ML17109A455

ASP Analysis Reject- Brunswick Steam Electric Plant Units 1 and 2, Emergency Diesel Generator 3 Inoperable Due to Failure to Auto-Start (LER 325-2016-002)

ML17109A455
Person / Time
Site:	Brunswick
Issue date:	04/20/2017
From:	Keith Tetter NRC/RES/DRA/FRB
To:
K. Tetter 301-415-2407
References
IR 2016001, IR 2016002, IR 2016003, LER 325-2016-002, LER-16-002
Download: ML17109A455 (11)

Text

Final ASP Program Analysis - Reject Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Brunswick Steam Electric Plant Emergency Diesel Generator 3 Inoperable Due to Failure to Auto-Start Units 1 and 2 LER: 325-2016-002 Unit 1 CDP = 3x10-8 Event Date: 3/4/2016 IRs: 05000325/2016001, 05000325/2016002, Unit 2 CDP = 2x10-7 05000325/2016003 Plant Type: Boiling-Water Reactor (BWR); General Electric 4 with a Wet Mark I Containment Plant Operating Mode (Reactor Power Level): Unit 1 = Mode 5 (0% Reactor Power)

Unit 2 = Mode 1 (100% Reactor Power)

Analyst: Reviewer: Contributors: BC Approved Date:

Keith Tetter Chris Hunter N/A 4/20/2017 EVENT DETAILS Event Description. On March 2, 2016 at 2:58 p.m., emergency diesel generator (EDG) 1 was declared inoperable in support of modifications, maintenance activities, and testing. Emergency bus E1 and balance of plant (BOP) bus 1D were deenergized in support of this work. This was a planned maintenance activity, being performed during the ongoing Unit 1 refueling outage.

Due to the shared electrical distribution system at Brunswick, Unit 2 was in Technical Specification (TS) 3.8.1, Condition B (i.e., two Unit 1 offsite circuits inoperable due to one Unit 1 balance of plant circuit path to the downstream 4.16 kV emergency bus inoperable for planned maintenance and the EDG associated with the affected downstream 4.16 kV emergency bus inoperable for planned maintenance). On March 3rd, work was ongoing to restore power to BOP bus 1D when an error in the restoration sequence resulted in an invalid auto-start of EDGs 2 and 4. The invalid signal mimicked under-voltage on the startup auxiliary transformer (SAT),

which is not a TS required start and, per design, would have started EDGs 1, 2, 3, and 4.

EDG 1 was under clearance and, as such, did not start. However, it was also expected that EDG 3 should have started. Troubleshooting activities and a thorough EDG 1 modification review were initiated. As a result, on March 4, 2016, at 12:35 pm, it was determined that continuity was lost across a dummy fuse block in the auto-start circuitry for EDG 3. This failure prevented TS required auto-actuation of EDG 3. Therefore, EDG 3 was declared inoperable, but could be manually started. At this time, Unit 2 entered TS 3.8.1, Condition I, (i.e., one or more offsite circuits and two or more Diesel Generators (DGs) inoperable). EDG 3 was restored to operable status at 6:34 pm after replacement of the fuse holder.

A review was performed to determine instances when EDGs 1, 2, or 4 were inoperable during the period from February 7, 2016, until March 4, 2016. The following instances were identified.

Note, the times provided are approximate, based on operations log entries.

EDG 1 February 20 at 6:06 pm to March 2 at 12:26 pm (i.e., 10 days, 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />, 20 minutes) for planned replacement of the automatic voltage regulator and margin improvement modifications.

1

LER 325-2016-002 March 2nd at 2:58 pm to March 9th at 1:51 a.m. (i.e., 6 days, 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />, 53 minutes) for Division 1 electrical outage and EDG 1 governor modification. Note that EDG 3 was restored to operable status on March 4th at 6:34 p.m.

EDG 2 February 19th from 8:25 p.m. to 8:53 p.m. (i.e., 28 minutes) for maintenance.

February 19th from 9:04 p.m. to February 20th at 12:14 a.m. (i.e., 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, 10 minutes) for surveillance testing.

EDG 4 February 15th from 12:35 p.m. to 2:34 p.m. (i.e., 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, 59 minutes) for surveillance testing.

February 18th from 9:06 p.m. to 9:40 p.m. (i.e., 34 minutes) for maintenance.

February 18th from 9:54 p.m. to February 19th at 1:19 a.m. (i.e., 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, 25 minutes) for surveillance testing.

