IR 05000395/2023090

NRC Inspection Report 05000395/2023090 and Preliminary Yellow Finding and Apparent Violation

ML23268A467
Person / Time
Site:	Summer
Issue date:	10/04/2023
From:	Ladonna Suggs Division Reactor Projects II
To:	Carr E Dominion Energy
References
EA-23-093, EPID I-2023-090-0008 IR 2023090
Download: ML23268A467 (18)

Text

SUBJECT:

VIRGIL C. SUMMER NUCLEAR STATION - NRC INSPECTION REPORT 05000395/2023090 AND PRELIMINARY YELLOW FINDING AND APPARENT VIOLATION

Dear Eric S. Carr:

The enclosed inspection report documents a finding with an associated apparent violation that the U.S. Nuclear Regulatory Commission (NRC) has preliminarily determined to be Yellow with substantial safety significance. This involved a self-revealed apparent violation of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix B, Criterion XVI, Corrective Action, which was identified for the licensee failing to correct a condition adverse to quality resulting in the inoperability of the A emergency diesel generator (EDG). We assessed the significance of the finding using the significance determination process (SDP) and the best available information at the time of the significance and enforcement review panel on September 13, 2023. We are considering escalated enforcement for the apparent violation consistent with our Enforcement Policy, which can be found at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. Because we have not made a final determination, no notice of violation is being issued at this time. Please be aware that further NRC review may prompt us to modify the number and characterization of the apparent violation.

The NRCs significance determination process is designed to encourage an open dialogue between your staff and the NRC; however, neither the dialogue nor the written information you provide should affect the timeliness of our final determination.

Before we make a final decision on this matter, we are providing you with an opportunity to (1)

attend a regulatory conference where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance, or (2) submit your position on the finding to the NRC in writing. If you request a regulatory conference, it should be held within 40 days of the receipt of this letter, and we encourage you to submit supporting documentation at least one week prior to the conference to make the conference more efficient and effective. The focus of the regulatory conference is to discuss the significance of the finding and not necessarily the root cause(s) or corrective action(s) associated with the finding. If a regulatory conference is held, it will be open for public observation. If you decide to submit only a written response, such submittal should be sent to the NRC within 40 days of your receipt of this letter.October 4, 2023 If you choose to send a response, please include your perspective of the significance of the finding along with the related facts and assumptions used to reach your determination.

Additionally, your response should be clearly marked as a Response to an Apparent Violation; (EA-23-093) and should include for the apparent violation: (1) the reason for the apparent violation; (2) the corrective steps that have been taken and the results achieved; (3) the corrective steps that will be taken; and (4) the date when full compliance will be achieved. Your response should be submitted under oath or affirmation and may reference or include previously docketed correspondence, if the correspondence adequately addresses the required response.

Additionally, your response should be sent to the U.S. Nuclear Regulatory Commission, ATTN:

Document Control Center, Washington, DC 20555-0001 with a copy to Mr. David E.

Dumbacher, U.S. Nuclear Regulatory Commission, Region II, within 40 days of the date of this letter. If an adequate response is not received within the time specified or an extension of time has not been granted by the NRC, the NRC will proceed with its enforcement decision or schedule a regulatory conference.

If you decline to request a regulatory conference or to submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisite and Limitation sections of Attachment 2 of NRC Inspection Manual Chapter 0609.

Please contact Mr. David E. Dumbacher at 404-997-4628, and in writing, within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision.

The final resolution of this matter will be conveyed in separate correspondence.

For administrative purposes, this inspection report provides an update to the apparent violation documented in NRC inspection report 05000395/2023002 (Agency Documents Access and Management System (ADAMS) ML23223A006) dated August 14, 2023.

This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.

Sincerely, LaDonna B. Suggs, Acting Director Division Of Reactor Projects Docket No. 05000395 License No. NPF-12

Enclosure:

IR 05000395/2023090 w/Attachment: A-EDG Fuel Oil Leak Detailed Risk Evaluation

Inspection Report

Docket Number: 05000395

License Number: NPF-12

Report Number: 05000395/2023090

Licensee: Dominion Energy

Facility: Virgil. C. Summer Nuclear Station

Location: Jenkinsville, SC

Inspection Dates: August 10, 2023 to September 13, 2023

Inspectors: N. Childs, Senior Project Engineer M. Read, Senior Resident Inspector S. Sandal, Senior Reactor Analyst

Approved By: LaDonna B. Suggs, Director Division of Reactor Projects

Enclosure SUMMARY

The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees performance by conducting an NRC inspection at Virgil. C. Summer, in accordance with the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for overseeing the safe operation of commercial nuclear power reactors. Refer to https://www.nrc.gov/reactors/operating/oversight.html for more information.

