IR 05000317/2023050
| ML24107A995 | |
| Person / Time | |
|---|---|
| Site: | Calvert Cliffs  |
| Issue date: | 04/18/2024 |
| From: | Christopher Hunter NRC/RES/DRA/PRB |
| To: | |
| References | |
| IR 2023050 | |
| Download: ML24107A995 (1) | |
Text
1 Final ASP Analysis - Reject Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Calvert Cliffs Nuclear Power Plant, Unit 2 Failure to Establish and Implement Adequate Maintenance Practices Contributes to the Failure of EDG 1A Event Date: 4/24/2023 LER:
None CDP =
05000317/2023050 Plant Type:
Combustion Engineering Generation II Two-Loop Pressurized-Water Reactor (PWR) with Dry Ambient Pressure Containment Plant Operating Mode (Reactor Power Level):
Mode 1 (100% Reactor Power)
Analyst:
Reviewer:
Completion Date:
Christopher Hunter John Lane 4/18/2024
EVENT DETAILS Event Description On April 24, 2023, while conducting the monthly surveillance test of emergency diesel generator (EDG) 1A EDG, the 1A2 engine developed significant lube oil leakage. Approximately 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> into a 2-hour run, the 1A2 Exhaust Gas Temp HI alarm occurred. A subsequent investigation by the operators identified a significant amount of white smoke coming from the engine in addition to oil leaks from both ends of the engine. The main control room (MCR) soon received the 1A2 lube oil high differential pressure alarms. Operators promptly shutdown EDG 1 The licensee assessed the 1A2 engine and determined it to have significant damage to the B1 piston crown; the skirt of the piston was fully scratched and showed signs of melted aluminum; the piston liner was severely scored; large amounts of aluminum debris were found inside the crankcase sump; and both lube oil filters were found clogged with aluminum shavings. The licensee performed corrective maintenance on the 1A2 engine, which included flushing the fuel oil and lube oil systems, filter replacements, crankcase cleaning, and replacing the B1 cylinder liner, connecting rod, piston and rings, head assembly, fuel pump, fuel injector, wrist pin bearing and pin, as well as corresponding replacements on the A1 cylinder. In addition, all 16 fuel injectors were pressure and spray tested satisfactorily. Following the corrective maintenance on the 1A2 engine, the station performed a 12-hour run to break in the new pistons, performed an additional oil change, and the pistons were inspected for unexpected wear. Operators then performed a loaded 12-hour run for post-maintenance test and declared the engine operable on May 2n On May 18, 2023, EDG 1A tripped on lube oil Pressure LO-LO alarms on the 1A2 engine during testing. This was approximately 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> into a 12-hour run. The licensee determined that the low lube oil pressure was caused by the failure of one of the two shaft-driven lube oil pumps on the 1A2 engine. The licensee elected to replace all four lube oil pumps on EDG 1 In addition, significant erosion on six piston crowns was identified. The licensee elected to replace 24 of the 32 EDG 1A pistons. EDG 1 was restored to operable status after repairs and post-maintenance testing were completed on June 7t IR 05000317/2023050
Additional information is provided in inspection report (IR) 05000317/2023050, Calvert Cliffs Nuclear Power Plant, Unit 1 - Special Inspection Report 05000317/2023050 and Preliminary White Finding and Apparent Violation, (ML23272A027). Note that there was no licensee event report (LER) issued for this conditio.2 Cause The licensee concluded the most probable cause of the failure of the 1B piston in the 1A2 engine was related to an imbalanced fueling and loss of compression condition. Further, the licensees root cause team ultimately refined and determined that the most probable cause of the piston failure was due to excessive accumulation of deposits inside the fuel injector that led to the loss of control of the fuel injection timing and metering for that cylinder. The licensee also determined the age of the injector and the lack of adequate maintenance to monitor the condition of the injector contributed to its