ML062710041

Final Precursor Analysis - Saint Lucie Units 1 and 2 (LER 355/04-004)Dual Unit Loss of Offsite Power During Hurricane Jeanne

ML062710041
Person / Time
Site:	Saint Lucie
Issue date:	09/27/2006
From:	Demoss G NRC/RES/DRASP/DDOERA/OEGI
To:
References
LER 04-004
Download: ML062710041 (32)

Text

1 For the initiating event assessment, the parameter of interest is the measure of the conditional core damage probability (CCDP). This is the value obtained when calculating the probability of core damage for an initiating event with subsequent failure of one or more components following the initiating event.

1 Final Precursor Analysis Accident Sequence Precursor Program ---Office of Nuclear Regulatory Research Saint Lucie Units 1 and 2 Dual Unit Loss of Offsite Power During Hurricane Jeanne Event Date 9/25/2004 LER 355/04-004 CCDP1 = 1E-05 September 27, 2006 Event Summary At 2356 hours0.0273 days <br />0.654 hours <br />0.0039 weeks <br />8.96458e-4 months <br /> on September 25, 2004, a dual-unit LOOP occurred at the St. Lucie site. Earlier that day both units commenced an orderly shutdown to prepare for the arrival of Hurricane Jeanne. At the time of the LOOP, the site was experiencing hurricane force winds with both units in Mode 4. The emergency diesel generators started and safe shutdown loads (with the exception of the 1B intake cooling water pump) were sequenced as designed. Offsite power was restored to both units by 1103 hours0.0128 days <br />0.306 hours <br />0.00182 weeks <br />4.196915e-4 months <br /> on September 26, 2004.

The LOOP was caused by two independent electrical faults associated with the wind-driven salt contamination in the westward eye wall of Hurricane Jeanne. However, with both units shutdown, the switchyard design protection scheme for the main generators effectively reduces electrical power redundancy to the startup transformers.

Site damage assessment and recovery efforts continued and both units were returned to service by October 4, 2004. The control switch and load-sequencing relay for the 1B ICW pump were replaced.

Cause. The faults that resulted in the dual unit LOOP at the St. Lucie site were most likely caused by salt contamination on electrical components as a result of the extreme environmental conditions experienced during Hurricane Jeanne. The west side of the eye wall was heavily contaminated with salt spray, creating the potential for electrical faults. This salt spray contamination was removed by the east side of eye wall as it washed the salt away with cleaner water. This west eye wall salt spray contamination - east eye wall self cleaning phenomenon was also observed in substations throughout the FPL service territory.

An additional cause for the LOOP is that the switchyard design requires removal of each unit's east and west 230kV bus cross-tie when the unit is off-line. If the switchyard design had non-load interrupting disconnect switches in the main transformer lines, Bays 1 and 3 would provide additional cross-ties between the east and west 230kV busses. This would allow re-closing the generator breakers (8W30 and 8W26 in Bay 1 for Unit 1 or 8W52 and 8W49 for Unit 2 in Bay

3) when a St. Lucie unit is off-line. This design would result in a more robust 230kV switchyard when challenged by extreme environmental conditions.

Other conditions, failures, and unavailable equipment. On Unit 1, all safety systems responded to the LOOP as required, except the 1B intake cooling water (ICW) pump failed to automatically load onto its respective EDG. Shutdown cooling flow to the "A" train was restored

LER 335/04-004 2

at 0004 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> when the 1A low pressure safety injection (LPSI) pump was restarted on EDG power. The 1B ICW pump was manually started at 0040 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br />.

On Unit 2, all safety systems responded to the LOOP as required, except that the 2A1 EDG fuel day tank solenoid valve failed to open such that the fuel day tank level had to be manually controlled by local operation. At 0245 hours0.00284 days <br />0.0681 hours <br />4.050926e-4 weeks <br />9.32225e-5 months <br />, decay heat removal was transitioned to shutdown cooling when the "A" train of shutdown cooling was placed in service.

The FPL investigation determined that the failure of the 1B ICW pump to automatically load on the EDG was isolated to the control signals to the 4.16kV breaker and not the breaker mechanism itself. Further troubleshooting determined that the most likely cause was the intermittent failure of either the 1B ICW pump control switch or the load-sequencing relay. As a conservative action both the 1B ICW control switch and load-sequencing relay were replaced.

Troubleshooting the 2A EDG fuel day tank fuel solenoid valve determined that the most likely cause was an intermittent failure in the solenoid valve control circuitry of either the RHH1 day tank hi-hi level relay or the "Gems Flip Pack A" solid-state controller. As a conservative action both components were replaced.

Recovery opportunities.

Although no attempt was made to restore offsite power to the startup transformers during the hurricane, if EDG power was lost, offsite power could have been restored through Bay 2.

However, weather conditions did hamper the restoration of offsite power to the units' electrical busses. Therefore, during the hurricane, safe shutdown loads remained connected to the EDGs even after power was capable of being restored to the east electrical switchyard busses because conditions would not allow personnel to safely inspect the switchyard. AC power recovery was feasible during the mission time of interest and credible. It is modeled in the event importance assessment.

Analysis Results Conditional core damage probability (CCDP)

This event is modeled as a loss of AC power event leading to loss of RHR cooling during mode 4 with a 24-hour mission time. The conditional core damage probability of this event is 1.1 E-05 (mean value). The acceptance threshold for the Accident Sequence Precursor Program is a CCDP of $ 1x10-6, therefore this condition is a precursor.

Mean Value Event Importance 1.1E-05 Dominant sequences There are four sequences that contribute 100% to event importance:

LER 335/04-004 3

Sequence CCDP Contribution Event Tree Node Node Description LOOP/SBO 23-30 7.80E-06 71%

EPS Onsite Emergency Power Fails AFW-B AFW fails DGR-01H EDG recovery in 1 hr fails OPR-01H Offsite power recovery in 1 hr fails LOOP 22 1.60E-06 15%

/EPS Onsite Emergency Power is Successful AFW-L AFW fails OTC-L Feed and Bleed fails LOOP/SBO 23-09 1.10E-06 10%

EPS Onsite Emergency Power Fails

/AFW-B AFW is Successful DGR-06H EDG recovery in 6 hrs fails RSUB Reactor cooling subcooling not maintained OPR-06H Offsite power recovery in 6 hrs fails LOOP/SBO 23-27 1.20E-07 1%

EPS Onsite Emergency Power Fails OPR-01H Offsite power recovery in 1 hr fails PORV-B Stuck open PORV/SRV occurs DGR-01H EDG recovery in 1 hr fails Results tables The conditional probabilities of the sequences with the highest CCDPs are shown in Table 1.

The event tree sequence logic for the sequences with the highest CCDPs are provided in Tables 2a and 2b.

The conditional cut sets for the sequences with the highest CCDPs are provided in Table 3.

Definitions and probabilities for modified or dominant basic events are provided in Table 4.

The event tree models which contain the dominant sequences are given as Figures 1 and 2.

Modeling Assumptions Assessment summary This event is modeled as a loss of offsite power initiating event, with its event-specific offsite power recovery distribution.

Modeling assumptions Key modeling assumptions.

S The risk of this event can be estimated by assuming that the success criteria for LOOP event at power operation applies.

LER 335/04-004 4

This assumption has both conservative and non-conservative aspects that are deemed to be balancing from a risk point of view. Namely, a)

Since the units are already shutdown, the decay heat is lower than at power. This gives a larger time window for operator actions, both for starting systems, or recovering power.

b)

Some mitigating safety systems, if needed, may require operator action to start; they may not be available for automatic actuation in mode 4.

One example of this is AFW cooling by SGs for unit 1, if RHR cooling fails during the event.

S For AC recovery time distribution, an event-specific calculation is made using SPAR-H model.

S Credit for crosstie to other unit EDG, which is already modeled in SPAR, is retained.

S It is assumed that unit 1 can go to SG cooling by AFW, if RHR cooling failed.

S Unit 1 SPAR model is used to estimate the event importance.

S The RCS temperature and pressure conditions are such that there is no RCP seal LOCA challenge due to loss of seal cooling.

S A dual unit LOOP occurs. The SPAR model parameters are set to simulate this event S

Other assumptions. Other assumptions that have negligible impact on the results due to relatively low importance include the following:

S Potential number of challenges to pressurizer PORVs/SRVs are considerably lower in mode 4 than in mode 1 operation.

Modifications to fault tree models None Basic event probability changes The basic event probability changes introduced into the model are discussed below.

Operator Fails to Recover Offsite Power (OEP-XHE-XL-NR0--)

For this category 3 hurricane event, an event-specific set of offsite power nonrecovery probabilities are calculated in Appendix A.

