ML17109A455
| ML17109A455 | |
| Person / Time | |
|---|---|
| Site: | Brunswick  |
| Issue date: | 04/20/2017 |
| From: | Keith Tetter NRC/RES/DRA/FRB |
| To: | |
| K. Tetter 301-415-2407 | |
| References | |
| IR 2016001, IR 2016002, IR 2016003, LER 325-2016-002, LER-16-002 | |
| Download: ML17109A455 (11) | |
Text
1 Final ASP Program Analysis - Reject Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Brunswick Steam Electric Plant Units 1 and 2 Emergency Diesel Generator 3 Inoperable Due to Failure to Auto-Start Event Date: 3/4/2016 LER: 325-2016-002 IRs: 05000325/2016001, 05000325/2016002, 05000325/2016003 Unit 1 CDP = 3x10-8 Unit 2 CDP = 2x10-7 Plant Type: Boiling-Water Reactor (BWR); General Electric 4 with a Wet Mark I Containment Plant Operating Mode (Reactor Power Level): Unit 1 = Mode 5 (0% Reactor Power)
Unit 2 = Mode 1 (100% Reactor Power)
Analyst:
Keith Tetter Reviewer:
Chris Hunter Contributors:
N/A BC Approved Date:
4/20/2017 EVENT DETAILS Event Description. On March 2, 2016 at 2:58 p.m., emergency diesel generator (EDG) 1 was declared inoperable in support of modifications, maintenance activities, and testing. Emergency bus E1 and balance of plant (BOP) bus 1D were deenergized in support of this work. This was a planned maintenance activity, being performed during the ongoing Unit 1 refueling outage.
Due to the shared electrical distribution system at Brunswick, Unit 2 was in Technical Specification (TS) 3.8.1, Condition B (i.e., two Unit 1 offsite circuits inoperable due to one Unit 1 balance of plant circuit path to the downstream 4.16 kV emergency bus inoperable for planned maintenance and the EDG associated with the affected downstream 4.16 kV emergency bus inoperable for planned maintenance). On March 3rd, work was ongoing to restore power to BOP bus 1D when an error in the restoration sequence resulted in an invalid auto-start of EDGs 2 and 4. The invalid signal mimicked under-voltage on the startup auxiliary transformer (SAT),
which is not a TS required start and, per design, would have started EDGs 1, 2, 3, and 4.
EDG 1 was under clearance and, as such, did not start. However, it was also expected that EDG 3 should have started. Troubleshooting activities and a thorough EDG 1 modification review were initiated. As a result, on March 4, 2016, at 12:35 pm, it was determined that continuity was lost across a dummy fuse block in the auto-start circuitry for EDG 3. This failure prevented TS required auto-actuation of EDG 3. Therefore, EDG 3 was declared inoperable, but could be manually started. At this time, Unit 2 entered TS 3.8.1, Condition I, (i.e., one or more offsite circuits and two or more Diesel Generators (DGs) inoperable). EDG 3 was restored to operable status at 6:34 pm after replacement of the fuse holder.
A review was performed to determine instances when EDGs 1, 2, or 4 were inoperable during the period from February 7, 2016, until March 4, 2016. The following instances were identified.
Note, the times provided are approximate, based on operations log entries.
EDG 1 February 20 at 6:06 pm to March 2 at 12:26 pm (i.e., 10 days, 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />, 20 minutes) for planned replacement of the automatic voltage regulator and margin improvement modifications.
LER 325-2016-002 2
March 2nd at 2:58 pm to March 9th at 1:51 a.m. (i.e., 6 days, 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />, 53 minutes) for Division 1 electrical outage and EDG 1 governor modification. Note that EDG 3 was restored to operable status on March 4th at 6:34 p.m.
EDG 2 February 19th from 8:25 p.m. to 8:53 p.m. (i.e., 28 minutes) for maintenance.
February 19th from 9:04 p.m. to February 20th at 12:14 a.m. (i.e., 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, 10 minutes) for surveillance testing.
EDG 4 February 15th from 12:35 p.m. to 2:34 p.m. (i.e., 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, 59 minutes) for surveillance testing.
February 18th from 9:06 p.m. to 9:40 p.m. (i.e., 34 minutes) for maintenance.
February 18th from 9:54 p.m. to February 19th at 1:19 a.m. (i.e., 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, 25 minutes) for surveillance testing.
During the above periods, Unit 2 was in Mode 1. Unit 1 was in Mode 1 until February 26th at 9:29 p.m. when Mode 3 was entered to start the refueling outage.
