ML12268A151

MD 8.3; Unit 2 Deterministic Criteria Evaluation

ML12268A151
Person / Time
Site:	Byron
Issue date:	01/30/2012
From:	Division Reactor Projects III
To:
References
FOIA/PA-2012-0287
Download: ML12268A151 (13)

Text

MD 8.3 Evaluation Decision Documentation for Reactive Inspection (Deterministic and Risk Criteria Analyzed)

PLANT: Byron Unit 2 EVENT DATE: 01/30/12 DETERMINISTIC CRITERIA EVALUATION DATE: 02/02/12 Brief Description of the Significant Operational Event or Degraded Condition:

This MD 8.3 is a revision for a previous MD 8.3 for the same event. The revision is based on new information developed by the Special Inspection Team, particularly as associated with the identification that a loss of seal flow to all four RCP seals occurred for about 8 minutes.

Changes are in bold.

On January 30, 2012, Byron Unit 2 tripped due to an undervoltage condition on the reactor coolant pump electrical bus. Immediately after the trip, licensee personnel reported smoke from both Unit 2 System Auxiliary Transformers (SATs). In response, the licensee de-energized the SATs resulting in a loss of offsite power (LOOP). Both Emergency Diesel Generators (EDGs) automatically started as designed to supply power to the safety-related buses. At the time of the event, the 2B EDG was inoperable, but available due to maintenance. The Auxiliary Feedwater (AF) system and Atmospheric Steam Dumps responded as designed to remove decay heat. A walkdown of the switchyard identified that the bus section between the SAT'Disconnect Switch (Bus 13) and the Revenue Meter (Combi Unit) failed and that two of the four "C" phase bus insulator sections were lying on the ground. A number of equipment issues were identified during this event, including 2B EDG oscillations, the failure of a number of safety-related motors to trip when in an undervoltage condition, and the failure of an Essential Service Water (SX) pump to start when expected.

From the time of the equipment failure until the SATs were de-energized, all safety-related equipment, including component cooling water that supplied cooling to the RCP seals, was unavailable. In addition, immediately following the trip until the SATs were de-energized, the 1A (motor-driven) AF pump was not available. The 2B (diesel-driven) AF pump operated as designed.

YIN DETERMINISTIC CRITERIA N

a. Involved operations that exceeded, or were not included in the design bases of the facility Remarks: The current operation was within the design bases of the facility.

Y

b. Involved a major deficiency in design, construction, or operation having potential

_ ~generic safety implications 1

81

Remarks: The C-Phase insulator stack for the Unit 2 SAT Revenue Metering Transformer (Combi Unit) broke and part of the insulator stack fell to the ground. This caused the C-Phase connection to break from the Revenue Metering Transformer terminal, resulting in a C-Phase open circuit. An open circuit would not have caused any of the SAT protective relays or differential relays to trip. The protective relays are designed to trip during a fault/overcurrent condition. A fault/overcurrent condition did not exist, therefore the SAT protective relays did not trip. The differential relays compare the differential between input and output current on a per phase basis. In this case, both input and output currents were zero, therefore the SAT feeder breakers did not open. The SATs continued to carry loads on Phases A and B.

The EDGs did not automatically start because an undervoltage on both Phases A-B and B-C are required, and the Phase A-B voltage was still normal.

Nonetheless, the loss of the C-Phase represented an undervoltage condition.

Therefore, all of the ESF and Non-ESF equipment powered from the 6.9 kV and 4.16 kV buses that were running before the event tripped and had a corresponding trip disagreement light lit along with stop indication on the respective main control board control switch. This included loads on safety-related buses 241 and 242, and all loads on nonsafety-related buses that transferred over from the UAT to the SAT as a result of the Unit 2 trip.

A potential design deficiency exists since safety-related equipment that would have otherwise been available had the SAT protective relays tripped, were not; and this appears to be how the plant was designed to operate.

This may also be how other nuclear power plants are designed to operate and as such, represents a potential generic safety issue.

Only through operator diagnosis and action were the SATs de-energized. No procedures existed to direct this diagnosis and actions. The actions were taken 8 minutes following the event. An RCP seal failure and LOCA in the absence of seal cooling from component cooling water is estimated to occur 13 minutes after the onset of the loss of seal cooling.

N

c. Led to a significant loss of integrity of the fuel, primary coolant pressure boundary, or primary containment boundary of a nuclear reactor Remarks: This condition involved equipment malfunctions that had not resulted in a loss of integrity of the three fission product barriers.

Y

d. Led to the loss of a safety function or multiple failures in systems used to mitigate an actual event Remarks: This condition involved equipment malfunctions that affected both SATs which are the offsite power supply for the safety-related buses. See b. above.