Changed to

LER 335/04-004 5

OEP-XHE-XL-NR01H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 1 HR 1.0 OEP-XHE-XL-NR02H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 2 HRS 0.5 OEP-XHE-XL-NR03H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 3 HRS 0.05 OEP-XHE-XL-NR04H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 4 HRS 0.005 OEP-XHE-XL-NR05H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 5 HRS 0.005 OEP-XHE-XL-NR06H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 6 HRS 0.005 OEP-XHE-XL-NR07H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 7 HRS 0.005 OEP-XHE-XL-NR08H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 8 HRS 0.005 Failure of RCP Seals due to loss of cooling (RCS-MDP-LK-SEALS-)

Since the RCP temperature and pressures do not pose RCP seal challenge in mode 4, the following basic events that represent failure of RCP seals due to loss of cooling are assigned zero probability of failure:

Basic Event Base Probability Changed to RCS-MDP-LK-SEALS 7.60E-03 0.00E+00 FALSE RCS-MDP-LK-SEALS01 3.10E-04 0.00E+00 FALSE RCS-MDP-LK-SEALS02 7.60E-04 0.00E+00 FALSE RCS-MDP-LK-SEALS03 2.00E-04 0.00E+00 FALSE RCS-MDP-LK-SEALS04 9.80E-05 0.00E+00 FALSE RCS-MDP-LK-SEALS1 1.20E-01 0.00E+00 FALSE Pressurizer PORV/SRV Opens (PPR-SRV-CO-SBO)

The base case value for this basic event is 0.37. In mode 4, much lower number of potential challenges are expected due to lower RCS pressure/temperature and lower decay heat rates, and absence of reactor trip. Since the probability of this basic event in mode 4 is not studied previously, an order of magnitude reduction is credited and the basic event probability is set equal to 0.037 (rather than zero).

Dual Unit LOOP Occurs.

Three basic event/flag values are changed as follows to simulate the occurrence of a dual-unit LOOP:

HE-DL-LP - Dual unit LOOP flag - set to TRUE.

LOOP-DUAL-UNIT - probability of dual unit LOOP - set to 1.

LOOP-SINGLE-UNIT - probability of single unit LOOP - set to 0.

Sensitivity Analyses An examination of the dominant core damage sequences and cutsets indicate the following potential conservatisms:

1. The first dominant sequence - the classic SBO

• turbine AFW failure sequence appears to be valid and sets a floor of about 8E-6 for the analysis. In this sequence, event specific, rather than generic extreme weather power recovery probabilities are used. These calculations are given in this report.

LER 335/04-004 6

In this dual-unit LOOP event, credit is taken for operators action to cross tie to second units EDGs if both EDGs for a unit fail to start or run, as represented by the basic event EPS-XHE-XM-XTIE.

2. The second dominant sequence is LOOP with failure of AFW and feed & bleed. The dominant loss of AFW event is failure to shift to the other unit's CST. For mode 4 operations, for which no specific PRA model exists, the following considerations may be applicable:

units own CST may be sufficient for success of AFW, because of the pre-hurricane shutdown activities (there may be enough water to cooldown). In the limit, this could eliminate the second dominant sequence, thus providing a 15% reduction.

Shifting to other units CST action may not be available during a 2-unit hurricane LOOP.

On the other hand, the feed and bleed operator action success probability would be more favorable in mode 4 operation due to longer time window available for such an action. Combined with the units own CST being sufficient for success, this may provide a net decrease in sequence importance.

In the same dominant sequence, the success requirement for feed & bleed is 2 PORVs.

That is often regarded as a conservative requirement for a plant that trips at power. If the success criteria were changed to one PORV due to the pre-hurricane shut down, the results would drop slightly, as indicated by the basic event importance results.

Neither of the above considerations are specifically modeled: as mentioned before, the mode 1 success criteria is used. Modeling of the above is not expected to change the general conclusion of the analysis results.

3. Due to pre-hurricane procedures, major safety equipment such as emergency diesels, auxiliary feedwater pumps, etc. will not be placed under elective T&M, and if they happened to be out-of-service, effort will be made to place them in service. This would reduce the average T&M unavailability of such components, but can not make the expected T&M unavailability zero, since not all such activities can be terminated promptly in all cases. Since the composition of T&M unavailabilities for a plant-specific component are not known, no attempt is made to reduce average T&M unavailabilities in this case. An examination of the basic event importances indicate that, the highest T&M contributor is the AFW TDP which, if its average T&M unavailability can be reduced to zero, would reduce the event importance by 22%.

4. To obtain reference points for event importance, the following additional event importances are also calculated:

Given a severe-weather LOOP in mode 1, with no other changes to the plant PRA model except for dual-unit LOOP assumption, the event importance is calculated to be 5 E-05.

Given a extreme-weather LOOP in mode 1, with no other changes to the plant PRA model except for dual-unit LOOP assumption, the event importance is calculated to be 2.3 E-04.

LER 335/04-004 7

Given a LOOP in mode 1 (type not specified, average recoveries in the base model are used as is), with no other changes to the plant PRA model except for dual-unit LOOP assumption, the event importance is calculated to be 4.2 E-05.

Thus the hurricane-dual-LOOP at mode 4 operation with event importance of 1.1E-05 is lower than the above, with the following model revisions credited:

1.

No RCP seal LOCA; 2.

Lesser likelihood of stuck open pressurizer PORV/SRV;

3.

Event-specific offsite power recovery distribution.

References 1.

LER 335/04-004-00 : Dual Unit Loss Of Offsite Power During Hurricance Jeanne, 11/24/ 2004 2.

St. Lucie SPAR Model, zip file STL1_3.12 11,748kB dated 7/22/2005.

LER 335/04-004 8

Table 1.

Importance values of Dominant Sequences Sequence Importance CCDP Contribution LOOP/SBO 23-30 7.8 E-06 71%

LOOP 22 1.6 E-06 15%

LOOP/SBO 23-09 1.1 E-06 10%

LOOP/SBO 23-27 1.2 E-07 1%

Total 1.1 E-05 Total CCDP includes all sequences (including those not shown in this table).

Table 2a. Event tree sequence logic for dominant sequences.

Event Tree Sequence No. Logic ("/" denotes success(1))

LOOP 23-30

/RPS EPS AFW-B OPR-01H DGR-01H LOOP 22

/RPS

/EPS AFW-L OTC-L LOOP 23-09

/RPS EPS

/AFW-B

/PORV-B

/CBO RSUB

/RCPSI02 OPR-06H DGR-06H LOOP 23-27

/RPS EPS

/AFW-B PORV-B OPR-01H DGR-01H

1. / denotes success; see Table 2B for top event names.

LER 335/04-004 9

Table 2b. Definitions of top events listed in Table 2a.

Fault Tree Name Description AFW-B AUXILIARY FEEDWATER SYSTEM-SBO AFW-L AUXILIARY FEEDWATER CBO CONTROLLED BLEEDOFF ISOLATED DGR-01H DIESEL GENERATOR RECOVERY IN 1 HOUR DGR-06H DIESEL GENERATOR RECOVERY IN 6 HOURS EPS EMERGENCY POWER OPR-01H OFFSITE POWER RECOVERY IN 1 HOUR OPR-06H OFFSITE POWER RECOVERY IN 6 HRS OTC-L ONCE THROUGH COOLING-LOOP PORV-B PORVs ARE CLOSED-SBO RCPSI02 RCP SEAL INTEGRITY MAINTAINED RPS REACTOR PROTECTION SYSTEM RSUB REACTOR COOLANT SUBCOOLING MAINTAINED

LER 335/04-004 10 Table 3. Conditional cut sets for two dominant sequences.