Additional information is provided in licensee event report (LER) 325-2016-002 (Ref. 1),
inspection report (IR) 05000325/2016001 (Ref. 2), IR 05000325/2016002 (Ref. 3), and IR 0500325/2016003 (Ref. 4).
Cause. The direct cause of the EDG 3 failure to auto-start was identified as a loss of continuity in the 2-DG3-FU-1-ECR dummy fuse at EDG 3 emergency control relay (ECR) Disconnect; specifically, loose fuse clamps in the dummy fuse block/holder. Further, there is firm evidence that this condition existed since February 7, 2016, when EDG 3 successfully auto-started in response to a Unit 1 SAT lock-out condition, the details of which are discussed in Brunswick LER 325-2016-001, dated April 6, 2016. On February 7, 2016, operators observed that the auto-start indications for EDG 3 (i.e., annunciator UA-21 5-2, and lights) had cleared, without operator action. This provides indication that the loss of continuity in the dummy fuse holder occurred at that time. The unexpected clearing indicates a loss of power to the ECR relay, the same failure mechanism that prevented EDG 3 auto-start on March 3, 2016. Therefore, it is concluded that the equipment issue was present from February 7, 2016 until March 4, 2016, when the fuse holder was replaced. Inoperability of EDG 3 was determined to be from 10:11 pm on February 7, 2016, when the EDG 3 was secured from the auto-start, until 6:34 pm on March 4, 2016, following replacement of the faulty fuse holder.
MODELING SDP Results/Basis for ASP Analysis. The ASP Program performs independent analyses for concurrent degraded conditions (i.e., overlapping exposure periods).
In IR 05000325/2016002 a green finding was identified due to the licensees failure to verify or check the adequacy of the design of the EDG 3 emergency auto-start circuitry. A detailed risk evaluation was performed, but only for the loss of function of a single train. The LER is closed in IR 0500325/2016003.
An independent ASP analysis is required because multiple safety-related EDGs were unavailable at the same time due to different causes.
LER 325-2016-002 3
Analysis Type. The Brunswick Unit 1 Standardized Plant Analysis Risk (SPAR) model Revision 8.24, modified in January 2017, and the Brunswick 2 SPAR Model Version 8.20, modified in February 2017, were used for this condition assessment.1 SPAR Model Modifications. The following modifications were required for this condition assessment:
Basic events EPS-XHE-XL-NR30M (Operator Fails to Recover Emergency Diesel in 30 Minutes), EPS-XHE-XL-NR01H (Operator Fails to Recover Emergency Diesel in 1 Hour),
EPS-XHE-XL-NR02H (Operator Fails to Recover Emergency Diesel in 2 Hours), and EPS-XHE-XL-NR12H (Operator Fails to Recover Emergency Diesel in 4 Hours) were set to TRUE in the base model. These basic events are set to TRUE for applicable ASP condition assessments and their use is limited to cases where event information supports credit for EDG recovery.
Key Modeling Assumptions. The following modeling assumptions were determined to be significant to the modeling of this event analysis:
Basic event EPS-DGN-FS-DG3 (diesel generator 3 fails to start) was set to TRUE because EDG 3 would not start automatically; however, it could be manually started by operators from the main control room. Therefore, basic events EPS-XHE-XL-NR30M, EPS-XHE-XL-NR01H, EPS-XHE-XL-NR02H, and EPS-XHE-XL-NR12H were conservatively set to a screening value of 0.1.2 For the applicable part of the exposure period that bus 1D was deenergized due to maintenance, basic event ACP-BAC-LP-1D (4160 VAC power bus 1D fails) was set to TRUE.
For the applicable part of the exposure period that bus E1 was deenergized due to maintenance, basic event ACP-BAC-LP-E1 (division E1 AC power buses fail) was set to TRUE.
For the applicable part of the exposure period that EDG 1 was deenergized due to maintenance, basic event EPS-DGN-TM-DG1 (diesel generator 1 unavailable due to test and maintenance) was set to TRUE.
For the applicable part of the exposure period that EDG 2 was deenergized due to maintenance, basic event EPS-DGN-TM-DG2 (diesel generator 2 unavailable due to test and maintenance) was set to TRUE.
For the applicable part of the exposure period that EDG 4 was deenergized due to maintenance, basic event EPS-DGN-TM-DG4 (diesel Generator 4 unavailable due to test and maintenance) was set to TRUE.
