ML19212A651

Transmittal of Final Accident Sequence Precursor Report (Licensee Event Report 293-2019-001)

ML19212A651
Person / Time
Site:	Pilgrim
Issue date:	08/12/2019
From:	Scott Wall Plant Licensing Branch III
To:	Brian Sullivan Entergy Nuclear Operations
Wall S
References
Download: ML19212A651 (12)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 August 12, 2019 Mr. Brian R. Sullivan Site Vice President Entergy Nuclear Operations, Inc.

Pilgrim Nuclear Power Station 600 Rocky Hill Road Plymouth, MA 02360-5508

SUBJECT:

PILGRIM NUCLEAR POWER STATION - TRANSMITTAL OF FINAL ACCIDENT SEQUENCE PRECURSOR REPORT (LICENSEE EVENT REPORT 293-2019-001)

Dear Mr. Sullivan:

By letter dated February 28, 2019 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML19064A593), Pilgrim Nuclear Power Station submitted licensee event report (LER) 293-2019-001, "Reactor Core Isolation Cooling System Declared Inoperable During Surveillance Testing," to the U.S. Nuclear Regulatory Commission (NRC) staff pursuant to Title 10 of the Code of Federal Regulations Section 50. 73. As part of the Accident Sequence Precursor (ASP) Program, the NRC staff reviewed the event to identify potential precursors and to determine the probability of the event leading to a core damage state. The results of the analysis are provided in the enclosure to this letter.

The NRC does not request a formal analysis review in accordance with Regulatory Issue Summary 2006-24, "Revised Review and Transmittal Process for Accident Sequence Precursor Analyses" (ADAMS Accession No. ML060900007), because the analysis resulted in an increase in core damage probability (~CDP) of less than 1x10-4.

Final ASP Analysis Summary. A brief summary of the final ASP analysis, including the results, is provided below.

Reactor Core Isolation Cooling System Pressure Switch Failure Results in Condition Prohibited by Technical Specifications. This event is documented in LER 293-2019-001.

Executive Summary. On January 8, 2019, the reactor core isolation cooling (RCIC) pump turbine was started from the main control room for a quarterly surveillance test. During the test run, the turbine did not reach rated flow conditions. Operators identified that flow controller FIC-1340-1 output meter was unexpectedly indicating zero. Operators attempted to change demand by increasing the flow controller setpoint, but no change in output or flow occurred.

Operators then manually stopped the RCIC turbine from the main control room and declared the RCIC system inoperable.

Licensee troubleshooting determined that the probable cause of the RCIC pump failure to reach rated flow was flow controller FIC-1340-1 output signal loss. Following replacement of the failed flow controller and successful testing, RCIC was declared operable on January 101h. RCIC was previously run satisfactorily on September 26, 2018.

This ASP analysis reveals that the most likely core damage scenarios are a loss of feedwater or loss of condenser heat sink with RCIC unavailable and the postulated unavailability of the high-pressure coolant injection and failure of operators to depressurize the reactor. These accident sequences account for approximately 57 percent of the total ~CDP for the event. The point estimate ~CDP for this event is 3x1Q-6 (internal events), which is considered a precursor under the ASP Program. The seismic contribution for this event is ~CDP of 2x10-1.

To date, no performance deficiency associated with this event has been identified and, therefore, an ASP analysis was performed since a Significance Determination Process evaluation was not performed.

Summary of Analysis Results. This operational event resulted in a best estimate ~CDP of 3x 10-6. The detailed ASP analysis can be found in the enclosure.

If you have any questions, please contact me at 301-415-2855 or via e-mail at Scott. Wall@nre.gov.

Docket No. 50-293

Enclosure:

ASP Report (LER 293-2019-001) cc: Listserv Sincerely, Scott P. Wall, Senior Project Manager Plant Licensing Branch Ill Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

ENCLOSURE Final Accident Sequence Precursor Analysis - Pilgrim Nuclear Power Station, Reactor Core Isolation Cooling System Declared Inoperable During Surveillance Testing (LER 293-2019-001) -

Precursor (ADAMS Accession No. ML19169A279)

Final ASP Program Analysis - Precursor Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Pilgrim Nuclear Power Reactor Core Isolation Cooling System Declared Inoperable Station During Surveillance Testing LER(s):

293-2019-001 Event Date:

1/08/2019

~CDP=

3x1Q-6 IR(s):

TBD Plant Type:

General Electric Type 3 Boiling-Water Reactor (BWR) with a Mark I Containment Plant Operating Mode Mode 1 (100% Reactor Power)

(Reactor Power Level):

Analyst:

Reviewer:

Contributors:

Approval Date:

Matthew Leech Christopher Hunter N/A 6/21/2019 EXECUTIVE

SUMMARY

On January 8, 2019, the reactor core isolation cooling (RCIC) pump turbine was started from the main control room for a quarterly surveillance test. During the test run, the turbine did not reach rated flow conditions. Operators identified that flow controller FIC-1340-1 output meter was unexpectedly indicating zero. Operators attempted to change demand by increasing the flow controller setpoint, but no change in output or flow occurred. Operators then manually stopped the RCIC turbine from the main control room and declared the RCIC system inoperable.