1. Total importance includes all cutsets (including those not shown in this table).

Event Tree: LOOP CCDP: 7.8E-006 Sequence: 23-30 CCDP % Cut Set Cut Set Events 8.4E-007 10.82 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FS-1C EPS-DGN-CF-R1AB2A 8.4E-007 10.82 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FS-1C EPS-DGN-CF-R1AB2B 7.0E-007 9.01 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-TM-1C EPS-DGN-CF-R1AB2A 7.0E-007 9.01 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-TM-1C EPS-DGN-CF-R1AB2B 5.8E-007 7.47 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FR-1C EPS-DGN-CF-R1AB2A 5.8E-007 7.47 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FR-1C EPS-DGN-CF-R1AB2B 2.5E-007 3.20 EPS-XHE-XL-NR01H EPS-DGN-CF-RUN12 LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FS-1C 2.1E-007 2.67 EPS-XHE-XL-NR01H EPS-DGN-CF-RUN12 LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-TM-1C 1.7E-007 2.21 EPS-XHE-XL-NR01H EPS-DGN-CF-RUN12 LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FR-1C 1.2E-007 1.52 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FS-1C EPS-DGN-CF-RUN1 EPS-XHE-XM-XTIE1 9.9E-008 1.26 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-TM-1C EPS-DGN-CF-RUN1 EPS-XHE-XM-XTIE1 9.7E-008 1.24 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FS-1C EPS-DGN-CF-S1AB2B 9.7E-008 1.24 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FS-1C EPS-DGN-CF-S1AB2A 9.1E-008 1.16 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FS-1C EPS-DGN-FR-DG1A EPS-DGN-FR-DG1B EPS-XHE-XM-XTIE1 8.2E-008 1.05 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FR-1C EPS-DGN-CF-RUN1 EPS-XHE-XM-XTIE1 8.1E-008 1.03 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-TM-1C EPS-DGN-CF-S1AB2B 8.1E-008 1.03 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-TM-1C EPS-DGN-CF-S1AB2A

LER 335/04-004 11 Event Tree: LOOP CCDP: 1.6E-006 Sequence: 22 CCDP % Cut Set Cut Set Events 1.3E-007 7.73 AFW-MOV-CF-SGS HPI-XHE-XM-FB 1.1E-007 6.84 HPI-XHE-XM-FB AFW-CKV-CF-SUCT 1.1E-007 6.84 HPI-XHE-XM-FB AFW-CKV-CF-SGS 9.6E-008 5.95 AFW-TNK-FC-CST HPI-XHE-XM-FB 2.7E-008 1.68 HPI-XHE-XM-FB AFW-CKV-CF-PMPS 2.7E-008 1.64 AFW-PMP-CF-ALL HPI-XHE-XM-FB 2.5E-008 1.58 LOOP-DUAL-UNIT AFW-MDP-TM-1A AFW-TDP-FS-1C EPS-DGN-FR-DG1B EPS-XHE-XM-XTIE1 2.5E-008 1.58 LOOP-DUAL-UNIT AFW-MDP-TM-1B AFW-TDP-FS-1C EPS-DGN-FR-DG1A EPS-XHE-XM-XTIE1 2.4E-008 1.49 AFW-CKV-CC-12176 HPI-XHE-XM-FB AFW-TDP-FS-1C 2.0E-008 1.24 AFW-CKV-CC-12176 HPI-XHE-XM-FB AFW-TDP-TM-1C 1.9E-008 1.18 HPI-XHE-XM-FB AFW-TDP-FS-1C AFW-MDP-CF-STRT 1.8E-008 1.09 LOOP-DUAL-UNIT AFW-MDP-TM-1A AFW-TDP-FR-1C EPS-DGN-FR-DG1B EPS-XHE-XM-XTIE1 1.8E-008 1.09 LOOP-DUAL-UNIT AFW-MDP-TM-1B AFW-TDP-FR-1C EPS-DGN-FR-DG1A EPS-XHE-XM-XTIE1 1.7E-008 1.03 AFW-CKV-CC-12176 HPI-XHE-XM-FB AFW-TDP-FR-1C

LER 335/04-004 12 Table 4. Definitions and probabilities of Basic Events in Dominant Cutsets Event Name Description Curr Prob Curr Prob AFW-CKV-CC-12176 MOTOR-DRIVEN PUMP COMMON SUCTION CKV 12176 1.00E-04 the same AFW-CKV-CF-PMPS COMMON CAUSE FAILURE OF AFW PUMP CKVS 9107/91 6.80E-07 the same AFW-CKV-CF-SGS COMMON CAUSE FAILURE OF SG CKVS 9252/9294 2.80E-06 the same AFW-CKV-CF-SUCT CCF OF AFW PUMP SUCTION CKVS 12174/12176 2.80E-06 the same AFW-MDP-CF-STRT COMMON CAUSE FAILURE OF AFW MDPS TO START 7.90E-05 the same AFW-MDP-TM-1A AFW MDP 1A UNAVAILABLE DUE TO TEST AND MAINTE 5.00E-03 the same AFW-MDP-TM-1B AFW MDP 1B UNAVAILABLE DUE TO TEST AND MAINTE 5.00E-03 the same AFW-MOV-CF-SGS CCF OF ALL AFW DISCHARGE MOVS 09-09/10/11/12 3.10E-06 the same AFW-PMP-CF-ALL COMMON CAUSE FAILURE OF AFW PUMPS 6.60E-07 the same AFW-TDP-FR-1C AFW TDP 1C FAILS TO RUN 4.10E-03 the same AFW-TDP-FS-1C AFW TDP 1C FAILS TO START 6.00E-03 the same AFW-TDP-TM-1C AFW TDP UNAVAILABLE DUE TO T&M 5.00E-03 the same AFW-TNK-FC-CST AFW CONDENSATE STORAGE TANK FAILURES 2.40E-06 the same EPS-DGN-CF-R1AB2A CCF OF UNIT 1 DGS AND UNIT 2 A DG TO RUN 1.70E-04 the same EPS-DGN-CF-R1AB2B CCF OF UNIT 1 DGS AND UNIT 2 B DG TO RUN 1.70E-04 the same EPS-DGN-CF-RUN1 COMMON CAUSE FAILURE OF UNIT 1 DGS TO RUN 5.90E-04 the same EPS-DGN-CF-RUN12 COMMON CAUSE FAILURE OF UNIT 1 & 2 DGS TO RUN 4.90E-05 the same EPS-DGN-CF-S1AB2A CCF OF UNIT 1 DGS AND UNIT 2 A DG TO START 1.90E-05 the same EPS-DGN-CF-S1AB2B CCF OF UNIT 1 DGS AND UNIT 2 B DG TO START 1.90E-05 the same EPS-DGN-FR-DG1A DIESEL GENERATOR 1A FAILS TO RUN 2.10E-02 the same EPS-DGN-FR-DG1B DIESEL GENERATOR 1B FAILS TO RUN 2.10E-02 the same EPS-DGN-FR-DG2A DIESEL GENERATOR 2A FAILS TO RUN 2.10E-02 the same EPS-DGN-FR-DG2B DIESEL GENERATOR 2B FAILS TO RUN 2.10E-02 the same EPS-DGN-TM-DG1A DIESEL GENERATOR 1A UNAVAILABLE DUE TO TEST A 9.00E-03 the same EPS-DGN-TM-DG1B DIESEL GENERATOR 1B UNAVAILABLE DUE TO TEST A 9.00E-03 the same EPS-XHE-XL-NR01H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 1 HR 8.40E-01 the same EPS-XHE-XL-NR06H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 6 HRS 3.50E-01 the same EPS-XHE-XM-XTIE1 OPERATOR FAILS TO ALIGN OPPOSITE UNIT DGS 4.00E-02 the same HPI-XHE-XM-FB OPERATOR FAILS TO INITIATE FEED AND BLEED COOLING 4.00E-02 the same LOOP-DUAL-UNIT DUAL UNIT LOOP TO SWING ONE UNIT 2 DGS 5.00E-01 1.00E+00 OEP-XHE-XL-NR01H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 1 5.30E-01 1.00E+00 OEP-XHE-XL-NR06H OPERATOR FAILS TO RECOVER OFFSITE 1.57E-01 5.00E-03

LER 335/04-004 13 POWER IN 6 PPR-SRV-CO-SBO PORVS/SRVS OPEN DURING SBO 3.70E-01 3.70E-02 PPR-SRV-OO-1402 PORV 1402 FAILS TO RECLOSE AFTER OPENING 3.00E-03 the same PPR-SRV-OO-1404 PORV 1404 FAILS TO RECLOSE AFTER OPENING 3.00E-03 the same 1.

Those basic events showing up in the cutsets of Table 3 are shown.

2.

Modified basic event probabilities are discussed in the main body of the report under Basic event probability changes.