During the above periods, Unit 2 was in Mode 1. Unit 1 was in Mode 1 until February 26th at 9:29 p.m. when Mode 3 was entered to start the refueling outage.

Additional information is provided in licensee event report (LER) 325-2016-002 (Ref. 1),

inspection report (IR) 05000325/2016001 (Ref. 2), IR 05000325/2016002 (Ref. 3), and IR 0500325/2016003 (Ref. 4).

Cause. The direct cause of the EDG 3 failure to auto-start was identified as a loss of continuity in the 2-DG3-FU-1-ECR dummy fuse at EDG 3 emergency control relay (ECR) Disconnect; specifically, loose fuse clamps in the dummy fuse block/holder. Further, there is firm evidence that this condition existed since February 7, 2016, when EDG 3 successfully auto-started in response to a Unit 1 SAT lock-out condition, the details of which are discussed in Brunswick LER 325-2016-001, dated April 6, 2016. On February 7, 2016, operators observed that the auto-start indications for EDG 3 (i.e., annunciator UA-21 5-2, and lights) had cleared, without operator action. This provides indication that the loss of continuity in the dummy fuse holder occurred at that time. The unexpected clearing indicates a loss of power to the ECR relay, the same failure mechanism that prevented EDG 3 auto-start on March 3, 2016. Therefore, it is concluded that the equipment issue was present from February 7, 2016 until March 4, 2016, when the fuse holder was replaced. Inoperability of EDG 3 was determined to be from 10:11 pm on February 7, 2016, when the EDG 3 was secured from the auto-start, until 6:34 pm on March 4, 2016, following replacement of the faulty fuse holder.

MODELING SDP Results/Basis for ASP Analysis. The ASP Program performs independent analyses for concurrent degraded conditions (i.e., overlapping exposure periods).

In IR 05000325/2016002 a green finding was identified due to the licensees failure to verify or check the adequacy of the design of the EDG 3 emergency auto-start circuitry. A detailed risk evaluation was performed, but only for the loss of function of a single train. The LER is closed in IR 0500325/2016003.

An independent ASP analysis is required because multiple safety-related EDGs were unavailable at the same time due to different causes.

2

LER 325-2016-002 Analysis Type. The Brunswick Unit 1 Standardized Plant Analysis Risk (SPAR) model Revision 8.24, modified in January 2017, and the Brunswick 2 SPAR Model Version 8.20, modified in February 2017, were used for this condition assessment.1 SPAR Model Modifications. The following modifications were required for this condition assessment:

• Basic events EPS-XHE-XL-NR30M (Operator Fails to Recover Emergency Diesel in 30 Minutes), EPS-XHE-XL-NR01H (Operator Fails to Recover Emergency Diesel in 1 Hour),

EPS-XHE-XL-NR02H (Operator Fails to Recover Emergency Diesel in 2 Hours), and EPS-XHE-XL-NR12H (Operator Fails to Recover Emergency Diesel in 4 Hours) were set to TRUE in the base model. These basic events are set to TRUE for applicable ASP condition assessments and their use is limited to cases where event information supports credit for EDG recovery.

Key Modeling Assumptions. The following modeling assumptions were determined to be significant to the modeling of this event analysis:

• Basic event EPS-DGN-FS-DG3 (diesel generator 3 fails to start) was set to TRUE because EDG 3 would not start automatically; however, it could be manually started by operators from the main control room. Therefore, basic events EPS-XHE-XL-NR30M, EPS-XHE-XL-NR01H, EPS-XHE-XL-NR02H, and EPS-XHE-XL-NR12H were conservatively set to a screening value of 0.1.2

• For the applicable part of the exposure period that bus 1D was deenergized due to maintenance, basic event ACP-BAC-LP-1D (4160 VAC power bus 1D fails) was set to TRUE.

• For the applicable part of the exposure period that bus E1 was deenergized due to maintenance, basic event ACP-BAC-LP-E1 (division E1 AC power buses fail) was set to TRUE.

• For the applicable part of the exposure period that EDG 1 was deenergized due to maintenance, basic event EPS-DGN-TM-DG1 (diesel generator 1 unavailable due to test and maintenance) was set to TRUE.

• For the applicable part of the exposure period that EDG 2 was deenergized due to maintenance, basic event EPS-DGN-TM-DG2 (diesel generator 2 unavailable due to test and maintenance) was set to TRUE.

• For the applicable part of the exposure period that EDG 4 was deenergized due to maintenance, basic event EPS-DGN-TM-DG4 (diesel Generator 4 unavailable due to test and maintenance) was set to TRUE.

