ML22048B595
| ML22048B595 | |
| Person / Time | |
|---|---|
| Issue date: | 04/12/2022 |
| From: | Vijay Goel NRC/NRR/DEX |
| To: | |
| O'Donnell E | |
| Shared Package | |
| ML22048B590 | List: |
| References | |
| Download: ML22048B595 (4) | |
Text
NRC FORM 833 U. S. NUCLEAR REGULATORY COMMISSION (04-2015)
Form to Propose a Generic Issue (GI)
NAME OF PERSON SUBMITTING REQUEST Vijay K Goel EMAIL ADDRESS Vijay.Goel@nrc.gov DATE OF REQUEST 02-07-2022 TELEPHONE NUMBER (Enter 10 numeric digits) 301-415-3730 MAILING ADDRESS NRC, OWFN, MS 09-H04 GENERAL INSTRUCTIONS FOR COMPLETING AND SUMBITTING THIS FORM:
The Generic Issue Program is managed by the Operating Experience and Generic Issues Branch in the Office of Nuclear Regulatory Research. The public (or NRC staff) should fill out this form, then email it to GIP.Resource@nrc.gov, or send by US Mail to US Nuclear Regulatory Commission, Generic Issues Program, Washington, DC 20555-0001, Mail Stop C-2C07M.
The proposer should review the Web Site to understand the criteria that will be used by staff to screen a proposed issue.
NRC Public Web site: www.nrc.gov/about-nrc/regulatory/gen-issues.html Website for NRC staff: www.internal.nrc.gov/RES/projects/GIP/UserInstructions.html Contact the GIP.Resource@NRC.gov for assistance in responding to the entries on the form below if needed.
If you believe an issue is an immediate safety concern, or identifies an inadequacy associated with NRC regulated activities at a licensee or other regulated party, you should instead report the issue through the procedures listed under "Report a Safety or Security Concern" found at:
http://www.nrc.gov/about-nrc/regulatory/allegations/safety-concern.html.
- 1. Describe the situation, condition, cause and significance of occurrence or adverse consequence by providing as much detail as practical. Identify the current regulatory requirements or guidance or describe why this proposed issue is not addressed by existing regulations and guidance. Provide a basis for your statements if available or indicate that it is your opinion or belief, as applicable.
ISSUE - Many EDG Protection Trips (many Mechanical & Electrical trips) are being bypassed at many plants under Loss of offsite-power (LOOP) conditions. This is contrary to industry guidance IEEE Std 387-1984, 1995, 2017, in which the following is stated: All protective devices shall remain effective during the diesel-generator unit testing, and during operation in non-accident conditions. [Non-accident conditions would include LOOP]. NRC Regulatory Guidance [e.g., BTP EICSB-17, RG 1.9] is silent regarding protective trips bypass under LOOP condition. This issue is related to adversely impacting the recovery of EDGs under LOOP conditions, and potentially incorrect modelling of the recovery of EDGs during LOOP/SBO in SPAR modelling by NRC, and similarly in the PRA models by the licensees.
- 2. Describe why the issue should be processed as a GI. Please provide your input on the following: The issue can have its risk or safety significance adequately determined or estimated; issue may affect public health, safety, common defense and security, or environment; issue applies to two or more plants; issue is not being addressed by other regulatory processes; issue will likely result in actions by licensees; or issues may result in new or revised regulation, policy, or guidance.
- The issue is Generic as it applied to two or more plants (approximately 60 percent of plants).
- The issue has safety significance based on qualitative and quantitative risk assessment.
- The issue is not being currently addressed by other regulatory processes.
- The issue is likely to result in actions by licensees.
- The issue may result in new or revised guidance.
- 3. Identify source(s) of information or references for the proposed GI (self, NRC process, research, other).
(1) BTP EICSB-17 (ML081510815) issued in 1975, states: The design of standby diesel-generator systems should retain only the engine overspeed and the generator differential trips and bypass all other trips under an accident condition. All those trips that are bypassed for an accident condition may be retained for the diesel-generator routine tests. [Silent regarding guidance for bypassing of non-critical trips under LOOP condition.] Similar guidance is provided in RG 1.9 R2, R3, R4.
Bypassing of non-critical trips was perhaps recommended to avoid EDG trips during accident conditions to avoid any spurious trips.