Licensee troubleshooting determined that the probable cause of the RCIC pump failure to reach rated flow was flow controller FIC-1340-1 output signal loss. Following replacement of the failed flow controller and successful testing, RCIC was declared operable on January 101h. RCIC was previously run satisfactorily on September 26, 2018.

This accident sequence precursor (ASP) analysis reveals that the most likely core damage scenarios are a loss of feedwater or loss of condenser heat sink with RCIC unavailable and the postulated unavailability of the high-pressure coolant injection (HPCI) and failure of operators to depressurize the reactor. These accident sequences account for approximately 57 percent of the increase in core damage probability (flCDP) for the event. The point estimate flCDP for this event is 3x1Q*6 (internal events), which is considered a precursor under the ASP Program. The seismic contribution for this event is flCDP of 2x10-1.

To date, no performance deficiency associated with this event has been identified and, therefore, an ASP analysis was performed since a Significance Determination Process (SOP) evaluation was not performed.

1

LER 293-2019-001 EVENT DETAILS Event Description. On January 8, 2019, the RCIC pump turbine was started from the main control room for a quarterly surveillance test. During the test run, the turbine did not reach rated flow conditions. Operators identified that flow controller, FIC-1340-1, output meter was unexpectedly indicating zero. Operators attempted to change demand by increasing the flow controller setpoint, but no change in output or flow occurred. Operators then manually stopped the RCIC turbine from the main control room and declared the RCIC system inoperable.

Licensee troubleshooting determined flow controller FIC-1340-1 output signal failed. Following replacement of the failed flow controller and successful testing, the RCIC system was declared operable on January 101h. Additional information is provided in licensee event report (LER) 293-2019-001 (Ref. 1).

Cause. Based on troubleshooting and investigation of the condition the licensee determined that the probable cause is output signal loss to the flow controller. All other potential failure causes were eliminated.

MODELING ASSUMPTIONS Analysis Type. The Pilgrim standardized plant analysis risk (SPAR) model, Version 8.56 dated April 19, 2019, was used for this condition assessment.

SDP Results/Basis for ASP Analysis. The ASP Program uses SOP results for degraded conditions when available (and applicable). To date, issued inspection reports for Pilgrim Nuclear Power Station do not provide additional information on this event. Discussions with Region 1 staff indicated that no performance deficiency has been identified to date; however, the LER remains open. An independent ASP analysis was performed because there was no performance deficiency identified and the potential risk significance of this event.

A search for additional Pilgrim LERs was performed to determine if any initiating events or additional unavailability existed during the exposure period of RCIC pump. No concurrent degraded conditions were identified; however, on October 5, 2018 a plant trip occured during the RCIC pump exposure period. An initiating event assessment was performed for a reactor trip with the concurrent unavailability of RCIC. The conditional core damage probability (CCDP) for this "windowed" event is bounded by the plant-specific CCDP of a nonrecoverable loss of condenser heat sink. Therefore, the risk impacts of the October 5th reactor trip are not evaluated further as part of this analysis.

Exposure Period. The exact time of failure of the flow controller is not known and could have occurred any time since the RCIC pump was last successfully operated. For these types of scenarios, Volume 1 (internal events) of the Risk Assessment of Operational Events (or RASP) handbook recommends the exposure time (7) be calculated by dividing time interval from the failure and the last successful operation (t) by 2 and adding the repair time.

t T = 2 + Repair Time The RCIC pump failed on January 8th at 9:39 a.m. The last successful operation of the RCIC pump occurred during the previous quarterly surveillance test completed on September 26th at 11 :58 a.m. (approximately 2518 hours0.0291 days <br />0.699 hours <br />0.00416 weeks <br />9.58099e-4 months <br />). It took the licensee approximately 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> to repair 2

LER 293-2019-001 the failed flow controller and restore the RCIC pump to operable status. However, this period also included a time in which Pilgrim had shut down following a plant trip that occurred on October 5th. After the trip, the plant was placed in cold shutdown mode (i.e., reactor coolant temperature was less than 212°F). Since RCIC is only required to be operable when reactor coolant temperature is greater than 365°F, the period of 137 hours0.00159 days <br />0.0381 hours <br />2.265212e-4 weeks <br />5.21285e-5 months <br /> in which the plant was in cold shutdown needs to be subtracted from t prior to dividing it by two. Therefore, the exposure time for this analysis was calculated as follows:

(2518 hours0.0291 days <br />0.699 hours <br />0.00416 weeks <br />9.58099e-4 months <br /> - 137 hours0.00159 days <br />0.0381 hours <br />2.265212e-4 weeks <br />5.21285e-5 months <br />)

T =

2

+ 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> = 1230.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />sl Key Modeling Assumptions. The following modeling assumptions were determined to be significant to the modeling of this event:

Basic event RCI-TDP-FR-P206 (RCIC pump P-206 fails to start) was set to TRUE because the pump was unable to fulfil its safety function due to the failed flow controller.