1 Both available as a test/limited use model. Model changes included, but were not limited to: (1) credit for swing EDG, (2) credit for back-feed in sequences greater than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, and (3) addition of top event SRV-O in the LOOP event tree.

2 NUREG-1792, Good Practices for Implementing Human Reliability Analysis, provides that 0.1 is an appropriate screening (i.e., typically conservative) value for most post-initiator HFEs 3

LER 325-2016-002

• All other safety systems were determined to be capable of fulfilling their safety function.

Exposure Periods. The following exposure periods and basic events were used to determine the increase in core damage probability (CDP) due to the various EDG unavailabilities. For exposure periods, A1, A6, A7, and A8, the applicable shutdown model was used.

Unit 1 Exposure Exposure Period Power/Shutdown (Mode) Basic Event(s) CDP Period (hours)

A1 Shutdown (Mode 4L) 122 EPS-DGN-FS-DG3 1.90E-11 A2 At-Power 177 EPS-DGN-FS-DG3 2.12E-09 EPS-DGN-FS-DG3 A3 At-Power 6 2.32E-10 EPS-DGN-TM-DG4 EPS-DGN-TM-DG2 A4 At-Power 4 1.34E-10 EPS-DGN-FS-DG3 EPS-DGN-TM-DG1 A5 At-Power 147 2.11E-08 EPS-DGN-FS-DG3 EPS-DGN-TM-DG1 A6 Shutdown (Mode 5E) 111 1.33E-09 EPS-DGN-FS-DG3 A7 Shutdown (Mode 5E) 3 EPS-DGN-FS-DG3 5.91E-12 ACP-BAC-LP-1D ACP-BAC-LP-E1 A8 Shutdown (Mode 5E) 52 8.56E-10 EPS-DGN-TM-DG1 EPS-DGN-FS-DG3 Total 2.58E-08 Unit 2 Exposure Exposure Power/Shutdown (Mode) Basic Event(s) CDP Period Period (hours)

A9 At-Power 423 EPS-DGN-FS-DG3 9.76E-09 EPS-DGN-TM-DG1 A10 At-Power 259 3.97E-08 EPS-DGN-FS-DG3 EPS-DGN-TM-DG2 A11 At-Power 4 6.97E-10 EPS-DGN-FS-DG3 EPS-DGN-FS-DG3 A12 At-Power 6 1.23E-09 EPS-DGN-TM-DG4 ACP-BAC-LP-1D ACP-BAC-LP-E1 A13 At-Power 52 1.50E-07 EPS-DGN-TM-DG1 EPS-DGN-FS-DG3 Total 2.01E-07 4

LER 325-2016-002 ANALYSIS RESULTS Importance. The increase in core damage probability (CDP) for this bounding analysis is 2.6x10-8 for Unit 1 and 2.0x10-7 for Unit 2. The ASP Program acceptance threshold is a CDP of 1x10-6; and therefore, this event is not a precursor.

Dominant Sequence. The dominant accident sequence for Unit 1 is grid-related loss of offsite power (LOOP) sequence 11 (CDP = 6.5x10-9), which contributes approximately 25 percent of the total internal events CDP. The dominant accident sequences for Unit 2 are loss of AC bus E4 (LOAC-E4) sequence 12 (CDP = 4.3x10-8) and loss of AC bus E3 (LOAC-E3) sequence 12 (CDP = 4.3x10-8), which contribute approximately 22 percent and 21 percent of the total internal events CDP respectively. Figures A-1 and A-2 in Appendix A illustrates these sequences. The dominant sequences that contribute at least 1 percent of the total internal events CCDP are provided in the following tables.

Unit 1

• Sequence CDP Percentage Description Grid-related LOOP initiating event; successful reactor trip; successful emergency power system; safety relief valves (SRVs) successfully open and reclose; high-LOOPGR 11 6.5E-09 25.1%

pressure injection (HPI) succeeds; suppression pool cooling fails; manual depressurization succeeds; low-pressure injection (LPI) fails; alternate LPI fails Switchyard-centered LOOP initiating event; successful reactor trip; successful emergency power system; SRVs successfully open and reclose; HPI succeeds; LOOPSC 11 3.6E-09 14.1%

suppression pool cooling fails; manual depressurization succeeds; LPI fails; alternate LPI fails Weather-related LOOP initiating event; successful reactor trip; emergency power system failure results in station blackout (SBO); SRVs successfully reclose; recirculation pump seal integrity successful; HPI succeeds; 4160 V bus cross-tie fails; actions to extend LOOPWR 29-07 2.3E-09 9.0%

