05000306/LER-2001-003

LER-2001-003,

Docket Numb R
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(v), Loss of Safety Function
Initial Reporting
3062001003R02 - NRC Website

EVENT DESCRIPTION

At approximately 3:00 PM on May 9, 2001, Prairie Island personnel declared the Emergency Diesel Generators1 (EDGs) for Unit 2 (D5 and D6) inoperable based on a suspected lube oil/fuel oil incompatibility that had the potential for affecting the ability of the EDGs to perform their design basis safety functions. A Unit 2 shutdown was commenced at approximately 5:00 PM on May 9, 2001 pursuant to the Prairie Island Technical Specifications.

The concern with a suspected lube oil/fuel oil incompatibility arose during a Prairie Island root cause investigation conducted regarding an elevated crankcase pressure problem encountered with D6 on April 9, 2001 (previously reported in LER 2-01-02). Specifically, as part of the root cause investigation, a re-assessment was initiated of external operating experience information regarding a 1996 incident at Calvert Cliffs involving EDGs from the same manufacturer (Wartsila SACM). Based on (1) an analysis of the Calvert Cliffs root cause report in light of the April D6 problems, (2) revised vendor information, and (3) a lack of any other clear cause(s) for the April D6 problem, operability of D5 and D6 was considered indeterminate and Prairie Island management declared D5 and D6 inoperable and subsequently shut down Unit 2 as required by Technical Specifications.

Following the May 9, 2001 shutdown, Prairie Island personnel performed detailed inspections, surveillance testing, and maintenance on both D5 and D6, including replacing the lube oil with a type compatible with the low sulfur fuel oil currently used at Prairie Island. An outside diesel expert (Ricardo, Inc.) was contracted to perform an investigation of the problems encountered on D6, including laboratory analyses of some replaced components.

Upon completion of the inspections, maintenance, investigation, analyses, and surveillance testing, D5 and D6 were declared operable and Unit 2 was subsequently restarted (left Mode 5) on June 1, 2001.

CAUSE OF THE EVENT

The cause of the event (a Technical Specification required shutdown of Unit 2) was the declared inoperability of D5 and D6 because of a suspected lube oil/fuel oil incompatibility. Prairie Island personnel determined, in the course of a root cause investigation, that the April 9, 2001 elevated crankcase pressure on D6 engine 2 caused by blow-by in one cylinder (E2B1) was likely attributable to a lube oil/fuel oil incompatibility similar to that experienced in 1996 at Calvert Cliffs. The Institute of Nuclear Power Operations (INPO) Operating Experience Report 0E7869, issued in May 1996, for the Calvert Cliffs experience indicated that lube oil with additives designed for high sulfur fuel oil can cause deposits on pistons and rings of diesel engines that burn low sulfur fuel oil. This deposition was determined by Calvert Cliffs to be a potential degradation mechanism that could impact the operability of the affected EDGs.

1 EIIS Component Identifier: DG; EIIS System Identifier: EK The lube oil/fuel oil incompatibility issue raised by the Calvert Cliffs operating experience had been previously assessed by Prairie Island. In evaluating the applicability of the 1996 Calvert Cliffs operating experience to Prairie Island, correspondence with oil vendors and discussions with engine manufacturers took place. The Prairie Island external operating experience assessment (XOE 19960761, which evaluated INPO 0E7869) concluded that there was no immediate action required for Prairie Island's D5 and D6 because (1) initial discussions (prior to the issuance of INPO 0E7869) with the EDG vendor indicated that the vendor did not agree that the Calvert Cliffs problem resulted from lube oil/fuel oil incompatibility, (2) the sulfur content of the fuel oil in the storage tanks was higher than the level of concern, (3) no cylinder liner scuffing was noted on preventive maintenance (PM) inspections, and (4) Prairie Island used a different lube oil (mineral based versus synthetic) than was used at Calvert Cliffs.

An action item (APR 19960895) was opened to develop recommendations on future lube oils for the Prairie Island EDGs. This was closed in July 2000 with no change in lube oil or monitoring frequency.

The decision to close the APR was an engineering decision which focused on the mechanical condition of the cylinder liners (extensive 5-year PMs had been performed on both D5 and D6 by that time). The conclusion was that although fuel oil sulfur content had decreased with addition of low sulfur fuel oil to existing inventories, discussions with lube oil vendors and engine manufacturers had indicated that the existing lube oils were satisfactory for use in older, cooler running engine designs (like D5 and D6) with low sulfur fuel oil. The evaluation noted that Prairie Island equipment monitoring and inspection had indicated no problems with the current lube oils. The five year PMs on D5 and D6 showed good cylinder liner and ring conditions. Surveillance data showed satisfactory crankcase pressure, indicating no blow- by.