NRC FORM 833 [Page 2 of 4]
(2) NRC Standard Technical Specifications (STS), e.g., NUREG-1431, R3, R4 (SR 3.8.1.13) recommends the verification of bypassing of EDG non-critical trips under LOOP concurrent with LOCA (accident - ESF/ECCS/SI actuation) conditions.
However, STS is also silent regarding bypassing of non-critical trips under LOOP only condition. The choice of non-critical trips is left to be decided by licensees (plant specific).
(3) During a review of license amendment request issued for Perry plant (ML17325B690) (a minor TS change to SR 3.8.1.13 related to bypassing of non-critical trips for conforming to STS R4 format), a discrepancy was noticed between the Perry TS and UFSAR. In the TS SR 3.8.1.13, the requirement was to bypass non-critical trips under ECCS signal. However according to the UFSAR Chapter 8, the design also allowed bypass of non-critical trips under accident OR LOOP condition.
During the review, it was noticed that similar discrepancy existed at some other plants. Therefore, this issue is considered as generic as it applies to many other plants also.
(4) In order to determine the extent of above discrepancies, and to determine the safety significance of above issue, a TABLE titled EDG Trips Bypass at Various Plants, Based on TSs and UFSARs (see Attachment 1) has been prepared, which is attached. This Table shows both Mechanical and Electrical Trips (considered critical and non-critical) at various plants.
Following important observations are made from the TABLE:
- Discrepancies between TS and UFSAR exist at approximately 25 of 59 plants (approx. 42% of plants). According to TS, SRs (e.g., SR 3.8.1.13) of these plants, the non-critical EDG trips are bypassed under LOCA (accident) concurrent with LOOP condition, whereas according to UFSAR, the non-critical EDG trips are bypassed under LOCA (accident) OR LOOP condition [i.e., OR instead of concurrent].
- TS SRs of 13 of 59 plants (approx. 22% of plants) indicate that the non-critical EDG trips are bypassed under LOCA (accident) OR LOOP conditions.
- Types of non-critical trips bypassed differ extensively among various plants; e.g., some plants considered Low Lube Oil Pressure trip as critical, while other plants considered this trip as non-critical.
- According to almost all plants UFSARs, all EDG trips (critical or non-critical) remain in-service during testing mode (manual/local start mode), whereas at approximately 64% (approx. 42% +22 %) of plants, the non-critical trips are bypassed when an EDG is not in testing mode (i.e., during auto/remote start due to LOOP). This indicates discrepancy between testing mode and operational mode of EDGs at almost plants.
(5) In the Chapter 8 of UFSAR of Braidwood and Byron, the following is stated: The diesel generator breaker control scheme trips the diesel generator breaker on overcurrent, underfrequency, loss of field, generator neutral ground and reverse power, during LOOP conditions with no safety injection signal present. This logic prevents potential damage of the ECCS equipment to ensure that the ECCS equipment is available in the event of an actual safety injection with or without a LOOP.
This is a good reason for not-bypassing of electrical trips during LOOP.
(6) A qualitative assessment of the above issue is done as follows based on PRA considerations:
- EDG availability/recovery after repairs is an important parameter in the PRA SPAR models of various plants (see example below-an excerpt from Clinton SPAR model report):
NRC FORM 833 [Page 3 of 4]
NUREG/CR-5994 (ML083640262) discusses risk impact of EDG unavailability due to maintenance and failure during power operation, and during different stages of plant shutdown. Appendix H of this report shows the relationship between the plant CDF and SBO accident sequence frequency and the EDG maintenance unavailability. An example of this for a plant (Surry) is shown below from that report.
As can be observed from above figure, EDG unavailability (and therefore CDF) could be highly impacted, if bypassing of certain protection trips causes greater damage to EDG, resulting in increased EDG maintenance unavailability.
NUREG CR-6928 (ML070650650) provides component average performance data for various systems including unavailability (UA) data for EDGs. According to this report, INL uses the Mitigating Systems Performance Index (MSPI) data source in updating SPAR models for NRC. EDG UA/recovery data as used in MPSI/SPAR models is likely to be predominately based on EDG tests (monthly, six monthly or bi-yearly) when no EDG trips are bypassed (during local/manual starting of EDGs) [compared to very little data under actual LOOP conditions]. The UA data could be highly impacted if EDG is significantly damaged due to bypassing of certain protective trips, under auto start/run of an EDG [i.e.,
under actual LOOP conditions]. Thus, the UA data used in SPAR models may not be a true representative of actual EDG unavailability considering that an EDG can be significantly damaged during actual emergency/LOOP operation due to the bypassing of certain protection trips, requiring lengthy corrective maintenance (increased UA of EDG). It is believed that potentially the main source of EDG unavailability/recovery data (maintained by Idaho National Lab) as used in SPAR models by NRC, and as used in PRA models by the licensees is same.