Y

e. Involved possible adverse generic implications Remarks: See b. above.

2

S4 Y

f. Involved significant unexpected system interactions Remarks: A number of equipment issues were identified during this event that may have involved potential unexpected system interactions. In particular, a number of safety-related motors failed to trip when in an apparent undervoltage condition and an essential service water (SX) pump failed to start when expected. See b. above.

N

g. Involved repetitive failures or events involving safety-related equipment or deficiencies in operations Remarks: No repetitive failures or events were identified.

N

h. Involved questions or concerns pertaining to licensee operational performance Remarks: No concerns pertaining to licensee operational performance were identified.

3

CONDITIONAL RISK ASSESSMENT RISK ANALYSIS BY: Nicholas Valos/Laura Kosak RISK ANALYSIS DATE: 02/02/12 Brief Description of the Basis for the Assessment (may include assumptions, calculations, references, peer review, or comparison with licensee's results):

The Senior Reactor Analysts (SRAs) evaluated the finding using the Byron Standardized Plant Analysis Risk (SPAR) model version 8.17 and Saphire version 8.0.7.17. Since the Byron SPAR model is a Unit 1 model, Unit 1 was used as a surrogate for Unit 2. The SRAs assumed that there was a switchyard-centered loss-of-offsite-power (LOOP), a failure of System Auxiliary Transformers (SATs) 242-1 and 242-2, and a failure to recover the SATs within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The Special Inspection team found that there was a loss of Reactor Coolant Pump (RCP) seal cooling for 8 minutes at the start of the event (i.e., the time of the Reactor Trip) until the breakers from System Auxiliary Transformers (SATs) 242-1 and 242-2 to Unit 2 were opened to allow the Emergency Diesel Generators (EDGs) to align and pick up the loads to safety-related buses 241 and 242.

To incorporate this information into the risk assessment, the NRC Safety Evaluation for RCP seal leakage models, titled "Safety Evaluation of Topical Report WCAP-15603, Revision 1, "WOG 2000 Reactor Coolant Pump Seal Leakage Model for Westinghouse PWRs (TAC No. MB1714)," dated May 20, 2003, was used to assess the risk impact regarding RCP seal leakage rates at Byron for high-temperature 0-ring seals.

Based on review of the document, a RCP seal LOCA is not assumed to occur until 13-minutes after the onset of the loss of seal cooling. The SRAs calculated the probability of a small LOCA occurring 13-minutes after the onset of loss of seal cooling (with no operator intervention) to be about 0.21. The probability of a Medium LOCA was much less (i.e., about two orders of magnitude less).

To assess the risk impact of operator intervention, the SRAs used SPAR-H to obtain a human error probability (HEP) that the operators would have failed to restore power to the safety-related buses within 13 minutes (and thus restore RCP seal cooling capability). High stress was assumed for both Diagnosis and Action. Nominal values were used for the other performance shaping factors (PSFs). The result was an HEP of 2.2E-2.

To obtain the updated risk assessment, the SRAs evaluated the finding using the Byron SPAR model version 8.18 and Saphire version 8.0.7.17. Since the Byron SPAR model is a Unit 1 model, Unit I was used as a surrogate for Unit 2.

The conditional core damage probability (CCDP) for a small LOCA (SLOCA) initiating event with no plant failures was 6.62E-3.

The conditional core damage probability (CCDP) for a medium LOCA (MLOCA) initiating event with no plant failures was 3.26E-3.

4

Although for the actual event operators were successful in preventing a RCP seal-induced LOCA from occurring, the risk is included in this revised analysis. The initial MD8.3 risk assessment determined the CCDP to be about 6.8E-6. The additional risk due to a small LOCA was calculated to be (CCDP) 3.06E-5 calculated as follows:

6.62E-3

• 0.21

• 0.022 = 3.06E-5.

The additional risk due to a medium LOCA was inconsequential to the small LOCA risk, primarily due to the smaller probability of a medium LOCA resulting from RCP seal failure.

Thus, the revised CCDP risk assessment is the sum of the above contributions or 3.7E-5. This risk is in the overlap region between a Special Inspection and an Augmented Inspection Team (AIT).

The result was a CODP of 6.8E-6. The dominant sequences were station blackout sequences (that involved a failure of offsite and emergency onsite power), a failure of rapid secondary depressurization, a failure of reactor coolant pump (RCP) seals, and a failure to recover either offsite power or an emergency diesel generator (EDG) within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

The estimated conditional core damage probability (CCDP) is 3.7E-5 and per IMC 0309, "Reactive Inspection Basis for Reactors" and MD 8.3 places the risk in the overlap region between a "Special Inspection" (SI) and an "Augmented Inspection Team" (AIT).

