ML17109A269

Final ASP Analysis-Brunswick 1 (LER 325-2016-001)

ML17109A269
Person / Time
Site:	Brunswick
Issue date:	03/17/2017
From:	Michael Cheok NRC/RES/DRA
To:	Ross-Lee M Office of New Reactors
David Aird 301-415-0634
Shared Package
ML17109A268	List: ML17109A269
References
LER 325-2016-001
Download: ML17109A269 (6)

Text

Final ASP Program Analysis - Precursor Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Brunswick Steam Loss of Offsite Power Resulting from Lockout of Startup Electric Plant, Unit 1 Auxiliary Transformer due to Electrical Bus Faults LER: 325-2016-001 Event Date: 2/7/2016 IRs: 05000325/2016008 CCDP = 3x10-5 05000325/2016003 Plant Type: General Electric BWR/4 with a Mark I Containment Plant Operating Mode (Reactor Power Level): Mode 1 (88% Reactor Power)

Analyst: Reviewer: Contributors: BC Approved Date:

David Aird Christopher Hunter N/A 3/17/2017 EXECUTIVE

SUMMARY

At 1:12 p.m., on February 7, 2016, with Brunswick Unit 1 operating at 88 percent reactor power, arc flashes occurred on a balance-of-plant 4160V bus and a breaker cubicle that caused a lockout of the startup auxiliary transformer (SAT). Operators manually scrammed the reactor per procedure. The manual reactor scram shut down the main turbine and generator. This interrupted power to emergency (safety-related) buses E1 and E2. This configuration constituted a loss of offsite power (LOOP) condition for Unit 1. Emergency diesel generator (EDG) -1 and EDG-2 automatically tied to their respective buses, E1 and E2. All control rods fully inserted into the core and operators were able to control reactor level and pressure. An Alert was declared after evidence of an electrical explosion was discovered in the breaker cubicle that supplies reactor recirculation pump (RRP) 1B variable frequency drive (VFD) unit.

At 4:28 p.m., the licensee re-established offsite power through the unit auxiliary transformer (UAT) back-feed to supply the safety-related buses E1 and E2. At 5:30 p.m., the emergency classification was downgraded to an Unusual Event (UE) because the plant no longer met the criteria for an Alert, since the source of the explosion was determined not to have affected safe shutdown equipment. The UE declaration was terminated at 6:14 p.m.

According to the risk analysis modeling assumptions used in this Accident Sequence Precursor (ASP) analysis, the most likely core damage scenario is the LOOP initiating event and subsequent failures of suppression pool cooling, containment spray, and other alternative long-term cooling strategies from a combination of operator failure events and the unavailability of injection sources due to the LOOP. This accident sequence accounts for approximately 41 percent of the event conditional core damage probability (CCDP).

A Green finding (i.e., very low safety significance) was identified due to the licensees failure to have adequate procedures to perform maintenance on the SAT non-segregated bus duct and the RRP 1B VFD cables. This licensee performance deficiency led to faults on the balance-of-plant 4160V bus and a breaker cubicle that caused a lockout of the SAT. Risk assessments performed as part of the Significance Determination Process (SDP) are limited to the analysis of individual performance deficiencies. An independent ASP analysis is required because 1) there was an initiating event, and 2) the SDP analysis did not model the two independent faults concurrently. When analyzed together, the consequence of the phase-to-phase high energy fault is a plant-centered LOOP.

1

LER 325-2016-001 EVENT DETAILS Event Description. At 1:12 p.m. on February 7, 2016, with Brunswick Unit 1 operating at 88 percent reactor power, arc flashes occurred on a balance-of-plant 4160V bus and a breaker cubicle that caused a lockout of the SAT. Upon the loss of the Unit 1 SAT, all four site EDGs started. Operators manually scrammed the reactor per procedure after the loss of both RRPs.

These pumps were among some of the equipment receiving power through the SAT. All control rods fully inserted into the core. Reactor pressure was initially controlled by the opening of safety and relief valves. Later, the reactor core isolation cooling (RCIC) system and high-pressure coolant injection (HPCI) system were used, as designed, to control reactor water level and pressure, respectively.

Brunswick Unit 1 has two emergency power 4160V buses, E1 and E2. At the time of the event, these were being powered by the main generator through the UAT. The manual reactor scram tripped the main turbine and generator. This interrupted power to emergency (safety-related) buses E1 and E2. Power could not be transferred to the SAT because it was in a lockout condition. This configuration constituted a LOOP condition for Unit 1. EDG-1 and EDG-2 were already running and automatically tied to their respective buses, E1 and E2.

An Alert was declared at 1:26 p.m., after evidence of an electrical explosion was discovered in the breaker cubicle that supplies the RRP 1B VFD unit. At 4:28 p.m., the licensee re-established offsite power through the UAT back-feed to supply the safety-related buses E1 and E2. At 5:30 p.m., the emergency classification was downgraded to an UE because the plant no longer met the criteria for an Alert, since the source of the explosion was determined not to have affected safe shutdown equipment. The UE emergency declaration was terminated at 6:14 p.m.

