ML19119A276

U.S. Nuclear Regulatory Commission Accident Sequence Precursor Program 2018 Annual Report

ML19119A276
Person / Time
Issue date:	04/30/2019
From:	Michael Cheok NRC/RES/DRA
To:
C. Hunter 301-415-1394
Shared Package
ML19119A274	List: ML19119A275 ML19119A276
References
Download: ML19119A276 (43)

Text

U.S. Nuclear Regulatory Commission Accident Sequence Precursor Program 2018 Annual Report April 2019 Contacts:

Christopher Hunter, (301) 415-1394 (Christopher.Hunter@nrc.gov)

Felix Gonzalez1, (301) 415-2413 (Felix.Gonzalez@nrc.gov) 1 Chief, Performance and Reliability Branch Performance and Reliability Branch Division of Risk Analysis Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

Summary of ASP Program Results 2018 Results. Based on the review of all 138 precursors.

licensee event reports (LERs) issued during

• 62 percent of all precursors used SDP calendar year 2018 and the results from the evaluation results for the ASP Program Significance Determination Process (SDP), purposes.

6 events were determined to be precursors.

Two of these precursors had late-2017 event

• The last significant precursor (i.e.,

dates and, therefore, are included in the 2017 conditional core damage probability precursor counts for trending purposes. An (CCDP) or increase in core damage independent Accident Sequence Precursor probability (CDP) greater than or equal (ASP) analysis was performed to determine to 10-3) was identified in 2002, which the risk significance of three precursors, while involved concurrent degraded conditions SDP results were used for the other three at the Davis Besse nuclear power plant.

precursors.

• Seven precursors with a CCDP or CDP greater than or equal to 10-4 were ASP Trends. Trend analyses of precursor identified in 2010-2012; however, none data are performed on a rolling 10-year have been identified since.

period (i.e., 2009-2018 for this report). In

• 59 percent of the precursors with a CCDP addition, trend analyses are performed on a or CDP greater than or equal to 10-5 are rolling 20-year period (i.e., 1999-2018 for this due to initiating events (with the report) to provide a historical perspective. remaining from degraded conditions). Of The following table provides the updated these, approximately three-quarters were results of these analyses1: the result of a LOOP.

• Precursors involving degraded conditions 10-Year 20-Year Precursor Category Trend Trend (90 precursors) outnumbered initiating events (48 precursors).

All Precursors

• 35 percent of initiating event precursors Precursors with a resulted from natural phenomena CCDP/CDP >10-4 (e.g., severe weather, seismic, etc.).

Precursors with a CCDP/CDP >10-5

• Of the 90 degraded condition precursors, 26 percent existed for at least 10 years.

Initiating Events

• Of the 41 precursors involving a degraded Degraded Conditions condition(s) at boiling-water reactors Emergency Diesel Generator (BWRs), most were caused by failures in (EDG) Unavailabilities the emergency core cooling systems Loss of Offsite Power (LOOP) (39 percent), others were caused by Events failures in emergency power system Boiling-Water Reactors (34 percent), and safety-relief valves (BWRs) (10 percent).

Pressurized-Water Reactors

• Of the 49 precursors involving a degraded (PWRs) condition(s) at pressurized-water reactors (PWRs), most were caused by failures in Key Insights. The following are some key the emergency power system ASP Program insights for the past decade: (35 percent), others were caused by

• The ASP Program has documented failures in the auxiliary feedwater system 1 Horizontal arrows indicate that no increasing or decreasing trend exists. Up and down arrows indicated that there is a statistically significant increasing or decreasing trend, respectively.

i

(27 percent), safety-related cooling water

• Licensee risk management initiatives are systems (12 percent), emergency core effective in maintaining a flat or cooling systems (12 percent), or electrical decreasing risk profile for the industry.

distribution system (6 percent).

• There are no indications of increasing risk due to the potential cumulative impact of Conclusions. A review of the ASP Program risk-informed initiatives.

data and trends for the past decade indicates that:

• No new component failure modes or mechanisms have been identified, and

• Current agency oversight programs and the likelihood and impacts of accident licensing activities remain effective as sequences have not changed.

shown by decreasing 10-year trends in the occurrence rate of all precursors (and most precursor subgroups) and the decreasing overall risk from precursors as shown in the integrated ASP index.

ii

TABLE OF CONTENTS

1. Background .......................................................................................................................... 1

2. Program Objectives .............................................................................................................. 1

3. Program Scope .................................................................................................................... 2

4. ASP Process ........................................................................................................................ 3

5. Analysis Types and Program Thresholds ............................................................................ 5

6. 2018 ASP Results ................................................................................................................ 7

7. ASP Trends and Insights ..................................................................................................... 9 7.1. All Precursors ........................................................................................................... 9 7.2. Significant Precursors ............................................................................................ 10 7.3. Precursors with a CCDP or CDP Greater than or Equal to 10-4 ........................... 10 7.4. Precursors with a CCDP or CDP Greater than or Equal to 10-5 ........................... 13 7.5. Precursors Involving Initiating Events and Degraded Conditions ........................... 13 7.6. Precursors Involving a LOOP Initiating Event ........................................................ 16 7.7. Precursors at BWRs and PWRs ............................................................................. 17

8. ASP Index .......................................................................................................................... 19

9. Comparison of Recent Program Pesults ............................................................................ 20

10. LER Screening Quality Assurance Review ........................................................................ 23 Appendix A: 2018 ASP Program Screened Analyses ............................................................... A-1 Appendix B: Historical Precursor Occurrence Rates ................................................................ B-1 iii

1. BACKGROUND The U.S. Nuclear Regulatory Commission (NRC) formed the Risk Assessment Review Group (commonly referred to as the Lewis Committee) to perform an independent evaluation of WASH-1400, The Reactor Safety Study. That committee made multiple recommendations in 1978, including that more use be made of operational data to assess the risk from commercial nuclear power plants (NPPs). Specifically, NUREG/CR-0400, Risk Assessment Review Group Report (also known as the Lewis Report) stated:

It is important, in our view, that potentially significant sequences and precursors, as they appear, be subjected to the kind of analysis contained in WASH-1400, in such a way that the analyses are subjected to peer review.

After the accident at Three Mile Island (Unit 2), the NRC instituted a special inquiry to review and report on the accident. The principal objectives of the inquiry were to:

• Determine what happened and why;

• Assess the actions of utility and NRC personnel before and during the accident; and

• Identify deficiencies in the system and areas where further investigation might be warranted.

This inquiry, as documented in NUREG/CR-1250, Three Mile Island; A Report to the Commissioners and to the Public (also known as the Rogovin Report) concluded, in part, that:

the systematic evaluation of operating experience must be undertaken on an industrywide basis, both by the utility industry, which has the greatest direct stake in safe operations, and by the NRC.

In response to these insights and recommendations, the NRC established the Accident Sequence Precursor (ASP) Program as part of the Office of Analysis and Evaluation of Operational Data (AEOD). In 1998, the Commission issued a Staff Requirements Memorandum, SECY-98-228, Proposed Streamlining and Consolidation of AEOD Functions and Responsibilities, which approved the transfer of the ASP Program to the Office of Nuclear Regulatory Research (RES). The Commission stated that:

The lessons learned from the independent assessment of operational events must continue to be shared with the nuclear industry in an effort to improve the safety of licensed operations and to assess the effectiveness of agency wide programs. It is important that these functions continue with a degree of independence and, in particular, remain independent of licensing functions. The Office of Research should provide focused analysis of the operational data and not expend scarce resources on those operational incidents that are not risk significant.

2. PROGRAM OBJECTIVES The ASP Program has the following primary objectives:

• Assists in ensuring that the agency meets Safety Objective 1 (see NRC Strategic Plan)to prevent, mitigate, and respond to accidents and ensure radiation safety.

• Contributes to Safety Strategy 1 (see NRC Strategic Plan) to evaluate domestic and 1

international operating events and trends and advances in science and technology for safety implications and enhance the regulatory framework as warranted.2

• Assists in fulfillment of agency Safety Performance Goal 4 (see NRC Congressional Budget Justification)to prevent accident precursors and reductions of safety margins at commercial nuclear power plants (operating or under construction) that are of high safety significance.3

• Assesses the efficacy of existing agency programs (Appendix B in the NRC Strategic Plan) and helps shape the agencys objectives and strategies for reactors.4

• Reviews and evaluates operating experience to identify precursors to potential core damage in accordance with Management Directive (MD) 8.7, Reactor Operating Experience Program.

Additional ASP Program objectives include:

• Providing feedback to improve NRC Standardized Plant Analysis Risk (SPAR) models.

- Examples include: common-cause interactions and events; operator recovery actions; inclusion of support systems; alternate success paths.

- Models are used in a different manner and reviews of model results allow for model improvements that aid other NRC programs (e.g., SDP, MD 8.3).

- Assists in fulfillment of the MD 8.7 requirement to provide feedback to agency risk models based on operating experience lessons learned from the application of these tools and models.

• Providing analyses to licensees for incorporation into their operating experience programs.

• Increasing NRC and licensee staff knowledge and increasing better harmonization of the PRA models by discussing and reviewing key modeling issues and assumptions with licensees. In addition, the ASP Program can provide insights into the adequacy of current PRA standards and guidance.

• Communicating risk-significant insights not associated with licensee performance to enable consideration of corrective actions or plant improvements, as appropriate.

3. PROGRAM SCOPE The ASP Program is one of three agency programs that assess the risk significance of events at operating NPPs. The other two programs are the Significance Determination Process (SDP), as defined in Inspection Manual Chapter (IMC) 0609, and the event-response evaluation process, as defined in MD 8.3, NRC Incident Investigation Program. The SDP evaluates the risk significance of a single licensee performance deficiency, while the risk assessments performed under MD 8.3 are used to determine, in part, the appropriate level of reactive inspection in response to an event. An SDP assessment has the benefit of information obtained from the 2 The ASP Program scope is limited to domestic operating events and trends.

3 The ASP Program defines a significant precursor as an event with a conditional core damage probability (CCDP) or change in core damage probability (CDP) greater than or equal to 10-3. Significant precursors are an input into the annual Abnormal Occurrence (AO), Congressional Budget Justification, and Performance and Accountability reports to Congress.

4 The Reactor Oversight Process (ROP) and AO Report are the two other program that provide this function.

2

inspection, whereas the MD 8.3 assessment is expected to be performed within several days of the event notification.

In contrast to the other two programs, a comprehensive and integrated risk analysis under the ASP Program includes all anomalies observed at the time of the event or discovered after the event. These anomalies may include unavailable and degraded plant structures, systems, and components (SSCs); human errors; and an initiating event (reactor trip). In addition, an unavailable or degraded SSC does not have to be attributed to a performance deficiency (e.g., SSCs out for test and maintenance) or an analyzed condition in the plant design basis.

The ASP Program has the benefit of time to complete the analysis of complex issues and thus produces a more refined estimate of risk. The ASP Program analysis schedules provide time so that NRC or licensee engineering evaluations can be made available for review. State-of-the-art methods can be developed, or current techniques can be refined for unique conditions when necessary. In addition, the SPAR models can be modified for special considerations (e.g., hazards such as seismic, internal fires, and flooding). The discussion of these differences is meant to highlight the programmatic differences and how they impact the results of risk assessments. Each program has been designed to achieve their respective objectives in an efficient manner.

There are similarities in the risk assessments conducted by the three programs. All three programs use SPAR models, the same documented methods and guidance in the Risk Assessment Standardization Project (RASP) manual, and similar analysis assumptions.

Differences arise where the programs objectives deviate from one another. ASP and SDP analyses assumptions are typically the same when the event is driven by a single performance deficiency. Because of this specific similarity, since 2006, in accordance with Regulatory Issue Summary (RIS) 2006-24, Revised Review and Transmittal Process for Accident Sequence Precursor Analyses, SDP results have been used in lieu of ASP analyses in specific instances where the SDP analyses considered all concurrent degraded conditions or equipment unavailabilities that existed during the time period of the condition. For initiating events, many of the modeling assumptions made for MD 8.3 analyses can be adopted by ASP analyses.