5

RESPONSE DECISION USING THE ABOVE INFORMATION AND OTHER KEY ELEMENTS OF CONSIDERATION AS APPROPRIATE, DOCUMENT THE RESPONSE DECISION TO THE EVENT OR CONDITION, AND THE BASIS FOR THAT DECISION DECISION AND DETAILS OF THE BASIS FOR THE DECISION:

Recommend a continuation of the Special Inspection that is in progress. An escalation to an AIT is not recommended at this time since the SIT has been effective in gathering and evaluating information associated with this event and no additional expertise is judged as needed.

Basis:

Deterministic criteria "b", "d", "e" and "f" were met. A loss of safety function was identified when smoke was observed from both SATs and licensee personnel de-energized the SATs, resulting in a LOOP. A number of equipment issues were identified during this event that may have involved potential unexpected system interactions. In particular, a number of safety-related motors failed to trip when in an undervoltage condition and an essential service water (SX) pump failed to start when expected.

The initial risk analysis performed using the Byron plant-specific SPAR model results in a conditional core damage probability (CCDP) of 3.7E-5 for Unit 2. This risk value is within the overlap range for either a Special Inspection Team (SIT) of Augmented Inspection Team (AIT) response.

BRANCH CHIEF REVIEW: IRA/Eric R. Duncan, Chief, DATE: 2/3/12 Reactor Projects Branch 3, Division of Reactor Projects TSS TEAM LEAD REVIEW: IRA/-Julio F. Lara, TSS DATE: 2/3/12 Team Leader, Division of Reactor Projects DIVISION DIRECTOR REVIEW: IRA!- Kenneth G.

DATE: 2/7/12 O'Brien, Deputy Director, Division of Reactor Safety for Steven A. Reynolds, Director DIVISION DIRECTOR REVIEW: IRA/- GaryL. Shear, DATE: 2/8/12 Deputy Director, Division of Reactor Projects, for Steven West, Director 6

Decision Documentation for Reactive Inspection (Deterministic-only Criteria Analyzed)

PLANT: Byron Unit 2 EVENT DATE: 01/30/12 EVALUATION DATE: 02/02/12 Brief Description of the Significant Operational Event or Degraded Condition:

This MD 8.3 is a revision for a previous MD 8.3. The revision is based on new information developed by the Special Inspection Team, particularly as associated with the identification that a loss of seal flow to all four RCP seals occurred for about 8 minutes. Changes are in bold.

On January 30, 2012, Byron Unit 2 tripped due to an undervoltage condition on the reactor coolant pump electrical bus. Immediately after the trip, licensee personnel reported smoke from both Unit 2 System Auxiliary Transformers (SATs). In response, the licensee de-energized the SATs resulting in a loss of offsite power (LOOP). Both Emergency Diesel Generators (EDGs) automatically started as designed to supply power to the safety-related buses. At the time of the event, the 2B EDG was inoperable, but available due to maintenance. The Auxiliary Feedwater (AF) system and Atmospheric Steam Dumps responded as designed to remove decay heat. A walkdown of the switchyard identified that the bus section between the SAT Disconnect Switch (Bus 13) and the Revenue Meter (Combi Unit) failed and that two of the four "C" phase bus insulator sections were lying on the ground.

A number of equipment issues were identified during this event, including 2B EDG oscillations, the failure of a number of safety-related motors to trip when in an undervoltage condition, and the failure of an Essential Service Water (SX) pump to start when expected. From the time of the equipment failure until the SATs were de-energized, all safety-related equipment, including component cooling water that supplied cooling to the RCP seals, was unavailable. In addition, immediately following the trip until the SATs were de-energized, the 1A (motor-driven) AF pump was not available. The 2B (diesel-driven)

AF pump operated as designed.

REACTOR SAFETY Y/N lIT Deterministic Criteria N

Led to a Site Area Emergency Remarks: This condition did not lead to a site area emergency.

N Exceeded a safety limit of the licensee's technical specifications Remarks: No safety limit was exceeded.

N Involved circumstances sufficiently complex, unique, or not well enough understood, or involved safeguards concerns, or involved characteristics the investigation of which would best serve the needs and interests of the Commission Remarks: The circumstances around the issue were not complex.

7

Y/N SI Deterministic Criteria N

Significant failure to implement the emergency preparedness program during an actual event, including the failure to classify, notify, or augment onsite personnel Remarks: This condition did not affect the emergency preparedness program.

