ML18193A028

Transmittal of Final Oyster Creek Nuclear Generating Station Accident Sequence Precursor Report (Licensee Event Report 219-2017-0005)

ML18193A028
Person / Time
Site:	Oyster Creek
Issue date:	07/20/2018
From:	John Lamb Special Projects and Process Branch
To:	Bryan Hanson Exelon Generation Co, Exelon Nuclear
Lamb J, NRR/DORL/LSPB, 415-3100
Shared Package
ML18200A026	List: ML18193A028
References
LER 2017-005
Download: ML18193A028 (18)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 July 20, 2018 Mr. Bryan C. Hanson Senior Vice President Exelon Generation Company, LLC President and Chief Nuclear Officer Exelon Nuclear Oyster Creek Nuclear Generating Station 4300 Winfield Road Warrenville, IL 60555

SUBJECT:

TRANSMITTAL OF FINAL OYSTER CREEK NUCLEAR GENERATING STATION ACCIDENT SEQUENCE PRECURSOR REPORT (LICENSEE EVENT REPORT 219-2017-005)

Dear Mr. Hanson:

By letter dated January 3, 2018 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML18009A436), Oyster Creek Nuclear Generating Station submitted licensee event report (LER) 219-2017-005, "Failure of the Emergency Diesel Generator #2 During Surveillance Testing due to a Broken Electrical Connector," to the U.S. Nuclear Regulatory Commission (NRC) staff pursuant to Title 10 of the Code of Federal Regulations Section 50.73. As part of the Accident Sequence Precursor (ASP) Program, the NRC staff reviewed the event to identify potential precursors and to determine the probability of the event leading to a core damage state. The results of the analysis are provided in the enclosure to this letter.

The NRC does not request a formal analysis review, in accordance with Regulatory Issue Summary 2006-24, "Revised Review and Transmittal Process for Accident Sequence Precursor Analyses" (ADAMS Accession No. ML060900007), because the analysis resulted in an increase in core damage probability (.6CDP) of less than 1x104 .

Final ASP Analysis Summary. A brief summary of the final ASP analysis, including the results, is provided below.

Failure of Emergency Diesel Generator during Surveillance Testing due to a Broken Electrical Connector. This event is documented in LER 219-2017-005.

Executive Summary. On October 9, 2017, during the bi-weekly load test on emergency diesel generator (EOG) 2, a generator lockout signal was received which tripped the EOG output breaker. The EOG diesel had run for 4 minutes loaded in the procedurally prescribed band of 2600-2800 kilowatt prior to receiving the lockout signal. This failure resulted in EDG2 being declared inoperable, and the plant entered into an unplanned 7-day limiting condition for operation according to Technical Specification 3.7.C. Repairs were completed on October 101h and EOG 2 was satisfactorily tested and declared operable.

B. Hanson According to the risk analysis modeling assumptions used in this ASP analysis, the most likely core damage scenarios are loss of 4.16 kilovolt safety-related alternating current bus initiating event with opposite train electrical failures that result in failure of the isolation condensers, reactor depressurization, and/or containment temperature/pressure control. These accident sequences account for approximately 60 percent of the increase in core damage probability

(~CDP) for the event. The point estimate ~CDP for this event is 6x1Q-6 (internal events), which is considered a precursor in the ASP Program. The seismic contribution for 198-day unavailability of EOG 2 is ~CDP of 1x10-1 (approximately 2 percent of the internal events contribution).

To date, no performance deficiency associated with this event has been identified and, therefore, an independent ASP analysis was performed.

Summary of Analysis Results. This operational event resulted in a best estimate LlCDP of 6x10-6. The detailed ASP analysis can be found in the enclosure.

If you have any questions, please contact me at 301-415-3100 or via e-mail at John.Lamb@nrc.gov.