Thus, Prairie Island closed the fuel oil/lube oil incompatibility issue in July of 2000 and it was not reconsidered until after the April 9, 2001 24-hour surveillance test of D6 was halted because of high crankcase pressure of D6 engine 2. Borescope inspection of all the cylinders on D6 engine 2 revealed indications of blow-by in only cylinder B1 (E2B1). There were also indications on E2B1 that were initially characterized as scuffing (now known to be carbon raking). During the repair phase of E2B1 cylinder liner and piston (once removed, it was determined that there was some sticking of the top piston ring and deposits on the piston) the cause for the indications was being evaluated. A conclusive determination was not made but it was believed that the cause of the elevated crankcase pressure was isolated to the particular cylinder liner and piston. E2B1 had been operating with an exhaust temperature that was 80 degrees F higher than the other cylinders since September 1997 with no identifiable cause. This temperature difference was within the engine specifications for this type of engine. Several unsuccessful attempts had been made in the past to reduce the cylinder temperature of E2B1. In addition, there was some consideration that there might be a connecting rod problem. The engine manufacturer, Wartsila SACM, representative inspected two pistons (both E2B1 and another, E2A1) and noted a higher than expected deposit buildup on the pistons for the number of hours on the engine. Following repairs, D6 was run for a break-in period of 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> and a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> run, and then a borescope inspection was performed on E2 cylinders Al and B1. Minor indications were observed on E2B1 cylinder liner but were considerably less than originally seen; there was no scuffing or carbon raking seen. In discussions regarding the slight indications, Wartsila SACM raised the potential lube oil/fuel oil incompatibility issue but could not explain why indications would be seen after so few hours and just in the one cylinder if the problem were oil incompatibility. With Wartsila SACM concurrence, we conducted an additional 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> run and a repeat borescope inspection of cylinder E2B1. No changes in the indications were noted, engine cylinder temperatures were within 50 degrees F of one another and crankcase pressure was in the normal range. D6 was declared operable on April 17, 2001.

A condition report (CR 20013515) was initiated on April 18, 2001 to determine the causes for the apparently excessive repair time and to determine the cause of what was then considered cylinder scuffing (now known to be carbon raking) and blow-by. The focus of the root cause team was divided between these two assessments and was originally concentrated on the repair time question.

The potential for lube oil/fuel oil incompatibility at Prairie Island, viewed in light of the April D6 problems, suggested re-assessment of the 1996 Calvert Cliffs experience. On April 23, 2001, copies of the original INPO 0E7869 on the Calvert Cliffs lube oil/fuel oil incompatibility issue were brought to the root cause team members by the team leader. Later that day, a copy of the Calvert Cliffs root cause evaluation was requested from Calvert Cliffs personnel. On April 25, 2001, the team discussed the possibility that the incompatibility issue may be applicable to the D6 problems. The Calvert Cliffs root cause evaluation report (along with an independent assessment by Ricardo, Inc.) was received at Prairie Island on April 30 and it was distributed at the May 2, 2001 team meeting but it was not discussed at that meeting. It was decided at that meeting to hire the same independent diesel engine expert which consulted at Calvert Cliffs (Ricardo) to assist in the root cause evaluation. On the afternoon of May 9, 2001 the team met to discuss the Calvert Cliffs root cause evaluation report. They re-assessed the Calvert Cliffs event for operability of D5 and D6. The conclusion of the re-assessment was that the operability of D5 and D6 was indeterminate. At that time, determination was made that the diesel fuel and lubricating oils in the engines were potentially incompatible, such that D5 and D6 may not be capable of long-term operation as required for mitigation of plant operational events. The root cause team informed plant management and the Duty Shift Manager declared D5 and D6 inoperable and Unit 2 was subsequently shut down as required by Technical Specifications.

Causes of this event were evaluated in two condition reports, one (CR 20014346) that investigated the mechanical causes of the event and one (CR 20014150) that investigated the organizational and programmatic causes of the event (specifically, with respect to the original assessment and closure of the 1996 operating experience assessment of the Calvert Cliffs event). An additional condition report (CR 20014237) addressed the possible effects of lube oil/fuel oil incompatibility on other site diesel engines.