RADIATION SAFETY YIN lIT Deterministic Criteria N

Led to a significant radiological release (levels of radiation or concentrations of radioactive material in excess of 10 times any applicable limit in the license or 10 times the concentrations specified in 10 CFR Part 20, Appendix B, Table 2, when averaged over a year) of byproduct, source, or special nuclear material to unrestricted areas Remarks: No significant radiological release occurred.

N Led to a significant occupational exposure or significant exposure to a member of the public. In both cases, "significant" is defined as five times the applicable regulatory limit (except for shallow-dose equivalent to the skin or extremities from discrete radioactive particles)

Remarks: No significant occupational exposure or exposure to the public occurred.

N Involved the deliberate misuse of byproduct, source, or special nuclear material from its intended or authorized use, which resulted in the exposure of a significant number of individuals Remarks: No misuse of byproduct, source or SNM occurred.

N Involved byproduct, source, or special nuclear material, which may have resulted in a fatality Remarks: No misuse of byproduct, source or SNM occurred.

N Involved circumstances sufficiently complex, unique, or not well enough understood, or involved safeguards concerns, or involved characteristics the investigation of which would best serve the needs and interests of the Commission Remarks: The circumstances around the issue were not complex.

Y/N AIT Deterministic Criteria N

Led to a radiological release of byproduct, source, or special nuclear material to unrestricted areas that resulted in occupational exposure or exposure to a member of the public in excess of the applicable regulatory limit (except for shallow-dose equivalent to the skin or extremities from discrete radioactive particles)

Remarks: No radiological release limits were exceeded.

8

N Involved the deliberate misuse of byproduct, source, or special nuclear material from its intended or authorized use and had the potential to cause an exposure of greater than 5 rem to an individual or 500 mrem to an embryo or fetus Remarks: No deliberate misuse of byproduct, source or SNM occurred.

N Involved the failure of radioactive material packaging that resulted in external radiation levels exceeding 10 rads/hr or contamination of the packaging exceeding 1000 times the applicable limits specified in 10 CFR 71.87 Remarks: No failure of radioactive material packaging occurred:

N Involved the failure of the dam for mill tailings with substantial release of tailings material and solution off site Remarks: No dam failure occurred.

Y/N SI Deterministic Criteria N

May have led to an exposure in excess of the applicable regulatory limits, other than via the radiological release of byproduct, source, or special nuclear material to the unrestricted area; specifically occupational exposure in excess of the regulatory limits in 10 CFR 20.1201 exposure to an embryo/fetus in excess of the regulatory limits in 10 CFR 20.1208

" exposure to a member of the public in excess of the regulatory limits in 10 CFR 20.1301 Remarks: No exposures exceeded any limits.

N May have led to an unplanned occupational exposure in excess of 40 percent of the applicable regulatory limit (excluding shallow-dose equivalent to the skin or extremities from discrete radioactive particles)

Remarks: No exposures exceeded any limits.

N Led to unplanned changes in restricted area dose rates in excess of 20 rem per hour in an area where personnel were present or which is accessible to personnel Remarks: No actual change in dose rates occurred.

N Led to unplanned changes in restricted area airborne radioactivity levels in excess of 500 DAC in an area where personnel were present or which is accessible to personnel and where the airborne radioactivity level was not promptly recognized and/or appropriate actions were not taken in a timely manner Remarks: No actual airborne radioactivity level change occurred.

9

N Led to an uncontrolled, unplanned, or abnormal release of radioactive material to the unrestricted area for which the extent of the offsite contamination is unknown; or, that may have resulted in a dose to a member of the public from loss of radioactive material control in excess of 25 mrem (10 CFR 20.1301(e)); or, that may have resulted in an exposure to a member of the public from effluents in excess of the ALARA guidelines contained in Appendix I to 10 CFR Part 50 Remarks: No actual release of radioactive material occurred.

N Led to a large (typically greater than 100,000 gallons), unplanned release of radioactive liquid inside the restricted area that has the potential for ground-water, or offsite, contamination Remarks: No actually release of radioactive liquid occurred.

N Involved the failure of radioactive material packaging that resulted in external radiation levels exceeding 5 times the accessible area dose rate limits specified in 10 CFR Part 71, or 50 times the contamination limits specified in 49 CFR Part 173 Remarks: No actual failure of radioactive material packaging occurred.

N Involved an emergency or non-emergency event or situation, related to the health and safety of the public or on-site personnel or protection of the environment, for which a 10 CFR 50.72 report has been submitted that is expected to cause significant, heightened public or government concern Remarks: This condition did not involve a submitted 10 CFR 50.72 report.