LER 335/04-004 14 HPR HIGH P RE SSURE RECIRCULATION CSR CONTAINME NT COOLING SDC SHUTDOWN COOLING SS C SE CONDAR Y SIDE COOLDOWN S SCR S ECONDAR Y COOLING RECOVE RE D OPR-06H OFFS ITE POWE R RE COV ERY IN 6 HRS OPR-02 H OFFS ITE POW ER RE COV ERY IN 2 HRS OTC ONCE THROUGH COOLING HPI HIGH P RE SSURE INJECTION LOSC RCP SE AL COOLING MAINTA INED PORV PORVs AR E CLOSE D AFW AUXILIA RY FEE DW ATER E PS E MERGENCY P OWER RP S RE ACTOR TRIP IE -LOOP LOS S OF OFFSITE POW ER END-S TA TE FRE QUENCY 1

OK 2

T LOOP-1 3

OK 4

OK 5

CD 6

CD 7

OK 8

CD 9

CD 10 OK 11 CD 12 CD 13 CD 14 OK 15 OK 16 CD 17 CD 18 OK 19 OK 20 CD 21 CD 22 CD 23 T

SBO 24 T

ATWS HPI-L HP R-L CSR-L HP R-L CSR-L OTC-L A FW -L PORV-L LOS C-L S SCR-L LOOP - St. Lucie 1 PWR G loss of offsite power 2005/02/03 Figure 1 LOOP Event Tree

LER 335/04-004 15 DGR-06H DIESEL GENERATOR RECOVERY IN 6 HOURS OPR-06H OFFSITE POWER RECOVERY IN 6 HRS RCPSI RCP SEAL INTEGRITY MAINTAINED RSUB REACTOR COOLANT SUBCOOLING MAINTAINED CBO CONTROLLED BLEEDOFF ISOLATED PORV PORVs ARE CLOSED AFW AUXILIARY FEEDWATER SYSTEM EPS EMERGENCY POWER END-STATE NOTES 1

OK 2

OK 3

CD 4

T SBO-1 5

OK 6

CD 7

OK 8

OK 9

CD 10 T

SBO-1 11 OK 12 CD 13 OK 14 OK 15 CD 16 T

SBO-1 17 OK 18 CD 19 OK 20 OK 21 CD 22 T

SBO-1 23 OK 24 CD 25 T

SBO-1 26 OK 27 CD 28 T

SBO-2 29 OK 30 CD RCPSI01 RCPSI02 RCPSI03 RCPSI04 OPR-01H OPR-01H OPR-01H OPR-01H OPR-01H OPR-01H DGR-01H DGR-01H DGR-01H DGR-01H AFW-B PORV-B DGR-01H DGR-01H SBO - St. Lucie 1 PWR G station blackout 2005/01/19 Figure 2 SBO Event Tree

LER 335/04-004 16 APPENDIX A Calculation of AC Power Recovery Failure Distribution In this appendix, the failure of AC power recovery (offsite power) is calculated for this category 3 hurricane. During the event, the offsite power to Midway 2 line was restored within minutes. However, weather conditions did hamper the restoration of offsite power to the units electrical buses.....Therefore, during the hurricane, safe shutdown loads remained connected to the EDGs even after power was capable of being restored to the east electrical buses because conditions would not allow personnel to safely inspect the switchyard. If EDG power was lost, offsite power could have been restored through Bay 2.

No immediate corrective action related to salt contamination was required since the post-storm testing demonstrated that the switchyard insulation was clean. The power was restored to the emergency buses in 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br />.

If the weather conditions allowed, the switchyard inspection could have been performed and the means of restoration could be identified and implemented. This operator action is diagnosis driven; once the diagnosis (e.g. switchyard inspection) is performed, failure of the action is less likely. Thus, the HEP is modeled as diagnosis driven.

Since the LER indicates that the conditions would not allow personnel to safely inspect the switchyard, no recovery credit is given for the first hour. For the second hour, the conditions are still taken to be uncertain, and only a 50% chance of recovery is assigned.

For the third and remaining hours, the HEP is calculated by using SPAR-H method as follows.

For the third hour, extreme stress and poor man-machine interactions due to the diagnosis (switchyard inspection) being outdoors in high winds and night time is postulated.

Availability of extra time of 30-60 minutes is allowed. The PSF multipliers for these three factors are 5, 10, and 0.1, respectively. Thus the HEP for the third hour is calculated as 0.05.

For the fourth hour, availability of more than 60 minutes for the diagnosis is postulated.

This lowers the HEP to 0.005.

Since the fourth hour HEP is at the order of 10E-03, it is low enough for action phase failures to start weighing in. The HEP of 0.005 is used for the subsequent hours to cover all modes of human error, without further calculations.

The resulting HEPs used in the current case are summarized below. The severe weather average from the SPAR model is also provided as a comparison.

Severe Weather Current Event Average OEP-XHE-XL-NR01H 4.6E-001

1.

OEP-XHE-XL-NR02H 3.6E-001 0.5 OEP-XHE-XL-NR03H 3.0E-001 0.05 OEP-XHE-XL-NR04H 2.5E-001 0.005 OEP-XHE-XL-NR05H 2.2E-001 0.005 OEP-XHE-XL-NR06H 2.0E-001 0.005 OEP-XHE-XL-NR07H 1.8E-001 0.005

LER 335/04-004 17 OEP-XHE-XL-NR08H 1.6E-001 0.005

LER 335/04-004 18 Appendix B GEM Output I N I T I A T I N G E V E N T A S S E S S M E N T Code Ver : 7:25 Fam : STL1_3 Model Ver : 2005/03/31 User : Init Event: IE-LOOP Ev ID: LOOP-HURRICANE-ASP-DUAL Total CCDP: 1.1E-005 Desc : Initiating Event Assessment - LOOP during Hurricane - units in mode 4 ope ration BASIC EVENT CHANGES Event Name Description Base Prob Curr Prob Type HE-DL-LP DUAL UNIT LOOP HOUSE EVENT +0.0E+000 1.0E+000 TRUE IE-ISL-HPI ISLOCA IE 2-CKV HPI interfac 5.2E-006 +0.0E+000 IE-ISL-LPI ISLOCA IE 2-CKV LPI interfac 5.2E-006 +0.0E+000 IE-ISL-SDC ISLOCA IE 2-MOV SDC interfac 2.9E-006 +0.0E+000 IE-LDC1A LOSS OF DC BUS 1A 1.3E-003 +0.0E+000 IE-LDC1B LOSS OF DC BUS 1B 1.3E-003 +0.0E+000 IE-LLOCA LARGE PIPE BREAK LOCA 5.0E-006 +0.0E+000 IE-LOCCW LOSS OF COMPONENT COOLING 2.0E-004 +0.0E+000 IE-LOCHS LOSS OF CONDENSER HEAT SI 9.0E-002 +0.0E+000 IE-LOIA LOSS OF INSTRUMENT AIR 8.0E-003 +0.0E+000 IE-LOICW LOSS OF INTAKE COOLING WATE 4.0E-004 +0.0E+000 IE-LOMFW LOSS OF MFW TRANSIENT 1.0E-001 +0.0E+000 IE-LOOP LOSS OF OFFSITE POWER 3.3E-002 1.0E+000 IE-MLOCA MEDIUM LOCA INITIATOR 4.0E-005 +0.0E+000 IE-RXVRUPT Reactor Vessel Rupture Ini 1.0E-007 +0.0E+000 IE-SGTR SG TUBE RUPTURE 4.0E-003 +0.0E+000 IE-SLOCA SMALL LOCA INITIATOR 4.0E-004 +0.0E+000 IE-TRANS TRANSIENT 7.0E-001 +0.0E+000 LOOP-DUAL-UNIT DUEAL UNIT LOOP TO SWING ONE 5.0E-001 1.0E+000 LOOP-SINGLE-UNIT SINGLE UNIT LOOP TO SWING BO 5.0E-001 +0.0E+000 OEP-XHE-XL-NR01H OPERATOR FAILS TO RECOVER OF 5.3E-001 1.0E+000 OEP-XHE-XL-NR02H OPERATOR FAILS TO RECOVER OF 3.7E-001 5.0E-001 OEP-XHE-XL-NR03H OPERATOR FAILS TO RECOVER OF 2.8E-001 5.0E-002 OEP-XHE-XL-NR04H OPERATOR FAILS TO RECOVER OF 2.2E-001 5.0E-003 OEP-XHE-XL-NR05H OPERATOR FAILS TO RECOVER OF 1.9E-001 5.0E-003 OEP-XHE-XL-NR06H OPERATOR FAILS TO RECOVER OF 1.6E-001 5.0E-003 OEP-XHE-XL-NR07H OPERATOR FAILS TO RECOVER OF 1.4E-001 5.0E-003 OEP-XHE-XL-NR08H OPERATOR FAILS TO RECOVER OF 1.2E-001 5.0E-003 OEP-XHE-XL-NR09H OPERATOR FAILS TO RECOVER OF 1.1E-001 5.0E-003 OEP-XHE-XL-NR10H OPERATOR FAILS TO RECOVER OF 1.0E-001 5.0E-003 OEP-XHE-XL-NR10H2 OPERATOR FAILS TO RECOVER OF 2.7E-001 5.0E-003 OEP-XHE-XL-NR10H4 OPERATOR FAILS TO RECOVER OF 4.5E-001 5.0E-003 OEP-XHE-XL-NR11H OPERATOR FAILS TO RECOVER OF 9.5E-002 5.0E-003 OEP-XHE-XL-NR12H OPERATOR FAILS TO RECOVER OF 8.9E-002 5.0E-003 OEP-XHE-XL-NR13H OPERATOR FAILS TO RECOVER OF 8.5E-002 5.0E-003 OEP-XHE-XL-NR14H OPERATOR FAILS TO RECOVER OF 8.2E-002 5.0E-003 OEP-XHE-XL-NR15H OPERATOR FAILS TO RECOVER OF 7.9E-002 5.0E-003 OEP-XHE-XL-NR16H OPERATOR FAILS TO RECOVER OF 7.6E-002 5.0E-003 OEP-XHE-XL-NR17H OPERATOR FAILS TO RECOVER OF 7.4E-002 5.0E-003 OEP-XHE-XL-NR18H OPERATOR FAILS TO RECOVER OF 7.2E-002 5.0E-003 2005/07/25 15:41:24 page 1

