therefore, recovery of the RCIC pump is not credited in this analysis.

The preliminary results were reviewed to determine if FLEX strategies would affect the risk of this event. The dominant accident scenarios are short-term loss of decay heat removal where electrical power remains available. Because FLEX strategies are currently implemented in extended loss of alternating-current (AC) power scenarios and/or when significant time is available to operators, FLEX strategies were not considered as part of this analysis.

ANALYSIS RESULTS CDP. The point estimate CDP for this event is 2.6x10-6, which is the sum of all exposure periods. The ASP Program acceptance threshold is a CDP of 1x10-6 for degraded conditions.

The CDP for this event exceeds this threshold; therefore, this event is a precursor.

Dominant Sequence. The dominant accident sequence is loss of condenser heat sink sequence 53 (CDP = 9.8x10-6), which contributes approximately 37 percent of the total internal events CDP. The dominant sequences are shown in the table below and graphically in Figure A-1 Appendix A. Accident sequences that contribute at least 1.0 percent to the total internal events CDP for this analysis are provided in the following table.

Sequence CCDP CDP CDP Description LOCHS 53 1.16x10-6 1.79x10-7 9.83x10-7 37.2%

Loss of condenser heat sink initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOMFW 60 6.27x10-7 9.61x10-8 5.31x10-7 20.1%

Loss of feedwater initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor TRANS 62 5.26x10-7 8.83x10-8 4.38x10-7 16.6%

Transient initiating event; successful reactor trip; power conversion system (including feedwater),

RCIC, and HPCI fail; and operators fail to depressurize the reactor LOACB-E23 62 1.89x10-7 2.85x10-8 1.60x10-7 6.1%

Loss of AC bus E23 initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOOPSC 35 1.42x10-7 2.18x10-8 1.20x10-7 4.5%

Switchyard-centered loss of offsite power (LOOP) initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOOPGR 35 1.17x10-7 1.79x10-8 9.86x10-8 3.7%

Grid-related LOOP initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOIAS 65 7.64x10-8 1.17x10-8 6.47x10-8 2.5%

Loss of instrument air initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOOPWR 35 6.35x10-8 9.76x10-8 5.37x10-8 2.0%

Weather-related LOOP initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor

LER 278-2018-001 4

Sequence CCDP CDP CDP Description IORV 38 4.87x10-8 7.68x10-9 4.10x10-8 1.6%

Inadvertent opening of safety relief valve initiating event; successful reactor trip; power conversion system (including feedwater), RCIC, and HPCI fail; and operators fail to depressurize the reactor TRANS 66-35 4.16x10-8 6.39x10-9 3.52x10-8 1.3%

Transient initiating event; consequential LOOP occurs; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LODCB-3B 62 3.29x10-8 4.97x10-9 2.79x10-8 1.1%

Loss of direct-current bus 3B initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor Total 3.26x10-6 6.21x10-7 2.64x10-6 Uncertainties. The key modeling uncertainty associated with this analysis is the exposure period. The licensee determined that corrosion caused by water intrusion had failed the pressure switch sometime between the last successful surveillance test on January 16th and the RCIC pump failure on April 22nd (96 days). There is no additional information available to reduce the uncertainty of when the pressure switch failed during this period. When there is no definitive time of failure, the exposure period is calculated as t/2 (i.e., 96 days/2 = 48 days). A sensitivity analysis, performed to determine the risk of an upper bound exposure period of 96 days, results in a CDP of 5.3x10-6. In addition, a sensitivity evaluation was performed to determine the minimum exposure period required for the CDP to exceed the precursor threshold of 1x10-6. It was determined that a RCIC unavailability of at least 19 days is needed to exceed the precursor threshold.

Seismic Contribution. Historically, independent condition assessments performed as part of the ASP Program only included the risk impact from internal events and did not include the consideration of other hazards such as fires, floods, earthquakes, etc.1 The reason for the exclusion of the impacts of other hazards in most ASP analyses was due to the lack of modeling capability within the SPAR models. However, seismic hazards modeling was completed for all SPAR models in December 2017. Therefore, beginning in 2018, seismic hazards will be evaluated as part of all condition assessments performed by the ASP Program. The seismic contribution for a RCIC unavailability of 48 days is CDP of 3x10-8. The following table provides the seismic bin results that contribute at least 1 percent of the total seismic CDP for this analysis.