List of Findings and Violations

Failure to Identify and Correct a Condition Adverse to Quality Associated with the EDG Fuel Oil System Cornerstone Significance Cross-Cutting Report Aspect Section Mitigating Preliminary Yellow None (NPP) 71111.12 Systems AV 05000395/2023002-01 Open EA-23-093 A self-revealed finding that has preliminarily been determined to be Yellow (substantial safety significance) and associated apparent violation (AV) of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix B, Criterion XVI, Corrective Action, was identified when the licensee failed to identify and correct a condition adverse to quality (CAQ) for the EDG fuel oil system that left the system vulnerable to piping cracks and eventually resulted in the failure of the A EDG during testing on November 2, 2022. Specifically, inspectors determined that, based on the failure history of the EDGs and the licensees documented conclusions that attributed pipe cracks to prior maintenance events, the licensee had sufficient information to identify the existence of a condition adverse to quality related to the design of the EDG fuel oil system. This condition caused threaded fuel oil piping connections to be vulnerable to maintenance activities that over torqued, strained, or impacted the piping.

Despite the challenge to maintain leak-tight connections and repeat occurrences of cracked piping, no significant changes were made to maintenance practices, procedures or system design, and the licensee continued to reactively monitor for leakage even after vulnerabilities were identified.

Additional Tracking Items

None.

INSPECTION SCOPES

Inspections were conducted using the appropriate portions of the inspection procedures (IPs) in effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with their attached revision histories are located on the public website at http://www.nrc.gov/reading-rm/doc-collections/insp-manual/inspection-procedure/index.html. Samples were declared complete when the IP requirements most appropriate to the inspection activity were met consistent with Inspection Manual Chapter (IMC) 2515, Light-Water Reactor Inspection Program - Operations Phase. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel to assess licensee performance and compliance with Commission rules and regulations, license conditions, site procedures, and standards.

INSPECTION RESULTS

Failure to Identify and Correct a Condition Adverse to Quality Associated with the EDG Fuel Oil System Cornerstone Significance Cross-Cutting Report Aspect Section Mitigating Preliminary Yellow None (NPP) 71111.12 Systems AV 05000395/2023002-01 Open EA-23-093 A self-revealed finding that has preliminarily been determined to be Yellow (substantial safety significance) and associated AV of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix B, Criterion XVI, Corrective Action, was identified when the licensee failed to identify and correct a CAQ for the EDG fuel oil system that left the system vulnerable to piping cracks and eventually resulted in the failure of the A EDG during testing on November 2, 2022. Specifically, inspectors determined that, based on the failure history of the EDGs and the licensees documented conclusions that attributed pipe cracks to prior maintenance events, the licensee had sufficient information to identify the existence of a condition adverse to quality related to the design of the EDG fuel oil system. This condition caused threaded fuel oil piping connections to be vulnerable to maintenance activities that over torqued, strained, or impacted the piping. Despite the challenge to maintain leak-tight connections and repeat occurrences of cracked piping, no significant changes were made to maintenance practices, procedures or system design, and the licensee continued to reactively monitor for leakage even after vulnerabilities were identified.

Description: On November 2, 2022, during the performance of a 24-hour surveillance test, operations identified a small leak on the 3/4 fuel piping header supplying the A EDG right bank cylinders fuel injectors. The leakage was monitored and observed to increase over several hours until operations stopped the surveillance test, secured the engine, and prepared the EDG for repairs. During troubleshooting and repairs, the licensee identified that a crack between the threads of the male end of the pipe had propagated 140-degrees around the circumference of the pipe. The location of the crack was in a section of piping that experienced vibrations during operation. The original design of the fuel oil delivery piping included threaded connections for ease of maintenance. An engineering assessment determined that the EDG was unlikely to have been able to perform its 24-hour mission time.

Inspectors reviewed historical condition reports (CRs) and maintenance records and noted that the A and B EDGs have experienced fuel oil piping cracking near the left and right fuel header connections where vibrations are present. Inspectors noted that, on March 2, 2020,

during repairs to correct minor fuel oil leakage under WO1909952 step 2, the licensee identified a crack on the A EDG 1 x 1/2 reducer bushing on the left bank header. A CR was not generated to document the cracked bushing. During the retest on March 5, 2020, fuel oil leakage was identified, and the licensee initiated CR 20-00712 as a non-condition adverse to quality (NCAQ) to document the leakage. After subsequent repairs on March 6, 2020, during the maintenance retest, the licensee identified a leak and a crack on the newly installed pipe nipple that was attached to a new bushing installed on March 5, 2020, which was documented in CR-20-00735 as an NCAQ. The nipple was replaced, and no further evaluation was performed.

Licensee procedure SAP-0999, Corrective Action Program, Revision 19, step 1.2.3 required the determination of CR category and evaluation type using examples and guidance in Enclosures A and J. Although maintenance rework items were identified as NCAQs and did not require evaluations, the identification of cracked bushing and fittings should have been identified as a CAQ because both components were found degraded in a condition that had the potential to inhibit a safety-related structure, system, and component from satisfactory performance of a safety-related function. This may have driven an evaluation of previous conditions, cause of the issue, and extent of condition, but guidance in Enclosure A to determine the level of evaluation would have been subjective based on the perceived consequence. Since the component cracked, it should have received at least a D-OTH evaluation which would have identified the most probable cause of the cracks. Since the failure was treated as a broke/fix, even though the components were cracked prior to the maintenance window, the licensee missed an opportunity to identify if a CAQ existed.