(7) A PRA quantitative risk assessment of the above issue was done at a sample of (4) plants (Catawba, Sequoyah, Braidwood, and Brunswick), by NRC office of RES/DRA/PRAB (Jeffery Wood), by using SPAR models considering No EDG Recovery.
See Attachment -2, EDG-protection-risk-significance assessment by RES-DRA-PRAB. The results are summarized are follows:
In case of Catawba, for the No credit for EDG recovery case, the CDF for internal events is 1.9 x 10-6. However, this value increases to 3 x 10-6 when external hazard events are also considered. The CDF value of 3 x 10-6 lies at border line of Figure B-2 of RES office instruction TEC-002 for deciding whether to exclude a generic issue from further evaluation. This CDF in case of Catawba for internal, and including external events is more than 1 x 10-6 criteria of very low risk significance as defined in NRR office instruction LIC-504 (ML19253D401).
In case of Sequoyah and Braidwood, the CDF for internal events is less than 1 x 10-6. Brunswick SPAR model does not include credit for EDG recovery. The electrical distribution systems of various plants are quite different from each other.
If all other plants are also evaluated (in which many of the EDG protection trips are bypassed), there could be few more plants which would have CDF (especially after including the impact of external events) more than 1 x 10-6, thus meeting the threshold of two or more plants for risk significance for consideration into generic issue.
NRC FORM 833 [Page 4 of 4]
(8) In RG 1.68 (Initial Test Programs), Section C.3, the following is stated: The testing of SSCs should include, to the extent practical, simulation of the effects of control system and equipment failures or malfunctions that could reasonably be expected to occur during the plants lifetime. The test program also should include testing to determine that the system and component interactions are in accordance with design. To the extent practical, the plant conditions during the tests should simulate the actual operating, abnormal operating occurrences and emergency conditions to which the SSCs may be subjected. Those plants, where the EDGs are being tested (during various SRs) with all protection trips active versus many of the protective trips bypassed during actual LOOP, do not meet the intent of testing conditions being same as actual emergency (LOOP) conditions, to meet the criteria of RG 1.68.
(9) Based on the above facts and risk assessment, bypassing of certain EDG trips (under LOOP only condition) are considered highly undesirable. It would be preferred to trip an EDG by all the applicable protection trips, save and recover the EDG for subsequently performing its safety function rather than letting it get damaged. According to NUREG-1032, plants can easily survive a LOOP/SBO condition for 1 to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> if the offsite power or an EDG is recovered subsequently. Therefore, emphasis should be placed on recovery of an EDG rather than letting it get damaged by passing of many trips under LOOP only condition.
Recommendations:
(i) This Generic Issue should be pursued with the industry/NEI. The plants (approximately 64% -see item (4) above), who according to UFSARs are currently bypassing EDG non-critical protective trips during LOOP OR accident condition, should voluntarily modify the EDG bypass circuitry - i.e., not to bypass any protective trips under LOOP only condition.
All protective trips (both Mechanical and Electrical) considered applicable during testing/SRs of EDGs should also remain applicable during LOOP only condition. This is also necessary so that EDG UA or EDG recovery data considered in PRA models is more realistic, i.e., same the EDG trips are considered during testing and during operation in a LOOP condition.
(ii) The industry/NEI should also have a second look of the protective trips which ones should be considered as non-critical trips (both Mechanical and Electrical Trips, which are bypassed under accident conditions) to have reasonable consistency.
(iii) The plants (approximately 22% -see item (4) above), who according to TS (such as SR 3.8.1.13) are currently bypassing EDG non-critical protective trips during LOOP OR accident condition, should submit license amendment request so that the non-critical protective trips are by bypassed only during accident (SIAS) condition (i.e., not under LOOP only condition), to be consistent with industry standards.
ATTACHMENTS
, TABLE - EDG Trips Bypass at Various Plants Based on TSs and FSARs
, EDG-protection-risk-significance assessment by RES-DRA-PRAB