Seismic Bin CDP Notes/Observations Seismic Event in Bin 3

(>0.5 G) occurs 2.64x10-8 Dominant scenarios are seismically-induced LOOP and small loss-of-coolant accident (SLOCA). Random and seismic HPCI failures along with seismically-induced failures of residual heat removal, low-pressure core spray, and/or service water result in a failure of short-or long-term reactor inventory makeup.

Seismic Event in Bin 2 (0.3-0.5 G) occurs 3.33x10-9 Dominant scenarios are seismically-induced LOOP and small LOCA. Random and seismic HPCI failures along with seismically-induced failures of service water result in a failure of long-term reactor inventory makeup.

TOTAL = 2.98x10-8 1

Initiating events caused by other hazards (e.g., tornado results in a LOOP) or degradations specific to a particular hazard (e.g., degraded fire barrier) have been analyzed as part of ASP Program.

LER 278-2018-001 5

Initial seismic calculations identified the following two issues:

Seismically-induced SLOCA accident sequences were being overestimated due to basic events SLOCA-EQ3 (small LOCA occurs) and SLOCA-EQ2 (small LOCA occurs) not having their process flags set to the appropriate selection. These basic events need to be set to W calculation type, which appropriately accounts for the success probabilities.

In most cases, the success terms are assumed have probabilities equal to 1.0, which is an adequate approximation when failure probabilities are small. However, when failure probabilities are larger (i.e., 0.1 or greater), success probabilities can be significantly less than 1.0 and, therefore, need to be appropriately accounted for to prevent over estimation of their core damage frequencies. While for the most part not an issue in internal events modeling, failure probabilities greater than or equal to 0.1 are more common in seismic modeling. This issue will be a focus of future reviews of seismic modeling in ASP analyses.

Evaluation of preliminary cut sets showed that emergency diesel generator (EDG) recovery credit is being incorrectly applied to seismically-induced station blackout (SBO) cut sets. The appropriateness of crediting of recovery using mean-time to repair data for EDGs is an open issue for modeling of both internal and external hazards. In addition, the modeling technique for EDG recovery credit was simplified in a manner that can result in invalid cut sets. For example, EDG recovery is credited in cut sets in which the SBO occurred due to seismically-induced electrical system failures not associated with the EDGs. This issue had a negligible effect on the results for this analysis and, therefore, no modeling changes were made. The issue of crediting EDG repair during seismic sequences in currently being evaluated by NRC and Idaho National Laboratory staff.

REFERENCES

1. Peach Bottom Atomic Power Station, "LER 278/18-001 - Reactor Core Isolation Cooling System Pressure Switch Failure Results in Condition Prohibited by TS, dated January 3, 2018 (ADAMS Accession No. ML18172A260).

LER 278-2018-001 A-1 Appendix A: Key Event Tree Figure A-1. Peach Bottom Loss of Condenser Heat Sink (LOCHS) Event Tree IE-LOCHS LOSS OF CONDENSER HEAT SINK RPS REACTOR SHUTDOWN OEP OFFSITE ELECTRICAL POWER SRV SRV'S CLOSE HPI HIGH PRESSURE INJECTION SPC SUPPRESSION POOL COOLING DEP MANUAL REACTOR DEPRESS CRD CRD INJECTION (2 PUMPS)

CDS CONDENSATE LPI LOW PRESSURE INJECTION FAILS TO PROVIDE MAKEUP VA ALTERNATE LOW PRESS INJECTION FAILS RHR RESIDUAL HEAT REMOVAL FAILS PCSR POWER CONVERSION SYSTEM RECOVERY CVS CONTAINMENT VENTING LI LATE INJECTION (LI)

End State (Phase - CD) 1 OK 2

OK 3

OK 4

OK LI05CV 5

CD 6

OK LI05CF 7

CD 8

OK 9

OK 10 OK LI05CV 11 CD 12 OK LI05CF 13 CD 14 OK 15 OK 16 OK LI06 17 CD 18 OK LI07 19 CD 20 OK SDC1 21 CD 22 OK LI05CV 23 CD 24 OK LI05CF 25 CD 26 CD 27 OK 28 OK 29 OK LI05CV 30 CD 31 OK LI05CF 32 CD 33 CD 34 OK 35 OK 36 OK LI05CV 37 CD 38 OK LI05CF 39 CD 40 OK 41 OK 42 OK LI06 43 CD 44 OK LI07 45 CD 46 OK SDC1 47 OK 48 OK LI05CV 49 CD 50 OK LI05CF 51 CD 52 CD 53 CD P1 54 1SORV P2 55 2SORVS 56 LOOPPC 57 ATWS 58 CD