ML21055A029

Final ASP Analysis - North Anna 1 Degraded Upper Piston Pin Bushing (LER 338-2020-001)

ML21055A029
Person / Time
Issue date:	03/02/2021
From:	George Wang NRC/RES/DRA/PRB
To:
Wang, G - 301 415 1686
References
IR 05000338/2020003, LER 338-2020-001
Download: ML21055A029 (8)

Text

1 Final ASP Analysis - Precursor Accident Sequence Precursor Program - Office of Nuclear Regulatory Research North Anna Power Station, Unit 1 Degraded Upper Cylinder Piston Pin Bushing Discovered during Maintenance Activities on Emergency Diesel Generator Event Date: 2/18/2020 LER: 338-20-001 CDP = 5x10-6 IR: 05000338/2020003 Plant Type:

Westinghouse Three-Loop Pressurized Water Reactor (PWR) with a Large, Dry Containment Plant Operating Mode (Reactor Power Level):

Mode 1 (100% Reactor Power)

Analyst:

Gary Wang Reviewer:

Chris Hunter Completion Date:

3/2/2021 1

EXECUTIVE

SUMMARY

On February 18, 2020, the licensee discovered brass shavings in the upper crankcase of emergency diesel generator (EDG) 1J during planned maintenance activities. Further investigation revealed degradation of the number one upper piston pin bushing. The apparent cause was determined to be a degradation of the connecting rod aluminum cooling oil spherical retainer ring which resulted in increased oil flow and inadequate lubrication between the piston pin and piston pin bushing. The licensee investigation concluded that the degradation occurred during the previous start of EDG 1J during surveillance testing completed on January 22, 2020.

The previous successful test on EDG 1J was completed on December 16, 2019. Repairs were completed on February 26th after successful post-maintenance testing.

The total mean core damage probability (CDP) for this event is 5x10-6 and, therefore, this event is a precursor. This accident sequence precursor (ASP) analysis reveals that the most likely core damage scenario involves a loss of offsite power (LOOP) initiating event and subsequent failure of all the EDGs resulting in station blackout (SBO) along with the random failure or unavailability of the turbine-driven auxiliary feedwater (AFW) pump and failure of operators to restore alternating current (AC) power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. This accident scenario accounts for approximately 31 percent of the increase in CDP for the event. The risk contribution from seismic events, internal floods, high winds, and tornados is minimal for this analysis.

No licensee performance deficiency associated with this event was identified by NRC inspectors; the LER is closed. An ASP analysis was completed because a Significance Determination Process (SDP) risk evaluation was not performed.

2 EVENT DETAILS 2.1 Event Description On February 18, 2020, the licensee discovered brass shavings in the upper crankcase of EDG 1J during planned maintenance activities. Further investigation revealed degradation of the number one upper piston pin bushing. The apparent cause was determined to be a degradation of the connecting rod aluminum cooling oil spherical retainer ring which resulted in

LER 338-2020-001 2

increased oil flow and inadequate lubrication between the piston pin and piston pin bushing.

The licensee investigation concluded that the degradation occurred during the previous start of EDG 1J during surveillance testing completed on January 22, 2020. The previous successful test on EDG 1J was completed on December 16, 2019. Repairs were completed on February 26th after successful post-maintenance testing. Additional information is provided in licensee event report (LER) 338-20-001, Degraded Upper Cylinder Piston Pin Bushing Discovered during Maintenance Activities on Emergency Diesel Generator, (ADAMS Accession No. ML20122A056).

Cause. Licensee investigation revealed that the failure of EDG 1J was caused by the degradation on number 1 upper cylinder piston pin bushing. Inadequate lubrication between the piston pin and bushing resulted from increased oil flow due to degradation of a connecting rod cooling oil spherical retainer ring.

3 MODELING 3.1 SDP Results/Basis for ASP Analysis The ASP Program uses SDP results for degraded conditions when available (and applicable).