1 Both available as a test/limited use model. Model changes included, but were not limited to: (1) credit for swing EDG, (2) credit for back-feed in sequences greater than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, and (3) addition of top event SRV-O in the LOOP event tree.
2 NUREG-1792, Good Practices for Implementing Human Reliability Analysis, provides that 0.1 is an appropriate screening (i.e., typically conservative) value for most post-initiator HFEs
LER 325-2016-002 4
All other safety systems were determined to be capable of fulfilling their safety function.
Exposure Periods. The following exposure periods and basic events were used to determine the increase in core damage probability (CDP) due to the various EDG unavailabilities. For exposure periods, A1, A6, A7, and A8, the applicable shutdown model was used.
Unit 1 Exposure Period Power/Shutdown (Mode)
Exposure Period (hours)
Basic Event(s)
CDP A1 Shutdown (Mode 4L) 122 EPS-DGN-FS-DG3 1.90E-11 A2 At-Power 177 EPS-DGN-FS-DG3 2.12E-09 A3 At-Power 6
EPS-DGN-FS-DG3 EPS-DGN-TM-DG4 2.32E-10 A4 At-Power 4
EPS-DGN-TM-DG2 EPS-DGN-FS-DG3 1.34E-10 A5 At-Power 147 EPS-DGN-TM-DG1 EPS-DGN-FS-DG3 2.11E-08 A6 Shutdown (Mode 5E) 111 EPS-DGN-TM-DG1 EPS-DGN-FS-DG3 1.33E-09 A7 Shutdown (Mode 5E) 3 EPS-DGN-FS-DG3 5.91E-12 A8 Shutdown (Mode 5E) 52 ACP-BAC-LP-1D ACP-BAC-LP-E1 EPS-DGN-TM-DG1 EPS-DGN-FS-DG3 8.56E-10 Total 2.58E-08 Unit 2 Exposure Period Power/Shutdown (Mode)
Exposure Period (hours)
Basic Event(s)
CDP A9 At-Power 423 EPS-DGN-FS-DG3 9.76E-09 A10 At-Power 259 EPS-DGN-TM-DG1 EPS-DGN-FS-DG3 3.97E-08 A11 At-Power 4
EPS-DGN-TM-DG2 EPS-DGN-FS-DG3 6.97E-10 A12 At-Power 6
EPS-DGN-FS-DG3 EPS-DGN-TM-DG4 1.23E-09 A13 At-Power 52 ACP-BAC-LP-1D ACP-BAC-LP-E1 EPS-DGN-TM-DG1 EPS-DGN-FS-DG3 1.50E-07 Total 2.01E-07
LER 325-2016-002 5
ANALYSIS RESULTS Importance. The increase in core damage probability (CDP) for this bounding analysis is 2.6x10-8 for Unit 1 and 2.0x10-7 for Unit 2. The ASP Program acceptance threshold is a CDP of 1x10-6; and therefore, this event is not a precursor.
Dominant Sequence. The dominant accident sequence for Unit 1 is grid-related loss of offsite power (LOOP) sequence 11 (CDP = 6.5x10-9), which contributes approximately 25 percent of the total internal events CDP. The dominant accident sequences for Unit 2 are loss of AC bus E4 (LOAC-E4) sequence 12 (CDP = 4.3x10-8) and loss of AC bus E3 (LOAC-E3) sequence 12 (CDP = 4.3x10-8), which contribute approximately 22 percent and 21 percent of the total internal events CDP respectively. Figures A-1 and A-2 in Appendix A illustrates these sequences. The dominant sequences that contribute at least 1 percent of the total internal events CCDP are provided in the following tables.