Sincerely, Joh . Lamb, Senior Project Manager Sp c*a1 Projects and Process Branch Div ion of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-219

Enclosure:

ASP Report (LER 219-2017-005) cc: Listserv

ENCLOSURE Final Accident Sequence Precursor Analysis - Oyster Creek Nuclear Generating Station, Failure of Emergency Diesel Generator during Surveillance Testing due to a Broken Electrical Connector (LER 219-2017-005) - Precursor (ADAMS Accession No. ML18130A649)

Final ASP Pro - Precursor Oyster Creek Nuclear Failure of Emergency Diesel Generator during Surveillance Generating Station Testing due to a Broken Electrical Connector LER(s): 219-2017-005 Event Date: 10/9/2017 flCDP =

IR(s): TBD General Electric Type 2 Boiling-Water Reactor (BWR) with a Mark I Plant Type:

Containment Plant Operating Mode Mode 1 (100% Reactor Power)

(Reactor Power Level):

Analyst: Reviewer: Contributors: Approval Date:

Christopher Hunter Ian Gifford N/A 5/23/2018 EXECUTIVE

SUMMARY

On October 9, 2017, during the bi-weekly load test on emergency diesel generator (EDG) 2, a generator lockout signal was received which tripped the EDG output breaker. The EDG had run for 4 minutes loaded in the procedurally prescribed band of 2600-2800 kilowatt (kW) prior to receiving the lockout signal. This failure resulted in EDG 2 being declared inoperable, and the plant entered into an unplanned 7-day limiting condition for operation (LCO) according to Technical Specification (TS) 3.7.C. Repairs were completed on October 10th and EDG 2 was satisfactorily tested and declared operable.

This accident sequence precursor (ASP) analysis reveals that the most likely core damage scenarios are a loss of 4.16 kilovolt (kV) safety-related alternating current (AC) bus initiating event with opposite train electrical failures that result in the unavailability of the isolation condensers, reactor depressurization, and/or containment temperature/pressure control. These accident sequences account for approximately 60 percent of the increase in core damage probability (~CDP) for the event. The point estimate ~CDP for this event is 6x 1Q-6 (internal events), which is considered a precursor in the ASP Program. The seismic contribution for 198-day unavailability of EDG 2 is ~CDP of 1 x 10-7 ( approximately 2 percent of the internal events contribution).

To date, no performance deficiency associated with this event has been identified and, therefore, an ASP analysis was performed since an SDP evaluation was not performed.

EVENT DETAILS Event Description. On October 9, 2017, during the bi-weekly load test on EDG 2, a generator lockout signal was received which tripped the EDG output breaker. The EDG had run for 4 minutes loaded in the procedurally prescribed band of 2600-2800 kW prior to receiving the lockout signal. This failure resulted in EDG 2 being declared inoperable, and the plant entered into an unplanned 7-day LCO (TS 3.7.C). Repairs were completed on October 10th and EDG 2 was satisfactorily tested and declared operable. Additional information is provided in licensee event report (LER) 219/2017-005 (Ref. 1).

1

LER 219-2017-005 Cause. During troubleshooting, the licensee identified a broken electrical ring lug connector on a current transformer that provides an input to the protective relay logic. A subsequent investigation determined the connector failure was due to fatigue cracking caused by stresses from bending and twisting of the electrical lug beyond the limits specified in industry guidelines.

The electrical lug was most likely stressed during initial installation in the 1990s.

MODELING ASSUMPTIONS Analysis Type. The Oyster Creek standardized plant analysis risk (SPAR) model, Version 8.52 dated December 7, 2017, was used for this condition assessment. This SPAR model version includes seismic inititiating events/

SDP Results/Basis for ASP Analysis. The ASP Program uses Significance Determination Process (SOP) results for degraded conditions when available (and applicable). To date, no inspection reports have been released that provide additional information on this event.

Discussions with Region 1 staff indicated that no performance deficiency has been identified to date; however, the LER remains open. An independent ASP analysis was performed given the lack of an identified performance deficiency and the potential risk significance of this event.