The NRC inspection of this event is documented in inspection report 05000338/2020003, North Anna Power Station - Integrated Inspection Report 05000338/2020003 and 05000339/2020003 and Exercise of Enforcement Discretion, (ADAMS Accession No. ML20310A166). The inspectors determined that the failure of EDG 1J was not reasonably preventable by the licensee and, therefore, the technical specification (TS) violation was not a result of deficient licensee performance and was addressed using traditional enforcement under the NRCs Enforcement Policy. The LER is closed. An independent ASP analysis was performed because there was no performance deficiency identified and, therefore, not SDP risk evaluation was performed. A search for windowed events revealed a concurrent unavailability of EDG 1H.

Specifically, LER 338-20-001 states that EDG 1H was inoperable for surveillance testing and maintenance for approximately 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> between December 16, 2019 through February 26, 2020.

3.2 Analysis Type A condition analysis was performed using Revision 8.56 of the standardized plant analysis risk (SPAR) model for North Anna Power Station (Unit 1 and Unit 2) created in March 2019. This SPAR model includes the following hazards:

Internal events, Internal floods,

Seismic, High winds, and Tornados.

3.3 SPAR Model Modifications The following modification was made to the SPAR model for this analysis:

Crediting FLEX Strategies. The probability of basic event FLX-XHE-XE-ELAP (operators fail to declare ELAP when beneficial) was set to its nominal value of 10-2 to activate the credit for FLEX mitigation strategies for postulated SBO scenarios for which an extended loss of AC power (ELAP) is declared.

LER 338-2020-001 3

FLEX Reliability Parameters. FLEX hardware reliability parameters suitable for inclusion in the NRC SPAR models is not yet available. Therefore, the base SPAR models currently use the reliability parameters of permanently installed equipment, which is inconsistent with the limited experience with the operation of FLEX equipment. As part of an NRC audit performed of preliminary FLEX hardware data provided by the Pressurized Water Reactor Owners Group (PWROG), Idaho National Laboratory reviewed the FLEX hardware parameters estimated by the PWROG. This review revealed that FLEX diesel generator failure-to-start (FTS) probability is 3 to 10 times higher and failure-to-run (FTR) rate is 2 to 5 times higher than permanently installed EDGs. The portable engine-driven centrifugal pump FTS probability is at least 8 times higher and FTR rate is at least 6 times higher than permanently installed pumps. See Table 1 in INL/EXT-20-58327, Evaluation of Weakly Informed Priors for FLEX Data, (ADAMS Accession No. ML20155K834) for additional information. Therefore, to provide a more representative estimate of the FLEX hardware reliability parameters, this analysis increased the hardware reliability by a factor of three in the best estimate case.

Removal of EDG Repair Credit for ELAP Scenarios. The base SPAR model provides credit for repair of postulated EDG failures for SBO scenarios. However, this potential credit is not applicable for scenarios where ELAP will be declared because (a.) operators will be focused on implementing the FLEX mitigation strategies and (b.) the DC load shedding activities could preclude recovery of EDGs. Therefore, credit for EDG repair credit was removed from the sequences if it is included after ELAP is likely declared (i.e., 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />).

72-Hour AC Power Recovery Requirement. The base SPAR model requires AC power recovery within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for a safe/stable end state for ELAP scenarios with successful FLEX implementation. If AC power is not recovered in these scenarios, the SPAR models assume core damage. The American Society of Mechanical Engineers/American Nuclear Society probabilistic risk assessment standard definition for safe/stable end state does not require AC power recovery. Because of the large uncertainty in modeling assumptions related to availability and reliability of components and strategies for mission times that are well beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and the unclear basis for requiring AC power recovery within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the 72-hour AC power requirement was eliminated in this analysis. As part of this change, the FTR events for FLEX diesel generators and pumps have a 72-hour mission time in the base SPAR model. These mission times were reset to be consistent with the 24-hour mission time used in the SPAR model.

3.4 Exposure Time The following two exposure times were identified for this condition analysis:

Exposure Time 1. The licensee concluded that the EDG 1J degradation occurred during its start as part of surveillance testing completed on January 22, 2020. Repairs were completed on February 26th after successful post-maintenance testing. Therefore, EDG 1J is assumed to be unable to fulfil its safety function for at least 36 days.