Additionally, inspectors noted the following events in 2003 and 2014, which illustrate a history of similar failures of the EDG fuel oil system piping:

On October 21, 2003, while performing maintenance testing on the A EDG, the right bank fuel supply line ruptured at the threaded connection. The licensee documented NCN-03-03500 and attributed the crack to manual manipulation of the pipe. The pipe nipple was replaced, and the 10-foot crossover pipe between the left and right fuel oil header banks was shortened to minimize piping spring.

On August 20, 2014, the A EDG left bank 3/4 x 2 nipple developed a 120 drops per minute leak. The licensee initiated CR 14-04564 to repair the connection. During repairs, mechanics identified a hairline crack in the threads. The nipple was replaced, and the licensee initiated CR 14-04592 to document the hairline crack. The CR actions included a quick cause evaluation and assignments for engineering to inspect other threaded connections for evidence of leakage during the next runs of the A and B EDGs. The quick cause evaluation noted the 2003 pipe crack on the opposite side of the A EDG and determined that the single impact event during a 2003 maintenance activity damaged the left bank nipple and over 11 subsequent years of operation, the crack developed due to fatigue.

On November 4, 2014, the B EDG right bank 3/4 x 15 nipple developed a small leak. The licensee initiated CR 14-05797 to repair the connection. During repairs, mechanics identified a hairline crack in the threads. The pipe nipple was replaced, and the D-OTH evaluation by engineering stated that the most likely cause was a single impact event followed by subsequent high stress low cycle fatigue. The

licensee established a corrective action to monitor the system for early signs of leakage during EDG runs.

Each of these instances of piping or bushing cracks were remediated by replacement of the components and monitoring for future leakage from similar components. The EDG fuel oil system was designed to be robust to withstand the expected high vibrations for the life of the plant. Due to the standby nature of EDGs at nuclear power plants, which only run during testing and events involving a loss of offsite power, it is rare that an EDG would operate more than 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> per year. Although the EDG fuel oil system cracks were separated by many years between events, the total run time of the EDGs between failures was small compared to the expected life of the system. The licensee had evidence that maintenance activities, including piping manipulation and impact events could not only damage multiple connections, but the damage may not reveal itself through an open crack for years. This vulnerability of the EDG system is exacerbated by the use of schedule-40 piping with tapered threads that is more susceptible to cracking than thicker piping or different connection designs.

Inspectors determined that, based on the failure history of the EDGs and the licensees documented conclusions that attributed pipe cracks to prior maintenance events, the licensee had sufficient information to identify that a CAQ existed with the design of the EDG fuel oil system that caused the threaded connections to be vulnerable to maintenance activities that over torqued, strained, or impacted the piping. This vulnerability in the system was most prevalent in the left and right bank fuel oil connections which were subject to high vibrations during EDG operation. Despite the challenge to maintain leak-tight connections and the history of cracked pipes, no significant changes were made to maintenance practices or procedures, and the licensee continued to reactively monitor for leakage even after vulnerabilities were identified. The licensee also did not make any substantive changes to the design of the system to reduce the vulnerability to maintenance-induced challenges.

The licensee treated individual pipe failures as broke/fix rather than identifying the system vulnerability. The licensee had evidence prior to the November 2022 failure of the A EDG supply header pipe that cracks could propagate rapidly during EDG operation as seen in the October 2003 rupture of the same A EDG supply header pipe. CRs documenting failures in 2020 were classified as NCAQs and represented a missed opportunity for the licensee to perform an evaluation to identify whether a common CAQ existed and determine if previous failures in 2003 and 2014 were indicative of a more significant problem with the EDG fuel oil system piping.

Corrective Actions: The licensee replaced the cracked pipe nipple on the A EDG and reperformed the 24-hour surveillance test. The licensee also replaced the same nipple on the B EDG to extend the life of the piping.

Corrective Action References: CR 1211780 Performance Assessment:

Performance Deficiency: The licensee's failure to identify and correct a CAQ for the EDG fuel oil system that left the system vulnerable to piping cracks was a performance deficiency.

Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable

consequences. Specifically, the condition caused the threaded fuel oil piping connections to be vulnerable to maintenance activities which resulted in the failure of a pipe nipple and inoperability of the A EDG on November 2, 2022.

Significance: The inspectors assessed the significance of the finding using IMC 0609 Appendix A, The Significance Determination Process (SDP) for Findings At-Power. The affected cornerstone was mitigating systems, as determined by IMC 0609, Attachment 4, Initial Characterization of Findings. The inspectors screened the performance deficiency using Exhibit 2 of Appendix A and determined a detailed risk evaluation was required because the degraded condition represented a loss of the Probabilistic Risk Assessment (PRA) function of one train of a multi-train Technical Specification (TS) system for greater than its TS allowed outage time.