A search for additional Oyster Creek LERs was performed to determine if any initiating events or additional unavailabilities existed during the exposure period of EOG 2. This review revealed that a reactor scram occurred on July 3, 2017, which was during the period that EOG 2 was unable to fulfill its safety function. Operators manually scrammed the reactor due to degraded vacuum; however, a complete loss of condenser heat sink did not occur. See LER 219-2017-002 (Ref. 2) for additional information. A sensitivity analysis shows that a reactor trip concurrent with an EOG 2 failure-to-run results in a conditional core damage probability of the 1.8x 10-6, which is less than the !lCDP for this condition assessment.

Therefore, the ASP analysis result is reflected by the condition assessment provided in this report.

SPAR Model Modifications. The following base SPAR model modifications were made as part this analysis:

• The probabilities for stuck-open safety relief valves (SRVs) were recently updated in the SPAR models. These probabilities significantly increased from previous calculations because previous calculations did not consider the number of expected valve cycles, which increase the potential for a stuck-open SRV. However, Oyster Creek Nuclear Generating Station has isolation condensers that provide reactor pressure control and, therefore, limit SRV open and close cycles. Given this information, the probabilities of stuck-open SRV(s) were changed to previous calculations. Specifically, basic events PPR-SRV-00-1VLV (one BWR SRV fails to close), PPR-SRV-00-2VLVs (two or more BWR SRVs fails to close), and PPR-SRV-00-3VLVs (three or more BWR SRVs fails to close) were changed to 8.6x10 4 ,

1.3x104 , and 5.5x1Q-5 , respectively.

• The recirculation pump seals at Oyster Creek are the same as those installed at Nine Mile Point. These seals were evaluated to have a lower probability of failure; therefore, the probability for basic event RRS-MDP-LK-SEALS (recirculation pump seals fail during SBO) was changed to 5x10-2 .

• The following changes were made to the station blackout (SBO) event tree (the revised SBO event tree is shown in Figure A-2 of Appendix A):

2

LER 219-2017-005

- Basic event DCP-XHE-XM-LOADSHED (operator fails to shed unnecessary DC loads) is set to TRUE (i.e., no credit is provided) in the base SPAR model. A review of the plant information, including procedures, indicates that operators will shed DC loads during a SBO, thus extending time until battery depletion. According to revised licensee battery calculations, the nominal depletion time for the safety-related batteries at Oyster Creek Nuclear Generating Station is 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br />. The successful shedding of loads can extend the batteries to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The probability of basic event DCP-XHE-XM-LOADSHED was set to a screening value of 0.1. 1 Any further refinement of this human error probability (HEP) has a negligible effect on the results. The SBO event tree branching was modified to match the revised battery depletion times.

- Firewater injection to the reactor is not credited in the base SPAR model. Firewater can be injected into the reactor relatively quickly via redundant diesel-driven pumps. 2 To model this credit, the FWS (firewater injection) fault tree was replaced in the SBO event tree with the FWS3 (Oyster Creek firewater system) fault tree. Firewater is needed for all scenarios to provide inventory makeup to the reactor, including scenarios with successful operation of the isolation condenser(s) with no loss-of-coolant accident (LOCA). At a minimum, reactor inventory makeup is needed due to recirculation seal leakage and decreased reactor water level caused by the cooldown. If firewater injection is successful, it is assumed that restoration of AC power is necessary for operators to place the plant in a safe/stable end state.

- Some top events were eliminated from the SBO event tree because the safety functions were either not available during a SBO, their success or failure did not affect the potential for core damage, or were considered as part of other fault trees. These top events include EXT (actions to extend ECCS operation), DGR (diesel generator recovery), CVS (containment venting), and LI (/ate injection).