Unit 1 Sequence CDP Percentage Description LOOPGR 11 6.5E-09 25.1%
Grid-related LOOP initiating event; successful reactor trip; successful emergency power system; safety relief valves (SRVs) successfully open and reclose; high-pressure injection (HPI) succeeds; suppression pool cooling fails; manual depressurization succeeds; low-pressure injection (LPI) fails; alternate LPI fails LOOPSC 11 3.6E-09 14.1%
Switchyard-centered LOOP initiating event; successful reactor trip; successful emergency power system; SRVs successfully open and reclose; HPI succeeds; suppression pool cooling fails; manual depressurization succeeds; LPI fails; alternate LPI fails LOOPWR 29-07 2.3E-09 9.0%
Weather-related LOOP initiating event; successful reactor trip; emergency power system failure results in station blackout (SBO); SRVs successfully reclose; recirculation pump seal integrity successful; HPI succeeds; 4160 V bus cross-tie fails; actions to extend reactor core isolation cooling (RCIC) operation succeed; operators fail to recover offsite power (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />); operators fail to recover emergency diesel generator (EDG) (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />); containment venting fails; late injection fails LOOPWR 11 2.2E-09 8.4%
Weather-related LOOP initiating event; successful reactor trip; successful emergency power system; safety relief valves successfully open and reclose; HPI succeeds; suppression pool cooling fails; manual depressurization succeeds; LPI fails; alternate LPI fails SDM5E-LOOP 18 2.0E-09 7.6%
Shutdown in early Mode 5; emergency power system fails; 4160 V bus cross-tie fails; AC power recovered before core damage fails
LER 325-2016-002 6
Sequence CDP Percentage Description TRANS 65-11 1.1E-09 4.3%
Transient initiating event with consequential LOOP; successful reactor trip; emergency power system fails; SRVs successfully open and reclose; HPI succeeds; suppression pool cooling fails; manual depressurization succeeds; LPI fails; alternate LPI fails LOOPGR 29-23-4 9.1E-10 3.5%
Grid-related LOOP initiating event; successful reactor trip; emergency power system failure results in station blackout (SBO); SRVs successfully reclose; recirculation pump seal integrity fails; RCIC fails; 4160 V bus cross-tie fails; operators fail to recover offsite power (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />); operators fail to recover EDG (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />)
LOOPGR 25 6.7E-10 2.6%
Grid-related LOOP initiating event; successful reactor trip; successful emergency power system; safety relief valves successfully open and reclose; HPI fails; manual depressurization fails LOOPGR 24 5.4E-10 2.1%
Grid-related LOOP initiating event; successful reactor trip; successful emergency power system; safety relief valves successfully open and reclose; HPI fails; manual depressurization succeeds; LPI fails; alternate LPI fails LOOPPC 11 5.2E-10 2.0%
Plant-centered LOOP initiating event; successful reactor trip; successful emergency power system; safety relief valves successfully open and reclose; HPI succeeds; suppression pool cooling fails; manual depressurization succeeds; LPI fails; alternate LPI fails LOOPWR 29-23-4 5.0E-10 2.0%
Weather-related LOOP initiating event; successful reactor trip; emergency power system failure results in station blackout (SBO); SRVs successfully reclose; recirculation pump seal integrity fails; RCIC fails; 4160 V bus cross-tie fails; operators fail to recover offsite power (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />); operators fail to recover EDG (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />)
LOOPGR 29-07 5.0E-10 1.9%
Grid-related LOOP initiating event; successful reactor trip; emergency power system failure results in station blackout (SBO); SRVs successfully reclose; recirculation pump seal integrity successful; HPI succeeds; 4160 V bus cross-tie fails; actions to extend reactor core isolation cooling (RCIC) operation succeed; operators fail to recover offsite power (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />); operators fail to recover emergency diesel generator (EDG) (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />); containment venting fails; late injection fails LOOPGR 12 4.5E-10 1.8%
Grid-related LOOP initiating event; successful reactor trip; successful emergency power system; SRVs successfully open and reclose; HPI succeeds; suppression pool cooling fails; manual depressurization fails
LER 325-2016-002 7
Sequence CDP Percentage Description LOOPSC 25 3.5E-10 1.4%
Switchyard-centered LOOP initiating event; successful reactor trip; successful emergency power system; safety relief valves successfully open and reclose; HPI fails; manual depressurization fails LOOPSC 24 2.8E-10 1.1%
Switchyard-centered LOOP initiating event; successful reactor trip; successful emergency power system; safety relief valves successfully open and reclose; HPI fails; manual depressurization succeeds; LPI fails; alternate LPI fails LOOPWR 04 2.7E-10 1.0%