A Region II Senior Reactor Analyst performed a detailed risk evaluation. The finding was preliminarily determined to be of substantial safety significance (Yellow). The preliminary risk estimate was obtained by performing a run-time failure conditional analysis of the A-train EDG using a 162-day exposure period evaluated over six run intervals. The dominant Standardized Plant Analysis Risk (SPAR) model sequences were associated with fire initiating events with impact to the normal offsite power supply, random failure/unavailability of the B-train EDG, and the inability to restore power from the 13.8 kV source and operator failure to control the Turbine Driven Essential Feedwater (TDEFW) pump following battery depletion. See Attachment, A-EDG Fuel Oil Leak Detailed Risk Evaluation, for a summary of the preliminary risk determination analysis.

Cross-Cutting Aspect: Not Present Performance. No cross-cutting aspect was assigned to this finding because the inspectors determined the finding did not reflect present licensee performance.

Enforcement:

Violation: 10 CFR Part 50 Appendix B, Criterion XVI Corrective Action, states, in part that, measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected.

Section 16, Corrective Action, of the V.C. Summer Quality Assurance Program Description, Revision 2 (2014), described the methods to meet Criterion XVI, which stated, in part, when complex issues arise where it cannot be readily determined if a condition adverse to quality exist, [the licensee] documents establish the requirements for documentation and timely evaluation of the issue.

Licensee procedure SAP-0999, Corrective Action Program, Revision 12 (2014), step 6.3.1 stated, When an issue is recognized that it is not meeting performance expectations, the event should be documented via a CR. An example of a condition that required a CR is The failure mechanism has implications that may affect multiple systems or components.

Contrary to the above, following discovery of cracked components in the EDG fuel oil system dating back to 2003, the licensee fixed the cracked piping/fittings but failed to identify and correct the failure mechanism that affected the fuel oil system piping on both the A and B EDGs, eventually leading to the failure of the A EDG fuel oil piping during testing on November 2, 2022. Specifically, CRs documenting failures in 2020 were classified as NCAQs and represented a missed opportunity for the licensee to perform an evaluation to identify

whether a common CAQ existed and determine if previous failures in 2003 and 2014 were indicative of a more significant problem with the EDG fuel oil system piping.

Enforcement Action: This violation is being treated as an AV pending a final significance (enforcement) determination.

EXIT MEETINGS AND DEBRIEFS

The inspectors verified no proprietary information was retained or documented in this report.

On September 28, 2023, the inspectors presented the NRC inspection results to Mr.

Robert Justice, Site Vice President, and other members of the licensee staff.

ATTACHMENT: A-EDG FUEL OIL LEAK DETAILED RISK EVALUATION

OVERALL RISK SUMMARY

The V.C. Summer A-train EDG was rendered inoperable due to a fuel header through-wall leak discovered during a surveillance test. The crack size and associated leak rate increased until the licensee terminated the surveillance test approximately six hours into a planned 24-hour run. Analysis of the condition indicated that the A-train EDG would not have been able to operate for its mission time and would have prevented the EDG from providing its emergency power safety function. A risk evaluation using a 162-day exposure period preliminarily estimated an increase in the change in core damage frequency (delta-CDF) of 2.92E-05/year (consistent with a Yellow finding).

PERFORMANCE DEFICIENCY

The licensee's failure to identify and correct a CAQ for the EDG fuel oil system that left the system vulnerable to piping cracks was a performance deficiency.

The inspectors determined the performance deficiency was more than minor because it was associated with the design control attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the condition caused the threaded fuel oil piping connections to be vulnerable to maintenance activities which resulted in the failure of a pipe nipple and inoperability of the 'A' EDG on November 2, 2022.

The analyst noted that the performance deficiency was also more than minor because it was associated with the equipment performance attribute of the mitigating systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the condition caused the threaded fuel oil piping connections to be vulnerable to maintenance activities which resulted in the failure of a fuel oil pipe nipple and inoperability of the A-train EDG on November 2, 2022.

EXPOSURE TIME

The component run-time failure approach discussed in Section 2.5 of Volume 1 of the Risk Assessment Standardization Project (RASP) Manual was used to evaluate the condition exposure time. The run history of the A-train EDG prior to the failure in November 2022 was used to determine the number of intervals of accumulated operation for its 24-hour PRA mission time (precise condition inception time was unknown, but the vibration-induced degradation mechanism was assumed to progress only during operation of the EDG). The final time interval included the A-train EDG repair time after the leak was identified during the surveillance test. A total exposure time of 162 days divided into six run intervals was used for the analysis. The condition exposure period began on May 24, 2022, and ended following repairs to the A-train EDG on November 2, 2022.