- The potential for EOG recovery was added to the applicable OPR ( offsite power recovered) fault trees. Specifically, basic events EPS-XHE-XL-NR30M (operator fails to recover emergency diesel in 30 minutes), EPS-XHE-XL-NR01 H (operator fails to recover emergency diesel in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />), EPS-XHE-XL-NR14H (operator fails to recover emergency diesel in 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br />), and EPS-XHE-XL-NR24H (operator fails to recover emergency diesel in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) were added to the OPR-30M (operator fails to recovery offsite power in 30 minutes), OPR-01 H ( operator fails to recovery offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />), OPR-14H (operator fails to recovery offsite power in 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br />), and OPR-24H (operator fails to recovery offsite power in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) fault trees, respectively. 3 These basic events were set to TRUE in the base SPAR model. An example of this modified fault tree logic (for OPR-14H) is provided in Figure B-1 of Appendix B.

- Increased failure probabilities for manual reactor depressurization and firewater injection were used for scenarios where less time is available for operators to initiate these functions. Therefore, for sequences that involve failures of isolation condensers and/or a LOCA, the DEP1 (manual reactor depressurization) and FWS3 fault trees were replaced by new fault trees, DEPISO (manual reactor depress (isolation condenser fails)) and FWSISO (firewater injection (isolation condenser fails)), respectively. These NUREG-1792, "Good Practices for Implementing Human Reliability Analysis," provides that 0.1 is an appropriate screening (i.e., typically conservative) value for most post-initiator human failure events.

The firewater pumps are low-head pumps and, therefore, manual reactor depressurization is needed for successful reactor injection.

3 The OPR-14H and OPR-24H fault trees were created based on the other OPR fault trees but with 14- and 24-hour specific offsite power and EDG recovery basic events.

3

LER 219-2017-005 two new fault trees include only a single basic event that represents the failure of operators to initiate these systems, which is expected to have a failure probability of at least two orders-of-magnitude higher than potential hardware failures. A new basic event, ADS-XHE-XM-MDEPRLOCA (operator fails to depressurize the reactor (LOCA or isolation condenser fails)), was inserted under the top gate in the DEPISOFAIL faulttree.

A new basic event, FWS-XHE-XL-ISO (operator fails to initiate firewater (LOCA or isolation condenser fails)), was inserted under the top gate in the FWSISO fault tree.

The probabilities of basic events ADS-XHE-XM-MDEPRLOCA and FWS-XHE-XL-ISO were set to a screening value of 0.1. Any further refinement of these HEPs has a minimal effect on the results. These fault trees are provided in Figures B-2 and B-3 of Appendix B.

Exposure Period. EOG 2 successfully passed its previous biweekly surveillance tests prior to the failure on October 9, 2017. However, the nature of the failure mechanism makes it likely that EOG 2 would not have been able to fulfill its safety function for its probabilistic risk assessment (PRA) mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for some time. Therefore, the run history for EOG 2 was used to estimate the exposure period (see the following table). Based on the run history, it has been determined that EOG 2 was unable to fulfill its safety function from March 26th until October 10, 2017, a period of 198 days.

8'(<<

10/10/2017 EDG 2 is repaired and returned to operable status 10/9/2017 Failed biweekly test 0.37 0.37 9/25/2017 Successful biweekly test 1.90 2.27 9/2/2017 Successful biweekly test 1.50 4.49 8/28/2017 Successful biweekly test 1.59 6.08 8/16/2017 Successful biweekly test 1.56 7.64 7/31/2017 Successful biweekly test 1.49 9.13 7/17/2017 Successful biweekly test 1.66 10.79 7/3/2017 Successful biweekly test 1.39 12.18 6/19/2017 Successful biweekly test 1.68 13.86 6/3/2017 Successful biweekly test 1.52 15.76 5/22/2017 Successful biweekly test 1.77 17.54 5/7/2017 Successful biweekly test 1.60 19.14 4/24/2017 Successful biweekly test 1.73 21.12 4/10/2017 Successful biweekly test 1.63 23.33 3/26/2017 Successful biweekly test 0.54 23.87 Key Modeling Assumptions. The following modeling assumptions were determined to be significant to the modeling of this event:

• Basic event EPS-DGN-FR-DG2 (diesel generator DG2 fails to run) was set to TRUE to represent the failure of EOG 2 to fulfill its safety function for the complete 24-hour mission time.