LER 335/04-004 19 OEP-XHE-XL-NR19H OPERATOR FAILS TO RECOVER OF 7.1E-002 5.0E-003 OEP-XHE-XL-NR20H OPERATOR FAILS TO RECOVER OF 6.9E-002 5.0E-003 OEP-XHE-XL-NR21H OPERATOR FAILS TO RECOVER OF 6.8E-002 5.0E-003 OEP-XHE-XL-NR22H OPERATOR FAILS TO RECOVER OF 6.7E-002 5.0E-003 OEP-XHE-XL-NR23H OPERATOR FAILS TO RECOVER OF 6.6E-002 5.0E-003 OEP-XHE-XL-NR24H OPERATOR FAILS TO RECOVER OF 6.5E-002 5.0E-003 OEP-XHE-XL-NR30M OPERATOR FAILS TO RECOVER OF 6.6E-001 1.0E+000 OEP-XHE-XL-NR90M OPERATOR FAILS TO RECOVER OF 4.4E-001 5.0E-001 PPR-SRV-CO-SBO PORVs/SRVs OPEN DURING SBO 3.7E-001 3.7E-002 RCS-MDP-LK-SEALS03 RCP SEALS FAIL W/O COOLING A 2.0E-004 +0.0E+000 FALSE RCS-MDP-LK-SEALS04 RCP SEALS FAIL W/O COOLING A 9.8E-005 +0.0E+000 FALSE RCS-MDP-LK-SEALS RCP SEALS FAIL W/O COOLING A 7.6E-003 +0.0E+000 FALSE RCS-MDP-LK-SEALS02 RCP SEALS FAIL W/O COOLING A 7.6E-004 +0.0E+000 FALSE RCS-MDP-LK-SEALS01 RCP SEALS FAIL W/O COOLING A 3.1E-004 +0.0E+000 FALSE ZV-LOOP-EW-LAMBDA EXTREME WEATHER RELATED LOSS 2.3E-003 1.0E+000 ZV-LOOP-GR-LAMBDA GRID RELATED LOSS OF OFFSITE 1.7E-002 +0.0E+000 ZV-LOOP-PC-LAMBDA PLANT CENTERED LOSS OF OFFSI 2.4E-003 +0.0E+000 ZV-LOOP-SC-LAMBDA SWITCHYARD CENTERED LOSS OF 8.7E-003 +0.0E+000 ZV-LOOP-SW-LAMBDA SEVERE WEATHER RELATED LOSS 3.0E-003 +0.0E+000 SEQUENCE PROBABILITIES Truncation : Cummulative : 100.0% Individual : 1.0%

Event Tree Name Sequence Name CCDP %Cont LOOP 23-30 7.8E-006 LOOP 22 1.6E-006 LOOP 23-09 1.1E-006 LOOP 23-27 1.2E-007 SEQUENCE LOGIC Event Tree Sequence Name Logic LOOP 23-30 /RPS EPS AFW-B OPR-01H DGR-01H LOOP 22 /RPS /EPS AFW-L OTC-L LOOP 23-09 /RPS EPS

/AFW-B /PORV-B

/CBO RSUB

/RCPSI02 OPR-06H DGR-06H LOOP 23-27 /RPS EPS

/AFW-B PORV-B OPR-01H DGR-01H 2005/07/25 15:41:24 page 2

LER 335/04-004 20 Fault Tree Name Description AFW-B AUXILIARY FEEDWATER SYSTEM-SBO AFW-L AUXILIARY FEEDWATER CBO CONTROLLED BLEEDOFF ISOLATED DGR-01H DIESEL GENERATOR RECOVERY IN 1 HOUR DGR-06H DIESEL GENERATOR RECOVERY IN 6 HOURS EPS EMERGENCY POWER OPR-01H OFFSITE POWER RECOVERY IN 1 HOUR OPR-06H OFFSITE POWER RECOVERY IN 6 HRS OTC-L ONCE THROUGH COOLING-LOOP PORV-B PORVs ARE CLOSED-SBO RCPSI02 RCP SEAL INTEGRITY MAINTAINED RPS REACTOR PROTECTION SYSTEM RSUB REACTOR COOLANT SUBCOOLING MAINTAINED SEQUENCE CUT SETS Truncation: Cummulative: 100.0% Individual: 1.0%

Event Tree: LOOP CCDP: 7.8E-006 Sequence: 23-30 CCDP % Cut Set Cut Set Events 8.4E-007 10.82 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FS-1C EPS-DGN-CF-R1AB2A 8.4E-007 10.82 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FS-1C EPS-DGN-CF-R1AB2B 7.0E-007 9.01 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-TM-1C EPS-DGN-CF-R1AB2A 7.0E-007 9.01 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-TM-1C EPS-DGN-CF-R1AB2B 5.8E-007 7.47 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FR-1C EPS-DGN-CF-R1AB2A 5.8E-007 7.47 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FR-1C EPS-DGN-CF-R1AB2B 2.5E-007 3.20 EPS-XHE-XL-NR01H EPS-DGN-CF-RUN12 LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FS-1C 2.1E-007 2.67 EPS-XHE-XL-NR01H EPS-DGN-CF-RUN12 LOOP-DUAL-UNIT OEP-XHE-XL-NR01H 2005/07/25 15:41:24 page 3

LER 335/04-004 21 AFW-TDP-TM-1C 1.7E-007 2.21 EPS-XHE-XL-NR01H EPS-DGN-CF-RUN12 LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FR-1C 1.2E-007 1.52 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FS-1C EPS-DGN-CF-RUN1 EPS-XHE-XM-XTIE1 9.9E-008 1.26 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-TM-1C EPS-DGN-CF-RUN1 EPS-XHE-XM-XTIE1 9.7E-008 1.24 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FS-1C EPS-DGN-CF-S1AB2B 9.7E-008 1.24 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FS-1C EPS-DGN-CF-S1AB2A 9.1E-008 1.16 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FS-1C EPS-DGN-FR-DG1A EPS-DGN-FR-DG1B EPS-XHE-XM-XTIE1 8.2E-008 1.05 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-FR-1C EPS-DGN-CF-RUN1 EPS-XHE-XM-XTIE1 8.1E-008 1.03 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-TM-1C EPS-DGN-CF-S1AB2B 8.1E-008 1.03 EPS-XHE-XL-NR01H LOOP-DUAL-UNIT OEP-XHE-XL-NR01H AFW-TDP-TM-1C EPS-DGN-CF-S1AB2A Event Tree: LOOP CCDP: 1.6E-006 Sequence: 22 CCDP % Cut Set Cut Set Events 1.3E-007 7.73 AFW-MOV-CF-SGS HPI-XHE-XM-FB 1.1E-007 6.84 HPI-XHE-XM-FB AFW-CKV-CF-SUCT 1.1E-007 6.84 HPI-XHE-XM-FB AFW-CKV-CF-SGS 9.6E-008 5.95 AFW-TNK-FC-CST HPI-XHE-XM-FB 2.7E-008 1.68 HPI-XHE-XM-FB AFW-CKV-CF-PMPS 2.7E-008 1.64 AFW-PMP-CF-ALL HPI-XHE-XM-FB 2.5E-008 1.58 LOOP-DUAL-UNIT AFW-MDP-TM-1A AFW-TDP-FS-1C EPS-DGN-FR-DG1B EPS-XHE-XM-XTIE1 2.5E-008 1.58 LOOP-DUAL-UNIT AFW-MDP-TM-1B AFW-TDP-FS-1C EPS-DGN-FR-DG1A EPS-XHE-XM-XTIE1 2.4E-008 1.49 AFW-CKV-CC-12176 HPI-XHE-XM-FB AFW-TDP-FS-1C 2.0E-008 1.24 AFW-CKV-CC-12176 HPI-XHE-XM-FB AFW-TDP-TM-1C 1.9E-008 1.18 HPI-XHE-XM-FB AFW-TDP-FS-1C 2005/07/25 15:41:24 page 4