reactor core isolation cooling (RCIC) operation succeed; operators fail to recover offsite power (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />); operators fail to recover emergency diesel generator (EDG) (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />); containment venting fails; late injection fails Weather-related LOOP initiating event; successful reactor trip; successful emergency power system; safety relief valves successfully open and reclose; HPI LOOPWR 11 2.2E-09 8.4%

succeeds; suppression pool cooling fails; manual depressurization succeeds; LPI fails; alternate LPI fails Shutdown in early Mode 5; emergency power system SDM5E-LOOP 18 2.0E-09 7.6% fails; 4160 V bus cross-tie fails; AC power recovered before core damage fails 5

LER 325-2016-002

• Sequence CDP Percentage Description Transient initiating event with consequential LOOP; successful reactor trip; emergency power system fails; SRVs successfully open and reclose; HPI succeeds; TRANS 65-11 1.1E-09 4.3%

suppression pool cooling fails; manual depressurization succeeds; LPI fails; alternate LPI fails Grid-related LOOP initiating event; successful reactor trip; emergency power system failure results in station blackout (SBO); SRVs successfully reclose; LOOPGR 29-23-4 9.1E-10 3.5% recirculation pump seal integrity fails; RCIC fails; 4160 V bus cross-tie fails; operators fail to recover offsite power (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />); operators fail to recover EDG (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />)

Grid-related LOOP initiating event; successful reactor trip; successful emergency power system; safety relief LOOPGR 25 6.7E-10 2.6%

valves successfully open and reclose; HPI fails; manual depressurization fails Grid-related LOOP initiating event; successful reactor trip; successful emergency power system; safety relief LOOPGR 24 5.4E-10 2.1% valves successfully open and reclose; HPI fails; manual depressurization succeeds; LPI fails; alternate LPI fails Plant-centered LOOP initiating event; successful reactor trip; successful emergency power system; safety relief valves successfully open and reclose; HPI LOOPPC 11 5.2E-10 2.0%

succeeds; suppression pool cooling fails; manual depressurization succeeds; LPI fails; alternate LPI fails Weather-related LOOP initiating event; successful reactor trip; emergency power system failure results in station blackout (SBO); SRVs successfully reclose; LOOPWR 29-23-4 5.0E-10 2.0% recirculation pump seal integrity fails; RCIC fails; 4160 V bus cross-tie fails; operators fail to recover offsite power (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />); operators fail to recover EDG (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />)

Grid-related LOOP initiating event; successful reactor trip; emergency power system failure results in station blackout (SBO); SRVs successfully reclose; recirculation pump seal integrity successful; HPI succeeds; 4160 V bus cross-tie fails; actions to extend LOOPGR 29-07 5.0E-10 1.9%

reactor core isolation cooling (RCIC) operation succeed; operators fail to recover offsite power (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />); operators fail to recover emergency diesel generator (EDG) (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />); containment venting fails; late injection fails Grid-related LOOP initiating event; successful reactor trip; successful emergency power system; SRVs LOOPGR 12 4.5E-10 1.8% successfully open and reclose; HPI succeeds; suppression pool cooling fails; manual depressurization fails 6

LER 325-2016-002

• Sequence CDP Percentage Description Switchyard-centered LOOP initiating event; successful reactor trip; successful emergency power system; LOOPSC 25 3.5E-10 1.4%

safety relief valves successfully open and reclose; HPI fails; manual depressurization fails Switchyard-centered LOOP initiating event; successful reactor trip; successful emergency power system; LOOPSC 24 2.8E-10 1.1% safety relief valves successfully open and reclose; HPI fails; manual depressurization succeeds; LPI fails; alternate LPI fails Weather-related LOOP initiating event; successful reactor trip; successful emergency power system; SRVs successfully open and reclose; HPI succeeds; LOOPWR 04 2.7E-10 1.0% suppression pool cooling fails; manual reactor depressurization succeeds; LPI succeeds; containment spray fails; containment venting succeeds; late injection fails Unit 2 Sequence CDP Percentage Description Loss of AC bus E4 initiating event; successful reactor trip; power conversion system (PCS) fails; SRVs open successfully; HPI succeeds; suppression pool cooling LOAC-E4 12 4.3E-08 21.6% fails; manual depressurization succeeds; condensate system fails; LPI succeeds; shutdown cooling fails; containment spray fails; PCS recovery fails; late injection fails Loss of AC bus E3 initiating event; successful reactor trip; power conversion system (PCS) fails; SRVs open successfully; HPI succeeds; suppression pool cooling LOAC-E3 12 4.3E-08 21.2% fails; manual depressurization succeeds; condensate system fails; LPI succeeds; shutdown cooling fails; containment spray fails; PCS recovery fails; late injection fails Weather-related LOOP initiating event; successful reactor trip; emergency power system failure results in station blackout (SBO); SRVs successfully reclose; recirculation pump seal integrity successful; HPI succeeds; 4160 V bus cross-tie fails; actions to extend LOOPWR 28-07 8.1E-09 4.0%