• EOG Recovery. After EOG 2 failed on October 9th, the licensee was able to repair and restore the EOG the next day (approximately 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br /> later). Discussions with Region 1 4

LER 219-2017-005 staff indicated that, if needed, the recovery could have been accomplished sooner. In a postulated SBO, it is estimated that EDG 2 could be repaired in approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. A conservative screening value of 0.1 was used for basic event EPS-XHE-XL-NR14H. 4 Any further refinement of this HEP has a negligible effect on the results. However, a more detailed evaluation was needed for the recovery of EDG 2 for the applicable 24-hour SBO sequences. Specifically, basic event EPS-XHE-XL-NR24H was evaluated using the SPAR-H Method (Ref. 3 and Ref. 4). Table 1 and Table 2 provide the key qualitative information for this human failure event (HFE) and the performance shaping factor (PSF) adjustments required for the quantification of the HEP using SPAR-H.

Table 1. Qualitative Evaluation of EPS-XHE-XL-NR24H The definition for this HFE is operators failing to repair EDG 2 within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> given a postulated loss of offsite power (LOOP) and subsequent SBO.

Given a LOOP and a failure of both EDGs, a subsequent SBO will occur. If the combustion turbine generators (CTGs) cannot be aligned, operators must restore AC power. Without recovery of AC power, the safety-related batteries will eventually deplete, rendering decay heat removal and reactor inventory makeup unavailable. Recovery of offsite power is modeled in separate basic events. This basic event represents the repair and restoration of EDG 2. Credit for recovery following the postulated failure of the other EDG is not provided.

Repair and restore EDG 2 to operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

• Safety-related bus under-voltage annunciators

• EDG failure annunciators Generic EDG maintenance and troubleshooting procedures exist; however, explicit procedures are not available. Skill-of-the-craft and other cues will indicate the

, failure cause to the technicians.

D,1~,N*rc>>t This HFE contains sufficient diagnosis and action components.

Table 2. SPAR-H Evaluation of EPS-XHE-XL-NR24H Time Available 0.01 I 1 It was determined through discussions with regional staff that the licensee, if needed, could have recovered EDG 2 in approximately 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Therefore, an additional 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> was available to determine the failure cause and complete repairs. A conservative estimate of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> was assumed for the time required to complete the repair (i.e, the action portion of the HFE), leaving approximately 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> available for diagnosis.

Therefore, diagnosis PSF for available time is set to Expansive Time (i.e., x0.01; greater than 2x nominal time and greater than 30 minutes).

Sufficient time exists to perform the action component of the offsite power recovery; therefore, the action PSF for available time is set to Nominal. See Ref. 4 for guidance on apportioning time between the diagnosis and action components of an HFE.

4 Recovery of the failed EOG is only given for SBO scenarios, which is potentially conservative.

5

LER 219-2017-005 Stress 2/ 1 The PSF for diagnosis stress is assigned a value of High Stress (i.e., x2) because core damage would occur if technicians fail to recover the EDG within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for the applicable scenario.

The PSF for action stress was not determined to be a performance driver for this HFE and, therefore, was assigned a value of Nominal (i.e., x1 ).

Complexity 5/1 The PSF for diagnosis complexity is assigned a value of Highly Complex (i.e., x5) because technicians would be dealing with multiple EDG failures that required troubleshooting.

The PSF for action complexity was not determined to be a performance driver for this HFE and, therefore, was assigned a value of Nominal (i.e., x1 ).

Procedures 5/1 The PSF for diagnosis complexity is assigned a value of Available, but Poor (i.e., x5) because technicians have guidance, but not explicit procedures for troubleshooting activities.