failur.3 Additional Information Calvert Cliffs has five total EDGs. The Unit 1 EDG 1A is a safety-related 4.16-kilovolt, three-phase, 60-cycle, tandem-diesel engine generator set which has a continuous rating of 5400 kilowatts. EDG 1A consists of two UD45 Societe Alsacienne De Constructions Mecaniques De Mulhouse (SACM) engines (1A1 and 1A2) that are connected to a common generator. EDG 1B is a Fairbanks-Morse opposable piston EDG. Unit 2 has two Fairbank-Morse EDGs (2A and 2B). The station blackout (SBO) diesel generator 0C is a SACM (similar to EDG 1A), which can be manually aligned to either units vital buse MODELING SDP Results/Basis for ASP Analysis The Accident Sequencer Precursor (ASP) Program uses Significance Determination Process (SDP) results for degraded conditions when available (and applicable). In response to this event, the U.S. Nuclear Regulatory Commission (NRC) performed a special inspection per Management Directive 8.3, NRC Incident Investigation Program (ML22294A067). The special inspection, as documented in IR 05000317/2023050, identified a preliminary White (i.e., low to moderate safety significance) finding associated with the failed to adequately establish and implement maintenance instructions and practices that reasonably ensured the reliability, availability, and operability of the EDG 1A. The licensee did not contest the finding nor the NRCs risk characterization. The White finding was finalized (ML23297A192) and accepted as the ASP Program result for Unit In addition to this White finding that is limited to the failure of EDG 1A on April 24th, there was a separate Green (i.e., very low safety significance) associated with the subsequent failure of EDG 1A on May 18th. Because of the rules associated with evaluating licensee performance deficiencies (i.e., failure causes) individually, the exposure time was split into two separate periods. However, ASP Program evaluations do not separate continuous exposure times due to different failure causes. Given that the EDG 1A would not have fulfilled its safety function for the complete mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> when it was restored to service on May 2nd, the ASP exposure time would increase to approximately 255 days from the 216 days used in the SDP evaluation for the White finding. This exposure time change would result in an increase of the annual change in core damage frequency (CDF) from 6.4x10-6 to 7.6x10-6. Given this relatively small increase would not result in changes to ASP Program insights nor precursor trend results,
the SDP evaluation results were accepted as the ASP Program results (i.e., no independent ASP analysis was performed).
Although these inspection findings were limited to Unit 1, the SDP risk evaluation associated with the failure of EDG 1A on April 25th included a risk impact estimate for Unit 2. This risk evaluation estimated an annual change in CDF of 2.3x10-6 for Unit 2, which exceeds the precursor threshold of 10-6 increase in core damage probability (CDP) for degraded condition In the past, the ASP Program have accepted evaluations performed as part of the SDP evaluation for units that are not associated with the licensee performance deficiency. However, a further review of the SDP evaluation determined that risk impact for Unit 2 is significantly influenced by the potential common-cause failure (CCF) of the EDGs across units. The inclusion of the CCF across units is included in some NRC standardized plant analysis risk (SPAR)
models; however, the extension of CCF parameters to cover components across systems or units is subject to significant uncertainties. Given the magnitude of the uncertainties associated with the SDP evaluation of the Unit 2 risk, an independent ASP analysis was performed for this degraded condition to provide best estimate of the risk for Unit 2 by identifying and reducing the uncertainties associated with the base SPAR model inclusion of cross unit CCF of the EDG The ASP Program will not reevaluate past events or degraded conditions that were significantly impacted by cross-unit CCF modeling (e.g., the 2022 EDG 1A failure at Calvert Cliffs).