RISK ANALYSIS/CONSIDERATIONS

Assumptions

1. The A-train EDG was assumed to have been able to operate an additional three hours beyond the point that the licensee voluntarily terminated the surveillance test on November 2, 2022. This assumption was made to avoid the overly conservative assumption that the A-EDG function had completely failed six hours into its test. The three-hour time estimate was made based on the reported rate of increase in leakage during the surveillance test which was assumed to be proportional to the rate of crack growth (or 140 degrees approximately six hours into the surveillance

test). This assumption could be considered non-conservative because the crack propagation, if allowed to continue, could reasonably have been expected to exhibit exponential growth characteristics (vs. linear) leading to more rapid failure of the EDG and potentially adding additional condition exposure time to the analysis. The run history of the A-train EDG was examined, and it was determined that the EDG had been operated successfully approximately one week prior to the start of the analysis exposure period of May 24, 2022. This indicates that the assumption, while potentially non-conservative, would not significantly impact the overall exposure period or conclusions resulting from the analysis.

2. The condition was assumed to only continue to degrade when the EDG was operated and not when in a standby status. Consequently, the component run-time failure approach discussed in Section 2.5 of Volume 1 of the RASP manual was used to evaluate the condition exposure time. Based on the run history of the A-train EDG a condition exposure period of 162 days, divided into six separate run intervals, and including repair time was used for the analysis. To explore the sensitivity of the analysis results with respects to use of the run-time failure approach, a sensitivity case will be performed that does not divide the 162-day exposure period into time intervals.

3. No repair credit for the failure of the A-train EDG fuel header was included in the analysis.

4. Diverse and Flexible Coping Strategies (FLEX) mitigating strategies and equipment were credited in the analysis using a 24-hour PRA mission time. FLEX equipment reliability was modeled using information contained in PWROG-18042-NP, Revision 1, FLEX Equipment Data Collection and Analysis, (ADAMS ML22123A259). A sensitivity case with no FLEX credit was also performed.

Systems Analysis Program for Hands-On Integrated Reliability Evaluations (SAPHIRE) software version 8.2.8 and V.C. Summer SPAR model version 8.80 was used for the evaluation.

1. The SPAR model was modified with the assistance of Idaho National Lab to account for the capability of powering the A-or B-train 7.2 kV Engineered Safety Features (ESF) bus from the 13.8 kV section of the Parr hydro unit switchyard. This offsite power supply is an underground feed via transformer XTF-5052 that has the capability of providing power to either ESF bus and does not require manning or start-up of the Parr hydro unit. No credit was provided in the analysis for start-up and operation of the Parr hydro unit as an alternate source of electrical power. In addition, the SPAR model was also modified to account for the ability of both the A and B-train emergency auxiliary transformers (XTF-31 and XTF-4) to supply offsite power to both ESF buses.

2. The approach discussed in Section 2.5 of the RASP manual was used to evaluate the condition exposure time. The run history of the EDG prior to the failure in November 2022 was used to determine the number of intervals of accumulated operation of the EDG for the 24-hour PRA mission time (condition inception time unknown but the vibration-induced degradation of the fuel line was assumed to progress during operation of the EDG). The final time interval includes the EDG repair time after the leak was identified. The table below summarizes the intervals that were used for the analysis.

Interval Exposure Interval Run Cumulative Run Time to Date # Period (days) Time (hrs) (hrs) Failure (hrs)

5/24/22 11:05 PM - - 5.0 5.0 24.0 6/14/22 11:15 PM 1 21 2.0 7.0 19.0 7/12/22 11:39 PM 2 28 1.0 8.0 17.0 8/17/22 12:00 AM 3 35 3.0 11.0 16.0 9/6/22 11:19 PM 4 21 2.0 13.0 13.0 10/5/22 12:26 AM 5 28 2.0 15.0 11.0 11/2/22 6:31 PM 6 29 9.0 24.0 9.0

The fault tree logic for the A-train EDG was modified to split the fail-to-run (FTR) basic event into two separate components so that adjustments could be made to credit EDG operation prior to failure. The SAPHIRE convolution mapping tool was then used to update model convolution events using the new fault tree logic.

For the conditional case the model was adjusted using change set 1AEXT_EDG_FTR which set event EPS-DGN-FR-1A to TRUE so that the FTR common cause change would be calculated by SAPHIRE.

The change set also set the new basic event EPS-DGN-FR-1AEXT to 1.0 so the failure would show up in cutsets for post-processing adjustment made for credited EDG run time.

For each time interval the mission time for basic events EPS-DGN-FR-1AT2 and EPS-DGN-FR-1AEXT were adjusted to reflect the estimated run time before failure and each time interval also included ET post-processing to look for A EDG FTR basic event EPS-DGN-FR-1AEXT in the cutsets and substitute the appropriate recovery terms based on credited EDG operation. The following table shows the mission time adjustments made to EPS-DGN-FR-1AT2 and EPS-DGN-FR-1AEXT for each time interval.

Exposure Time to EPS-DGN-FR-1AT2 EPS-DGN-FR-1AEXT Interval Period (days) Failure (hrs) Mission Time (hrs) Mission Time (hrs)

1 21 19 18 5 2 28 17 16 7 3 35 16 15 8 4 21 13 12 11 5 28 11 10 13 6 29 9 8 15

3. A conditional case was performed for every interval bin and the results were summed to determine the overall risk estimate.