reactor core isolation cooling (RCIC) operation succeed; operators fail to recover offsite power (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />); operators fail to recover emergency diesel generator (EDG) (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />); containment venting fails; late injection fails Grid-related LOOP initiating event; successful reactor trip; successful emergency power system; safety relief valves (SRVs) successfully open and reclose; high-LOOPGR 11 6.6E-09 3.3%

pressure injection (HPI) succeeds; suppression pool cooling fails; manual depressurization succeeds; low-pressure injection (LPI) fails; alternate LPI fails 7

LER 325-2016-002 Sequence CDP Percentage Description Grid-related LOOP initiating event; successful reactor trip; successful emergency power system; SRVs LOOPGR 12 5.6E-09 2.8% successfully open and reclose; HPI succeeds; suppression pool cooling fails; manual depressurization fails Grid-related LOOP initiating event; successful reactor trip; emergency power system failure results in station blackout (SBO); SRVs successfully reclose; recirculation pump seal integrity successful; HPI succeeds; 4160 V bus cross-tie fails; actions to extend LOOPGR 29-07 3.6E-09 1.8%

reactor core isolation cooling (RCIC) operation succeed; operators fail to recover offsite power (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />); operators fail to recover emergency diesel generator (EDG) (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />); containment venting fails; late injection fails Switchyard-centered LOOP initiating event; successful reactor trip; successful emergency power system; SRVs successfully open and reclose; HPI succeeds; LOOPSC 11 3.3E-09 1.6%

suppression pool cooling fails; manual depressurization succeeds; LPI fails; alternate LPI fails Grid-related LOOP initiating event; successful reactor trip; emergency power system failure results in station blackout (SBO); SRVs successfully reclose; recirculation pump seal integrity successful; HPI LOOPGR 29-19 3.2E-09 1.6%

succeeds; 4160 V bus cross-tie fails; actions to extend RCIC operation fails; manual depressurization fails; operators fail to recover offsite power (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />);

operators fail to recover EDG (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />)

Switchyard-centered LOOP initiating event; successful reactor trip; successful emergency power system; LOOPSC 12 2.2E-09 1.1% SRVs successfully open and reclose; HPI succeeds; suppression pool cooling fails; manual depressurization fails Grid-related LOOP initiating event; successful reactor trip; emergency power system failure results in station blackout (SBO); SRVs successfully reclose; LOOPGR 29-23-4 2.0E-09 1.0% recirculation pump seal integrity fails; RCIC fails; 4160 V bus cross-tie fails; operators fail to recover offsite power (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />); operators fail to recover EDG (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />)

REFERENCES

1. Brunswick Steam Electric Plant, "LER 325/16-002 - Emergency Diesel Generator 3 Inoperable Due to Failure of Auto-Start, dated August 8, 2016 (ML16132A076).

2. U.S. Nuclear Regulatory Commission, Brunswick Steam Electric Plant - NRC Integrated Inspection Report Nos.: 05000325/2016001 and 05000324/2016001, dated April 28, 2016 (ML16119A056).

8

LER 325-2016-002

3. U.S. Nuclear Regulatory Commission, Brunswick Steam Electric Plant - NRC Integrated Inspection Report Nos.: 05000325/2016002 and 05000324/2016002 and Exercise of Enforcement Discretion, dated August 11, 2016 (ML16224A976).

4. U.S. Nuclear Regulatory Commission, Brunswick Steam Electric Plant - NRC Integrated Inspection Report Nos.: 05000325/2016003 and 05000324/2016003 and Exercise of Enforcement Discretion, dated November 9, 2016 (ML16314D607).

9

LER 325-2016-002 Appendix A: Key Event Tree Figure A-1. Unit 1 LOOP (Grid-Related) Event Tree A-1

LER 325-2016-002 Figure A-2. Unit 2 LOAC-E4 Event Tree A-2