The PSF for action complexity was not determined to be a performance driver for this HFE and, therefore, was assigned a value of Nominal (i.e., x1 ).

Experience/Training 1/ 1 No event information is available to warrant a change in these Ergonomics/HM I PSFs (diagnosis or action) from Nominal for this HFE.

Fitness-for-Duty Work Processes An HEP evaluated using SPAR-H is calculated using the following formula:

Calculated HEP= (Product of Diagnosis PSFs x 0.01) + (Product of Action PSFs x 0.001)

Therefore, the probability of basic event EPS-XHE-XL-NR24H was set to 6x1Q-3 .

ANALYSIS RESULTS ACDP. The point estimate b.CDP for this event is 5.7x1Q-6, which is the sum of all exposure periods. The ASP Program acceptance threshold is a b.CDP of 1 x 1Q-6 for degraded conditions.

The b.CDP for this event exceeds this threshold; therefore, this event is a precursor.

Dominant Sequence. The dominant accident sequences are loss of safety-related bus 1C, sequences 32 and 14 (b.CDP = 1. ?x 1Q-6), which each contribute approximately 31 percent of the total internal events b.CDP. The dominant sequences are shown graphically in Figure A-1 Appendix A. Accident sequences that contribute at least 1.0 percent to the total internal events b.CDP for this analysis are provided in the following table.

Sequence CCDP CDP ACDP  % '

9esc;ription L01C 32 1.95x1Q-6 2.15x1Q-7 1.74X1 Q-6 30.5% Loss of safety-related bus 1C initiating event; successful reactor trip; offsite power remains available; isolation condensers fail; and reactor depressurization fails 6

LER 219-2017-005

~..,.,

L01C14

-CCDP

,:'>h-.:,t 1.96x1Q-6

-."i CDP 2.27x1Q*7 ACDP 1.74X1Q-6 30.5%

'f)escitfptlorJ Loss of safety-related bus 1C initiating event; successful reactor trip; offsite power remains available; isolation condensers fail; operators restore main feedwater (MFW); condenser heat sink fails; reactor depressurization fails; suppression pool cooling fails; and containment venting fails LOOP 16 3.98X1Q*7 2.33x1Q-8 3.75x1Q*7 6.6% LOOP initiating event; successful reactor trip; emergency power system succeeds; makeup to isolation condensers fails; control rod drive injection fails; and reactor depressurization fails LOOP 29-36 3.32x1Q*7 9.99x1Q*9 3.23x1Q*7 5.7% LOOP initiating event; successful reactor trip; emergency power system fails resulting in an SBO; safety relief valve (SRV) fails to close resulting in a LOCA; isolation condensers succeed; and offsite power recovery within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> fails LOOP 29-17 2.86x1Q*7 8.45E-09 2.78x1Q*7 4.9% LOOP initiating event; successful reactor trip; emergency power system fails resulting in an SBO; CTGs fail; recirculation pump seals fail resulting in a LOCA; isolation condensers succeed; reactor depressurization fails; and failure of offsite power recovery within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> LOOP 29-15 2.58x1Q*7 7.59x1Q*9 2.sox10-7 4.4% LOOP initiating event; successful reactor trip; emergency power system fails resulting in an SBO; CTGs fail; recirculation pump seals fail resulting in a LOCA; isolation condensers succeed; reactor depressurization succeeds; firewater injection fails; and failure of offsite power recovery within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> TRANS14 1.36x1Q*7 2.17x1Q-8 1.14x1Q*7 2.0% Transient initiating event; successful reactor trip; offsite power remains available; isolation condensers fail; MFW succeeds; condenser heat sink fails; reactor depressurization fails; suppression pool cooling fails; and containment venting fails TRANS 32 1.27x1Q*7 2.43x1Q-8 1.03x1Q*7 1.8% Transient initiating event; successful reactor trip; offsite power remains available; isolation condensers fail; MFW fails; and reactor depressurization fails 7