Mechanical Causes The root cause for increasing D6 engine crankcase pressure and associated crankcase blow-by was determined to be an incompatibility between the high Total Base Number (TBN) lube oil and the progressively decreasing sulfur content of the fuel oil. The sulfur in the fuel oil forms sulfuric acid during the combustion process and this acid is corrosive to the engine parts. Basic salts are used in lubricating oils to neutralize the sulfuric acid to reduce the corrosive effects. However, if the sulfur content is too low for the corresponding lube oil formulation, the basic salts can combine with uncombusted carbon to create hard deposits on the piston. In the case of D6, the use of low sulfur fuel oil did not produce enough sulfuric acid during combustion to minimize the detergent salts from the lube oil and the remaining detergent salts from the lube oil did cause carbon deposits. These deposits have two primary negative effects on the engine: (1) cylinder bore polishing and (2) ring sticking/ring nip.

Cylinder Bore Polishing On D6, carbon deposits became "hard packed" in the top land area of the pistons. These did lead to indications seen on the cylinders (carbon raking, which was initially and incorrectly characterized as scuffing). Laboratory analysis (profilometry) of a number of sample cylinder liners (including the D6 E2B1 liner removed in April) was conducted to assess the state of the cylinder bores. The profilometry results indicate that liners all had adequate surface roughness to retain oil for lubrication and that no area of any liner met the definition of polished as specified in SAE 760722.

The consultant who analyzed the profilometry results concluded that the liners were in satisfactory condition and that adequate life remained for several hundred hours of operation.

Ring Sticking/Ring Nip Carbon deposits (either deposited between the ring and groove or in the form of carbon flakes from the piston top land or the cylinder bore) interfered with the normal movement of piston rings such that, intermittently, the piston rings did not seat properly against the cylinder liner, leading to blow- by experienced by D6 Engine 2. Blow-by, in turn, led to the observed high crankcase pressure.

In addition, engine load had an effect on the ring sticking (hot sticking2)/ring nip. Piston temperature rises with increasing engine load. Increased temperature affects both hot sticking and ring nip. Hot sticking (caused by carbon deposits) is alleviated at lower temperatures because less lubricating oil is pyrolized at lower temperature — thus, the lubricating oil detergents are better able to remove carbon. Ring nip is also temperature (load) dependent; higher temperatures lead to distortion of the piston and ring groove (which can pinch the ring and interfere with its movement — ring nip).

Continued blow-by could lead to greater crankcase pressure, eventually causing an automatic shutdown of the engine on a high crankcase pressure signal, even though the machine could continue to function. The condition of the rings on D6 was reviewed by a consultant who concluded that the rings and pistons were in fair to good condition for a medium speed engine.

Organizational and Programmatic Causes A root cause evaluation (CR 20014150) related to the original external operating experience evaluation (XOE 19960761) for the 1996 Calvert Cliffs event considered the initial screening of the external 2 CRC Manual No. 18, "CRC Diesel Engine Rating Manual," defines a Stuck Ring (Hot Stuck) as "A ring which will not move in its groove under moderate finger pressure and whose face is covered with lacquer/varnish or carbon deposits over varying degrees of its circumference, showing that the ring was not bearing against the cylinder wall during engine operation.

operating experience (XOE), the short-term and long-term actions recommended by the XOE assessment, and the decision-making process leading to the final disposition of the XOE. The root cause team has identified as root causes:

1. lack of a standard problem solving technique or standardized review methods for external operating events, and 2. lack of independent review of external operating events.

In addition, the root cause team identified as contributing causes:

1. lack of timely distribution of technical data by the diesel manufacturer, 2. non-independence of technical advice from lube oil vendors, and 3. ineffective program for monitoring of sulfur content in the fuel oil.

The evaluation concludes that a more effective assessment and disposition of this XOE and the subsequent action item (APR 19960895, issued to develop future recommendations for EDG oils) would have provided an effective monitoring method for sulfur content in fuel oils. This, in itself, would probably not have prevented the April 9, 2001 D6 cylinder and piston problems because the fuel oil sulfur content for D6 had not yet dropped below 0.05% (Wartsila SACM technical bulletin did not recommend switching to a different lube oil until that point.) But a more effective assessment would have likely avoided declaration of operability of D6 following the April repairs without full evaluation of the possibility of the damage being caused by fuel oil/lube oil incompatibility.