However, the failure mechanism could have occurred during any start of the EDG after its successful surveillance test completed on December 16, 2019, which is an additional 37 days. Therefore, EDG 1J is assumed to be unable to fulfil its safety function for approximately 73 days. Exposure time 1 is calculated as 1712 hours0.0198 days <br />0.476 hours <br />0.00283 weeks <br />6.51416e-4 months <br /> (i.e., 73 days minus the 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> from exposure time 2).

LER 338-2020-001 4

Exposure Time 2. Based on the information provided in LER 338-20-001, EDG 1H was inoperable for normal maintenance and surveillance activities for approximately 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> between December 16, 2019 through February 26, 2020. Therefore, both EDGs are assumed to be unavailable for 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> in this exposure time.

3.5 Analysis Assumptions The following assumptions were determined to be significant to the modeling of this condition assessment:

Basic event EPS-DGN-FS-DG1J (EDG 1J fails to start) was set to TRUE for both exposure times.

Basic event EPS-DGN-TM-DG1H (EDG 1H unavailable due to T&M) was set to TRUE for Exposure Time 2 only.

4 ANALYSIS RESULTS 4.1 Results The mean CDP for this analysis is calculated to be 5x10-6, which is the sum of both exposure times. The ASP Program threshold is 1x10-6 for degraded conditions; therefore, this event is a precursor. The parameter uncertainty results for each exposure time are provided below:

Table 1. Parameter Uncertainty Results for Exposure Time 1 5%

Median Pt. Estimate Mean 95%

5.1x10-7 2.0x10-6 2.2x10-6 2.7x10-6 7.5x10-6 Table 2. Parameter Uncertainty Results for Exposure Time 2 5%

Median Pt. Estimate Mean 95%

4.5x10-7 1.4x10-6 9.9x10-7 1.9x10-7 4.9x10-6 4.2 Dominant Hazards1 The dominant hazard is internal events (CDP = 3.0x10-6), which contributes approximately 92 percent of the total CDP. The following table provides the contribution of all hazards that are included in the North Anna SPAR model.

Table 3. Dominant Hazards Hazards CDP

% Contribution Internal Events 3.0x10-6 92%

High Winds 1.5x10-7 5%

Seismic 9.6x10-8 3%

Tornados 1.0x10-9 Negligible Internal Flood

<1x10-12 Negligible 1

The CDP presented in Sections 4.2 and 4.3 are point estimates.

LER 338-2020-001 5

4.3 Dominant Sequences The dominant accident sequence is LOOP sequence 17-12 (CDP = 1.0x10-6, which contribute approximately 31 percent of the total CDP. The dominant sequences are shown in the table below and graphically in Figures A-1 and A-2 in Appendix A. Accident sequences that contribute at least 5 percent of the total CDP.

Table 4. Dominant Sequences Sequence CDP Description LOOP 17-12 1.0x10-6 31.0% LOOP initiating event; emergency power system failure results in SBO; AFW fails; operators fail to restore AC power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> results in core damage.

LOOP 17-03-03 9.8x10-7 30.5% LOOP initiating event; emergency power system failure results in SBO; AFW successfully operates; operators fail to restore AC power prior to normal battery depletion (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />);

operators declare ELAP; FLEX diesel generators successfully charge batteries; FLEX SG pumps successfully provide inventory makeup to the SGs; FLEX reactor coolant system (RCS) makeup pumps fail; core damage is assumed if operators fail to restore AC power within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

LOOP 17-03-09 4.5x10-7 14.0% LOOP initiating event; emergency power system failure results in SBO; AFW successfully operates; operators fail to restore AC power prior to normal battery depletion (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) ;

operators declare ELAP; FLEX diesel generators fail to charge batteries is assumed to result in core damage (no credit for continued operation of AFW without DC power is provided).