However, it often becomes necessary to revise some modeling assumptions as more detailed information about the event becomes available upon completion of inspection activities. In addition, there are program differences on how certain modeling aspects are incorporated (e.g.,

SSCs unavailable due to testing or maintenance). These key similarities provide opportunities for significant ASP Program efficiencies. For a potential significant precursor, analysts from the three programs work together to provide a timely determination of plant risk. As such, duplication between the programs is minimized to the extent practicable within the program objectives.

4. ASP PROCESS To identify potential precursors, the staff reviews operational events from all licensee event reports (LERs) submitted to the NRC per Title 10 of the Code of Federal Regulations (10 CFR)

Section 50.73. In recent years, there are approximately 300 to 400 LERs issued each year.

Idaho National Laboratory (INL) performs this initial LER screening as part of their LER review activities that support other NRC data collection activities (e.g., initiating event and system studies). Each LER is evaluated (on a plant unit basis) against qualitative screening criteria to identify events that warrant further analysis as potential precursors. If an LER describes an event that does not meet one of the candidate ASP (cASP) criteria, then the LER is screened out of the ASP Program.

3

In July 2018, RES and INL staff completed a review of the cASP criteria to identify revisions that would maximize the number of LERs screened out in the initial process while ensuring the criteria are sufficiently broad to identify all potential precursors that require a more detailed evaluation. Notable changes include: the removal of the recoverable loss of main feedwater (MFW) events from Criterion 2, shifting the focus of Criterion 3 away from safety system functional failures that could result in loss of a single train of safety-related equipment being prematurely screened out, and an increase in the risk threshold in Criterion 4 from 10-8 to 10-6.

The revised cASP criteria are provided below:

• Criterion 1Unplanned Scrams with Complications. Did the event involve an unplanned scram with a complication that results in a yes to any question per Nuclear Energy Institute (NEI) 99-02, Regulatory Assessment Performance Indicator Guideline?

Pressurized-Water Reactors (PWRs)

- Failure of two or more control rods to insert

- Failure of turbine to trip

- Loss of power to safety-related electrical bus

- Safety injection signal

- Non-recoverable loss of MFW

- Operators entered emergency procedures other than scram procedure Boiling-Water Reactors (BWRs)

- Failure of reactor protection system (RPS) to indicate or establish a shutdown rod pattern for a cold clean core

- Pressure control unavailable following initial transient

- Loss of power to safety-related electrical bus

- Level 1 injection signal

- Non-recoverable loss of MFW

- Reactor pressure/level and drywell pressure meet the entry conditions for emergency operating procedures

• Criterion 2Core Damage Initiators. Did the reactor scram due to either an initial plant fault or a functional impact in one of the following categories from NUREG/CR-5750, Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995?

- Loss of offsite power (LOOP), including partial LOOP events

- Loss of safety-related electrical bus

- Loss of instrument air

- Loss of safety-related cooling water (e.g., service water)

- Steam generator tube rupture

- Loss-of-coolant accidents (LOCAs)

- High-energy line break

- Loss of condenser heat sink

• Criterion 3Failure of Safety-Related Systems or Components. A loss of safety function for one or more trains of the following safety related systems require a detailed analysis to be performed.

- RPS

- Auxiliary feedwater (AFW) or emergency feedwater

- Essential service water 4

- Emergency core cooling systems (ECCS)

- Emergency alternating current (AC) and direct current (DC) power systems

- Ultimate heat sink

- Safety relief valve (SRV) or reactor coolant system (RCS) pressurizer relief valve

• Criterion 4Risk Significant Events Based on a Probabilistic Risk Assessment (PRA).

Events in which the licensee indicates the CCDP or CDP was greater than or equal to 10-6.

• Criterion 5Other Risk-Significant Events. Any event that, based on the reviewers experience, could have resulted in potential core damage.

Typically, 70 to 85 percent of all LERs are screened out of the ASP Program in this initial process. This initial screening supports agency efficiency goals by focusing risk analyst resources on events of higher risk significance. For LERs that are determined to be potential precursors, the staff uses risk evaluations performed as part of the SDP for degraded conditions in accordance with RIS 2006-24, when possible. However, if potential precursors associated with LERs involve an initiating event (e.g., loss of condenser heat sink, LOOP), are "windowed" (i.e., are concurrent with other degraded condition(s)), or were not evaluated by the SDP (e.g.,

no performance deficiency was identified), then an independent ASP analysis is performed.

Independent ASP analyses are conducted using the NRC's SPAR models and the Systems Analysis Programs for Hands on Integrated Reliability Evaluations (SAPHIRE) software.

Additional details on the ASP process are provided in Figure 1.

5. ANALYSIS TYPES AND PROGRAM THRESHOLDS An operational event can be one of two types: (1) a degraded plant condition characterized by the unavailability or degradation of equipment without the occurrence of an initiating event, or (2) the occurrence of an initiating event, such as a reactor trip or a loss of offsite power, with or without any subsequent equipment unavailability or degradation.

For the first type of event, the staff calculates a CDP. This metric represents the increase in core damage probability for the period during which a component, or multiple components, were deemed unavailable or degraded. The ASP Program defines a degraded condition with a CDP greater than or equal to 10-6 to be a precursor.

For the second type of event, the staff calculates a CCDP. This metric represents a conditional probability that a core damage state is reached given the occurrence of the observed initiating event (and any subsequent equipment failure or degradation). When the value of the plant-specific CCDP for a non-recoverable loss of feedwater and condenser heat sink is greater than 10-6, the value of the plant-specific CCDP is used as the threshold for an initiating event precursor. This ensures the more safety-significant events are analyzed. Since 1988, this initiating-event precursor threshold has screened out uncomplicated trips (i.e., reactor trips with no losses of safety-related equipment) from being precursors because of their relatively low risk significance.

Historically, ASP analyses have been focused on the risk due to internal events unless an external hazard (e.g., fires, floods, seismic) resulted in a reactor trip (e.g., seismically induced LOOP) or a degraded condition is specific to an external hazard (e.g., degraded fire barrier).

This limitation was due to lack of external event modeling in the SPAR models for all plants.

However, the incorporation of seismic hazards in all SPAR models was completed in December 2017. Therefore, the decision was made to evaluate seismic risk for all degraded conditions. The inclusion of seismic hazard risk in ASP analyses will improve the SPAR models 5

Figure 1. ASP process diagram 6

by identifying issues and insights in the seismic scenarios. To maintain consistency with previous ASP evaluations, and to study the effect of the inclusion of seismic scenarios, ASP results are documented with seismic contribution separated from the internal events impact. As SPAR models (for all plants) incorporate other external hazards (e.g., high winds), ASP analyses will evaluate the risk of these hazards when the modeling efforts are completed.

The ASP Program defines a significant precursor as an event with a CCDP or CDP greater than or equal to 10-3. Significant precursors are included in the annual AO (Criterion II.C) and Performance and Accountability (Safety Performance Goal 4) reports to Congress.

Note that when risk evaluations performed as part of the SDP are used for ASP program purposes, the SDP color representing the significance of the inspection finding is used as the official ASP Program result. The associated risk of the four SDP colors is as follows:

• Red (High Safety Significance), which corresponds to an event with a CCDP/CDP greater than or equal to 10-4;

• Yellow (Substantial Safety Significance), which corresponds to an event with a CCDP/CDP greater than or equal to 10-5, but less than 10-4;

• White (Low to Moderate Safety Significance), which corresponds to an event with a CCDP/CDP greater than or equal to 10-6, but less than 10-5; and

• Green (Very Low Safety Significance), which corresponds to an event with a CCDP/CDP less than 10-6.

6. 2018 ASP RESULTS There were 253 LERs reviewed during calendar year 2018. From these LERs, 215 (approximately 86 percent) were screened out in the initial screening process and 38 events were selected and analyzed as potential precursors. Of the 38 potential precursors, 6 events were determined to exceed the ASP Program threshold and, therefore, are precursors.5 For three of these precursors, the performance deficiency identified under the SDP documented the risk-significant aspects of the event completely. In these cases, the SDP significance category (i.e., the color of the finding) is reported as the ASP Program result. An independent ASP analysis was performed to determine the risk significance of the other three precursors. Table 1 provides a brief description of all precursors identified in 2018. Two of these precursors had late-2017 event dates and, therefore, are included in the 2017 precursor counts for trending purposes. There was no significant seismic risk impact in any of the six precursors.

5 Note that LER 277-2018-002 issued for Peach Bottom Atomic Power Station (Unit 2) corresponds to a precursor for both units.

7

Table 1. 2018 precursors Event Exposure CCDP/CDP ADAMS Plant LER Description Date Period SDP Color Accession #

Peach Bottom 3 Emergency diesel generator air inlet check valve failure 277-2018-002 6/3/2018 196 days results in a condition prohibited by technical White ML18341A206 Peach Bottom 2 specifications Division 2 diesel generator inoperability due to air Clinton 461-2018-002 5/17/2018 10 days receiver remaining isolated following clearance removal White ML19092A212 resulting in unplanned shutdown risk change Reactor core isolation cooling system pressure switch Peach Bottom 3 278-2018-001 4/22/2018 48 days failure results in condition prohibited by technical 3x10-6 ML18352B099 specifications Division 1 transformer failure leads to instrument air Initiating Clinton 461-2017-010-02 12/9/2017 Event isolation to containment requiring a manual reactor 8x10-6 ML19050A510 scram Failure of emergency diesel generator during Oyster Creek 219-2017-005 10/9/2017 198 days 6x10-6 ML18130A649 surveillance testing due to a broken electrical connector 8

After further analysis, the remaining 33 LERs identified by the initial LER screening (as described in Section 4) were determined not to be precursors.6 These events were evaluated not to be precursors by acceptance of SDP results (5 events), completion of a simplified/bounding analysis (25 events), or a detailed ASP analysis (2 events). Detailed ASP analyses for events determined to not be precursors were performed for emergency diesel generator failures at River Bend and Calvert Cliffs (Unit 2). See Agencywide Documents Access and Management System (ADAMS) Accession Nos. ML19046A034 and ML19072A240 for additional information on these two analyses. Additional information on the LERs determined not to be precursors via a simplified/bounding analysis or by acceptance of SDP results is provided in Appendix A.

7. ASP TRENDS AND INSIGHTS This section provides the results of trending analyses performed for several different precursor categories and discusses any insights identified. The purpose of the trending analysis is to determine if a statistically significant trend exists for the precursor group of interest during a specified period. A statistically significant trend is defined in terms of the p-value. A p-value is a probability indicating whether to accept or reject the null hypothesis that no trend exists in the data.7 A p-value less than or equal to 0.05 indicates that there is 95 percent confidence that a trend exists in the data (i.e., leading to a rejection of the null hypothesis that there is no trend).

The data period for ASP trending analyses is a rolling 10-year period (i.e., 2009-2018 for this report). In addition, data and trending information for the past 20 years (i.e., 1999-2018 for this report) is provided for a longer-term perspective. Note that the figures in this report only include a trend line if a statistically significant increasing or decreases trend was observed.8 If a precursor subgroup has statistically significant trend for both the 10- and 20-year periods, a trend line is only shown for the 10-year trend.

7.1. All Precursors Trending of all precursor analyses provides insights as part of the agencys long-term operating experience program.

• Trend. Over the past decade (2009-2018), the mean occurrence rate of all precursors exhibits a statistically significant decreasing trend (p-value = 0.002).9 See Figure 2 for additional information.

• Long-Term Trend. There is no statistically significant trend (p-value = 0.08) for the mean occurrence rate of all precursors over the past 20 years (1999-2018). A figure containing the precursor occurrence rates for complete history of the ASP Program is provided in Appendix B.

• Use of SDP Results. Over the past decade, 64 percent of all precursors used SDP evaluation results for the ASP Program purposes. These precursors typically involve a 6 This number includes LER 440-2018-001 issued for Perry Nuclear Power Plant that was associated a precursor previously identified based on an SDP White finding. See ASP Program 2017 Annual Report (ML18130A856) for additional information.

7 For the purposes of this analysis, the null hypothesis is based on a constant-rate Poisson process producing the observed data set. A lower p-value indicates a lower likelihood that the observed data could be produced by this constant-rate process.