4. Basic events were adjusted in the base SPAR model to enable FLEX sequences and account for best estimate reliability of FLEX equipment using industry failure data at a 24-hour mission time.

Based on the unavailability of industry reliability data for load-run basic events, the model was adjusted to ignore those failures. A sensitivity case will also be performed giving no credit for FLEX mitigation of the performance deficiency. These adjusted values were used for both the nominal and conditional case as the performance deficiency did not impact FLEX strategies.

5. Two new Human Error Probability (HEP) basic events were created to model operator actions to recover offsite power supplies. The first HEP (ACP-XHE-XM-PARRHYDRO) estimates the failure to manually align the 13.8 kV offsite source from Parr hydro switchyard to either the A-or B-train 7.2 kV ESF bus. The second HEP (ACP-XHE-XA-ALT1DA(B)) estimates the failure to manually align either XTF-31 to the B-and A-train ESF buses or XTF-4 to the A-and B-train ESF buses. Development of the HEPs was documented using SPAR-H worksheets.

ACP-XHE-XM-PARRHYDRO = 4.4E-02 ACP-XHE-XA-ALT1DA(B) = 5.40E-03

6. SAPHIRE condition assessments were performed using the event tree direct solve method where cutset results were gathered for sequences other than internal events. Conditional case change set 1AEXT_EDG_FTR was used to evaluate the change in risk that could be attributed to the EDG failure for each time interval being evaluated over the 162-day exposure period.

Change Set 1AEXT_EDG_FTR (shown for interval 1)

Basic Event Nominal Conditional EPS-DGN-FR-1A 2.68E-02 TRUE EPS-DGN-FR-1AEXT 5.88E-03 1.0

7. SAPHIRE condition assessments were also performed using the ECA module to generate dominant sequence and cutset reports. Conditional case change set 1AEXT_EDG_FTR_ECA was used in the condition assessments.

Change Set 1AEXT_EDG_FTR_ECA (shown for interval 1)

Basic Event Nominal Conditional EPS-DGN-FR-1A 2.68E-02 TRUE EPS-DGN-FR-1AEXT 5.88E-03 1.0 EPS-DGN-FR-1AT2 2.10E-02 2.10E-02 EPS-DGN-TM-1A 1.51E-02 1.51E-02

CALCULATIONS

Best Estimate:

Internal Internal Exposure Fire Events High Wind Seismic Tornado Flooding Interval (days) Delta-CDP Delta-CDP Delta-CDP Delta-CDP Delta-CDP Delta-CDP 1 21 3.81E-06 1.18E-07 9.20E-08 5.75E-09 3.07E-10 5.81E-12 2 28 4.78E-06 8.67E-08 8.04E-08 7.67E-09 4.09E-10 4.76E-12 3 35 5.97E-06 1.11E-07 1.03E-07 9.59E-09 5.11E-10 6.14E-12 4 21 3.59E-06 7.19E-08 6.73E-08 5.75E-09 3.06E-10 3.74E-12 5 28 4.79E-06 1.00E-07 9.47E-08 7.67E-09 4.07E-10 5.75E-12 6 29 5.05E-06 1.10E-07 1.04E-07 7.95E-09 4.22E-10 5.96E-12 Total 162 2.80E-05 5.98E-07 5.41E-07 4.44E-08 2.36E-09 3.22E-11

SAPHIRE condition assessments were performed using the direct solve method and conditional case change set 1AEXT_EDG_FTR. The overall estimated increase in risk was a delta core damage probability (delta-CDP) of 2.92E-05. FIRE sequences were determined to be strongly dominant in the results with INTERNAL EVENTS and HIGH WINDS also significant sequence contributors. SAPHIRE ECA condition assessments were performed to generate dominant sequence and cutset reports.

Dominant FIRE cutsets were associated with fire initiating events in the 1DB switchgear room, station transformer area, and turbine building. These fire initiators result in a plant transient with either fire damage impacting B-train power or random failure/unavailability of the B EDG accompanied by the inability to restore power from the 13.8 kV source and operator failure to control the Turbine Driven Essential Feedwater (TDEFW) pump following battery depletion.

Dominant INTERNAL EVENT and HIGH WIND cutsets were associated with weather-related loss of offsite power with failure to align the 13.8 kV source accompanied by random failures of the B EDG and FLEX DG and failure to recover offsite power sources.

Sensitivity 1 - No Time Intervals

To explore the sensitivity of the analysis results due to application of the run-time treatment of exposure time, this sensitivity will determine the estimated increase in risk-based on the full exposure period without the use of time intervals or post-processing to adjust power recovery terms.

SAPHIRE condition assessments were performed using the direct solve method and conditional case change set 1AEXT_EDG_FTR for the full 162-day exposure period.