However, the ASP Program will review this modeling issue more closely going forward, beginning with this analysi.2 Analysis Type A degraded condition analysis was performed using a test and limited use revision of the version 8.84 SPAR model for Calvert Cliffs Nuclear Power Plant, Unit 2 created in March 202 This SPAR model was revised with corrections made to the auxiliary feedwater (AFW) system and alternating current (AC) power fault tree logic. In addition, the following FLEX modeling changes were included:
The credit for the FLEX mitigation strategies was activated for SBO scenario for which an extended loss of AC power (ELAP) is declare The requirement for operators to perform a deep load shed of the direct current (DC)
buses to extend the safety-related batteries depletion time during a postulated SBO to allow for the implementation of the FLEX mitigation strategies was added to the SBO-ELAP event tre Credit for offsite power recovery was limited to sequence-specific depletion time of the safety-related batteries. This modeling assumption is potentially conservative for accident sequences where battery charging is restore Because of the large uncertainty in modeling assumptions related to availability and reliability of components and strategies for mission times that are well beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and the unclear basis for requiring AC power recovery within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the 72-hour AC power requirement was eliminated from the SBO-ELAP event tre Credit is provided for the plant to reach a safe and stable end state without offsite power recovery if either a turbine-driven auxiliary feedwater (AFW) pump or the FLEX steam generator (SG) makeup maintains adequate SG inventory and reactor coolant system (RCS) makeup is initiated prior to the onset of reflux coolin IR 05000317/2023050
Credit for EDG repair was limited to the ELAP declaration time (i.e., 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />) because (a.)
the operators focus would switch from EDG troubleshooting activities to implementing the FLEX mitigation strategies and (b.) the DC load shedding activities could preclude recovery of EDG This SPAR model includes the following hazards:
Internal events,
Seismic events, and
High winds (including hurricanes and tornados).
It is unlikely that the risk impact from internal floods would be significant because internal floods typically do not have a substantial likelihood of leading to a loss of offsite power (LOOP) or partial LOOP event. However, the risk impact due to internal fires could be significant and, therefore, the lack of internal fire scenarios in the SPAR model is a key uncertainty, which is considered qualitatively in Section.3 SPAR Model Modifications The following modifications were made the Calvert Cliffs Nuclear Power Plant, Unit 2 SPAR model:
The base SPAR model has seven EDG common cause component groups (CCCGs) per failure mode (i.e., failure to run and failure to start). Many of these CCCGs include EDGs across units. The existing CCF data is not collected across units or systems and, therefore, the expansion of the EDG CCCGs and the use of the current EDG CCF parameters (i.e., alpha factors) across Units 1 and 2 is subject to significant uncertainties. In addition, the use of multiple CCCGs results can result in the overestimation of the impact of potential CCFs. As stated in Section 1.3, the design of EDG 1A and the SBO diesel generator 0C are significantly different to the other three EDGs. Given these considerations, the EDG CCCGs were redefined to eliminate any cross-unit CCF potential and grouped the EDGs together that are of similar design. To model these changes, basic events ESP-DGN-CF-FR (CCF of all five diesel generators to run), ESP-DGN-CF-FR1AB0C (CCF of diesel generators 1A & 1B and SBO to run),
ESP-DGN-CF-FR1B2AB (CCF of Fairbanks Morris diesel generators 1B & 2A & 2B to run), ESP-DGN-CF-FR2AB0C (CCF of diesel generators 2A & 2B and SBO to run),
ESP-DGN-CF-FS (CCF of all five diesel generators to start), ESP-DGN-CF-FS1AB0C (CCF of diesel generators 1A & 1B and SBO to start), ESP-DGN-CF-FS1B2AB (CCF of Fairbanks Morris diesel generators 1B & 2A & 2B to start), and ESP-DGN-CF-FS2AB0C (CCF of diesel generators 2A & 2B and SBO to start) were set to IGNORE. Although these modeling changes are judged to be best estimate given the current CCF data and modeling, they will result in a lower bound risk estimate associated with potential CCF of the EDGs. These modeling assumptions are identified as key uncertainty associated with this analysis, which is discussed further in Section.4 Exposure Time The exposure time for Unit 2 associated with the April 24th failure of EDG 1A was determined to be approximately 196 days as documented in IR 05000317/2023050. An additional 39 days of exposure time is associated with May 18th failure and subsequent repair time. Therefore, an exposure time of 235 days was used for this analysi IR 05000317/2023050
5 Analysis Assumptions The following modeling assumptions were determined to be significant for this analysis:
Basic event EPS-DGN-FR-1A (diesel generator 1A fails to run) was set to TRUE because EDG 1A failed during surveillance testing on April 24t ANALYSIS RESULTS Results The mean CDP for this analysis is calculated to be 1.1x10-7. The ASP Program threshold is 1x10-6 for degraded conditions; therefore, this event is not a precursor. The parameter uncertainty results are provided in the table below:
Table 1. Parameter Uncertainty Results 5%
Median Pt. Estimate Mean 95%
1.2x10-8 6.7x10-8 9.9x10-8 1.1x10-7 3.4x10-7 Dominant Hazards1 The dominant hazards for this analysis are internal events (CDP = 9.7x10-8), which contribute approximately 98 percent of the total CDP. High winds (including hurricanes and tornados)
and seismic hazards are minimal contributors for this analysis. The lack of internal fire scenarios in the SPAR model is a key uncertainty, which is considered qualitatively in Section.3 Dominant Sequences The dominant accident sequence is LOOP sequence 20 (CDP = 3.6x10-8), which contributes approximately 36 percent of the total CDP. The sequences that contribute at least 10 percent to the total CDP are provided in the following table. The event tree with the dominant sequence is shown graphically in Figures A-1, A-2, and A-3 of Appendix Table 2. Dominant Sequences Sequence CDP
%
Description LOOP 20 3.6x10-8 35.7%
LOOP initiating event occurs; emergency power system successfully maintains safety-related AC power; AFW fails; and once-through cooling fails resulting in core damag LOOP 21-03-08 2.2x10-8 22.3%
LOOP initiating event occurs; emergency power system failure results in SBO; operators fail to recover AC power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />; AFW successfully operates; operators successfully declare ELAP; operators successfully shed DC loads; FLEX diesel generator fails to charge safety-related batteries; and operators fail to recover AC power within 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> is assumed to result in core damag The CDPs presented in Sections 3.2, 3.3, and 3.4 are point estimate IR 05000317/2023050
Sequence CDP
%
Description LOOP 21-03-03 2.2x10-8 21.6%
LOOP initiating event occurs; emergency power system failure results in SBO; operators fail to recover AC power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />; AFW successfully operates; operators successfully declare ELAP; operators successfully shed DC loads; FLEX diesel generator successfully charges safety-related batteries; RCS makeup fails; and operators fail to recover AC power within 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> is assumed to result in core damag.4 Key Uncertainties A review of the analysis assumptions and results reveal the following key uncertainties:
CCF Modeling Assumptions. As stated in Section 2.1 and Section 2.3, the expansion of the alpha factor method across units (or systems) is subject to significant uncertainty. In addition, there are significant design differences between the EDGs. Therefore, the EDG CCCGs were revised to eliminate cross-unit CCF potential and based on significant design differences. However, these modeling changes are not meant to imply that there is no CCF potential between EDGs across units or EDGs with significantly different designs. For example, all the EDGs share at least some of the CCF coupling factors (e.g., maintenance, operation, environment, etc.). However, the strength of the CCF coupling is unknown between EDGs across units and those of different designs due to the current data limitations. For the purposes of this analysis, a sensitivity analysis was performed by doubling the failure to run CCF probability of the Unit 2 EDGs 2A and 2B. This increase in the Unit 2 EDG CCF probability is judged to be an upper bound of potential CCF impact given the EDG 1A failure. This calculation resulted in a CDP of 1.9x10-7, which is still below the precursor threshol Lack of Internal Fire Modeling in the SPAR Model. The Calvert Cliffs SPAR model does not include internal fire scenarios. However, the SDP evaluation estimate Unit 2 risk due to internal fires using the licensee fire probabilistic risk assessment (PRA). The annual change in the Unit 2 CDF was estimated to be 2.3x10-6 given the failure of EDG 1A for an exposure time of 196 days. This risk impact is largely due to the increased cross-unit CCF of the EDGs.2 Given this analysiss modeling assumptions associated with CCF modeling of the EDGs, the risk impact from internal fires would be expected to decrease significantly to below the precursor threshold of 10-6 for degraded condition No Credit for EDG 1A Run Time. Depending on when a postulated demand of EDG 1A during the exposure time would occur, EDG 1A would have likely run for some tim Past ASP analyses have credited additional time for AC power recovery given the run history of failed EDG in some cases (either in the best estimate or as a sensitivity analysis). No credit for the potential successful run time of EDG 1A was provided in this analysis. The inclusion of this credit has resulted in a range of CDP reductions (minimal to up to 40 percent decrease) in past ASP analyse Modeling of Unit 2 Shutdown Time. Unit 2 was shutdown for approximately 20 days during the EDG 1A exposure time. The potential risk to Unit 2 during this period is not
The licensee PRA has CCCGs of all five site EDGs, the two SACM EDGs (1A and SBO diesel generator 0C, and the three Fairbanks-Morse EDGs (1B, 2A, and 2B).