The RCIC system function was restored approximately 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> after the pump was secured. Core damage is expected to occur approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for the dominant accident sequences in this analysis and, therefore, repair of the RCIC pump is not credited in this analysis.

The preliminary results were reviewed to determine if FLEX strategies would affect the risk of this event. In order for FLEX strategies to be successful at Pilgrim, either RCIC or HPCI must be available. The dominant sequences for this event involved both RCIC and HPCI failing. Without either, FLEX cannot be successfully deployed, therefore FLEX strategies were not considered as part of this analysis.

ANALYSIS RES UL TS

~CDP. The point estimate LiCDP for this event is 3x1Q-6, which is the sum of all exposure periods. The ASP Program acceptance threshold is a LiCDP of 1 x 1 o-s for degraded conditions.

The LiCDP for this event exceeds this threshold; therefore, this event is a precursor.

Dominant Sequence. The dominant accident sequence is loss of condenser heat sink sequence 40 (LiCDP = 1 x 1 o-6), which contributes approximately 37 percent of the total internal events LiCDP. The dominant sequences are shown in the table below and graphically in Figure A-1 Appendix A. Accident sequences that contribute at least 1.0 percent to the total internal events LiCDP for this analysis are provided in the following table.

Sequence CCDP CDP ACDP Description LOCHS 40 2.1ox10-6 9.54x1Q-7 1.15x1Q-6 37%

Loss of condenser heat sink initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor The input for risk calculations using the event and condition assessment (ECA) module within SAPHIRE only allows exposure period to be input as integers. Therefore, this analysis used 1231 hours0.0142 days <br />0.342 hours <br />0.00204 weeks <br />4.683955e-4 months <br />.

3

LER 293-2019-001 Sequence ; ',

CCl?,P i:l;)P:

4CPP Des,eription LOMFW40 1.13x1Q-6 5.15x1Q-7 6.17x1Q-7 20%

Loss of feedwater initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LODCB-B 45 3.16x1Q-7 4.76x1Q-B 2.69x1Q-7 9%

Loss of vital bus B initiating event; successful reactor trip; power conversion system (including feedwater) fails, RCIC, and HPCI fail; condensate fails, reactor depressurization succeeds; low-pressure injection (LPI) fails; and alternate injection fails IORV47 3.83x1Q-7 1.31 x1Q-7 2.51x1Q-7 8%

Inadvertent opening of safety relief valve initiating event; successful reactor trip; power conversion system (including feedwater) fails, RCIC, and HPCI fail; and operators fail to depressurize the reactor LOOPSC 25 1.68x1Q-7 2.83x1Q-B 1.39x1Q-7 5%

Switchyard-centered loss of offsite power (LOOP) initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOOPGR25 1.38x1Q-7 2.32x1Q-B 1.14x1Q-7 4%

Grid-related LOOP initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOOPWR25 7.49x1Q-8 1.26x1Q-B 6.22x1Q-8 2%

Weather-related LOOP initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOOPSC 28-17 4.93x1Q-B 7.22x1Q-9 4.21x1Q-8 1%

Plant-centered LOOP initiating event; successful reactor trip; emergency power fails; RCIC and HPCI fail; and operators fail to recover offsite power LODCB-B 38 4.83x1Q-B 7.21x10-9 4.10x1Q-8 1%

Loss of vital bus B initiating event; successful reactor trip; power conversion system (including feedwater) fails, RCIC, and HPCI fail; condensate fails, LPI succeeds; suppression pool cooling fails; containment spray fails, power conversion system recovery is not successful; containment venting fails; and long-term low pressure injection fails TRANS 44-25 4.9Qx1Q-B 8.27x1Q-9 4.Q8x1Q-B 1%

Transient initiating event; consequential LOOP occurs; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor LOOPGR 28-17 4.21x1Q-B 6.19x1Q-9 3.59x1Q-8 1%

Grid-related LOOP initiating event; successful reactor trip; RCIC and HPCI fail; and operators fail to depressurize the reactor 4