LOOP 17-06 2.0x10-7 6.3%

LOOP initiating event; emergency power system failure results in SBO; AFW successfully operates; reactor coolant pump (RCP) seal failure results in loss-of-coolant accident (LOCA); operators fail to restore AC power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> results in core damage.

4.4 Key Uncertainties The following is the key modeling uncertainty of this ASP analysis:

Credit for FLEX Mitigation Strategies. The crediting of FLEX mitigation strategies has a significant impact on these analysis results. A sensitivity analysis assuming no credit for FLEX results in a CDP increase by nearly a factor of four (i.e., total mean CDP of 2.3x10-5).

Lack of Internal Fire Scenarios in the SPAR Model. The lack of internal fires scenarios in the North Anna SPAR model is a key uncertainty. To address this uncertainty, the risk information provided by the licensee for various risk-informed applications (e.g., TS change) was reviewed. North Anna references its individual plant examination for external events (IPEEE) for a quantitative assessment of the risk associated with internal fires in their risk-informed licensing amendments to date.

Internal fire scenarios that could significantly impact for the risk of this event would either have to (a.) impact the functionality of the unaffected Unit 1 EDGs or (b.) result in a LOOP event. A review of the North Anna IPEEE results reveals that the potential fire scenarios in the compartments containing the EDGs and the fuel oil rooms were screened without a detailed evaluation because a fire in these areas would not result in

LER 338-2020-001 6

a plant trip. In addition, potential fires in one of these areas combined with the known unavailability of another EDG would require a controlled reactor shutdown as directed by TS. Potential fire scenarios that could result in a complete LOOP (offsite power to both safety and nonsafety-related buses) were not noted in IPEEE. Given these considerations, it is not expected that postulated internal fires would substantially increase the risk of the event evaluated as part of this analysis.

LER 338-2020-001 A-1 Appendix A: Key Event Trees Figure A-1. North Anna LOOP Event Tree IE-LOOPGR LOSS OF OFFSITE POWER INITIATOR (GRID-RELATED)

RPS-L FS = FTF-LOOP REACTOR TRIP EPS FS = FTF-SBO EMERGENCY POWER AFW FS = FTF-LOOP-RECOVERY AUXILIARY FEEDWATER PORV FS = FTF-LOOP-RECOVERY PORVS ARE CLOSED LOSC FS = FTF-LOSC RCP SEAL COOLING MAINTAINED HPI FS = FTF-LOOP-RECOVERY HIGH PRESSURE INJECTION FAB FS = FTF-LOOP-RECOVERY FEED AND BLEED OPR-06H OFFSITE POWER RECOVERY IN 6 HRS HPR HIGH PRESSURE RECIRC RSS RECIRC SPRAY End State (Phase - CD)

AFW-L 1

OK LOSC-L 2

LOOP-1 PORV-L HPI-SIL 3

OK 4

CD 5

CD HPR-SIL 6

OK RSS-SIL 7

CD HPR-SIL 8

CD HPI-SIL 9

CD AFW-L FAB-L 10 OK 11 CD 12 CD HPR-L 13 OK RSS-L 14 CD HPR-L 15 CD FAB-L 16 CD 17 SBO 18 ATWS 19 CD

LER 338-2020-001 A-2 Figure A-2. North Anna SBO Event Tree EPS FS = FTF-SBO EMERGENCY POWER AFW-B FS = FTF-SBO AUXILIARY FEEDWATER PORV-B FS = FTF-SBO PORVS/SRVS DURING SBO RCPSEALLOCA-SBO RCP Seal LOCA - MLOCA with N9000 Seals OPR-02H OFFSITE POWER RECOVERY IN 2 HRS DGR-02H OPERATOR FAILS TO RECOVER DIESEL GENERATOR IN 2 HRS End State (Phase - CD) 1 OK 2

OK 3

SBO-4 OPR-01H 4

SBO-1 OPR-01H 5

OK DGR-01H 6

CD OPR-01H 7

SBO-2 OPR-01H 8

OK DGR-01H 9

CD OPR-01H 10 SBO-3 OPR-01H 11 OK DGR-01H 12 CD