Extent of Condition with Respect to Other Site Diesel Engines There is no indication that the lube oil/fuel oil incompatibility issue is applicable to the other diesel engines at Prairie Island. It is important to note that a particular TBN value and sulfur content do not by themselves cause incompatibility. The report from Ricardo (on its investigation on D5 and D6) states that engine piston, ring and cylinder liner design features can prevent carbon deposit bore polishing, and concludes that incompatible fuel and lube oil combinations will exacerbate carbon deposit packing only in a susceptible engine design. A review of industry operating experiences does not reveal any fuel oil/lube oil incompatibility problems related to these diesel engines.

Unit 1 Emergency Diesel Generators D1 and D2 The manufacturer (Fairbanks-Morse) reports that engines of similar design have been tested with fuel oils with sulfur content as low as 0.00%. The factory testing was performed with the same type of crankcase lube oil that is used at Prairie Island. The manufacturer has recommended no lower limit on sulfur content in fuel oil.

Surveillance testing and recent preventive maintenance inspection have indicated that D1 and D2 are not experiencing problems similar to those of D6. The latest PM inspection was made with the D6 problems in mind, visually inspecting the pistons, rings, and liners through the intake and exhaust ports.

Diesel-Driven Cooling Water Pumps 12 and 22 The manufacturer (Caterpillar) confirmed that the currently used lube oil is appropriate for use with fuel oils with sulfur content as low as 0.00%.

Surveillance testing and recent preventive maintenance inspection have indicated that the cooling water pump diesel engines are not experiencing problems similar to those of D6.

Non Safety-Related Engines Evaluations concluded that there are no lube oil/fuel oil incompatibility concerns with the plant's non safety-related diesel engines.

ANALYSIS OF THE EVENT

The design basis for run times on D5 and D6 depends on the initiating event that they are required to mitigate (this discussion is based on action item (2D0 20015089, "Determine if a Safety System Functional Failure Resulted from the D5/D6 Lube Oil and Fuel Oil Incompatibility"). For initiating events where the operability of D5 could not be credited (e.g., design basis accidents where a single failure must be assumed or for an Appendix R fire where a fire affecting Unit 2 Train A safeguards electrical power must be tolerated), D6 would have to run. For these events, an Appendix R fire is the limiting initiating event and Appendix R, 1111.5 allows for reliance on offsite power following 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Thus, D6 would have to run for a maximum of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to mitigate the limiting initiating event.

For initiating events where D5 could be credited (e.g., external events where a concurrent single failure is not assumed as part of the Prairie Island design basis), D6 would not have to run at all to mitigate the postulated event, but either D5 or D6 or a combination of D5 and D6 would have to be able to run for a maximum of 21 days (504 hours0.00583 days <br />0.14 hours <br />8.333333e-4 weeks <br />1.91772e-4 months <br />) to mitigate the limiting initiating event. In these events, the maximum probable flood is the limiting initiating event. (USAR Section 2.4.3.5 states that, for the probable maximum flood, ". . . the flood stage would remain above 695 ft. for approximately 13 days.") When the flood exceeds an elevation of 695 ft., the unit transformers may be disabled. After the water recedes below the point of disabling the offsite source transformers, some time would be required to inspect and test the transformers before returning them to service. This would require EDG operation beyond 14 days and using a 3-5 day inspect, maintain, and clean duration, could put the EDG operating time near 19 days; adding two more days for margin establishes the 21-day time for EDG operation.

Based on the Ricardo investigation, the laboratory analyses of the cylinder liner conditions, and the root 1 cause investigations, D6 was determined to be able to run for "several hundred hours" in the as-found conditions (on both April 9, 2001 and May 9, 2001):

"There was no immediate risk to the engine in its current condition. However over time (although not absolute, probably several hundred hours) the condition would have continued to worsen with repeated increases in blow-by and oil leaks from a pressurized crankcase. In addition, cylinder liner polishing3 would have continued through the abrasion mechanism of the hard carbon at the top ring position." (p.13 of Ricardo report dated May 23, 2001) "The general condition of the engine, together with the quantitative results from the liner surface analysis, indicate the engine was in relatively good health and easily capable of many further hours of operation before mechanical failure occurred. The engine would have experienced increasing blow-by and oil leakage but would have taken some time before levels caused concern." (p. 27 of Ricardo report dated May 23, 2001) D5, which (1) had substantially less run time since its last major overhaul, (2) had been operating on higher sulfur content fuel oil, and (3) had cylinder liners that were found to be in better condition, was expected to have been able to run for a much longer period in the as-found condition.