LER 335/04-004 22 AFW-MDP-CF-STRT 1.8E-008 1.09 LOOP-DUAL-UNIT AFW-MDP-TM-1A AFW-TDP-FR-1C EPS-DGN-FR-DG1B EPS-XHE-XM-XTIE1 1.8E-008 1.09 LOOP-DUAL-UNIT AFW-MDP-TM-1B AFW-TDP-FR-1C EPS-DGN-FR-DG1A EPS-XHE-XM-XTIE1 1.7E-008 1.03 AFW-CKV-CC-12176 HPI-XHE-XM-FB AFW-TDP-FR-1C Event Tree: LOOP CCDP: 1.1E-006 Sequence: 23-09 CCDP % Cut Set Cut Set Events 3.0E-007 27.01 EPS-XHE-XL-NR06H LOOP-DUAL-UNIT OEP-XHE-XL-NR06H EPS-DGN-CF-R1AB2B 3.0E-007 27.01 EPS-XHE-XL-NR06H LOOP-DUAL-UNIT OEP-XHE-XL-NR06H EPS-DGN-CF-R1AB2A 8.8E-008 7.99 EPS-XHE-XL-NR06H EPS-DGN-CF-RUN12 LOOP-DUAL-UNIT OEP-XHE-XL-NR06H 4.2E-008 3.79 EPS-XHE-XL-NR06H LOOP-DUAL-UNIT OEP-XHE-XL-NR06H EPS-DGN-CF-RUN1 EPS-XHE-XM-XTIE1 3.4E-008 3.10 EPS-XHE-XL-NR06H LOOP-DUAL-UNIT OEP-XHE-XL-NR06H EPS-DGN-CF-S1AB2B 3.4E-008 3.10 EPS-XHE-XL-NR06H LOOP-DUAL-UNIT OEP-XHE-XL-NR06H EPS-DGN-CF-S1AB2A 3.2E-008 2.90 EPS-XHE-XL-NR06H LOOP-DUAL-UNIT OEP-XHE-XL-NR06H EPS-DGN-FR-DG1A EPS-DGN-FR-DG1B EPS-XHE-XM-XTIE1 2.2E-008 2.01 EPS-XHE-XL-NR06H EPS-DGN-FR-DG2B LOOP-DUAL-UNIT OEP-XHE-XL-NR06H EPS-DGN-CF-RUN1 2.2E-008 2.01 EPS-XHE-XL-NR06H EPS-DGN-FR-DG2A LOOP-DUAL-UNIT OEP-XHE-XL-NR06H EPS-DGN-CF-RUN1 1.7E-008 1.53 EPS-XHE-XL-NR06H EPS-DGN-FR-DG2B LOOP-DUAL-UNIT OEP-XHE-XL-NR06H EPS-DGN-FR-DG1A EPS-DGN-FR-DG1B 1.7E-008 1.53 EPS-XHE-XL-NR06H EPS-DGN-FR-DG2A LOOP-DUAL-UNIT OEP-XHE-XL-NR06H EPS-DGN-FR-DG1A EPS-DGN-FR-DG1B 1.4E-008 1.23 EPS-XHE-XL-NR06H LOOP-DUAL-UNIT OEP-XHE-XL-NR06H EPS-DGN-FR-DG1B EPS-DGN-TM-DG1A EPS-XHE-XM-XTIE1 1.4E-008 1.23 EPS-XHE-XL-NR06H LOOP-DUAL-UNIT OEP-XHE-XL-NR06H EPS-DGN-FR-DG1A EPS-DGN-TM-DG1B EPS-XHE-XM-XTIE1 2005/07/25 15:41:24 page 5

LER 335/04-004 23 Event Tree: LOOP CCDP: 1.2E-007 Sequence: 23-27 CCDP % Cut Set Cut Set Events 1.6E-008 13.51 EPS-XHE-XL-NR01H PPR-SRV-OO-1402 PPR-SRV-CO-SBO LOOP-DUAL-UNIT OEP-XHE-XL-NR01H EPS-DGN-CF-R1AB2A 1.6E-008 13.51 EPS-XHE-XL-NR01H PPR-SRV-OO-1404 PPR-SRV-CO-SBO LOOP-DUAL-UNIT OEP-XHE-XL-NR01H EPS-DGN-CF-R1AB2B 1.6E-008 13.51 EPS-XHE-XL-NR01H PPR-SRV-OO-1402 PPR-SRV-CO-SBO LOOP-DUAL-UNIT OEP-XHE-XL-NR01H EPS-DGN-CF-R1AB2B 1.6E-008 13.51 EPS-XHE-XL-NR01H PPR-SRV-OO-1404 PPR-SRV-CO-SBO LOOP-DUAL-UNIT OEP-XHE-XL-NR01H EPS-DGN-CF-R1AB2A 4.6E-009 3.99 EPS-XHE-XL-NR01H PPR-SRV-OO-1402 EPS-DGN-CF-RUN12 PPR-SRV-CO-SBO LOOP-DUAL-UNIT OEP-XHE-XL-NR01H 4.6E-009 3.99 EPS-XHE-XL-NR01H PPR-SRV-OO-1404 EPS-DGN-CF-RUN12 PPR-SRV-CO-SBO LOOP-DUAL-UNIT OEP-XHE-XL-NR01H 2.2E-009 1.90 EPS-XHE-XL-NR01H PPR-SRV-OO-1404 PPR-SRV-CO-SBO LOOP-DUAL-UNIT OEP-XHE-XL-NR01H EPS-DGN-CF-RUN1 EPS-XHE-XM-XTIE1 2.2E-009 1.90 EPS-XHE-XL-NR01H PPR-SRV-OO-1402 PPR-SRV-CO-SBO LOOP-DUAL-UNIT OEP-XHE-XL-NR01H EPS-DGN-CF-RUN1 EPS-XHE-XM-XTIE1 1.8E-009 1.55 EPS-XHE-XL-NR01H PPR-SRV-OO-1402 PPR-SRV-CO-SBO LOOP-DUAL-UNIT OEP-XHE-XL-NR01H EPS-DGN-CF-S1AB2A 1.8E-009 1.55 EPS-XHE-XL-NR01H PPR-SRV-OO-1404 PPR-SRV-CO-SBO LOOP-DUAL-UNIT OEP-XHE-XL-NR01H EPS-DGN-CF-S1AB2B 1.8E-009 1.55 EPS-XHE-XL-NR01H PPR-SRV-OO-1402 PPR-SRV-CO-SBO LOOP-DUAL-UNIT OEP-XHE-XL-NR01H EPS-DGN-CF-S1AB2B 1.8E-009 1.55 EPS-XHE-XL-NR01H PPR-SRV-OO-1404 PPR-SRV-CO-SBO LOOP-DUAL-UNIT OEP-XHE-XL-NR01H EPS-DGN-CF-S1AB2A 1.7E-009 1.45 EPS-XHE-XL-NR01H PPR-SRV-OO-1402 PPR-SRV-CO-SBO LOOP-DUAL-UNIT OEP-XHE-XL-NR01H EPS-DGN-FR-DG1A EPS-DGN-FR-DG1B EPS-XHE-XM-XTIE1 1.7E-009 1.45 EPS-XHE-XL-NR01H PPR-SRV-OO-1404 PPR-SRV-CO-SBO LOOP-DUAL-UNIT OEP-XHE-XL-NR01H EPS-DGN-FR-DG1A EPS-DGN-FR-DG1B EPS-XHE-XM-XTIE1 2005/07/25 15:41:24 page 6

LER 335/04-004 24 1.2E-009 1.00 EPS-XHE-XL-NR01H PPR-SRV-OO-1404 PPR-SRV-CO-SBO EPS-DGN-FR-DG2B LOOP-DUAL-UNIT OEP-XHE-XL-NR01H EPS-DGN-CF-RUN1 1.2E-009 1.00 EPS-XHE-XL-NR01H PPR-SRV-OO-1404 PPR-SRV-CO-SBO EPS-DGN-FR-DG2A LOOP-DUAL-UNIT OEP-XHE-XL-NR01H EPS-DGN-CF-RUN1 1.2E-009 1.00 EPS-XHE-XL-NR01H PPR-SRV-OO-1402 PPR-SRV-CO-SBO EPS-DGN-FR-DG2A LOOP-DUAL-UNIT OEP-XHE-XL-NR01H EPS-DGN-CF-RUN1 1.2E-009 1.00 EPS-XHE-XL-NR01H PPR-SRV-OO-1402 PPR-SRV-CO-SBO EPS-DGN-FR-DG2B LOOP-DUAL-UNIT OEP-XHE-XL-NR01H EPS-DGN-CF-RUN1 BASIC EVENTS (Cut Sets Only)