Weather-related LOOP initiating event; successful reactor trip; successful emergency power system; SRVs successfully open and reclose; HPI succeeds; suppression pool cooling fails; manual reactor depressurization succeeds; LPI succeeds; containment spray fails; containment venting succeeds; late injection fails Unit 2 Sequence CDP Percentage Description LOAC-E4 12 4.3E-08 21.6%
Loss of AC bus E4 initiating event; successful reactor trip; power conversion system (PCS) fails; SRVs open successfully; HPI succeeds; suppression pool cooling fails; manual depressurization succeeds; condensate system fails; LPI succeeds; shutdown cooling fails; containment spray fails; PCS recovery fails; late injection fails LOAC-E3 12 4.3E-08 21.2%
Loss of AC bus E3 initiating event; successful reactor trip; power conversion system (PCS) fails; SRVs open successfully; HPI succeeds; suppression pool cooling fails; manual depressurization succeeds; condensate system fails; LPI succeeds; shutdown cooling fails; containment spray fails; PCS recovery fails; late injection fails LOOPWR 28-07 8.1E-09 4.0%
Weather-related LOOP initiating event; successful reactor trip; emergency power system failure results in station blackout (SBO); SRVs successfully reclose; recirculation pump seal integrity successful; HPI succeeds; 4160 V bus cross-tie fails; actions to extend reactor core isolation cooling (RCIC) operation succeed; operators fail to recover offsite power (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />); operators fail to recover emergency diesel generator (EDG) (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />); containment venting fails; late injection fails LOOPGR 11 6.6E-09 3.3%
Grid-related LOOP initiating event; successful reactor trip; successful emergency power system; safety relief valves (SRVs) successfully open and reclose; high-pressure injection (HPI) succeeds; suppression pool cooling fails; manual depressurization succeeds; low-pressure injection (LPI) fails; alternate LPI fails
LER 325-2016-002 8
Sequence CDP Percentage Description LOOPGR 12 5.6E-09 2.8%
Grid-related LOOP initiating event; successful reactor trip; successful emergency power system; SRVs successfully open and reclose; HPI succeeds; suppression pool cooling fails; manual depressurization fails LOOPGR 29-07 3.6E-09 1.8%
Grid-related LOOP initiating event; successful reactor trip; emergency power system failure results in station blackout (SBO); SRVs successfully reclose; recirculation pump seal integrity successful; HPI succeeds; 4160 V bus cross-tie fails; actions to extend reactor core isolation cooling (RCIC) operation succeed; operators fail to recover offsite power (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />); operators fail to recover emergency diesel generator (EDG) (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />); containment venting fails; late injection fails LOOPSC 11 3.3E-09 1.6%
Switchyard-centered LOOP initiating event; successful reactor trip; successful emergency power system; SRVs successfully open and reclose; HPI succeeds; suppression pool cooling fails; manual depressurization succeeds; LPI fails; alternate LPI fails LOOPGR 29-19 3.2E-09 1.6%
Grid-related LOOP initiating event; successful reactor trip; emergency power system failure results in station blackout (SBO); SRVs successfully reclose; recirculation pump seal integrity successful; HPI succeeds; 4160 V bus cross-tie fails; actions to extend RCIC operation fails; manual depressurization fails; operators fail to recover offsite power (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />);
operators fail to recover EDG (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />)
LOOPSC 12 2.2E-09 1.1%
Switchyard-centered LOOP initiating event; successful reactor trip; successful emergency power system; SRVs successfully open and reclose; HPI succeeds; suppression pool cooling fails; manual depressurization fails LOOPGR 29-23-4 2.0E-09 1.0%
Grid-related LOOP initiating event; successful reactor trip; emergency power system failure results in station blackout (SBO); SRVs successfully reclose; recirculation pump seal integrity fails; RCIC fails; 4160 V bus cross-tie fails; operators fail to recover offsite power (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />); operators fail to recover EDG (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />)
REFERENCES
- 1. Brunswick Steam Electric Plant, "LER 325/16-002 - Emergency Diesel Generator 3 Inoperable Due to Failure of Auto-Start, dated August 8, 2016 (ML16132A076).
- 2. U.S. Nuclear Regulatory Commission, Brunswick Steam Electric Plant - NRC Integrated Inspection Report Nos.: 05000325/2016001 and 05000324/2016001, dated April 28, 2016 (ML16119A056).
LER 325-2016-002 9
- 3. U.S. Nuclear Regulatory Commission, Brunswick Steam Electric Plant - NRC Integrated Inspection Report Nos.: 05000325/2016002 and 05000324/2016002 and Exercise of Enforcement Discretion, dated August 11, 2016 (ML16224A976).
- 4. U.S. Nuclear Regulatory Commission, Brunswick Steam Electric Plant - NRC Integrated Inspection Report Nos.: 05000325/2016003 and 05000324/2016003 and Exercise of Enforcement Discretion, dated November 9, 2016 (ML16314D607).
LER 325-2016-002 A-1 Appendix A: Key Event Tree Figure A-1. Unit 1 LOOP (Grid-Related) Event Tree
LER 325-2016-002 A-2 Figure A-2. Unit 2 LOAC-E4 Event Tree