Two additional factors support the ability of D5 and D6 to operate for sustained runs of the required duration:

• The expected loadings for all initiating events are lower than the rated load of the EDGs (the rated load is 5400KW and the expected loadings are all less than 4000KW) and lower than the loading on D6 when it exhibited high crankcase pressure on April 9, 2001 (crankcase pressure is a function of load on the engine; when the load was reduced to 4000KW, the crankcase pressure went to zero), and

• Long, sustained runs of diesel engines are much less wear-inducing than multiple starts and short runs (because the majority of engine wear occurs on starting).

Engine load has a large effect on both of the potential failure mechanisms:

• bore polishing — high loads effect bore polishing due to the increased rate of carbon accumulation on the top land (from additional fuel) and the side impact mechanism which potentially results in greater impacts and, thus, harder packing.

• ring sticking or ring nip — in particular hot nip is caused, by the distortion of the piston as its temperature rises. This distortion reduces the clearance between the ring and groove. Piston temperature is a function of load and the temperature increases with load. The propensity for hot sticking and nipping is reduced or eliminated at lower loads.

The load at which crankcase pressure began rising on April 9 was 110% of rated load, although higher than normal crankcase pressure was seen at 103% of load. Event loads, particularly the loads expected 3 Note that the report also indicates no area of any liner met the definition of polished in the as-found condition. � 1 for the events with the longest run-time requirements (Appendix R fire or probable maximum flood), are much lower. For D6 during an Appendix R fire in the Bus 25 room (the only Appendix R fire for which D6 is credited) the expected load is about 45% of rated load (2453 kW). For D5 during a flood the expected load is about 48% of rated load (2602 kW).

This event is reportable per 10CFR 50.73(a)(2)(i)(A) because Unit 2 was shut down as required by Technical Specifications. Even though subsequent investigations concluded that D5 and D6 would have been able to perform their design basis safety functions, they were declared inoperable on May 9, 2001, because their operability was judged indeterminate at that time and Unit 2 was shut down as required by Technical Specifications.

Loss Of Safety Function and Other Performance Indicator Impacts With respect to loss of safety function, subsequent engineering evaluations (including the failure investigation and analyses of Ricardo) conclude that D5 and D6 would have run long enough in the as- found conditions (on either April 9, 2001 or May 9, 2001) to have been capable of performing their design basis safety function. Therefore, neither this event (the May 9, 2001 declaration of inoperability of both D5 and D6) nor the April 9, 2001 problem (the high crankcase pressure on D6, engine 2) represented a loss of safety function. Consequently this event is not reportable per 10CFR 50.73(a)(2)(v).

With respect to Safety System Unavailability for this event, per the guidance of NEI 99-02, Revision 0, time that either diesel was unavailable while Unit 2 was at cold shutdown is not counted. However, there was some time that D5 and D6 were unavailable before Unit 2 reached cold shutdown.

Approximately 26 hours3.009259e-4 days <br />0.00722 hours <br />4.298942e-5 weeks <br />9.893e-6 months <br /> of unavailability for D5 and approximately 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> of unavailability for D6 will be counted. The April 9, 2001 event (reported in Unit 2 LER 01-02) involved unavailability of approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for D5 and approximately 206 hours0.00238 days <br />0.0572 hours <br />3.406085e-4 weeks <br />7.8383e-5 months <br /> for D6.

With respect to fault exposure time, in the as-found condition on April 9, 2001, D5 and D6 have been evaluated as capable of performing their design basis safety functions. This evaluation includes an assessment of whether a high crankcase pressure trip could have precluded D5 or D6 from performing their safety function. The 24-hour surveillance run of D6 on April 9, 2001 was manually terminated due to elevated crankcase pressure. D6 will trip on high crankcase pressure; however, this trip is bypassed by a Safety Injection (SI) signal. For those initiating events that would not produce an SI signal, it should be noted that the 24-hour surveillance was conducted at significantly higher load than is required to mitigate these initiating events. Test loads were between 5400 KW and 5940 KW when the high crankcase pressure occurred. When the load was reduced to 4000KW, the crankcase pressure went to zero. The non-safety injection accident analysis loadings are no greater than 3652 KW (for SBO). For the events which have the limiting run times (Appendix R fire in the Bus 25 Room and the probable maximum flood), the loads are much lower — 2453 kW (45%) and 2602 kW (48%), respectively. As noted above, at the analyzed loads for these initiating events, a crankcase pressure trip is considered to have been highly unlikely had the EDGs been called upon to mitigate one of these initiating events.