Event Name Description Curr Prob AFW-CKV-CC-12176 MOTOR-DRIVEN PUMP COMMON SUCTION CKV 12176 1.0E-004 AFW-CKV-CF-PMPS COMMON CAUSE FAILURE OF AFW PUMP CKVS 9107/91 6.8E-007 AFW-CKV-CF-SGS COMMON CAUSE FAILURE OF SG CKVS 9252/9294 2.8E-006 AFW-CKV-CF-SUCT CCF OF AFW PUMP SUCTION CKVS 12174/12176 2.8E-006 AFW-MDP-CF-STRT COMMON CAUSE FAILURE OF AFW MDPS TO START 7.9E-005 AFW-MDP-TM-1A AFW MDP 1A UNAVAILABLE DUE TO TEST AND MAINT. 5.0E-003 AFW-MDP-TM-1B AFW MDP 1B UNAVAILABLE DUE TO TEST AND MAINT. 5.0E-003 AFW-MOV-CF-SGS CCF OF ALL AFW DISCHARGE MOVS 09-09/10/11/12 3.1E-006 AFW-PMP-CF-ALL COMMON CAUSE FAILURE OF AFW PUMPS 6.6E-007 AFW-TDP-FR-1C AFW TDP 1C FAILS TO RUN 4.1E-003 AFW-TDP-FS-1C AFW TDP 1C FAILS TO START 6.0E-003 AFW-TDP-TM-1C AFW TDP UNAVAILABLE DUE TO T&M 5.0E-003 AFW-TNK-FC-CST AFW CONDENSATE STORAGE TANK FAILURES 2.4E-006 EPS-DGN-CF-R1AB2A CCF OF UNIT 1 DGS AND UNIT 2 A DG TO RUN 1.7E-004 EPS-DGN-CF-R1AB2B CCF OF UNIT 1 DGS AND UNIT 2 B DG TO RUN 1.7E-004 EPS-DGN-CF-RUN1 COMMON CAUSE FAILURE OF UNIT 1 DGS TO RUN 5.9E-004 EPS-DGN-CF-RUN12 COMMON CAUSE FAILURE OF UNIT 1 & 2 DGS TO RUN 4.9E-005 EPS-DGN-CF-S1AB2A CCF OF UNIT 1 DGS AND UNIT 2 A DG TO START 1.9E-005 EPS-DGN-CF-S1AB2B CCF OF UNIT 1 DGS AND UNIT 2 B DG TO START 1.9E-005 EPS-DGN-FR-DG1A DIESEL GENERATOR 1A FAILS TO RUN 2.1E-002 EPS-DGN-FR-DG1B DIESEL GENERATOR 1B FAILS TO RUN 2.1E-002 EPS-DGN-FR-DG2A DIESEL GENERATOR 2A FAILS TO RUN 2.1E-002 EPS-DGN-FR-DG2B DIESEL GENERATOR 2B FAILS TO RUN 2.1E-002 EPS-DGN-TM-DG1A DIESEL GENERATOR 1A UNAVAILABLE DUE TO TEST/M 9.0E-003 EPS-DGN-TM-DG1B DIESEL GENERATOR 1B UNAVAILABLE DUE TO TEST/M 9.0E-003 EPS-XHE-XL-NR01H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL 1hr 8.4E-001 EPS-XHE-XL-NR06H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL 6hr 3.5E-001 EPS-XHE-XM-XTIE1 OPERATOR FAILS TO ALIGN OPPOSITE UNIT DGS 4.0E-002 HPI-XHE-XM-FB OPERATOR FAILS TO INITIATE FEED AND BLEED 4.0E-002 LOOP-DUAL-UNIT DUEAL UNIT LOOP TO SWING ONE UNIT 2 DGS 1.0E+000 2005/07/25 15:41:24 page 7

LER 335/04-004 25 Event Name Description Curr Prob OEP-XHE-XL-NR01H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 1 1.0E+000 OEP-XHE-XL-NR06H OPERATOR FAILS TO RECOVER OFFSITE POWER IN 6 5.0E-003 PPR-SRV-CO-SBO PORVS/SRVS OPEN DURING SBO 3.7E-002 PPR-SRV-OO-1402 PORV 1402 FAILS TO RECLOSE AFTER OPENING 3.0E-003 PPR-SRV-OO-1404 PORV 1404 FAILS TO RECLOSE AFTER OPENING 3.0E-003

LER 335/04-004 26 Attachment A Event Description In the late evening hours of September 25, 2004, St. Lucie Units 1 and 2 were shutdown in Mode 4 as the effects of Hurricane Jeanne, a Category 3 hurricane on the Saffir-Simpson scale, were experienced at the site. Earlier that day both units were taken off-line, as required by the St. Lucie emergency plan implementing procedures, prior to the onset of hurricane force winds at the site.

The four bay 230 kV (nominal) switchyard provides switching capability for two main generator outputs, four startup transformers, three outgoing transmission lines, and one distribution substation. The three outgoing transmission lines are identified as Midway 1, 2, and 3 and service switchyard Bays 1, 2, and 3, respectively. The Hutchinson Island distribution substation is serviced by Bay 4. The main generators for both St Lucie Units 1 and 2 produce power and that enters the switchyard in Bays 1 and 3, respectively.

Bay 2 (Midway 2) supplies power to startup transformers IA and 2A, located in the St Lucie Unit 1 transformer yard. Bay 4 (Hutchinson Island distribution substation) supplies power to startup transformers 1B and 2B located in the St. Lucie Unit 2 transformer yard. During normal operation, either set of startup transformers can be fed from any one of the incoming transmission lines through all of the east-west switchyard bus cross-ties. However, when a unit is taken off-line, the switchyard design requires removal of the cross-tie between the east and west 230kV busses. To remove a unit from service, the generator breakers (8W30 and 8W26 in Bay 1 for Unit 1 or 8W52 and 8W49 in Bay 3 for Unit 2) must be opened and remain open to isolate the main transformer lines. Since both units are removed from service in anticipation of hurricane force winds, two bays between the east and west busses are lost such that the startup transformers are serviced by the two remaining east-west cross-ties in Bays 2 and 4.

At 1100 hours0.0127 days <br />0.306 hours <br />0.00182 weeks <br />4.1855e-4 months <br /> on September 25, 2004, Unit 1 was removed from service followed by Unit 2 at 1159 hours0.0134 days <br />0.322 hours <br />0.00192 weeks <br />4.409995e-4 months <br />. Later the same day Unit 1 entered Mode 4 at 1840 hours0.0213 days <br />0.511 hours <br />0.00304 weeks <br />7.0012e-4 months <br /> followed by Unit 2 at 2036 hours0.0236 days <br />0.566 hours <br />0.00337 weeks <br />7.74698e-4 months <br />.

At 2221 hours0.0257 days <br />0.617 hours <br />0.00367 weeks <br />8.450905e-4 months <br />, a fault in the Hutchinson Island distribution substation feed caused the west bus breaker 8W67 and mid breaker 8W64 to open in Bay 4. At this time, the lA/2A startup transformers were still connected to the east and west switchyard busses in Bay 2, but in Bay 1 the 1B/2B startup transformers were only connected to the east switchyard bus. By 2349 hours0.0272 days <br />0.653 hours <br />0.00388 weeks <br />8.937945e-4 months <br />, Unit 1 completed the transition to shutdown cooling as the decay heat removal mechanism, but Unit 2 was still removing decay heat by steaming to the steam generators. At 2356 hours0.0273 days <br />0.654 hours <br />0.0039 weeks <br />8.96458e-4 months <br />, a fault on the Midway 2 feed to Bay 2 opened the west bus breaker 8W43 and the mid breaker 8W40, and power to the east switchyard bus was lost causing a complete loss of offsite power at both units (although Midway lines 1 and 3 remained energized, they were only capable of powering the west switchyard bus and the east -west cross-ties in Bays 2 and 4 were lost with the faults on the Hutchinson Island distribution substation and Midway 2 feeds). As described later, all four of the emergency diesel generators started in response the LOOP conditions and safe shutdown loads were sequenced onto each unit's safety busses.

At 0004 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> on September 26, 2004, power to the Midway 2 line was restored. However, the decision was made to not restore power to the startup transformers until weather conditions improved enough to permit switchyard inspections.