SAFEGUARDS/SECURITY Y/N lIT Deterministic Criteria N

Involved circumstances sufficiently complex, unique, or not well enough understood, or involved safeguards concerns, or involved characteristics the investigation of which would best serve the needs and interests of the Commission Remarks: The circumstances around the issue were not complex and did not involve safeguards concerns.

N Failure of licensee safety-related equipment or adverse impact on licensee operations as a result of a safeguards initiated event (e.g., tampering).

Remarks: The condition did not involve safeguards concern.

N Actual intrusion into the protected area.

Remarks: No actual intrusion into the protected area occurred.

10

Y/N AIT Deterministic Criteria N

Involved a significant infraction or repeated instances of safeguards infractions that demonstrate the ineffectiveness of facility security provisions Remarks: No safeguards infractions occurred.

N Involved repeated instances of inadequate nuclear material control and accounting provisions to protect against theft or diversions of nuclear material Remarks: This condition did not involve nuclear material control and accounting.

N Confirmed tampering event involving safety-related or security-related equipment Remarks: This condition did not involve tampering.

N Substantial failure in the licensee's intrusion detection or package/personnel search procedures which results in a significant vulnerability or compromise of plant safety or security Remarks: This condition did not involve intrusion detection or search procedure.

Y/N SI Deterministic Criteria N

Involved inadequate nuclear material control and accounting provisions to protect against theft or diversion, as evidenced by inability to locate an item containing special nuclear material (such as an irradiated rod, rod piece, pellet, or instrument)

Remarks: This condition did not involve nuclear material control and accounting.

N Involved a significant safeguards infraction that demonstrates the ineffectiveness of facility security provisions Remarks: No safeguard infraction was involved.

N Confirmation of lost or stolen weapon Remarks: This condition did not involve a loss or stolen weapon.

N Unauthorized, actual non-accidental discharge of a weapon within the protected area Remarks: This condition did not involve a discharge of weapon.

N Substantial failure of the intrusion detection system (not weather related)

Remarks: This condition did not involve the intrusion detection system.

11

N Failure to the licensee's package/personnel search procedures which results in contraband or an unauthorized individual being introduced into the protected area Remarks: This condition did not involve a failure to the licensee's search procedures.

RESPONSE DECISION USING THE ABOVE INFORMATION AND OTHER KEY ELEMENTS OF CONSIDERATION AS APPROPRIATE, DOCUMENT THE RESPONSE DECISION TO THE EVENT OR CONDITION, AND THE BASIS FOR THAT DECISION DECISION AND DETAILS OF THE BASIS FOR THE DECISION:

Recommend a continuation of the Special Inspection that is in progress. An escalation to an AIT is not recommended at this time since the SIT has been effective in gathering and evaluating information associated with this event and no additional expertise is judged as needed.

Basis:

Deterministic criteria "b", "d", "e" and "f" were met. A loss of safety function was identified when smoke was observed from both SATs and licensee personnel de-energized the SATs, resulting in a LOOP. A number of equipment issues were identified during this event that may have involved potential unexpected system interactions. In particular, a number of safety-related motors failed to trip when in an undervoltage condition and an essential service water (SX) pump failed to start when expected.

The initial risk analysis performed using the Byron plant-specific SPAR model results in a conditional core damage probability (CCDP) of 3.7E-5 for Unit 2. This risk value is within the overlap range for either a Special Inspection Team (SIT) of Augmented Inspection Team (AIT) response.

BRANCH CHIEF REVIEW: IRA/Eric R. Duncan, Chief, DATE: 2/3/12 Reactor Projects Branch 3, Division of Reactor Projects TSS TEAM LEADER REVIEW: IRA/-Julio F. Lara, TSS DATE: 2/3/12 Team Leader, Division of Reactor Projects DIVISION DIRECTOR REVIEW: IRA/- Kenneth G.

DATE: 2/7/12 O'Brien, Deputy Director, Division of Reactor Safety for Steven A. Reynolds, Director DIVISION DIRECTOR REVIEW: IRA/- Gary L. Shear, DATE: 2/8/12 Deputy Director, Division of Reactor Projects, for Steven West, Director 12

Distribution: Darrell J. Roberts, RI; David A. Ayres, RI; Chris Miller, RI; Peter Wilson, RI; Richard Croteau, RII; William Jones, RII; Joel Munday, RII; Harold Christensen, RII; Steven West, Rill; Gary Shear, Rill; Steven Reynolds, Rill; Kenneth O'Brien, Rill; Kriss Kennedy, RIV; Troy Pruett, RIV; Anton Vegel, RIV; Tom Blount, RIV; Julio Lara, Rill; NRR Reactive lnspectiondnrc.qov 13