Therefore, no fault exposure time is counted for either this event or the April 9, 2001 diesel problem.

This event affects the number of unplanned power changes per 7,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />, but the unit has had 6 or fewer unplanned power changes in the last 7,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />.

Significance Determination The risk associated with the Unit 2 plant shutdown per Technical Specifications performed on May 9, 2001 was very low (not significantly greater than that expected for a normal plant shutdown). This was described in detail in the Significance Determination section of LER 2-01-04. The issues surrounding the D5 and D6 diesel generator fuel oil/lube oil incompatibility that led to that shutdown also had very low risk significance. As described in detail in the other sections of this LER, D5 and D6, while degraded, were evaluated to have been capable of performing their design basis safety functions in the as-found conditions (of either April 9, 2001 or May 9, 2001). However, the risk increase due to the potentially increased likelihood of EDG failure was also evaluated, and is described below.

The conclusion of very low risk significance is based on a review of the issue from both a deterministic and a probabilistic perspective. The deterministic review described below focuses on evaluation of the potential initiating events of concern, the safety functions required to mitigate the impact of occurrence of those initiating events and the impact to them given the fuel oil/lube oil incompatibility issue, and the remaining capability to restore the safety functions if required during an event. The probabilistic review focuses on determination of the Incremental Core Damage Probability (ICDP) associated with the fuel oil lube oil incompatibility issue, and includes an analysis of the sensitivity of the ICDP to the EDG failure probability assumed. Note that in addition to having determined that D5 and D6 could have successfully performed their design basis safety functions (as described previously in this LER), the engineering evaluation found that D5 was expected to have been able to run for a much longer period in the as-found condition than was D6. Therefore, this review focuses on the risk significance of the increased potential for unavailability of the D6 EDG.

Initiating event review: The diesel generators at Prairie Island function only to supply a backup source of power to the plant 4160 V safeguards AC buses. This function is only required when both the normal and auxiliary sources of offsite power to those buses are lost. Loss of both offsite sources to any one bus, but not to the other buses, is not the event of concern. A more likely and much more risk significant scenario is a loss of all offsite power (LOOP) to one unit (both safeguards AC buses) or to both units at the site. The risk of core damage following all initiating events other than the LOOP initiating event is essentially unchanged with the D6 diesel generator unavailable. The risk of this event is, therefore, bounded by the 2-unit LOOP, in which all four onsite 4160 V safeguards AC buses initially lose offsite power and the emergency diesel generators must function to supply their respective buses. All LOOP events were conservatively assumed to be dual-unit LOOP events for the purposes of this analysis.

Note that, as described in the Prairie Island IPEEE analysis, the likelihood of LOOP due to events, such as the events referred to previously in this LER (internal fires and external flooding), is very low. When viewed over the actual period of concern for the fuel oil/lube oil incompatibility issue, the likelihood of one of these events occurring is even lower. In addition, there are plant design features and administrative controls in place to prevent the loss of the safeguards AC power system should one of these events occur. Therefore, only the internally-initiated LOOP event was explicitly included in this assessment.

Restoration of power to Bus 26 from the Unit 1 Train B diesel generator: At Prairie Island, the 4160 V AC buses on the same safeguards train (Train A buses 15 and 25, and Train B buses 16 and 26) can be connected manually via bus-tie breakers should a LOOP event occur and the dedicated diesel generator for a bus fail to start or otherwise be unavailable. The D6 diesel generator is the dedicated diesel generator for Unit 2 Bus 26. Therefore, if a LOOP event occurred and D6 failed to perform its function, Bus 26 would initially lose power and operator action to close the bus-tie breaker from Bus 16 (D2 diesel generator) would be required to restore power to Train B safeguards equipment. However, the required actions are simple and are performed entirely from the main control room, the actions are directed by procedure, and the operators are trained on the required actions. Therefore, the likelihood of successful restoration of onsite AC power to Bus 26 is high.