By 0800 hours0.00926 days <br />0.222 hours <br />0.00132 weeks <br />3.044e-4 months <br /> on September 26, 2004, weather conditions had improved sufficiently and switchyard inspections commenced. At 1009 hours0.0117 days <br />0.28 hours <br />0.00167 weeks <br />3.839245e-4 months <br />, offsite power was restored to all of the Unit 2 electrical busses. At 1103 hours0.0128 days <br />0.306 hours <br />0.00182 weeks <br />4.196915e-4 months <br />, offsite power was restored to all of the Unit 1 electrical busses.

Damage assessment and hurricane recovery plans continued and St. Lucie Unit 2 was returned to service on October 3, 2004, followed by the return to service of Unit 2 on October 4, 2004.

The units' responses to the LOOPs were as follows:

On Unit 1, all safety systems responded to the LOOP as required, except the 1B intake cooling water (ICW) pump failed to automatically load onto its respective EDG. Shutdown cooling flow to

LER 335/04-004 27 the "A" train was restored at 0004 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> when the 1A low pressure safety injection (LPSI) pump was restarted on EDG power.

The 1B ICW pump was manually started at 0040 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br />.

On Unit 2, all safety systems responded to the LOOP as required, except that the 2A1 EDG fuel day tank solenoid valve failed to open such that the fuel day tank level had to be manually controlled by local operation. At 0245 hours0.00284 days <br />0.0681 hours <br />4.050926e-4 weeks <br />9.32225e-5 months <br />, decay heat removal was transitioned to shutdown cooling when the "A" train of shutdown cooling was placed in service.

Cause of the Event The faults that resulted in the dual unit LOOP at the St. Lucie site were most likely caused by salt contamination on electrical components as a result of the extreme environmental conditions experienced during Hurricane Jeanne. The west side of the eye wall was heavily contaminated with salt spray, creating the potential for electrical faults. This salt spray contamination was removed by the east side of eye wall as it washed the salt away with cleaner water. This west eye wall salt spray contamination -

east eye wall self cleaning phenomenon was also observed in substations throughout the FPL service territory.

An additional cause for the LOOP is that the switchyard design requires removal of each unit's east and west 230kV bus cross-tie when the unit is off-line. If the switchyard design had non-load interrupting disconnect switches in the main transformer lines, Bays 1 and 3 would provide additional cross-ties between the east and west 230kV busses. This would allow re-closing the generator breakers (8W30 and 8W26 in Bay 1 for Unit 1 or 8W52 and 8W49 for Unit 2 in Bay 3) when a St. Lucie unit is off-line. This design would result in a more robust 230kV switchyard when challenged by extreme environmental conditions.

The FPL investigation determined that the failure of the 1B ICW pump to automatically load on the EDG was isolated to the control signals to the 4.16kV breaker and not the breaker mechanism itself. Further troubleshooting determined that the most likely cause was the intermittent failure of either the 1B ICW pump control switch or the load-sequencing relay. As a conservative action both the 1B ICW control switch and load-sequencing relay were replaced.

Troubleshooting the 2A EDG fuel day tank fuel solenoid valve determined that the most likely cause was an intermittent failure in the solenoid valve control circuitry of either the RHH1 day tank hi-hi level relay or the "Gems Flip Pack A" solid-state controller. As a conservative action both components were replaced.

Analysis of the Event This event is reportable in accordance with 10 CFR 50.73(a)(2)(iv)(A) due to the automatic actuation of the emergency AC electrical power systems.

Additionally, this event is also being reported in accordance with 10 CFR 50.73(a)(2)(iii) as a natural phenomenon that significantly hampered the ability of site personnel to safely operate the nuclear power plants. During the hurricane all the required actions to maintain the units in safe shutdown conditions took place within sheltered areas. However, weather conditions did hamper the restoration of offsite power to the units' electrical busses. Therefore, during the hurricane, safe shutdown loads remained connected to the EDGs even after power was capable of being restored to the east electrical switchyard busses because conditions would not allow personnel to safely inspect the switchyard.

Analysis of Safety Significance

LER 335/04-004 28 A review of the relay actions shows that the switchyard system protection operated properly. The protection disconnected transmission circuits from the switchyard busses when the integrity of the circuits was challenged by the environmental conditions present during Hurricane Jeanne. Storm preparations included briefing the operating crews on the possibility of a LOOP. The operators were prepared for losing the reactor coolant pumps and took appropriate action on natural circulation while the units were transitioned to shutdown cooling. There was no significant equipment problems noted while maintaining shutdown conditions during the hurricane.

Additionally, although no attempt was made to restore offsite power to the startup transformers during the hurricane, if EDG power was lost, offsite power could have been restored through Bay 2.

Based on the above, this event did not have a significant effect on the health and safety of the public.

Corrective Actions

1. No immediate corrective action related to salt contamination was required since the post-storm testing demonstrated that the switchyard insulation was clean.

2. The 1B ICW pump load-sequencing relay was replaced under work order 34016797 and the 1B ICW pump control switch was replaced under work order 34016797.

3. The 2A EDG Day Tank RHH1 relay and the solid-state controller were replaced under work order 34016818.

4. St. Lucie is considering replacing the disconnect links between the switchyard and the main transformers of each St. Lucie unit with motor operated disconnect (MOD) switches or evaluate other means of improving switchyard reliability. This assessment will be completed by May 1, 2005.

Additional Information None Failed Components Identified Component: CS-833 - 1B ICW pump pull to lock control switch Manufacturer: General Electric Co.

Model Number: 16SBMD4D09TlFlP1 Component: 2X/TDPU - 1B ICW pump load-sequencing relay Manufacturer: Allen Bradley Model Number: 700-RTllC200Zl Similar Events None

LER 335/04-004 29 Group 2:

Pressurized RHR cooldown 3

Cooldown with RHR to 200EF Cooldown of Rx from 345EF to # 200EF by controlled main turbine steam bypass (while maintaining SG pressure).

RHR is placed in service during hold.

All engineered safeguard pumps (except one charging pump) is placed in pull-to-lock (PTL).

RCS pressure is maintained at 345 psig with a bubble in the pressurizer.

Once RHR is in service SG steaming and RHR cooling is used to cooldown RC until SG pressure decreases to 5 to 15 psig (RCS temp 220 - 250EF).

Mode 4: Hot shutdown

LER 335/04-004 30 Check for copies of appropriate documents 1

yes LER 2

none Inspection report(s) 3 none SERP Worksheet 4

none Final or preliminary significance determination 5

none Licensees corrective action report 6

Licensees PRA analysis of the issue 7

Operating procedures if the issue involves

- Operator actions for equipment recovery

- Mitigating actions (e.g., flood or fire protective actions)

- GL 91-18 type compensatory measures 8

Current system diagram (I&ID) or structural/floor drawings for specific SSC-related performance issues 9

For failed or degraded SSCs, metallurgical laboratory report and/or test results performed to qualify the equipment or material in question 10 An electronic photo of plant equipment or areas in question 11 Licensees root cause analysis

LER 335/04-004 31 Attachment B LER Search for Windowed Events LER Number Event Date Plant Title 3352003001 (S)*

2/18/2003 St Lucie 1, 2 This is a Safeguards LER 3352003002 2/17/2003 St Lucie 1 Invalid 4.16kV Bus Undervoltage Condition During Maintenance Caused EDG Start 3352003003 9/25/2003 St Lucie 1 Fire Seals Inoperable Due to Inadequate Qualification Testing 3352003004 10/16/2003 St Lucie 1 Improper Sampling Techniques Led to Operation of NaOH Tank Outside Tech Spec Limits 3352003005 12/3/2003 St Lucie 1 Condition Prohibited by Tech Specs Due to Failed Containment Vacuum Breakers 3352004001 4/15/2004 St Lucie 1 PSB-1 Analysis Non-Conservatisms Led To Past Operation Prohibited by TSs 3352004002 5/17/2004 St Lucie 1 Train Emergency Core Cooling System Room Ventilation System Inoperable 3352004004 9/25/2004 St Lucie 1, 2 Dual Unit Loss Of Offsite Power During Hurricane Jeanne 3892003001 4/1/2003 St Lucie 2 Manual Reactor Trip Due to Decreasing Main Condenser Vacuum 3892003002 4/30/2003 St Lucie 2 Two Flaws Identified During Refueling Outage Reactor Pressure Vessel Head Inspections

• C=Cancelled, P=Proprietary, S=Safeguards/Security Search Restrictions:

Status: Active, Cancelled, Restricted Event Dates: between Jan-01-2003 and Dec-31-2004 Reactor Type: PWR Docket: 335, 389 Date of Search: Dec-16-2004