Internal Internal Exposure Fire Events High Wind Seismic Tornado Flooding (days) Delta-CDP Delta-CDP Delta-CDP Delta-CDP Delta-CDP Delta-CDP 162 3.87E-05 1.92E-06 1.45E-06 4.44E-08 2.33E-09 1.22E-10

The overall estimated increase in risk was a delta-CDP of 4.22E-05.

As expected, the sensitivity results were higher without consideration of the run history of the A EDG or consideration for the increased time that would have been available to potentially recover power sources for the affected ESF bus. The higher estimate would not have been sufficient to alter the overall conclusions of the analysis. The use of the run-time failure methodology was determined to be the most appropriate treatment of exposure time for the analysis.

Sensitivity 2 - Increase Parr Switchyard Alignment Human Error Probability (HEP)

To evaluate the sensitivity of analysis results with respect to operator actions for alignment of the Parr hydro 13.8 kV offsite power supply, the basic event for operator failure (ACP-XHE-XM-PARRHYDRO)

was increased by a factor of 2x for both the nominal and conditional cases.

ACP-XHE-XM-PARRHYDRO = 8.8E-02

SAPHIRE direct solve condition assessments were performed with conditional change set 1AEXT_EDG_FTR. Dominant event sequences FIRE, INTERNAL EVENTS, and HIGH WIND were utilized for the sensitivity.

Fire Internal Events High Wind Interval Exposure (days) Delta-CDP Delta-CDP Delta-CDP 1 21 7.53E-06 2.35E-07 1.85E-07 2 28 9.52E-06 1.71E-07 1.60E-07 3 35 1.19E-05 2.21E-07 2.07E-07 4 21 7.15E-06 1.42E-07 1.34E-07 5 28 9.63E-06 1.99E-07 1.88E-07 6 29 1.01E-05 2.18E-07 2.06E-07 Total 162 5.58E-05 1.19E-06 1.08E-06

The overall estimated increase in risk was a delta-CDP of 5.81E-05.

The analyst noted that the analysis results were strongly sensitive to consideration of operator actions to align the Parr hydro 13.8 kV power supply to the B-train ESF bus. This sensitivity was consistent with the number of SPAR model dominant cutsets containing that basic event. The sensitivity demonstrated that increasing the HEP by a factor of two approximately doubled the estimated increase in risk but would not have altered the overall conclusions of the analysis. Additionally, the analyst noted that given the

proportional impact on the analysis results, reducing the HEP by half would also not be expected to lower the risk estimate enough to change the overall analysis conclusions.

Sensitivity 3 - No FLEX

To evaluate the sensitivity of analysis results with respect to crediting of FLEX mitigation strategies, the basic event for operator failure to enter extended loss of AC power procedures was set to 1.0 for both the nominal and conditional cases.

FLX-XHE-XE-ELAP = 1.0

SAPHIRE direct solve condition assessments were performed with conditional change set 1AEXT_EDG_FTR. Dominant event sequences FIRE, INTERNAL EVENTS, and HIGH WIND were utilized for the sensitivity.

Fire Internal Events High Wind Interval Exposure (days) Delta-CDP Delta-CDP Delta-CDP 1 21 3.75E-06 1.15E-07 1.23E-07 2 28 5.01E-06 1.78E-07 1.91E-07 3 35 6.26E-06 2.38E-07 2.52E-07 4 21 3.83E-06 1.57E-07 1.67E-07 5 28 5.11E-06 2.22E-07 2.36E-07 6 29 5.38E-06 2.46E-07 2.60E-07 Total 162 2.93E-05 1.16E-06 1.23E-06

The overall estimated increase in risk was a delta-CDP of 3.17E-05.

FLEX mitigation of the finding was not a strongly influential factor in the analysis results. This was primarily due to the top SPAR cutsets involving Station Blackout (SBO) sequences accompanied by early failure of the TDEFW pump. Under these conditions core damage can occur quickly and there would not be sufficient time to implement the phase two FLEX strategies. Although not a strongly influential factor, inclusion of FLEX mitigation was determined to be most appropriate to the circumstances and was considered in the best estimate case.

Sensitivity 4 - Probabilistic Safety Analysis (PSA) Values

To assess the sensitivity of the SPAR model analysis results with respect to values used in the licensees model the following adjustments were made:

SPAR PSA Flagset Basic Event Description Value Value N/A ACP-XHE-XM-PARRHYDRO OPERATOR FAILS TO ALIGN BACKUP 4.40E-02 7.39E-02 POWER FROM PARR HYDRO N/A EFW-XHE-XM-CNTRL OPERATOR FAILS TO OPERATE EFW 3.00E-01 1.60E-02 TDP AFTER BATTERY DEPLETION FRI-IB2202-T4 EFW-TDP-FR-XPP8 EFW TDP XPP-8 FAILS TO RUN TRUE 5.93E-02 FRI-IB2202-CMPT-9 EFW-TDP-FR-XPP8 EFW TDP XPP-8 FAILS TO RUN TRUE 5.93E-02 FRI-YD03-CMPT-10 ACP-XHE-XM-PARRHYDRO OPERATOR FAILS TO ALIGN BACKUP 4.40E-02 TRUE POWER FROM PARR HYDRO

The basic events were selected based on their relative importance to dominant SPAR model sequences and the differences in treatment between the licensees model and the SPAR model. The PSA values for ACP-XHE-XM-PARRHYDRO and EFW-XHE-XM-CNTRL were used for used for the nominal and conditional case for the sensitivity. Failure of EFW-TDP-FR-XPP8 was removed from the fire scenarios for fire area IB2202 where the licensees PSA did not assume fire-induced loss of the pump. Additionally, ACP-XHE-XM-PARRHYDRO was added to the switchyard fire scenario to account for fire-induced unavailability of the Parr hydro switchyard power source.