8 For figures with statistically significant trends, the solid line is the fitted occurrence rate of precursor using a Poisson process model. The dashed lines represent the 90-percent confidence band for the fitted occurrence rate.

9 The occurrence rate is calculated by dividing the number of precursors by the number of reactor years.

9

single unavailability or degradation in which no initiating event occurred. However, in a few cases the SDP condition assessment risk exceeded the ASP initiating event risk and, therefore, was used as the final ASP Program result.

Figure 2. Occurrence rate of all precursors 7.2. Significant Precursors The NRCs Congressional Budget Justification (NUREG-1100) uses performance indicators to measure and evaluate performance as part of the NRCs planning, budget, and performance management process. The number of significant precursors identified by the ASP program is one of several inputs to a safety performance indicator used to monitor the agencys Safety Performance Goal 4. No significant precursors were identified in 2018. The last significant precursor was identified in 2002, which involved concurrent, multiple degraded conditions at the Davis-Besse nuclear power plant. Additional information on all significant precursors identified since 1969 is provided in Appendix B of the ASP Program 2017 Annual Report.

7.3. Precursors with a CCDP or CDP Greater than or Equal to 10-4 Precursors with a CCDP or CDP greater than or equal to 10-4 are important in the ASP Program because they generally have a CCDP higher than the annual CDP estimated by most plant-specific PRAs.10 The staff did not identify any precursors with a CCDP or CDP greater than or equal to 10-4 in 2018.

• Trend. Over the past decade (2009-2018), the mean occurrence rate of precursors with a CCDP or CDP greater than or equal to 10-4 exhibits a statistically significant decreasing trend (p-value = 0.03).11 See Figure 3 for additional information.

10 Precursors with CCDP or CDP greater than or equal to 10-4 are also called important precursors.

11 There are known issues when using a Poisson model to fit data with excessive zero counts, as is potentially the case when analyzing annual precursor occurrence rates greater than or equal to 10-4. In cases such as this, quantitative statistical significance trending is supplemented with qualitative analysis to verify the practical significance of the results.

10

Figure 3. Occurrence rate of precursors with a CCDP or CDP greater than or equal to 10-4

• Long-Term Trend. There is a statistically significant decreasing trend (p-value = 0.002) for the mean occurrence rate for precursors with a CCDP or CDP greater than or equal to 10-4 over the past 20 years (1999-2018).

• Precursor Counts. Over the past decade, seven precursors with a CCDP or CDP greater than or equal to 10-4 were identified, with all these precursors occurring from 2010 to 2012.

See Table 2 for additional information on these seven precursors. Six of the seven precursors involved events in electrical distribution systems.

Table 2. Latest precursors with a CCDP or CDP greater than or equal to 10-4 Plant Date Description Risk Insights (Risk Measure) 5/24/12 River Bend LER 458-12-003, Loss of normal Initiating event coupled with postulated loss of CCDP = 3x10-4 service water, circulating water, safety-related service water would lead to complete and feedwater due to electrical loss of heat sink. ML13322A833 fault.

1/30/12 Byron 2 LER 454-12-001, Transformer The key issue for this event is the potential for CCDP = 10-4 and breaker failures cause loss of operators to fail to recognize this scenario. Operator offsite power, reactor trip, and errors could lead to station blackout (SBO) -like de-energized safety buses. sequences. See NRC Information Notice (IN) 2012-3, Design Vulnerability in Electric Power System and NRC Bulletin 2012-01, Design Vulnerability in Electric Power System, for additional information.

ML13059A525 11

Plant Date Description Risk Insights (Risk Measure) 1/13/12 Wolf Creek LER 482-12-001, Multiple This event involved a moderate length LOOP (2-3 CCDP = 5x10-4 switchyard faults cause reactor hours) caused by equipment failures in the switchyard.

trip and subsequent loss of offsite Risk was dominated by SBO sequences. The ASP power. analysis looked at the LOOP initiating event while the SDP analysis performed a condition assessment on the loss of the startup transformer resulting in a Yellow finding associated with the a licensee performance deficiency for the failure to identify that electrical maintenance contractors had not installed insulating sleeves on wires that affected the differential current protection circuit, contrary to work order instructions. ML13115A190 8/23/11 North Anna 1 LER 338-11-003, Dual unit loss of This event involved an earthquake coupled with CCDP = 3x10-4 offsite power caused by routine maintenance on the AFW pump and an earthquake that coincided with the unrelated failure of an EDG. Risk was dominated by Unit 1 turbine-driven auxiliary SBO sequences. The SDP assessment resulted in a feedwater (AFW) pump being White finding associated with the licensee out-of-service because of testing performance deficiency for the failure to establish and and the subsequent failure of a maintain maintenance procedures appropriate to the Unit 2 EDG. circumstances for the safety-related EDGs. See NRC IN 2012-01, Seismic Considerations - Principally Issues Involving Tanks, and IN 2012-25, Performance Issues with Seismic Instrumentation and Associated Systems for Operating Reactors, for additional information. ML12278A188 6/7/11 Fort Calhoun EA-12-023, Fire in safety-related The plant operated with a poorly designed Red Finding 480-volt electrical breaker modification to nine breakers, all of which had a because of deficient design potential for a fire, especially in a relatively minor controls during breaker seismic event. Risk comes from a very wide variety of modifications. Eight other sequences. ML12101A193 breakers were susceptible to similar fires.

10/23/10 Browns Ferry 1 EA-11-018, Failure to establish A valve failure coupled with a postulated fire that Red Finding adequate design control and required execution of self-induced SBO procedures perform adequate maintenance could have resulted in a loss of recirculation capability.

causes valve failure that led to a The self-induced SBO procedures added one to two residual heat removal loop being orders of magnitude to the risk of this event. See unavailable. NRC IN 2012-14, Motor-Operated Valve Inoperable due to Stem-Disc Separation, for additional information. ML111290482 3/28/10 Robinson LER 261-10-002, Fire causes loss Neither the fire nor the minor equipment failures CCDP = 4x10-4 of non-vital buses along with a individually should have led to a high-risk event.

partial loss of offsite power with However, poor operator performance created a much reactor coolant pump (RCP) seal higher risk scenario. Risk was dominated by cooling challenges. transient-induced RCP seal LOCA. The SDP assessment resulted in two White findings (one performance deficiency was for failure to adequately implement the requirements contained in OPS-NGGC-1000, Fleet Conduct of Operations, and the other performance deficiency was for improper implementation of the Commission-approved requalification program). See NRC IN 2010-09, Importance of Understanding Circuit Breaker Control Power Indications, for additional information.

ML112411359 12

7.4. Precursors with a CCDP or CDP Greater than or Equal to 10-5 Precursors with a CCDP or CDP greater than or equal to 10-5 are equivalent to the significant events measure that used to be evaluated by the Industry Trends Program (ITP).12 The staff did not identify any precursors with a CCDP or CDP greater than or equal to 10-5 in 2018. This is the first time in ASP history that no such precursors were identified in a calendar year.

• Trend. Over the past decade (2009-2018), the mean occurrence rate of precursors with a CCDP or CDP greater than or equal to 10-5 exhibits a statistically significant decreasing trend (p-value = 0.002). See Figure 4 for additional information.

Figure 4. Precursors with a CCDP or CDP greater than or equal to 10-5

• Long-Term Trend. There is no statistically significant trend (p-value = 0.06) for the mean occurrence rate for precursors with a CCDP or CDP greater than or equal to 10-5 over the past 20 years (1999-2018).

• Initiating Event Impact. Historically, precursors due to initiating events make up approximately 65 percent of all precursors with a CCDP or CDP greater than or equal to 10-5. Over the past decade (2009-2018), the percentage is approximately 58 percent. Most of these precursors (i.e., 74 percent) are due to LOOP initiating events.

7.5. Precursors Involving Initiating Events and Degraded Conditions Both initiating events and degraded conditions have the potential to be precursors (as described in Section 5). An initiating event can (by itself) result in a CCDP that exceeds the ASP Program threshold (e.g., LOOP, LOCA, etc.). In addition, a reactor trip concurrent with an SSC unavailability can result in a precursor. Degraded conditions that exceed the ASP Program threshold can be associated with a single or multiple (i.e., windowed) unavailabilities.

• Trends. The mean occurrence rates of precursors involving initiating events exhibits a 12 The ITP was terminated in 2016 as part of the agency's Project Aim re-baselining initiative.

13

statistically significant decreasing trend (p-value = 0.03) during the past decade (2009-2018). During this same period, the mean occurrence rate of precursors from degraded conditions also exhibits a statistically significant decreasing trend (p-value = 0.03). See Figure 5 and Figure 6, respectively, for additional information.

Figure 5. Occurrence rate of precursors involving an initiating event 0.30 0.25 0.20 Occurrence Rate 0.15 0.10 0.05 0.00 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 Calendar Year Figure 6. Occurrence rate of precursors due to degraded condition(s)

• Long-Term Trend. The mean occurrence rate of precursors involving initiating events does not exhibit a statistically significant trend (p-value = 0.78) during the past 20 years (1999-14

2018). However, the mean occurrence rate of precursors from degraded conditions exhibits a statistically significant decreasing trend (p-value = 0.02) during this period.

A review of the data for the past decade (2009-2018) reveals the following insights:

• Precursor Counts. Precursors involving degraded conditions (90 precursors) outnumbered initiating events (48 precursors) by a factor of approximately two.

• Initiating Event Precursor Breakdown. Of the 48 precursors involving initiating events, 26 precursors (54 percent) were LOOP events and 21 precursors (44 percent) were complicated trips.13 One initiating event occurred while the affected plant was shut down.

Typically, the CCDP estimates for LOOPs are higher than for complicated trips.

• Initiating Events due to Natural Phenomena. Of the 48 precursors involving initiating events, 17 precursors (35 percent) resulted from natural phenomena (e.g., severe weather, seismic, etc.).

• EDG Failure Trends. The mean occurrence rate of precursors involving degraded conditions due to EDG failures reveals a statistically significant increasing trend (p-value

= 0.02) over the past 20 years (1999-2018). This increasing trend was first noted in the 2016 annual ASP report and is largely influenced by the very small number of EDG precursors in the late 1990s and early 2000s. Over the past decade (2009-2018), no statistically significant trend (p-value = 0.40) exists for this precursor group.

• Degraded Conditions due to External Hazards.14 Of the 90 precursors involving degraded conditions, 28 precursors (31 percent) were associated with postulated external hazards (fire, flood, etc.). Of these 28 precursors, 19 precursors were associated with degradations related to floods, 8 precursors were associated with degradations related to fires, and 1 precursor was associated with a degradation related to tornadoes.

• Degraded Condition Causes.15 Of the 90 precursors involving degraded conditions, 31 precursors (34 percent) were due to inadequate procedures, 27 precursors (30 percent) were due to design deficiencies, and 21 precursors (23 percent) were due to an ineffective corrective action program.

• Long-Term Degraded Conditions. Of the 90 precursors involving degraded conditions, 23 precursors (26 percent) involved degraded conditions existing for a decade or longer.16 Of these 23 precursors, 9 precursors involved degraded conditions dating back to initial plant construction.

13 A complicated trip is a reactor trip with a concurrent loss of safety-related equipment.

14 The term external hazards often includes hazards other than internal events that also occur within the plant boundary such as internal fires.

15 These causes were determined by a review of inspections findings associated with the applicable precursor events. Typically, these causes were associated with greater-than-Green findings. However, causes associated with Green findings (i.e., very low safety significance) were considered for events with windowed effects that resulted in the event exceeding the precursor threshold.

16 Note that although these degraded conditions lasted for many years, ASP and SDP analyses limit the exposure period to 1 year.

15

7.6. Precursors Involving a LOOP Initiating Event A LOOP initiating event involves a reactor trip and the simultaneous loss of electrical power to all unit safety-related buses (also referred to as emergency buses, Class 1E buses, and/or vital buses) requiring all EDGs to start and supply power to the safety buses. An initiating event that involves the loss of offsite power to all electrical buses is considered a complete LOOP.