LER 219-2017-005

~  :.Ceo, . **CDP ACDP  % Deacr1ptlon LOOPWR 12 9. 73x1Q-8 4.50x1Q-9 9.28x1 o-a 1.6% Weather-related LOOP initiating event; successful reactor trip; emergency power system succeeds; makeup to isolation condensers fails; control rod drive injection fails; reactor depressurization succeeds; low-pressure coolant injection succeeds; failure of offsite power recovery within 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />; suppression pool cooling fails; shutdown cooling fails; successful containment venting; and late (alternate) injection fails LOOPWR 29-26 7.95x10-a 2.74x1Q-9 7.67x1Q-8 1.3% Weather-related LOOP initiating event; successful reactor trip; emergency power system fails resulting in an SBO; CTGs fail; isolation condensers fail; reactor depressurization fails; and failure of offsite power recovery within 30 minutes LOOPWR 29-24 7.15x1Q-8 2.44x1Q-9 6.91 x1 o-a 1.2% Weather-related LOOP initiating event; successful reactor trip; emergency power system fails resulting in an SBO; CTGs fail; isolation condensers fail; reactor depressurization succeeds; firewater injection fails; and failure of offsite power recovery within 30 minutes LOOPSC 29-38 6.99x1Q-8 3.52x1Q-9 6.63x1Q-8 1.2% Switchyard-centered LOOP initiating event; successful reactor trip; emergency power system fails resulting in an SBO; and multiple SRVs fail to close Total 1.27X1 o-s 6.98X10-6 5. 70X10-6 Uncertainties. The best estimate analysis does not consider FLEX credit or successful run time of EDG 2 (for the applicable portion of the exposure period), which is potentially conservative. A review of the sequences/cut sets indicates that crediting FLEX would not significantly affect the results because the dominant sequences/cut sets are either non-SBO scenarios or short-term SBO scenarios (core damage within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or less). Therefore, it is expected that there is inadequate time available mitigate these scenarios through the implementation of FLEX.

ASP analyses use the "failure memory" approach in which successful operation of equipment is not credited. 5 However, EDG 2 successfully passed its biweekly surveillance tests prior to the failure on October 9, 2017. Therefore, depending on when it was demanded, it is likely that the 5

Convolution factors are applied to the postulated failures-to-run of the other EOG.

8

LER 219-2017-005 EOG 2 would have run for some time prior to failing within the PRA mission time (i.e., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />).

Recent ASP analyses have included a sensitivity analysis crediting additional time for the expected successful run time for the failed EOG (based on the surveillance test data) by adjusting the offsite power recovery probabilities for the applicable exposure periods. However, a review of the dominant sequences/cut sets reveals that this credit would have a negligible effect on the results and, therefore, no quantitative analysis was performed.

Seismic Contribution. Historically, independent condition assessments performed as part of the ASP Program only included the risk impact from internal events and did not include the consideration of other hazards such as fires, floods, earthquakes, etc. 6 The reason for the exclusion of the impacts of other hazards in most ASP analyses was due to the lack of modeling capability within the SPAR models. However, seismic hazards modeling was completed for all SPAR models in December 2017. Therefore, beginning in 2018, seismic hazards will be evaluated as part of all condition assessments performed by the ASP Program. The seismic contribution for an EOG 2 unavailability of 198 days is f1CDP of 1.2x 10-7

• The following table provides the seismic bin results that contribute at least 1 percent of the total seismic f1CDP for this analysis.

Seismic Bin

• ACOP Notes/Observations Seismic Event in Bin 3 7.25x1Q-8 Dominant scenarios are seismically-induced LOOP and small (0.5-1.0 G) occurs LOCA. Seismically induced electrical failures (e.g., batteries, (Bin peak ground 480 volt AC buses) or failure of low-pressure core spray result in acceleration (PGA) 0. 71) a failure of reactor depressurization capability, reactor inventory makeup, and/or containment temperature/pressure control.