Impact on decay heat removal capability: On a LOOP event with D6 unavailable, both auxiliary feedwater (AFW) pumps associated with each unit remain available and automatically function to supply the steam generators on that unit, providing a continuous means of decay heat removal. Also, either of the two motor-driven pumps can be cross-tied to supply the needs of the steam generators on the opposite unit if necessary. The required actions are directed by procedure and operators are trained on the required actions. This is true even if power is not restored to Bus 26 through the manual bus-tie breaker operation, since neither pump depends on power from D6. Also, Train A emergency core cooling (ECCS) equipment remains available, as do both of the pressurizer power operated relief valves (PORVs) for bleed and feed operation should the auxiliary feedwater function completely fail.

Incremental Core Damage Probability (ICDP): 10CFR50.65, paragraph (a)(4) (typically referred to as Maintenance Rule (a)(4), or simply, "(a)(4)") requires that all plants assess and manage the risk associated with plant equipment unavailability configurations considered in-scope to the rule. The D6 diesel generator is considered "in-scope" to the rule and its unavailability is, therefore, assessed and managed under the plant (a)(4) compliance program.

The primary guidance document for (a)(4) evaluations is NUMARC 93-01, Section 11. This document defines the Incremental Core Damage Probability (ICDP) measure as one method of determining the risk associated with equipment configurations. In general, the ICDP is calculated as the increase in the plant core damage frequency over the time period that the configuration exists (in this case, over the time period that D6 is assumed to be unavailable). One additional measure, the Incremental Large Early Release Probability (ILERP), is also identified in NUMARC 93-01. However, at Prairie Island, core damage sequences involving a large, early release generally are those which bypass containment (i.e., those that involve Steam Generator Tube Rupture (SGTR) and Intersystem LOCA initiating events).

Since D6 unavailability only impacts the risk associated with LOOP initiating events, and LOOP-initiated events generally do not lead to large, early releases, the ILERP will not be calculated for this analysis.

NUMARC 93-01, Section 11.3.7.2 identifies a threshold ICDP of 1E-6 as a level below which normal work controls are sufficient to manage the risk associated with the configuration. (In addition, the NRC SDP uses a change in CDF of 1E-6 as the Green-White finding threshold, the level above which issues are considered to have risk significance.) Using this threshold as an upper limit for allowable configuration risk, the total time (the risk-informed "Allowable Out-of-Service Time" or AOT) in which plant operation may continue under normal work controls with the D6 EDG unavailable was calculated.

To model the uncertainty surrounding the actual availability of D6 due to its degraded as-found condition, the AOT values for a number of sensitivity cases were also determined. In these cases, the D6 failure probability was varied from 0.0 (completely available and reliable to perform its function) to 1.0 (completely unavailable and unreliable).

The results of the probabilistic analysis are summarized below:

AOT for ICDP = 1E-6 0.10 > 1 year > 1 year 0.25 > 1 year 158.7 days 0.50 152.1 days 77.7 days 0.75 96.1 days 51.4 days 1.00 71.6 days 39.2 days Note that the current PRA model of record is for Unit 1 only. Therefore, the Unit 1 AOT values were calculated directly using the current PRA model. Although the Unit 1 and Unit 2 EDG sets are not identical, the emergency AC power system between the two units is functionally symmetrical.

Therefore, the Unit 2 AOT calculations were performed by adjusting the failure probability for the dedicated Unit 1 Train B EDG (D2), and determining the change in CDF from the baseline level.

These results show that nearly complete unavailability or unreliability of the D6 diesel generator must be assumed in order to produce a configuration that approaches risk significance.

CORRECTIVE ACTIONS

1. Maintenance, inspection, testing, and a lube oil change-out have been completed on both D5 and D6.

2. This event is captured in the Prairie Island Corrective Action process (in condition reports 20014346 and 20014150). These condition reports have recommended actions to prevent the recurrence of this event.

3. Condition report 20014237 through its related action item (2D0 20014619) has established actions to control the use of lube oil for differing sulfur contents of fuel oils for the various diesel engines at Prairie Island.

FAILED COMPONENT IDENTIFICATION

None. Although D5 and D6 were declared inoperable based upon a suspected degradation mechanism (i.e., deposition caused by lube oil incompatible with low sulfur fuel oil), subsequent engineering evaluation indicates neither D5 nor D6 were in a failed condition such that they would have been prevented from fulfilling their design basis safety functions.

PREVIOUS SIMILAR EVENTS

The event reported in LER 2-01-02 is a precursor to this event.