Typically, complete LOOP initiating events (i.e., loss of offsite power to all electrical buses) meet the precursor threshold. However, if the nonsafety-related buses remain energized during a LOOP initiating event, the CCDP may not exceed the precursor threshold. No LOOP events occurred in 2018, which has only happened one other time in the past decade.

• Trend. Over the past decade (2009-2018), the mean occurrence rate of precursors involving LOOP events exhibits a statistically significant decreasing trend (p-value = 0.05).

See Figure 7 for additional information.

0.12 0.10 0.08 Occurrence Rate 0.06 0.04 0.02 0.00 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 Calendar Year Figure 7. Occurrence rate of precursors involving a LOOP

• Long-Term Trend. There is no statistically significant trend (p-value = 0.63) for the mean occurrence rate of precursors involving a LOOP over the past 20 years (1999-2018).

A review of the data for the past decade (2009-2018) reveals the following insights:

• Precursor Counts. Of the 138 precursors that occurred during the past decade, 26 precursors (19 percent) were LOOP events that occurred at 20 nuclear power plant (NPP) sites. Of the 26 LOOP precursor events, 17 precursors occurred in between 2011-2013.

• Concurrent Unavailability of an Emergency Power Train. Of the 26 LOOP precursors, two events involved a concurrent unavailability of an EDG. One precursor involved an EDG failure to run due to a leak in the coolant system and the other precursor involved an EDG out of service due to maintenance.

• Natural Phenomena. Of the 26 LOOP precursors, 13 (50 percent) precursors resulted from 16

natural phenomena, including: two tornadoes (5 precursors), Hurricane Katrina (1 precursor), 4 other weather-related events (5 precursors), and the 2011 Virginia earthquake (2 precursors). All units at the five multi-unit NPP sites involved in these events were affected.

• Grid-Related LOOPs. Of the 26 LOOP precursors, 5 (19 percent) precursors resulted from an electrical fault either in the plant switchyard or offsite power transmission line to the switchyard.

• Multi-unit NPP Sites. Of the 26 LOOP precursors, 11 precursors occurred at all units at a multi-unit NPP site, 7 precursors occurred at a single unit on a multi-unit site, and 8 precursors occurred at a single-unit site.

7.7. Precursors at BWRs and PWRs Some events (e.g., LOOP initiators, EDG unavailabilities) are not typically influenced by different reactor technologies and can lead to significantly increased risk regardless of whether the affected NPP is a BWR or PWR. However, given the substantial differences in plant design and operating conditions, it is valuable to investigate whether design differences result in proportional precursor occurrence rates between the two reactor technologies currently used in the U.S.17

• Trends. Over the past decade (2009-2018), the mean occurrence rates of precursors that occurred at BWRs does not exhibit a statistically significant trend (p-value = 0.72). During this same period, there is a statistically significant decreasing trend (p-value = 0.0001) for the mean occurrence rate of precursors that occurred at PWRs. See Figure 8 and Figure 9 for additional information.

0.35 0.30 0.25 Occurrence Rate 0.20 0.15 0.10 0.05 0.00 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 Calendar Year Figure 8. Precursors at BWRs 17 Approximately two-thirds of U.S. NPPs are PWRs; therefore, we may expect PWR precursor counts to be about twice as common as the BWR precursor counts.

17

0.40 0.35 0.30 0.25 Occurrence Rate 0.20 0.15 0.10 0.05 0.00 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 Calendar Year Figure 9. Precursors at PWRs

• Long-Term Trends. The mean occurrence rate of precursors at BWRs exhibits a statistically significant increasing trend (p value = 0.02) over the past 20 years (1999-2018). During the same period, the mean occurrence rate for precursors at PWRs exhibits a statistically significant decreasing trend (p-value = 0.00001).

A review of the data for the past decade (2009-2018) reveals the following insights:

• LOOPs by Plant Type. Of the 19 precursors involving initiating events at BWRs, 12 precursors (63 percent) were complete LOOP events. Of the 29 precursors involving initiating events at PWRs, 14 precursors (48 percent) were complete LOOP events.

• BWR Degraded Condition Breakdown. Of the 41 precursors involving degraded condition(s) at BWRs, most were caused by failures in emergency core cooling systems (16 precursors or 39 percent), others were caused by failures of EDGs (14 precursors or 34 percent), and safety-relief valves (4 precursors or 10 percent).

• PWR Degraded Condition Breakdown. Of the 49 precursors involving degraded condition(s) at PWRs, most were caused by failures of EDGs (17 precursors or 35 percent), others were caused by failures in the auxiliary feedwater system (13 precursors or 27 percent),

safety-related cooling water systems (6 precursors or 12 percent), emergency core cooling systems (6 precursors or 12 percent), or electrical distribution system (3 precursors or 6 percent).

• PWR Sump Recirculation. Of the six precursors involving failures in the emergency core cooling systems, three precursors (50 percent) were because of conditions affecting sump recirculation during postulated loss-of-cooling accidents of varying break sizes.

• Degraded AFW systems. Of the 13 precursors involving failures of the auxiliary feedwater system, 5 precursors (38 percent) were specific to the turbine-driven pump train.

18

8. ASP INDEX The integrated ASP index shows the cumulative plant average risk from precursors on an annual basis. The integrated ASP index is calculated using the sum of CCDPs/CDPs from precursors identified in a given year and is then normalized by dividing the total reactor-operating years for all NPPs in that year. In addition, the integrated ASP index includes the risk contribution of a precursor for the entire duration of the degraded condition (i.e., the risk contribution is included in each fiscal year that the condition existed). For example, a precursor involving a degraded condition is identified in June 2011 and has a CDP of 5x10-6. A review of the LER or inspection report (IR) reveals that the degraded condition has existed since a design modification that was performed in September 2007. In the integrated ASP index, the CDP of 5x10-6 is included in the years 2009-2011 (i.e., the year it was identified and any full year that the deficiency existed). The risk contributions from precursors involving initiating events are included in the year that the event occurred. Figure 10 depicts the integrated ASP indices for 1999 to 2018.

Figure 10. Integrated ASP index A review of the ASP indices leads to the following insights:

• Insights. Over the past 20 years (1999-2018), the total risk associated with precursors (292 total precursors) is dominated by degraded conditions associated with issues dating back to initial plant construction. These 38 precursors account for approximately 26 percent of the total risk due to all precursors. The one significant precursor (Davis-Besse, 2002) accounts for approximately 24 percent of the total risk due to all precursors.18 The other 253 precursors account for approximately 50 percent to the total risk due to all precursors.

18 During the same period, the 19 precursors with a CCDP/CDP greater than or equal to 1x10-4 (including the Davis-Besse significant precursor) account for approximately 62 percent of the total risk due to all precursors.

19

• Trends. Over the past decade (2009-2018), the integrated ASP index exhibits a statistically significant decreasing trend (p-value = 0.002).19 A statistically significant decreasing trend (p-value = 0.00001) is also present for the past 20 years (1999-2018). The 10-year trend is largely influenced by the seven precursors with CCDP or CDP greater than or equal to 10-4 that occurred in the 2010-2012 period. The 20-year trend is largely due to the significant precursor (Davis-Besse, 2002) and precursors with a CCDP or CDP greater than or equal to 10-4 due to long-term degraded conditions in 1999 and early 2000s.20

• Limitations. Unlike the trend analyses performed on various precursor groups that are focused on the occurrence rate of precursors, the integrated ASP index is focused on the total risk due to all precursors. It is important to note that precursors evaluated by an independent ASP analysis or an SDP evaluation are limited to a 1-year exposure period.

Therefore, the integrated ASP index provides a unique way to evaluate the total risk effect of longer-term degraded conditions that is not fully captured in the individual analyses.

9. COMPARISON OF RECENT PROGRAM PESULTS The three precursors identified in 2018 using an independent ASP analysis were compared with results from MD 8.3 and SDP analyses, as shown in Table 4. Given the three programs have different functions, it is expected that the results are likely to be different.

19 A log-linear regression was used for the trend analysis of the integrated ASP index.

20 Examples of these high-risk, long-term degraded conditions are the potential common-mode failure of all AFW pumps at Point Beach, Units 1 and 2 (2001), and multiple HELB vulnerabilities at D.C. Cook, Units 1 and 2 (1999).

20

Table 3. 2018 independent ASP analysis comparison SPAR Model/Methodology Event Description MD 8.3 Results SDP Results ASP Results Improvements and Insights Peach Bottom 3; 278-18-001; No MD 8.3 evaluation was No performance deficiency has CDP = 3x10-6; RCIC FLEX strategies were not 4/22/18. Reactor core isolation performed. been identified for this event; unavailability for 48 days. See included in the Peach Bottom cooling (RCIC) system therefore, no SDP evaluation final ASP analysis (Unit 2) SPAR model at the pressure switch failure results has been performed. (ML18352B099) for additional time of the analysis and, in condition prohibited by information. therefore, were not considered.

technical specifications. A review of the dominant accident scenarios reveals that the crediting of FLEX strategies would not greatly impact the results of this analysis.

Clinton; 461-17-010; 12/9/17. CCDP estimated to be in the Two Green findings were CCDP = 8x10-6; reactor This analysis require Division 1 transformer failure range of 4x10-6-9x10-6, which identified. The first finding was transient with loss of division 1 analysis-specific and base leads to instrument air isolation led to a special inspection. See associated with the licensee 480-volt buses. See final ASP SPAR model changes, to containment requiring a IR 05000461/2017012 failure to perform a corrective analysis (ML18038B063) for including:

manual reactor scram. (ML18029A863) for additional action to preclude repetition for additional information.

• Revised instrument air information. a similar transformer failure that system dependencies.

occurred in December 2013.

• Corrected some minor event The second finding was tree errors associated with associated with the licensee late injection.

failing to follow procedures that would classify three

• Removed duplicative human nonsafety-related 4.16 kV and failure events from the 480 V transformers as containment venting fault operationally critical tree.

components. Both findings were screened out (i.e., no FLEX strategies were not detailed risk evaluation was included in the Clinton SPAR performed). See IR model at the time of the 05000461/2017012 analysis and, therefore, were (ML18029A863) for additional not considered in this analysis.

information. Most of the dominant scenarios would be unaffected by crediting FLEX strategies.

21

SPAR Model/Methodology Event Description MD 8.3 Results SDP Results ASP Results Improvements and Insights Oyster Creek; 219-17-005; No MD 8.3 evaluation was No performance deficiency has CDP = 6x10-6; unavailability Significant modifications were 10/9/17. Failure of EDG during performed. been identified for this event; of EDG 2 for 198 days. See made to the SBO event tree surveillance testing due to a therefore, no SDP evaluation final ASP analysis (e.g., credited DC load broken electrical connector. has been performed. (ML18130A649) for additional shedding and firewater information. injection, increased human error probabilities for certain functions due less time available to operators). In addition, stuck-open safety relief valve and recirculation pump seal failure probabilities were modified.

FLEX strategies were not included in the Oyster Creek SPAR model at the time of the analysis and, therefore, were not considered. A review of the dominant accident scenarios reveals that the crediting of FLEX strategies would not greatly impact the results of this analysis.

22

10. LER SCREENING QUALITY ASSURANCE REVIEW In previous years, a separate quality assurance review of the LER screening performed by Idaho National Laboratory (INL) was performed by the staff. The purpose of this review was to verify that all potentially risk-significant LERs are screened into the ASP Program. In addition, the review confirmed that the coding scheme is logical and assesses if any revisions are necessary to ensure ASP analyst resources are focused on potential precursors. The LER screening process, along with a summary of the recent review of the cASP criteria is described in Section 4.

In 2018, the choice was made to leverage current ASP Program activities to provide the quality assurance review of the LER screening. The primary activity for this is the participation in the Operating Experience Clearinghouse meetings, which is held three times per week. This meeting reviews all event notifications, LERs, regional phone call items, greater-than-Green regulatory findings, NRC communications, and Part 21 notifications and distributes them to the relevant internal technical review groups. When LERs are reviewed by the clearinghouse, the ASP Program manager determines whether the events described meet one or more cASP criteria. If so, the ASP Program manager then ensures that the applicable LER was determined to be a potential precursor via the INL screening process.