IORV46 LODC-B 46 Total LER 293-2019-001 CCDP CDP ACDP

Description 4.15x1Q-8 6.25x1Q-8 3.53x1Q-8 1%

Inadvertent opening of safety relief valve initiating event; successful reactor trip; power conversion system (including feedwater) fails, RCIC, and HPCI fail; condensate fails; LPI fails; and alternate injection fails 2.25x1Q-7 1.93x1Q-7 3.26x1Q-8 1 %

Loss of vital bus B initiating event; successful reactor trip; power conversion system (including feedwater) fails, RCIC, and HPCI fail; and operators fail to depressurize the reactor 1.42x10*5 1.11x10*5 3.07x10*6 Uncertainties. The key modeling uncertainty associated with this analysis is the exposure period. The flow controller failed sometime between the last successful surveillance test on September 26, 2018 and the time of discovery on January 8, 2019 (105 days). There is no additional information available to reduce the uncertainty of when the flow controller failed during this period. A sensitivity analysis, was performed to determine the risk of an upper bound exposure period of 105 days (i.e., assuming that the controller failed directly after the successful test on September 261h test), subtracting the 137 hours0.00159 days <br />0.0381 hours <br />2.265212e-4 weeks <br />5.21285e-5 months <br /> in which RCIC was not required to be operable in service while the plant was in cold shutdown during a forced outage, and adding the 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> of repair time. The b.CDP for this 2421-hour exposure period is 6x 10*6.

In addition, a sensitivity evaluation was performed to determine the minimum exposure period required for the b.CDP to exceed the precursor threshold of 1x10*6* It was determined that a RCIC unavailability of at least 17 days (approximate) is needed to exceed the precursor threshold.

Seismic Contribution. Historically, independent condition assessments performed as part of the ASP Program only included the risk impact from internal events and did not include the consideration of other hazards such as fires, floods, earthquakes, etc. 2 The reason for the exclusion of the impacts of other hazards in most ASP analyses was due to the lack of modeling capability within the SPAR models. However, seismic hazards modeling was completed for all SPAR models in December 2017. Therefore, seismic hazards are now being evaluated as part of all condition assessments performed by the ASP Program. The seismic contribution for a RCIC unavailability of 1231 hours0.0142 days <br />0.342 hours <br />0.00204 weeks <br />4.683955e-4 months <br /> is b.CDP of 2x10*7. The following table provides the seismic bin results that contribute at least 1 percent of the total seismic b.CDP for this analysis.

Seismic Bin Seismic Event in Bin 3

{>0.5 G) occurs Seismic Event in Bin 2 (0.3-0.5 G) occurs 4CDP Notes/Observations 1.89x10-7 Dominant scenarios are seismically-induced LOOP and failure of the emergency power system result in a station blackout.

Random and seismic HPCI failures result in core damage.

1.19x1Q-8 Dominant scenarios are seismically-induced LOOP and failure of 1-----------+----

the safety-related batteries result in SBO. The seismically-induced battery failures result in the unavailability of HPCI and subsequent core damage.

2 TOTAL= 2.01 x1Q-7 Initiating events caused by other hazards (e.g., tornado results in a LOOP) or degradations specific to a hazard (e.g., degraded fire barrier) have been analyzed as part of ASP Program.

5

LER 293-2019-001 REFERENCES

1. Pilgrim Nuclear Power Station, "LER 293/19-001 - Reactor Core Isolation Cooling System Declared Inoperable During Surveillance Testing," dated February 28, 2019 (ADAMS Accession No. ML19064A593).

6

Appendix A: Key Event Tree r-0--0----

L--

o---,

0----

0---0---

0----

. n 0---

0---

0---0---0---

0----

0---

o---Co---o---

~'

Figure A-1. Pilgrim Loss of Condenser Heat Sink (LOCHS) Event Tree A-1 LER 293-2019-001 Endstete (PhlM*CD)

SUBJECT:

TRANSMITTAL OF FINAL PILGRIM NUCLEAR POWER STATION ACCIDENT SEQUENCE PRECURSOR REPORT (LICENSEE EVENT REPORT 293-2019-001) DATED AUGUST 12, 2019 DISTRIBUTION:

PUBLIC RidsACRS_MailCTR Resource RidsNrrDorlLpl3 Resource RidsNrrLAJBurkhardt Resource RidsNrrPMPilgrim Resource RidsRgn 1 MailCenter Resource CHunter, RES/ORA D

A AMS Accession Nos.: p ackaqe ML 212A667 L tt ML 19212A6 1 ASP R rt ML19169A279 19

e er 5 ;

epo v,a ema, OFFICE NRR/DORL/LPL3/PM NRR/DORL/LSPB/LA NRR/DORL/LPL3/BC(A) NRR/DORL/LPL3/PM NAME SWall JBurkhardt LRegner SWall DATE 07/31/19 08/01/19 08/09/19 08/12/19 OFFICIAL RECORD COPY