Cause. The first arc flash occurred in a non-segregated balance-of-plant 4160V bus duct due to water accumulation. Water entered the bus housing through a degraded seal and through an area that had previously been repaired. This fault created a voltage imbalance which led to the second arc flash that occurred in a breaker cubicle where cable insulation was found to be degraded. This circuit breaker cubicle powers the RRP 1B VFD. It was determined that during installation of electrical stress relieving insulation in 2010, the dielectric insulation on a cable jacket had been damaged when a piece of semiconducting material was being removed. The arc flash occurred at the point where the cable insulation had been damaged. Licensee corrective actions included repairing equipment damaged by the electrical fault and revising the procedures and work instructions.

Additional Event Information. A coastal storm with strong winds and heavy rainfall was passing through the plant area at the time of the event. Unit 2 safety-related buses E3 and E4 were not affected by the event. EDG-3 and EDG-4 started per design, but did not connect to their buses because a LOOP condition did not exist on Unit 2. Unit 2 buses E3 and E4 remained powered by their normal, offsite sources.

Additional event information is available in licensee event report (LER) 325-2016-001 (Ref. 1),

inspection report (IR) 05000325/2016008 (Ref. 2), and IR 05000325/2016003 (Ref. 3).

MODELING Basis for ASP Analysis/SDP Results. The ASP Program uses SDP results for degraded conditions when available and if they are applicable. The inspectors determined that the failure 2

LER 325-2016-001 of the licensee to have adequate procedures to perform maintenance on the SAT non-segregated bus duct and the RRP 1B VFD cables was a performance deficiency. A detailed risk review was performed by the regional Senior Reactor Analyst. After additional review, it was determined that the two inadequate procedures did not share the same cause.

Therefore, the risk associated with each condition was analyzed separately in accordance with the SDP. When separate, each finding, given the appropriate conditions, would result in a ground. The high resistance grounding design of the plants 4160V system limits the phase-to-ground fault current to a low enough value to limit plant equipment damage and allow time to search for the ground. The very low risk significance associated with these two separate grounds resulted in a Green finding (i.e., very low safety significance).

The ASP Program performs independent analyses for initiating events. ASP analyses of initiating events account for all failures/degraded conditions and unavailabilities (e.g., equipment out for test/maintenance) that occurred during the event, regardless of licensee performance.1 Additional LERs were reviewed to determine if concurrent unavailabilities existed during the February 7, 2016, event. No windowed events or concurrent degraded operating conditions were identified. The LER was closed in IR 05000325/2016008.

Analysis Type. An initiating event analysis was performed using the Brunswick Unit 1 Standardized Plant Analysis Risk (SPAR) model Revision 8.24, modified in January 2017.2 This event was modeled as a plant-centered LOOP initiating event.

SPAR Model Modifications. No modifications to the Brunswick Unit 1 SPAR model were required to perform this analysis.3 Key Modeling Assumptions. The following assumptions were determined to be significant to the modeling of this event:

• The analysis models the February 7, 2016, single-unit reactor trip at Brunswick Steam Electric Plant Unit 1 as a plant-centered LOOP initiating event.

- The probability of plant-centered LOOP (IE-LOOPPC) was set to 1.0; all other initiating event probabilities were set to zero.

• Basic event ACP-TFM-FC-SAT1 (Transformer SAT #1 Failure No Power) was set to TRUE.

• Brunswick Unit 2 did not lose offsite power to the safety buses. Therefore, basic event OEP-VCP-LP-SITEPC (Site LOOP Plant Centered) was set to FALSE.

• The key offsite power recovery times for Brunswick Unit 1 modeled within the SPAR model are:

- 30 Minutes - A LOOP and subsequent station blackout (SBO) with failures of both RCIC and HPCI.

- 1 Hour - A LOOP and subsequent SBO with two or more stuck open safety relief valves and success of one high-pressure injection source (RCIC or HPCI).

1 ASP analyses also account for any degraded condition(s) that were identified after the initiating event occurred if the failure/degradation exposure period(s) overlapped the initiating event date.

2 Available as a test/limited use model. Model changes included, but were not limited to: 1) credit for swing EDG, 2) credit for back-feed in sequences greater than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, and 3) addition of top event SRV-O in the LOOP event tree.

3 Diesel generator recovery was not credited in the SPAR model.

3

LER 325-2016-001

- 2 Hours - A LOOP and subsequent SBO with high-pressure injection source(s) available initially, operators fail to cross-tie emergency buses, and extended operation of HPCI/RCIC fails due to battery depletion. Offsite power must be recovered in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> if operators either fail to depressurize the reactor or initiate firewater injection (assuming depressurization was successful). Additionally, a LOOP and subsequent SBO with one stuck open safety relief valve (or recirculation pump seal failure), success of one high-pressure injection source (RCIC or HPCI), and operators fail to cross-tie the emergency buses.