included in this analysis due to the lack of the shutdown modeling in the Calvert Cliffs SPAR model. The risk from this shutdown period is not expected to be significant contributor to the overall risk from this conditio IR 05000317/2023050
A-1 Appendix A: Key Event Trees
Figure A-1. Weather-Related LOOP Event Tree IE-LOOPWR LOSS OF OFFSITE POWER (WEATHER-RELA TED)
RPS REACTOR TRIP EPS FS = SBO-FTF EMERGENCY POWER AFW FS = LOOP-RECOVERY AUXILIARY FEEDWATER PORV PORVS ARE ISOLATED LOSC FS = LOSC-FTF RCP SEAL INTEGRITY MAINTAINED HPI FS = LOOP-RECOVERY HIGH PRESSURE INJECTION OTC FS = LOOP-RECOVERY ONCE THROUGH COOLING OPR-02H OFFSITE POWER RECOVERY IN 2 HRS OPR-06H OFFSITE POWER NOT RECOVERED IN 6 HRS SSC SECONDARY SIDE COOLDOWN SDC SHUTDOWN COOLING HPR FS = LOOP-RECOVERY HIGH PRESSURE RECIRC CSR FS = LOOP-RECOVERY CONTAINMENT COOLING
End State (Phase - CD)
AFW-L
OK LOSC-L
LOOP-1 PORV-L HPI-L
OK
OK
CD
CD
OK
CD
CD HPR-L
OK CSR-L
CD HPR-L
CD HPI-L
CD AFW-L OTC-L
OK
CD
CD HPR-L
OK CSR-L
CD HPR-L
CD OTC-L
CD
CD
A-2
Figure A-2. SBO Event Tree
Figure A-3. SBO-ELAP Event Tree EPS FS = SBO-FTF EMERGENCY POWER AFW-B FS = SBO-FTF AUXILIARY FEEDWATER SYSTEM PORV-B FS = SBO-FTF PORVS ARE CLOSED RCPSI RCP SEALS FAIL FOLLOWING A LOSS OF COOLING OPR-04H OFFSITE POWER RECOVERY IN 4 HRS DGR-04H DIESEL GENERATOR RECOVERY IN 4 HRS
End State (Phase - CD)
OPR-01H
OK OPR-01H
OK DGR-01H
SBO-ELAP OPR-01H
SBO-1 OPR-01H
OK DGR-01H
CD OPR-01H
SBO-1 OPR-01H
OK DGR-01H
CD OPR-01H
SBO-2 OPR-01H
OK DGR-01H
CD SBO-ELAP SBO - Extended Loss of AC Power ELAP ELAP IS DECLARED WHEN NEEDED FLEX-DLSHED DEEP LOAD SHEDDING PER FSGs OPR-07H OFFSITE POWER NOT RECOVERED IN 7 HRS FLEX-480 FLEX DIESEL GENERATOR OPERATION AND BUS
ALIGNMENT AFW-MAN-TDP LONG-TERM CONTROL OF AFW TDP - NO FLEX PUMP FLEX-SGP FLEX SG PUMP OPERATION FLEX-MUP BORON INJECTION AND RCS
MAKEUP WITH FLEX PUMP
End State (Phase - CD)
OPR-07H
SBO-1 OPR-07H FLEX-TDP2
OK
CD FLEX-TDP2
OK
CD
CD FLEX-TDP3
OK FLEX-TDP3
CD OPR-04H
SBO-1 OPR-04H FLEX-TDP3
OK FLEX-TDP3
CD OPR-04H
SBO-1 OPR-04H FLEX-TDP3
OK FLEX-TDP3
CD