A secondary activity is the search for windowed LERs for events that were identified by INL to be potential precursors. As part of the detailed evaluation for LERs corresponding to potential precursors, ASP analysts are required to review other LERs from the applicable plant that may have resulted in initiating events and/or SSC unavailabilities during the same period identified in the LER undergoing the ASP evaluation. As part of these reviews, ASP analysts can identify LERs that were inappropriately screened-out in the initial LER screening.

These two activities resulted in the identification of four LERs, initially screened out of the ASP Program, as potential precursors. In subsequent discussions with INL, these LERs were inappropriately screened-out due to a misinterpretation of information provided in the LER or the ambiguity in the applicable coding guidance. Note that these four LERs were determined to not be precursor after the detailed evaluation was performed.

23

Appendix A: 2018 ASP Program Screened Analyses This appendix provides the justification for each licensee event report (LER) that was screened out of the Accident Sequence Precursor (ASP) Program based on a simplified or bounding analysis or by acceptance of Significance Determination Process (SDP) results. Note that the justification reflects the status of the LER (open or closed) at the time of the ASP completion date. While ASP analysts monitor the final SDP evaluation of all findings for including greater-than-Green findings as precursors, the screen-out justification is not updated retroactively for events that were initially screened out by an ASP analysis and are later assessed as Green (i.e., very low safety significance) in the final SDP evaluation.

LER: 440-2017-007 Plant: Perry Event Date: 12/22/17 LER Report Date: 2/13/18 LER Screening Date: 3/6/18 cASP Criterion: 3d ASP Completion Date: 4/27/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any inspection report (IR) to date; the LER remains open. On December 22, 2017, the high-pressure core spray (HPCS) system was declared inoperable due to a through-wall leak on the minimum flow line piping. The leak was approximately 60 drops per minute. A combination of cavitation and mechanical wear caused the through-wall leak. On December 25th, a temporary repair consisting of a weld overlay was added to the thinned elbow area of the pipe and the HPCS system was declared operable. A permanent repair will be made during the next refueling outage. A search of LERs did not yield any windowed events during the exposure period. A bounding risk assessment was performed assuming the HPCS pump was unable to fulfill its safety function for an exposure period of 3 days, which resulted in an increase in core damage probability (CDP) of 2x10-7 for internal events. The seismic contribution to the risk of this event is negligible. This bounding risk assessment may be conservative, as it is likely that the HPCS system could have fulfilled its safety function despite the leak in the minimum flow piping. The risk result is below the ASP threshold of 10-6 and, therefore, is not a precursor.

LER: 306-2017-003 Plant: Prairie Island 2 Event Date: 12/22/17 LER Report Date: 1/11/18 LER Screening Date: 1/26/18 cASP Criterion: 3d ASP Completion Date: 4/27/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On November 12, 2017, while performing a control room board walkdown, operators discovered that both containment spray pump control switches were in the pull-to-lock position when the plant transitioned from Mode 5 to Mode 4. With the control switches in pull-to-lock, the pumps would not automatically start as required. A preliminary licensee investigation concluded that a surveillance procedure associated with main steam isolation valve testing did not include guidance to realign the containment spray control switches after testing was complete.

Containment spray pumps are not typically included in the Level 1 probabilistic risk assessment (PRA) modeling for pressurized-water reactors (PWRs), as the system does not play a role in mitigation of core damage. Therefore, this event is screened out, and is not considered a precursor under the ASP Program. A search for windowed events is not required.

LER: 315-2017-001 Plant: D.C. Cook 1 Event Date: 12/21/17 LER Report Date: 2/16/18 LER Screening Date: 3/6/18 cASP Criterion: 3h ASP Completion Date: 4/27/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On December 21, 2017, while operating in Mode 1, the turbine-driven auxiliary feedwater (AFW)

A-1

pump was declared inoperable after failing to achieve the required operating speed during a surveillance test. Licensee staff determined that the valve linkage was incorrectly set while performing preventative maintenance on October 13th, which prevented the governor valve from opening fully. On November 25th, while operating in Mode 3, the turbine-driven AFW pump passed its surveillance test. A licensee evaluation determined that the turbine-driven AFW pump passed this surveillance test because the steam supply pressure available to the turbine-driven AFW pump is higher in that plant configuration. The lower steam supply pressure in Mode 1 resulted in the turbine-driven AFW pump failing to reach its operating speed with the governor valve in a partially closed position. Plant personnel adjusted the governor valve linkage and declared the turbine-driven AFW pump operable on December 23rd. Two motor-driven AFW pumps remained operable during this period and a search of LERs did not yield any windowed events. The ASP analyst performed a bounding risk assessment assuming the turbine-driven AFW pump was unable to fulfill its safety function for an exposure period of 29 days, which resulted in a CDP of 2x10-8 for internal events. Note that this result is lower than expected due to credit for an AFW system crosstie with the other unit. The seismic contribution to the risk of this event is CDP of 7x10-9. The risk result is below the ASP threshold of 10-6 and, therefore, this event is not a precursor.

LER: 335-2018-001 Plant: Limerick 2 Event Date: 12/8/17 LER Report Date: 2/6/18 LER Screening Date: 2/20/18 cASP Criterion: 3d ASP Completion Date: 5/31/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On December 8, 2017, while completing surveillance testing on the high-pressure coolant injection system (HPCI) system, main control room operators received indications that the HPCI pump suction piping was pressurizing. The system pressurized due the failure of the HPCI pump discharge check valve to fully close, which caused repeated cycling of the HPCI pump minimum flow bypass valve during surveillance testing. The licensee concluded that the check valve failure was due to unexpected wear of the valve disc and formation of notches in the valve body. Operators closed the isolation valve located immediately downstream of the pump discharge check valve to stop the pressurization of the pump suction piping and the HPCI system was declared inoperable. Following repair of the pump discharge check valve and successful testing, the HPCI system was declared operable on December 11th. Since the HPCI system was unavailable for less than the limits of technical specifications (TS) limiting condition for operation (LCO) 3.5.1, Action C.1 (14 days), this event is screened out and is not considered a precursor under the ASP Program. A confirmatory risk analysis assuming the unavailability of the HPCI system for 3 days results in a CDP of 2x10-7 for internal events; the seismic risk contribution is negligible. A search of LERs did not yield any windowed events.

LER: 373-2018-002 Plant: LaSalle 1 Event Date: 2/17/18 LER Report Date: 4/18/18 LER Screening Date: 5/3/18 cASP Criterion: 3d ASP Completion Date: 6/18/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On February 16, 2018, at 4:18 p.m., the main control room received alarms associated with the division 3 emergency diesel generator (EDG) 1B and determined that the associated oil circulating pump was not rotating. On February 17th, licensee staff identified damage to a bus bar that supplies power to the EDG 1B auxiliaries and the division 3 direct-current (DC) battery charger. A spare cubicle was used to supply power to the affected loads, and EDG 1B and the HPCS system were declared operable on February 17th at 11:39 p.m. The licensee determined that the loss of loads to the EDG 1B auxiliaries would not have prevented it from fulfilling its safety function; however, loss of the division 3 battery charger may have prevented HPCS from A-2

fulfilling its safety function. A search of LERs did not yield any windowed events that would significantly impact the risk of this event. A bounding risk assessment was performed assuming HPCS was unable to fulfill its safety function for an exposure period of 2 days, which resulted in a CDP of 10-7 for internal events. The seismic contribution to the risk of this event is negligible. The risk result is below the ASP threshold of 10-6 and, therefore, this event is not a precursor.

LER: 298-2018-001 Plant: Cooper Event Date: 3/10/18 LER Report Date: 5/8/18 LER Screening Date: 5/31/18 cASP Criterion: 3d ASP Completion Date: 7/3/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On March 10, 2018, following planned maintenance on the HPCI system, operators observed rising pressure in the drywell. The licensee attributed the cause of the increasing pressure to leakage in the valve packing of a containment isolation valve (HPCI-MOV-MO15), which operators subsequently closed to stop the leakage and declared the HPCI system inoperable.

The plant verified operability of reactor core isolation cooling (RCIC) and entered TS 3.5.1, which requires system restoration within 14 days. The licensee decided to perform a normal plant shutdown to make the valve repairs. The plant entered Mode 3 on March 11th and new valve packing was installed on March 15th, restoring HPCI system operability. Since the HPCI system was unavailable for less than the limits of TS, this event is screened out and is not considered a precursor under the ASP Program. A search of LERs did not yield any windowed events.

LER: 352-2018-003 Plant: Limerick 1 Event Date: 4/17/18 LER Report Date: 6/18/18 LER Screening Date: 7/15/18 cASP Criterion: 3d ASP Completion Date: 7/30/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On March 26, 2018, Unit 1 was shut down for a refueling outage. During the outage, work was performed to repair a small leak on the HPCI main pump seal. On April 16th, with the plant preparing for startup (Mode 2), HPCI was declared operable following verification testing showing no seal leakage was evident with reactor pressure at 200 pounds per square inch gauge (psig). Note that HPCI is not required to be operable according to TS if reactor steam dome pressure is less than 200 psig. On April 17th, HPCI system was secured during surveillance testing due to a leak from the main pump inboard seal with reactor pressure at 960 psig and subsequently declared inoperable. Licensee troubleshooting identified that a retaining collar was not properly secured with its setscrew during reassembly of main pump inboard seal.

The seal sleeve had moved out of position during surveillance testing, resulting in the pump inboard seal leak. Following repairs and successful testing, the HPCI system was declared operable on April 17th. The licensee determined that HPCI was at 200 psig based on no seal leakage identified during verification testing performed on April 16th. However, the licensee could not verify HPCI operability when the Unit 1 entered Mode 1 at 8:04 a.m. on April 17th, resulting in inoperability of HPCI for approximately 35 hours4.050926e-4 days <br />0.00972 hours <br />5.787037e-5 weeks <br />1.33175e-5 months <br />. Since the HPCI system was unavailable for less than the limits of TS LCO 3.5.1, Action C.1 (14 days), this event is screened out and is not considered a precursor under the ASP Program. A search of LERs did not reveal any windowed events.

A-3

LER: 528-2018-003 Plant: Palo Verde 1 Event Date: 3/15/18 LER Report Date: 5/14/18 LER Screening Date: 5/31/18 cASP Criterion: 4a ASP Completion Date: 7/30/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On January 5, 2018, atmospheric dump valve (ADV) 179 failed to open when a 50-percent open signal was initiated during testing. Licensee troubleshooting determined that the current-to-pressure converter was not supplying the correct output air signal to the positioner and an excessive amount of air was being exhausted through the regulating nozzle. A subsequent causal analysis concluded that a defective current-to-pressure converter was installed on April 17, 2016. Although ADV-179 had undergone successful surveillance testing since the defective converter was installed, the licensee determined the observed failure mechanism challenged the prior presumption of operability. The defective current-to-pressure converter was replaced and ADV-179 was declared operable, after successful testing, on January 7th. A bounding risk assessment was performed assuming ADV-179 pump was unable to fulfill its safety function for an exposure period of 1 year, which results in a CDP of 10-8 for internal events. The seismic contribution to the risk of this event is negligible. The risk result is below the ASP threshold of 10-6 and, therefore, this event is not a precursor. A search of LERs did not yield any windowed events that would significantly impact the risk of this event.

LER: 352-2018-001 Plant: Limerick 1 Event Date: 12/7/17 LER Report Date: 2/5/18 LER Screening Date: 2/20/18 cASP Criterion: 3h ASP Completion Date: 7/31/18 Classification: SDP Screen-Out Analyst Justification: A Green finding was identified in IR 05000352/2018001; the LER is closed. On December 7, 2017, during surveillance testing of EDG D12, licensee personnel observed an abnormally high combustion air temperature (220°F; normal band is 115°F to 145°F). EDG D12 ran unloaded for approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and fully loaded for approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> before the EDG was secured. EDG D12 was subsequently declared inoperable and TS LCO 3.8.1.1 was entered. Licensee troubleshooting identified that the high air cooler discharge temperature was due to the associated cooling water controllers setpoint being set at 200°F, instead of the required setpoint of 130°F. NRC inspectors determined that the licensee failed to properly maintain EDG operating procedure S92.9.N, Routine Inspection of the Diesel Generators, which resulted in EDG D12 unable to fulfil its safety function from November 6th to December 12th (36 days). The SDP risk assessment assumed the unavailability of EDG D12 for 36 days, which resulted in an increase in core damage frequency (CDF) of 8x10-8 per year.