- 12 Hours - A LOOP and subsequent SBO with high-pressure injection source(s) available and operators fail to cross-tie emergency buses. Operators must restore offsite power within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> if able to extend HPCI/RCIC operation. Additionally, if extended operation of HPCI/RCIC is not possible or fails, operators would have 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> to restore offsite power if manual depressurization and firewater injection is successful.

• Offsite power was restored to the UAT approximately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after the LOOP occurred.

Based on this information, recovery of offsite power to a safety bus prior to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> is assumed to fail. Therefore, the recovery actions OEP-XHE-XL-NR30MPC (Operator Fails to Recover Offsite Power in 30 Minutes), OEP-XHE-XL-NR01HPC (Operator Fails to Recover Offsite Power in 1 Hour), and OEP-XHE-XL-NR02HPC (Operator Fails to Recover Offsite Power in 2 Hours) were set to TRUE.4 ANALYSIS RESULTS CCDP. The point estimate CCDP for this event is 3.0x10-5. The ASP Program acceptance threshold is a CCDP of 1x10-6 or the CCDP equivalent of an uncomplicated reactor trip with a non-recoverable loss of feedwater and the condenser heat sink, whichever is greater. This CCDP equivalent for Brunswick Unit 1 is 9.7x10-6. Therefore, this event is a precursor.

Dominant Sequence. The dominant accident sequence is LOOPPC Sequence 4 (CCDP =

1.2x10-5) that contributes approximately 41 percent of the total internal events CCDP. The dominant sequence is shown graphically in Figure A-1 in Appendix A. The dominant sequences that contribute at least 1 percent to the total internal events CCDP for this analysis are provided in the following table.

Sequence CCDP  % Description Plant-centered LOOP initiating event, successful reactor trip, emergency power is available, safety relief valves open to relieve initial pressure, safety relief valves do not stick open, high-pressure injection source is available (HPCI or RCIC), suppression pool cooling fails, successful manual reactor LOOPPC 04 1.20E-5 40.6%

depressurization, low-pressure injection source is available (low-pressure coolant injection or core spray), containment spray cooling mode of residual heat removal system fails, successful containment (suppression pool) venting, alternate long-term low-pressure injection fails Plant-centered LOOP initiating event, successful reactor trip, emergency power LOOPPC 28 7.57E-6 25.7%

is available, safety relief valves fail to open Plant-centered LOOP initiating event, successful reactor trip, emergency power is available, safety relief valves open to relieve initial pressure, safety relief LOOPPC 25 5.18E-6 17.6%

valves do not stick open, high-pressure injection sources are not available (HPCI or RCIC), manual reactor depressurization fails 4 There is potential that operators could have restored offsite power before 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />; however, additional recovery credit has a negligible effect on the analysis results. Recovery credit could be applied to the 12-hour non-recovery probability; however, additional credit beyond the nominal probability has a negligible effect on the analysis results.

4

LER 325-2016-001 Sequence CCDP  % Description Plant-centered LOOP initiating event, successful reactor trip, emergency power is available, safety relief valves open to relieve initial pressure, safety relief valves do not stick open, high-pressure injection source is available (HPCI or RCIC), suppression pool cooling fails, successful manual reactor LOOPPC 06 2.55E-6 8.7%

depressurization, low-pressure injection source is available (low-pressure coolant injection or core spray), containment spray cooling mode of residual heat removal system fails, containment venting fails, failure of late injection (after containment failure)

Plant-centered LOOP initiating event, successful reactor trip, emergency power is available, safety relief valves open to relieve initial pressure, safety relief LOOPPC 12 6.77E-7 2.3%

valves do not stick open, high-pressure injection source is available (HPCI or RCIC), suppression pool cooling fails, manual reactor depressurization fails Plant-centered LOOP initiating event, successful reactor trip, emergency power is available, safety relief valves open to relieve initial pressure, safety relief LOOPPC 24 5.06E-7 1.7% valves do not stick open, high-pressure injection sources are not available (HPCI or RCIC), successful manual reactor depressurization, low-pressure injection sources are not available, alternate low pressure injection fails REFERENCES

1. Duke Energy Progress, Inc., "LER 325-2016-001 - Electrical Bus Fault Results in Lockout of Startup Auxiliary Transformer and Loss of Offsite Power, dated April 6, 2016 (ML16104A391).

2. U.S. Nuclear Regulatory Commission, Brunswick Steam Electric Plant - NRC Integrated Inspection Report 05000325/2016008, dated July 13, 2016 (ML16195A012).

3. U.S. Nuclear Regulatory Commission, Brunswick Steam Electric Plant - NRC Integrated Inspection Report 05000325/2016003, dated November 9, 2016 (ML16314D607).

5

LER 325-2016-001 Appendix A: Key Event Tree Figure A-1: Brunswick Unit 1 LOOP Event Tree (Plant-Centered) with Sequence 4 in bold A-1