SAPHIRE direct solve condition assessments were performed with conditional change set 1AEXT_EDG_FTR. Dominant event sequences FIRE, INTERNAL EVENTS, and HIGH WIND were utilized for the sensitivity.

Fire Internal Events High Wind Interval Exposure (days) Delta-CDP Delta-CDP Delta-CDP 1 21 4.86E-06 1.91E-07 1.41E-07 2 28 5.87E-06 1.10E-07 9.78E-08 3 35 7.34E-06 1.40E-07 1.26E-07 4 21 4.41E-06 8.98E-08 8.11E-08 5 28 5.88E-06 1.24E-07 1.13E-07 6 29 6.17E-06 1.35E-07 1.24E-07 Total 162 3.45E-05 7.90E-07 6.83E-07

The overall estimated increase in risk was a delta-CDP of 3.60E-05.

For the basic events being evaluated, the difference in treatment between the SPAR model and the licensees model were not strongly influential in the analysis results. Overall, the sensitivity was higher than the best estimate case but did not alter the resulting conclusions. The most influential factor appears to be the value used for ACP-XHE-XM-PARRHYDRO which is addressed in Sensitivity 2 of the evaluation.

LICENSEE EVALUATION

During the development of this detailed risk evaluation, discussions with the licensee indicated preliminary risk estimates from the licensees risk model were consistent with NRC SPAR model results with FIRE sequences strongly dominant in the lower portion of the E-05 range. Although the licensees model or record does not include FLEX equipment, the top cutsets also involved SBO sequences accompanied by failure of the TDEFW pump which would normally not include credit for FLEX mitigation.

The licensee was developing an analysis to determine if enough decay heat would be removed prior to the expected run-time failure of the A-train EDG to allow implementation of Phase 2 FLEX strategies to restore the heat removal function prior to core damage. The licensees evaluation was not completed at the time of this detailed risk evaluation. A qualitative review of SPAR model cutsets for the top FIRE sequences indicate that FLEX credit under those conditions had the potential to reduce the estimated risk of the condition.

DELTA-CDF FOR EXPOSURE TIME

The overall results are summarized below:

Best Sensitivity #1 Sensitivity #2 Sensitivity #3 Sensitivity #4 EVENT SEQUENCE Estimate No Intervals SWYD HEP 2x No FLEX PSA Values FIRE 2.80E-05 3.87E-05 5.58E-05 2.93E-05 3.45E-05 INTERNAL EVENTS 5.98E-07 1.92E-06 1.19E-06 1.16E-06 7.90E-07 HIGH WINDS 5.41E-07 1.45E-06 1.08E-06 1.23E-06 6.83E-07 SEISMIC 4.44E-08 4.44E-08 - - -

TORNADO 2.36E-09 2.33E-09 - - -

INTERNAL FLOODING 3.22E-11 1.22E-10 - - -

TOTAL 2.92E-05 4.22E-05 5.81E-05 3.17E-05 3.60E-05

Considering that SAPHIRE calculates the difference in core damage probability over a given exposure time, and that changes in CDF over the same period are numerically equivalent, the change in CDF due to the finding would be on the order of 2.92E-05/year.

EXTERNAL EVENTS CONSIDERATIONS

Internal event estimates were greater than 1E-07, therefore external events were discussed and estimated in this risk evaluation. FIRE and HIGH WINDS event sequences were determined to be significant contributors to the overall estimated risk and were included in sensitivity evaluations with INTERNAL EVENTS.

LARGE EARLY RELEASE FREQUENCY IMPACT

The finding was evaluated in accordance with IMC 0609, Appendix H, Containment Integrity Significance Determination Process, as a Type A finding. Although the estimated delta-CDF was greater than 1E-07/year, the dominant accident sequences did not involve steam generator tube rupture or interfacing system Loss of Coolant Accidents. Therefore, the issue associated with failure of the A-train EDG would not be expected to be a significant contributor to an increase in large early release frequency (delta-LERF) risk in comparison to the delta-CDF risk. Delta-CDF was determined to be the risk metric of interest for this evaluation.

CONCLUSIONS/RECOMMENDATIONS

The preliminary estimated risk increase (delta-CDF) over the nominal case for the inoperability of the A-train EDG was 2.92E-05/year, which should be preliminarily considered a finding of substantial (Yellow)

significance.

15