This analysis was reviewed and determined to be appropriate for ASP Program needs. The calculated risk is below the precursor threshold of 10-6; therefore, this event is not considered a precursor. A search of LERs did not yield any windowed events that would impact the risk significance of this event.

LER: 315-2018-001 Plant: D.C. Cook 1 Event Date: 4/2/18 LER Report Date: 5/31/18 LER Screening Date: 7/16/18 cASP Criterion: 3h ASP Completion Date: 8/9/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On April 2, 2018, at 9:36 a.m., operators identified an abnormal noise coming from the Unit 1 East essential service water (ESW) pump motor. The licensee reviewed pump motor vibration data and determined it was acceptable. On April 4th, an increase in sound level was noted by operators and a subsequent review of the pump motor vibration data confirmed an increase in vibration levels. Following additional vibration monitoring, the Unit 1 East ESW train was secured and declared inoperable on April 5th at 12:30 p.m., when the licensee determined that A-4

vibration data indicated a degraded upper motor bearing and that pump was likely unable to fulfil its design-basis 30-day mission time. The pump motor was replaced and the Unit 1 East ESW train was declared operable on April 6th, at 5:27 p.m. Although the pump was declared inoperable from April 2nd until April 6th, the licensee determined that the Unit 1 East ESW train was unavailable to fulfil its safety function during repairs (approximately 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br />). A risk assessment was performed assuming the Unit 1 East ESW train was unable to fulfill its safety function for an exposure period of 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br />, which resulted in a CDP of 7x10-7 for internal events. The seismic contribution to the risk of this event is negligible. Note that the ESW cross-connect from Unit 2 was unavailable because the plant was shut down during the event.

The risk result is below the ASP threshold of 10-6 and, therefore, this event is not a precursor. A search of LERs did not reveal any windowed events.

LER: 259-2018-003 Plant: Browns Ferry 1 Event Date: 3/19/18 LER Report Date: 5/29/18 LER Screening Date: 7/16/18 cASP Criterion: 3h ASP Completion Date: 8/14/18 Classification: SDP Screen-Out Analyst Justification: A Green finding was identified in IR 05000259/2018002; the LER is closed. On March 8, 2018, during a relay functional test of emergency equipment cooling water (EECW) pump C3 trip circuit, incorrect wiring was discovered on the associated pump breaker.

The incorrect wiring would prevent the breaker closing springs from recharging while the transfer switch was in the emergency position. Maintenance personnel completed work to correct the wiring for the pump breaker on March 10th. A subsequent licensee evaluation determined that EECW pump C3 had been unavailable since August 23, 2012, when the incorrect wiring occurred. However, EECW pump C3 was not credited in backup control mode until 10 CFR 50.48(c), "National Fire Protection Association 805," became effective on October 28, 2015. For postulated fire scenarios that could cause a loss of offsite power and result in main control room abandonment, the required EECW pumps utilized in the fire safe shutdown procedure may not have been available. A risk assessment performed by the licensee showed this event to be very low safety significance (i.e., Green). The Region 2 SRA agreed with the licensee's risk assessment results and, therefore, this issue was screened using IMC 0609, Appendix F. The risk of the event was limited due to the incorrect wiring only affected one of the four EECW pumps and only during main control room abandonment scenarios which require a pump restart. A search of LERs did not yield any windowed events that would significantly impact the risk of this event.

LER: 331-2018-001 Plant: Duane Arnold Event Date: 2/6/18 LER Report Date: 4/4/18 LER Screening Date: 5/31/18 cASP Criterion: 3a ASP Completion Date: 8/16/18 Classification: SDP Screen-Out Analyst Justification: A Green finding was identified in IR 05000331/2018002; the LER is closed. On February 6, 2018, the licensee found that the use of the reactor protection system (RPS) test box could affect two reactor scram functions. The RPS test box was used as part of surveillance testing for the main steam isolation valves (MSIVs) from June 2015 through July 2016 and for the turbine stop valves (TSVs) from May 2006 through December 2017.

TS 3.3.1.1 requires that RPS instrumentation for MSIVs and TSVs remain operable. The associated TS bases require three operable valve signals per trip system, which was not met during testing with the test box installed. However, the licensee determined that the use of the RPS test box would still result in a half-scram signal and, therefore, a MSIV or TSV closure (3 of 4 valves) would still result in a reactor scram because each trip logic channel individually produces a half scram. A performance deficiency was identified with the licensee failure to have procedures appropriate for testing MSIV and TSV closure functions as required by 10 CFR 50, Appendix B, Criterion V. This performance deficiency was determined to be Green (i.e., very A-5

low safety significance) using the screening questions provided in Appendix A of Inspection Manual Chapter 0609. A search of LERs for windowed events was not needed because there was no loss of safety function.

LER: 456-2018-002 Plant: Braidwood 1 Event Date: 4/20/18 LER Report Date: 6/18/18 LER Screening Date: 7/15/18 cASP Criterion: 3h ASP Completion Date: 8/22/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On April 20, 2018, at 10:42 a.m., EDG 1B was undergoing surveillance testing when an engine overspeed trip was received. Main control room operators directed personnel to locally trip EDG 1B, as required by the alarm response procedure. The licensee declared EDG 1B inoperable and the plant entered TS 3.8.2, "AC Sources - Shutdown," Condition B. Licensee troubleshooting determined that the turbocharger inlet butterfly valve handle springs broke, which allowed the valve to shift and two limit switches to open, resulting in a test-mode only electrical overspeed trip signal. On April 20th, at 12:49 p.m., the butterfly springs were replaced, the emergency stop pushbutton was reset, and EDG 1B was declared operable. EDG 1B remained operable except for the period after the EDG was manually tripped until the trip was reset (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 7 minutes). Except for when EDG 1B was tripped and undergoing repairs, the EDG maintained its safety function because the broken springs only affected the test-mode electrical overspeed trip signal. If an actual demand occurred, this overspeed trip would have been bypassed, and EDG 1B would have remained running. A review of LERs reveals that EDG 1A was also inoperable (i.e., windowed event) during the 2-hour exposure period of EDG 1B; see LERs 456-2018-001 and 456-2018-004 for additional information. Due to the lack of shutdown modeling for Braidwood and limited modeling of Mode 6 scenarios in general, the 2-hour exposure period when both EDGs 1B and 1A were unable to fulfil its safety function was evaluated qualitatively. The plant was in Mode 6 (refueling) with the reactor cavity flooded during this event exposure period, which experience has shown the time to boil for this plant operating state is at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and likely longer. Given the long-expected time to boil, the risk of core damage is considered negligible for postulated loss of offsite power during the 2-hour exposure period with both EDGs inoperable. Therefore, this event is screened out, and is not considered a precursor under the ASP Program.

LER: 338-2018-001 Plant: North Anna 1 Event Date: 3/11/18 LER Report Date: 5/9/18 LER Screening Date: 5/31/18 cASP Criterion: 3h ASP Completion Date: 8/23/18 Classification: Analyst Screen-Out Analyst Justification: This LER is closed in IR 05000338/2018002; no inspection finding associated with this event was identified. On March 11, 2018, with the plant in Mode 5, service water pump B failed to trip during blackout testing of emergency bus 1J. Specifically, the pump did not strip off and sequence onto the bus, as expected, but remained energized via emergency bus 1J during the auto-start of EDG 1J. A licensee investigation identified a disconnected wire resulted in timer relay 1-SW-62-1SWEB03 being inoperable per TS surveillance requirement 3.8.1.16. In addition, the licensee declared EDG 1J inoperable.

However, a licensee evaluation revealed that the additional load of service water pump B did not challenge established limits of EDG 1J and, therefore, no loss of safety function occurred.

Since no loss of safety function was experienced, this event is screened out of the ASP Program and is not considered a precursor. A review of potential windowed events was not needed because there was no loss of safety function.

A-6

LER: 456-2018-001 Plant: Braidwood 1 Event Date: 4/19/18 LER Report Date: 6/18/18 LER Screening Date: 8/14/18 cASP Criterion: 3h ASP Completion Date: 9/18/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On April 19, 2018, with the plant in Mode 6, EDG 1A was undergoing surveillance testing to verify EDG 1A would successfully start and sequence loads to its associated engineered safety feature (ESF) bus given an undervoltage signal. After successfully starting and supplying electrical power to ESF bus 141, EDG 1A lost voltage resulting in an unplanned valid actuation of bus 141 undervoltage relay. Operators restored power to ESF bus 141 via crosstie of the Unit 2 offsite power source in approximately 9 minutes. Shutdown cooling was maintained throughout the event because residual heat removal train 1B was in service. The EDG issue was caused by a failed diode and a licensee root cause evaluation determined that the diode failed during the test. It was also determined that the diode was potentially weakened by testing completed approximately 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> earlier. Braidwood TS LCO 3.8.2 requires only one EDG be available during Mode 6 operation. Except for a 2-hour window where both EDG 1A and EDG 1B (see LER 456-18-002) were unavailable, the plant fulfilled their TS requirements. This 2-hour window was qualitatively determined to have a negligible risk impact (see Analyst Screen-Out of LER 456-18-002). Since TS requirements were fulfilled during the other portion of the exposure period (i.e., only EDG 1A was unavailable), this event is screened out and is not considered a precursor under the ASP Program. A review of LERs revealed that EDG 1A experienced issues during testing performed 3 days later (LER 456-18-004); however, it was determined that these issues did not significantly impact the risk of this event.

LER: 456-2018-004 Plant: Braidwood 1 Event Date: 4/22/18 LER Report Date: 6/21/18 LER Screening Date: 8/14/18 cASP Criterion: 3h ASP Completion Date: 9/18/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On April 22, 2018, EDG 1A was undergoing surveillance testing to verify EDG 1A would start and sequence loads on a safety injection signal. All ESF bus 141 load breakers successfully tripped, EDG 1A started and obtained rated speed and voltage and energized ESF bus 141, and bus loads began sequencing on as expected. During the sequential loading of equipment, the EDG 1A output breaker tripped open on underfrequency, resulting in an unplanned actuation of the ESF bus 141 undervoltage relay. The bus load breakers tripped, as designed.

EDG 1A. Frequency recovered, which resulted in permissives being met to allow the breaker to close. The EDG 1A output breaker subsequently closed and re-energized ESF bus 141, and the bus load sequencing reinitiated. The EDG output breaker cycling (i.e., breaker opening on underfrequency, de-energizing the bus coincident with the sequencing of loads onto the bus) several additional times. The EDG output breaker cycling was stopped by the operators placing the EDG 1A output breaker in the pull-to-lock position. Operators restored power to ESF bus 141 via crosstie of the Unit 2 offsite power source. Later, the cross-tie breaker tripped opened, resulting in another ESF bus 141 underfrequency condition caused by the actuated state of the degraded voltage relays from the EDG 1A test, which locked in a degraded voltage signal. Operators isolated the fuel supply to EDG 1A shutting down the EDG. Operators then restored power to ESF bus 141 from the Unit 1 offsite power source. Discussions with NRC inspectors revealed that this EDG issue was caused by a wiring error combined with an unlubricated EDG fuel rack. A review of past tests revealed that the EDG successfully passed previous tests with the wiring error in place. Therefore, the licensee concluded that the unlubricated fuel rack was critical to the test failure. The underfrequency trip is bypassed during a real EDG demand during loss of offsite power (LOOP) and/or loss-of-coolant accident (LOCA); therefore, the incorrect wiring combined with unlubricated fuel rack did not result in loss A-7

of safety function. Since no loss of safety function was experienced, this event is screened out of the ASP Program and is not considered a precursor. A review of potential windowed events was not needed because there was no loss of safety function.