Seismic Event in Bin 2 4.1 Ox1 o-a Similar sequences and cut sets to Seismic Bin 3, except with (0.3-0.5 G) occurs lower seismic failure probabilities.

(Bin PGA 0.39)

Seismic Event in Bin 4 6.35x10-9 Dominant scenarios are seismically-induced LOOP and small (1.0-1.SG) occurs LOCA. Seismically induced electrical failures low-pressure core (Bin PGA 1.22) spray and service water/turbine building cooling water result in a failure of reactor inventory makeup.

Seismic Event in Bin 1 3.75x1Q*9 Dominant scenarios are seismically-induced LOOP and small (0.1-0.3 G) occurs LOCA. Random failure of the other EDG results in SBO with (Bin PGA 0.17) core damage assumed.

t-----------+----

TOTAL= 1.24x1Q*7 6 Initiating events caused by other hazards (e.g., tornado results in a LOOP) or degradations specific to a particular hazard (e.g., degraded fire barrier) have been analyzed as part of ASP Program.

9

LER 219-2017-005 REFERENCES

1. Oyster Creek Nuclear Generating Station, "LER 219/17-005 - Failure of the Emergency Diesel Generator #2 During Surveillance Testing due to a Broken Electrical Connector,"

dated January 3, 2018 (ADAMS Accession No. ML18009A436).

2. Oyster Creek Nuclear Generating Station, "LER 219/17-002- Manual Scram due to Degraded Main Condenser Vacuum," dated August 31, 2017 (ADAMS Accession No. ML17249A124 ).

3. Idaho National Laboratory, NUREG/CR-6883, "The SPAR-H Human Reliability Analysis Method," August 2005 (ADAMS Accession No. ML051950061).

4. Idaho National Laboratory, "INUEXT-10-18533, SPAR-H Step-by-Step Guidance,"

May 2011 (ADAMS Accession No. ML112060305).

10

l.t) 0 I :'. ~~~~ :~~~~~~* ~; ~* :'~* ~~~~~~- :

0 0:::

"~~I  ! ~~

w

..J

~ ./ 11 ~ 1~ 1~ 1111111 U

! 1, l ~ ~ ~ lllllllU ~

i 1* 1 j ,1 1

1 11 I

r1 1111111!

1111111 i

, '1 1 1 1 1 111111 ~

I, f 111111

~ f IU

~1 l l 1~ I I

= T i e 6 i "

LER 219-2017-005

~==---'

~==---'ICD n==-'

m==---'

~==--_J'I l"n==-'

m==CD=--'

~;::=~->

rn==---'

r,nr==__,,)

rn==-'

rP=_:________)

~===---'

f"igure A-2

• Mod*t*

11edOyster Creek SBO Event Tree A-2

LER 219-2017-005 Appendix B: Modified Fault Trees

~. .~litJ4 El'S-Jllf-llL-tfll'IH TIU! El'S->>E-IIL-tfll'IH TIU! El'S-IIHE-IIL-tfll'IH TIU! El'S->>E-IIL-tfll'IH TIU!

Figure B-1. Modified OPR Fault Tree 8-1

LER 219-2017-005 OPERATOR FAILS TO ESSURIZE 11-iE REACTOR A OR ISOLATION CONDENSER 1.00E-01 Figure B-2. DEPISO Fault Tree

,RATOR FAILS TO INITIATE ATER (LOCA OR ISOLATION CONDENSER FAILS) 1.00E-01 Figure B-3. FWSISO Fault Tree B-2

Package ML18200A026; Letter ML18193A028; ASP Report ML18130A649

• via email OFFICE NRR/DORL/LSPB/PM NRR/DORL/LSPB/LA* NRR/DORL/LSPB/BC NRR/DORL/LSPB/PM NAME JLamb JBurkhardt EMiller for DBroaddus JLamb DATE 7/18/18 7/19/18 7/20/18 7/20/18