LER: 461-2018-003 Plant: Clinton Event Date: 6/20/18 LER Report Date: 8/17/18 LER Screening Date: 9/24/18 cASP Criterion: 3d ASP Completion Date: 10/16/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On June 20, 2018, at 12:45 p.m., HPCS injection valve 1E22-F004 was observed to be open instead of closed (the required position). Operators determined that the valve opened 9:47 a.m.

(approximately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> earlier). The plant entered TS 3.5.1, "Emergency Core Cooling System

- Operating," and TS 3.6.1.3, "Primary Containment Isolation Valves." At 2:24 p.m., while the licensee was performing troubleshooting activities, the HPCS injection valve began cycling open and closed. The valve cycling continued for approximately 14 minutes, at which time 1E22-F004 valve was de-energized and manually closed. The licensee determined that load driver circuit card failed, which resulted in a spurious signal causing 1E22-F004 to open. In addition, unexpected output voltages resulted in valve cycling. The failed load driver card was replaced on June 23rd and HPCS operability was restored on June 24th. Since the HPCS system was unavailable for less than the limits of LCO 3.5.1, Action B.2 (14 days), this event is screened out and is not considered a precursor under the ASP Program. A search of LERs did not yield any windowed events.

LER: 458-2018-005 Plant: River Bend Event Date: 6/26/18 LER Report Date: 8/27/18 LER Screening Date: 9/24/18 cASP Criterion: 3a ASP Completion Date: 10/16/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On June 26, 2018, the licensee identified that the use of the RPS test fixture during surveillance test procedures resulted in inadequate number of TS main steam line (MSL) inputs for the RPS trip system for the MSIV closure function. The use of the RPS test fixture began in November 2014 and was used a total of 15 times. The use of the RPS test fixture bypasses MSIV position signal inputs for two MSLs and prevents the associated trip logic division from being in a tripped condition. With two isolated MSLs in a bypassed division, a scram would not occur if only three MSLs are isolated. The remaining RPS trip signals (e.g., high reactor pressure, low reactor water level, high drywell pressure, etc.) remained available. For example, the availability of the high reactor pressure trip, in conjunction with safety relief valves (SRVs),

provides trip redundancy for over-pressure transients. The licensee determined that although the TS operability for the RPS trip function for MSIV closure was lost while using the RPS test fixture, RPS remained functional and would have initiated a scram on a MSIV isolation (isolation of all four MSLs). In addition, the licensee credits high fixed neutron flux signal with generating a scram in the plant's over-pressurization protection analysis rather than a direct scram from MSIV closure. Therefore, the RPS safety function was maintained when the test fixture was in use. Since no loss of safety function was experienced, this event is screened out of the ASP Program and is not considered a precursor. A review of potential windowed events was not needed because there was no loss of safety function.

A-8

LER: 416-2017-009 Plant: Grand Gulf Event Date: 12/12/17 LER Report Date: 3/26/18 LER Screening Date: 8/8/18 cASP Criterion: 3g ASP Completion Date: 10/31/18 Classification: SDP Screen-Out Analyst Justification: A Green finding was identified in IR 05000416/2018002; the LER remains open. On December 12, 2017, a division 1 ESF transformer lockout resulted in a loss of power to the division 1 safety related bus. The division 1 EDG automatically started (as designed) and restored power to the division 1 safety-related bus. This restoration of power resulted in an unexpected automatic isolation of the RCIC system. The licensee declared RCIC inoperable and entered TS 3.5.3, Action A. Licensee troubleshooting determined that RCIC systems isolation was caused by temperature switches associated with the leak detection systems that provided a high temperature signal, which completed the isolation logic to isolate the RCIC system. Additional evaluation determined that these temperature switches had an insufficient time delay to prevent a spurious isolation. A performance deficiency was identified with the licensee failure appropriately evaluate or test the impact of RCIC leak isolation system temperature switches when they were replaced in 2009. A detailed risk evaluation was performed as part the SDP, which focused only on scenarios that would result in the loss of power to the division 1 safety-related bus and subsequent reenergization (i.e., loss of offsite power with no station blackout). This risk evaluation determined that the CDF would be less than 10-7. This analysis was reviewed and determined to be appropriate for ASP Program needs. The calculated risk is below the precursor threshold of 10-6; therefore, this event is not considered a precursor. A review of Grand Gulf LERs identified a windowed event associated with the ESF transformer lockout (LER 416-2017-007). The windowed effects of these two events will be analyzed in the ASP review of LER 416-2017-007. No other windowed events that would impact the risk significance of this event were identified.

LER: 259-2018-004 Plant: Browns Ferry 1 Event Date: 7/9/18 LER Report Date: 9/7/18 LER Screening Date: 10/4/18 cASP Criterion: 3d ASP Completion Date: 11/2/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On July 9, 2018, at 8:20 a.m., maintenance personnel began performing a function test on the HPCI system steam line supply low pressure signal. This quarterly surveillance test involves closing pressure switches located in the logic circuit for the automatic closure of HPCI steam-line isolation valves given a low-pressure signal in HPCI steam line. This low-pressure condition in the HPIC steam supply line is indicative a steam leak/rupture. At 10:11 a.m., during a walkdown of the control room, the HPCI steam-line inboard and outboard isolation valves (1-FCV-73-0002 and 1-FCV-73-0003) were found closed. The operators determined that these valves closed at 08:58 a.m.; therefore, declared HPCI inoperable. The licensee subsequently determined that degraded pressure switches allowed the isolation circuit to complete while another pressure switch was closed during testing. In response to HPCI system inoperability, the plant entered TS LCO 3.5.1, Condition C, which requires operators to immediately verify RCIC is operable and to restore HPCI operability within 14 days. Operators successfully verified that RCIC was operable. The degraded switches were replaced, and the surveillance test was completed successfully at 12:10 p.m. on July 9th. HPCI was subsequently declared operable at 12:42 p.m. on July 10th and the plant exited TS LCO 3.5.1, Condition C. Although the pressure switches were degraded, HPCI maintained its safety function except for when the system was isolated (approximately 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />). The actual system isolation that occurred on July 9th was due to the decreased redundancy in the logic configuration in the test. While degraded pressure switches could increase the likelihood of spurious system isolation while not in test, the risk impact is believed to be negligible. Since the HPCI system was unavailable for A-9

less than the limits of TS (i.e., 14 days), this event is screened out and is not considered a precursor under the ASP Program. A search of LERs did not yield any windowed events.

LER: 440-2018-002 Plant: Perry Event Date: 7/1/18 LER Report Date: 8/23/18 LER Screening Date: 9/24/18 cASP Criterion: 3d ASP Completion Date: 11/29/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On June 30, 2018, at 4:13 p.m., the control room received an unexpected out of service alarm for the residual heat removal (RHR) A system and the low-pressure core spray (LPCS) system.

Initial walkdowns of the control room panels did not indicate any abnormalities associated with these systems. On July 1st at 1:00 a.m., the licensee identified that the positive main line fuse was failed in disconnect ED1A06-08. This disconnect serves multiple components associated with division 1 emergency core cooling system (ECCS) LOCA initiation logic. The following key division 1 ECCS LOCA equipment was declared inoperable according to TS: RCIC, RHR A, LPCS A, EDG 1, ESW A, and emergency closed cooling water (ECCW) A. The failed fuse was replaced and the division 1 ECCS LOCA initiation logic and associated systems were declared operable at 2:30 a.m. on July 1st. A bounding risk assessment was performed assuming a 15-hour exposure for the failed fuse. The failed fuse was conservatively assumed to result in a loss of safety function for the applicable trains/systems determined inoperable according to TS (listed above). This is conservative because not all trains/systems would have failed to actuate (i.e., the fuse failure did not lead to a loss of safety function), some systems (e.g., EDGs) would initiate prior to LOCA signal for applicable accident sequences (e.g., LOOP), and all the affected trains/systems could be initiated manually by operators as directed by procedures. This bounding risk assessment resulted in a CDP of 3x10-7 for internal events; the seismic contribution is negligible. The risk result is below the ASP threshold of 10-6 and, therefore, this event is not a precursor. A search of LERs reveals did not yield any windowed events.

LER: 414-2018-002 Plant: Catawba 2 Event Date: 6/11/18 LER Report Date: 8/13/18 LER Screening Date: 9/24/18 cASP Criterion: 3h ASP Completion Date: 12/19/18 Classification: SDP Screen-Out Analyst Justification: A Green finding was identified in IR 05000413/2018003 (ML18292A675); the LER is closed. On June 11, 2018, at 4:08 a.m., EDG 2A was declared inoperable for planned maintenance. During post-maintenance testing later the same day, the output breaker for EDG 2A tripped open because of the actuation of the lockout relay 86D.

Subsequent troubleshooting by the licensee identified two disconnected cables in the voltage regulator circuitry. Maintenance personnel failed to reconnect these two cables during the maintenance activities completed earlier that day. The disconnected cables resulted in damage requiring repairs that would exceed TS required completion time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (TS 3.8.1, 3.7.8, 3.7.5, and 3.6.6). On June 14th, the licensee requested a notice of enforcement discretion (NOED) in anticipation of exceeding the 72-hour TS completion time, which was granted by the NRC. Repairs were completed and the EDG 2A was declared operable on June 14th at 9:06 p.m. NRC inspectors determined that the licensees failure to follow procedures during maintenance on EDG 2A was a performance deficiency. An SDP detailed risk evaluation for this performance deficiency was performed assuming an unavailability of EDG 2A for an exposure period of 89 hours0.00103 days <br />0.0247 hours <br />1.471561e-4 weeks <br />3.38645e-5 months <br />, which resulted in a CDF of less than 10-6 per year. This analysis was reviewed and determined to be appropriate for ASP Program needs. The calculated risk is below the precursor threshold of 10-6; therefore, this event is not considered a precursor. A search of LERs did not yield any windowed events.

A-10

LER: 341-2018-002 Plant: Fermi Event Date: 4/14/18 LER Report Date: 6/12/18 LER Screening Date: 10/31/18 cASP Criterion: 2a ASP Completion Date: 12/20/18 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On April 14, 2018, a reactor scram occurred due to low reactor water level caused by a partial loss of feedwater and reactor recirculation system scoop tube lock. The HPCI and RCIC systems automatically started as designed and restored reactor water level. Operators subsequently maintained reactor water level using RCIC. No SRVs actuated during the event and the primary containment isolation system responded as expected. Licensee investigation determined that the direct cause of the event was moisture intrusion into the A6 cubicle of the bus 1-2B enclosure resulting in a ground fault tripping the 13.8 kV bus 11 position D breaker.

The normal source of power to transformer 64 is provided via this breaker. Because transformer 64 lost power, the division 1 safety-related buses 64B and 64C and balance-of-plant bus 64A also lost power. The loss of power to balance-of-plant bus 64A tripped its associated condensate pump, a heater feed pump, and both heater drain pumps, which resulted in the trip of the south reactor feedwater pump. Although the plant is designed to withstand a partial loss of feedwater, the loss of power to the division 1 buses also caused a reactor recirculation pump scoop tube lock, which disabled their run-back feature. The loss of both, the south reactor feedwater pump and reactor recirculation run-back feature, resulted in reactor water level decreasing to the low-level scram setpoint (i.e., level 3). EDGs 11 and 12 automatically started and restored power to safety-related buses 64B and 64C. A risk assessment was performed for a loss of offsite power to division 1 buses initiating event, which results in a conditional core damage probability (CCDP) of 8x10-7. An additional complication during the event response was identified with the division 2 emergency equipment cooling water (EECW) temperature control valve controller. This controller was found in emergency bypass mode instead of staying in automatic mode, as expected. The licensee determined that this issue would not affect cooling of the EECW system, but could potentially affect the division 2 control center heating, ventilation, and air conditioning. This system is not modeled in the Fermi SPAR model.

However, the potential for overcooling is not considered risk significant and, therefore, was not considered in the risk assessment. The risk result for this analysis is below the ASP threshold of 10-6 and, therefore, this event is not a precursor. A search of LERs did not yield any windowed events that would impact the risk significance of this event.

LER: 278-2018-002 Plant: Peach Bottom 3 Event Date: 9/21/18 LER Report Date: 11/19/18 LER Screening Date: 1/2/19 cASP Criterion: 3d ASP Completion Date: 1/16/19 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On September 20, 2018, an operator identified the differential pressure switches associated with the HPCI system were reading lower than expected. These switches control the isolation of the HPCI system in the event of a HPCI steam line break. On September 21st, the pressure switches were declared inoperable in accordance with TS, and operators subsequently isolated the HPCI system, which rendered it unable to fulfill its safety function. Additional licensee analysis of the low differential pressure indicated on the two pressure switches indicated a possible upstream steam leak in the instrument line. In support of this conclusion, a small increase in drywell leakage was also identified. A reactor power reduction was initiated to support an entry into the drywell. The drywell inspection verified leakage of a 1-inch diameter instrument line, which is a reactor coolant system pressure boundary. A controlled shutdown was initiated, and the unit entered Mode 3 on September 22th and Mode 4 on September 23rd.

TS only require HPCI to be operable in Modes 1-3. Since the HPCI system was unavailable for less than the limits of TS LCO 3.5.1, Action C (14 days), this event is screened out and is not A-11

considered a precursor under the ASP program. The risk impact associated with the primary pressure boundary leakage is considered negligible. A search of LERs did not reveal any windowed events.

LER: 387-2018-006 Plant: Susquehanna 1 Event Date: 9/26/18 LER Report Date: 11/21/18 LER Screening Date: 12/20/18 cASP Criterion: 3g ASP Completion Date: 1/25/19 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On September 26, 2018, the 1A standby liquid control (SLC) pump discharge pressure relief valve lifted after the SLC pump was started. The relief valve failed to reclose, resulting in the pump only obtaining 28 gallons per minute (gpm) flow, which fails to meet the TS surveillance requirement minimum required flow rate of 40 gpm. Licensee troubleshooting identified that the insulation surrounding the relief valve was in contact with its reset arm. The insulation had been installed on April 27, 2018, during the Unit 1 refueling outage. A bounding risk assessment was performed assuming that the 1A SLC pump was unable to fulfill its safety function for an exposure period of 153 days. This analysis also considers that both SLC pumps were unavailable at the same time due to the 1B SLC pump being temporarily removed from service for testing and maintenance (conservatively assumed) for 2 days. The bounding risk assessment resulted in a CDP of 5x10-8 for internal events. This risk assessment is likely conservative because reduced flow from the 1A SLC pump would still allow for the injection of sufficient storage tank inventory to shut down the reactor, although this would take longer than the normal time of 10 minutes. The seismic contribution is a CDP of 2x10-8 for the event. The risk result is below the ASP threshold of 10-6 and, therefore, is not a precursor. A search of LERs did not yield any windowed events.

LER: 254-2018-005 Plant: Quad Cities 1 Event Date: 10/24/18 LER Report Date: 12/21/18 LER Screening Date: 2/11/19 cASP Criterion: 3d ASP Completion Date: 2/21/19 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On October 24, 2018, during undervoltage surveillance test, 4.16 kV safety-related bus 13-1 tripped on an inadvertent protection signal. The loss of bus 13-1 caused EDG 1/2 to start automatically; however, the EDG did not load onto the bus due to testing alignments. The loss of bus 13-1 resulted in core spray pump A and RHR pumps 1A and 1B being rendered unavailable. In addition, the loss of bus 13-1 resulted in a 480 V bus 18 being deenergized, which caused a loss of logic to both LPCI loops. The EDG 1/2 cooling water pump also did not start due to the loss of bus 18. Several systems inadvertently actuated, including: reactor building ventilation system tripped; standby gas treatment system automatically started; power to RPS 1A swapped; and the reactor water cleanup system isolation. Several TS LCOs were entered due to these various inoperabilities. Normal electrical power to the affected buses was restored in approximately 10 minutes. Since the unavailability of buses 13-1 and 18 was less than associated TS LCOs for various functions (e.g., electrical power, LPCI, core spray A, etc.)

this event is screened out and is not considered a precursor under the ASP Program. A search of LERs did not yield any windowed events.

LER: 499-2018-001-01 Plant: South Texas 2 Event Date: 3/25/18 LER Report Date: 5/24/18 LER Screening Date: 6/6/18 cASP Criterion: 3g ASP Completion Date: 2/28/19 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On March 25, 2018, the plant was in Mode 3 preparing for a refueling outage when the A-12

extended range excore neutron flux monitors (NI-0045 and NI-0046) failed to meet required channel check criteria. Operators declared NI-0045 inoperable according to applicable TS. A subsequent licensee review concluded that NI-0046 was the inoperable monitor (i.e., NI-0045 was operable). Therefore, for approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, both extended range monitors were inoperable while NI-0045 was removed from service for corrective maintenance. In Modes 3-5, operators use these monitors to detect a return to criticality due to an inadvertent reactor coolant system dilution event. The extended range monitors and applicable shutdown modes/events are not included in the South Texas Project SPAR model; therefore, this event is evaluated qualitatively. The licensee determined that although both extended range monitors were unavailable for 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, there was significant shutdown margin available to prevent a return to criticality given a postulated dilution event. In addition, at least one source range monitor was always available, which would provide continuous indication of any changes to core conditions. Given this information, the risk impact is determined to be negligible and, therefore, this event is qualitatively screened out of the ASP Program. A search of LERs revealed no windowed events.

LER: 247-2018-003 Plant: Indian Point 2 Event Date: 10/28/18 LER Report Date: 12/20/18 LER Screening Date: 2/11/19 cASP Criterion: 3c ASP Completion Date: 3/5/19 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On October 28, 2018, operators were unable to close valve SWN-6 (supply to turbine building oil coolers) during swapping the essential service water (SW) headers. Operators declared the service water system inoperable and enter TS LCO 3.0.3, which requires the plant to be in Mode 3 within 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />. Licensee troubleshooting identified that the valve actuator's shear pin had failed. The valve was repaired in approximately 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> and service water operability was restored. SWN-6 was last successfully operated on September 16th and, therefore, the maximum exposure period the valve was unable to be closed for 1013 hours0.0117 days <br />0.281 hours <br />0.00167 weeks <br />3.854465e-4 months <br />. There are two potential risk impacts associated with the inability of SWN-6 to close. First, operators are directed to manually close SWN-6 to maximize cooling to support recirculation during a LOCA.

However, given the relatively low river water temperature at the time, this risk impact is negligible because the system ultimate heat sink would have enough capacity during a design basis accident regardless of the position of SWN-6. Second, a seismic event could rupture non-seismically qualified piping downstream of SWN-6, which could result in SW flow being diverted from required loads. During normal operation, the impact would be limited to non-essential SW header and recirculation capability given a LOCA. However, during the header swap October 28th, both SWN-6 and SWN-7 were open and, therefore, the essential and non-essential headers were cross-connected. With the headers cross-connected, there is potential for the essential SW header to be affected as well. Given the headers were cross-connected for less than the TS allowed outage time of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, no risk assessment was performed for this condition. However, a conservative risk assessment was performed assuming the failure of recirculation given any seismic event for an exposure period of 1013 hours0.0117 days <br />0.281 hours <br />0.00167 weeks <br />3.854465e-4 months <br />. This analysis results in a CDP of 5x10-7. The quantitative and qualitative considerations of this analysis show this event is below the precursor threshold of 10-6; therefore, this event is screened out of the ASP Program. A search of LERs reveals no windowed events.

LER: 341-2018-006 Plant: Fermi Event Date: 10/19/18 LER Report Date: 12/14/18 LER Screening Date: 2/12/19 cASP Criterion: 3d ASP Completion Date: 3/11/19 Classification: Analyst Screen-Out Analyst Justification: This event is not discussed in any IR to date; the LER remains open.

On October 19, 2018, DTE Electric Company identified that the ESF bus degraded voltage load A-13

shed relay scheme could inhibit the RHR pumps from automatically starting during a LOOP with a non-simultaneous LOCA. The root cause evaluation determined that this issue was a design defect that occurred during the original plant design. The licensee successfully completed a design modification on October 24th. A subsequent licensee review concluded that under certain scenarios of a combined LOOP and LOCA (e.g., a LOOP followed by a LOCA or a LOCA followed by a LOOP), the RHR pumps would have started, but then immediately tripped.

However, the RHR pumps could be manually started from the main control room for the affected scenarios. A risk assessment was performed assuming that the RHR pumps would fail to start automatically given a postulated, non-simultaneous LOOP/LOCA event, which resulted in a CDP of 7x10-9 for internal events. The seismic contribution is a CDP of 2x10-9 for the event.

The risk result is below the ASP threshold of 10-6 and, therefore, this event is not a precursor. A search of LERs did not yield any windowed events that would significantly impact the risk of this event.

LER: 416-2017-007-01 Plant: Grand Gulf Event Date: 12/12/17 LER Report Date: 2/5/18 LER Screening Date: 2/20/18 cASP Criterion: 3h ASP Completion Date: 3/12/19 Classification: Analyst Screen-Out Analyst Justification: On December 12, 2017, ESF transformer 11 de-energized due to a cable fault resulting in a loss of offsite power to the division 1 ESF bus. The division 1 EDG re-energized the division 1 ESF bus as expected; however, an unrelated isolation of RCIC occurred when power was restored. The cause of the RCIC isolation was due to the design of temperature switches in the RCIC isolation initiation circuits (see the ASP Program review of LER 426-2017-009 for additional information). Offsite power was restored to the division 1 ESF bus via ESF transformer 21. A risk assessment was performed for the loss of offsite power to the division 1 ESF bus and concurrent unavailability of RCIC (given successful operation of the division 1 EDG) for 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The resulting CDP was 2x10-9 for internal events. The seismic risk contribution for this event is negligible. The risk result is below the ASP threshold of 10-6 and, therefore, this event is not a precursor. A search of LERs did not yield any other windowed events.

A-14

Appendix B: Historical Precursor Occurrence Rates The figure in this appendix provides the annual occurrence rates of all precursors for the entire history of the Accident Sequence Precursor (ASP) Program (1969-2018). The occurrence rates of precursors have decreased significantly since plants began operating in the United States.21 The overall risk due to precursors has also decreased significantly as shown by the decreasing number of precursors with conditional core damage probability (CCDP) or increase in core damage probability (CDP) of greater than or equal to 10-4 (also called important precursors).

Applicable NRC regulatory initiatives and program changes that could potentially influence precursor occurrence rates are shown in the figure (not an exhaustive list). One of the examples shown in the figure is the use of simplified calculations until 1992, when the initial version of the standardized plant analysis risk (SPAR) models were developed and used for ASP analyses. The simplified calculations were likely sufficient to quantify reasonable estimates most of the time. However, it is possible that the simplified calculations overestimated the risk impact of events in some cases.

An example of a factor not shown in the figure, which influenced precursor occurrence rates is the change in LER screening criteria over the years. The screening criteria used for the analyses of events that occurred in the 1970s and 1980s, would typically screen-out failures of safety-related equipment where redundancy was not lost. Subsequent experience has shown that single-train failures of safety-related equipment can have CDPs that exceed the precursor threshold of 10-6. Given the initiating event frequencies and equipment reliability in the 1970s and 1980s, the precursor counts for these years are likely underestimated.

Based on the observation of the precursor occurrence rates during the 1969-2018 period, it appears that safety at U.S. nuclear power plants has improved significantly due to the implementation of NRC and licensee initiatives. However, ASP data alone should only be one input to determine an overall conclusion on the safety trends of commercial nuclear fleet in the U.S.

21 The occurrence rate of all precursors exhibits a statistically significant decreasing trend (p-value = 0.000) during the 1969-2018 period.

B-1

Simplified Calculations SPAR Models 1.0 Individual Plant Examinations SBO Rule; Scram Reduction 0.9 Reactor Oversight Process ASP Program Changes TMI Lessons Learned Maintenance Rule 0.8 Initiatives 0.7 Important Precursors Precusor Occurrence Rate (precursors per reactor-year)

All Other Precursors 0.6 0.5 0.4 0.3 0.2 0.1 0.0 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 Calendar Year Figure 11. Annual occurrence rates of all precursors for the entire history of ASP Program (1969-2018)

Note: This figure identifies program changes that could potentially influence precursor occurrence rates and is not an exhaustive list.

B-2