ML22109A035

Memo Enclosure 2 - Risk Evaluation of Proposed Generic Issue for Emergency Diesel Generator Protective Trips

ML22109A035
Person / Time
Issue date:	06/09/2022
From:	Woods J NRC/NRR/DRA/APOB
To:
O'Donnell E
Shared Package
ML22048B590	List: ML22048B593 ML22048B594 ML22048B595 ML22048B598 ML22048B664 ML22109A035 ML22109A036 ML22109A038
References
Download: ML22109A035 (12)

Text

Enclosure 2 Risk Evaluation of Proposed Generic Issue for EDG Protective Trips Jeffery Wood and Kevin Coyne June 9, 2022

1.0 Background

1.1 Statement of Issue The proposed generic issue is stated as follows:

ISSUE - Many EDG Protection Trips (many Mechanical & Electrical trips) are being bypassed at many plants under Loss of offsite-power (LOOP) conditions. This is contrary to industry guidance IEEE Std 387-1984, 1995, 2017, in which the following is stated:

All protective devices shall remain effective during the diesel-generator unit testing, and during operation in non-accident conditions. [Non-accident conditions would include LOOP]. NRC Regulatory Guidance [e.g., BTP EICSB-17, RG 1.9] is silent regarding protective trips bypass under LOOP condition. This issue is related to adversely impacting the recovery of EDGs under LOOP conditions, and potentially incorrect modelling of the recovery of EDGs during LOOP/SBO in SPAR modelling by NRC, and similarly in the PRA models by the licensees.

The issue is related to plants practices for bypassing emergency diesel generator (EDG) non-critical protective trips under LOOP conditions. The suggested impact of this issue is that bypassing of non-critical trips could adversely impact the ability to recovery the EDGs functionality after a failure and adversely impact the availability of the EDG. The design of EDG protective trips and approaches for bypassing the trips varies from plant-to-plant. Some of the non-critical protective trips that could be bypassed under LOOP conditions include:

• Low lubricating oil pressure

• High lubricating oil temperature

• Low jacket cooling water pressure

• High jacket cooling water temperature

• High crankcase pressure

• Generator overcurrent

• Generator overvoltage

• Generator underfrequency 1.2 Representing the risk impact in a PRA model Each plants capabilities to mitigate a LOOP condition influences the importance of their installed onsite emergency ac power systems to their overall risk. Plants that have capabilities to cross-tie between units at a site or have installed supplemental station blackout (SBO) power sources (e.g., additional diesel generators) will see benefits in their risk associated with SBO scenarios. The strategies and capabilities for alternate ac power sources vary between plants, so the risk sensitivity to failures of their onsite EDGs also varies between plants.

The failure of EDGs is modeled in the SPAR models by considering all possible failure modes (e.g., failure to start, failure to run) and conditions that would prevent the availability of an EDG 1

(e.g., unavailability due to routine maintenance). The likelihood of failure or unavailability is based on recent operating experience collected from the industry. The failure probabilities and unavailability are estimated from the industry-wide data, and parameters are updated with new experience approximately every five years. The latest parameters can be found at the Reactor Operational Experience and Results Databases site (INL, 2022). This approach is consistent with the current state-of-practice in PRA modeling and consistent with the ASME/ANS PRA Standard (ASME/ANS, 2009).

The EDG failures that are collected include a range of different failure mechanisms and causes.

Individual failure causes are not explicitly modeled in the PRA, but they are grouped based on the impact on the component function. The resulting failure probabilities that are used in the models are appropriate for estimating an average annual risk. The individual failure events that are grouped to estimate the failure probabilities could have a range of different causes, for example failure of a control switch or generator bearing failure due to inadequate lubrication.

The possibility of recovering the EDG1 function may be more or less likely depending on the particular details of the failure and the plants ability to repair the issue (e.g., available staff, part availability). However, the modeling approach does not separate failure events based on their likelihood of recovery. The modeled EDG failure events represent an average likelihood of failure of the EDG function. If recovery of the EDG is modeled, then that failure-to-recover probability would also represent an average likelihood of failure to recover the EDG (i.e., the EDG non-recovery probability).

Using this approach for modeling failure probabilities, the SPAR models cannot provide a precise estimate of the risk impact that would be associated with bypassing a specific protective trip and a failure cause related to that bypassed trip, e.g., failure due to high coolant temperature. The SPAR models can provide estimates of the risk impact associated with SBO scenarios and EDG recovery, in general. The exact impacts of an individual plants protective trip bypassing approach are not easily determined. However, looking at the overall change in CDF related to EDG non-recovery probabilities can provide a bounding estimate of the potential impacts that might be associated with bypassing protective trips.

1.3 Potential negative impacts of bypassing non-critical trips during LOOP conditions As highlighted in the proposed generic issue, many plants have chosen to bypass non-critical trips during LOOP conditions. There may be potential benefits and potential negative impacts associated with bypassing non-critical trips.

The potential negative impacts relate to the loss of protection against conditions that could degrade and cause severe, non-recoverable failure of the EDG, for example, gradual overheating due to inadequate coolant. Having all protective trips in place could help to prevent non-recoverable failure; however, there are other features that can protect against EDG failure.

Even if the non-critical protective trips are bypassed, the plant operators are expected be monitoring EDG operation when demanded during a LOOP. EDG operating parameters are 1

The term recovery typically refers to a simple human action to restore a components function, e.g.,

locally manipulating a switch. In the context of this discussion, recovery of an EDG is intended to include repair of the EDG, including complex actions that may require part replacement, recalibration, and testing.

These more complex repair activities are generally not included in PRA models, but due to the unique circumstances for EDGs (e.g., availability of data and potential risk significance of EDG recovery in retrospective risk assessments), the SPAR models generally provide some credit for EDG repair.

2 monitored with control room annunciators and responses to adverse conditions would be guided by alarm response procedures. Also, there will typically be a non-licensed operator dispatched locally to the EDG room to monitor conditions. An example of monitoring of EDG performance during an actual event is demonstrated in the response to the seismic event at the North Anna station in 2011 (NRC, 2011). The earthquake caused a loss of offsite power event. All four EDGs started as designed, but operators manually tripped one EDG after 49 minutes due to a coolant leak. An alternate diesel generator was manually aligned to re-energize the emergency bus. As demonstrated in this event, the potential negative impacts of bypassing trips can be mitigated by monitoring and response by the operators.

While there are potential negative impacts on EDG recovery when bypassing non-critical trips during LOOP conditions, these negative impacts are unlikely to be realized given the mitigating factors and limiting conditions, which include:

• The negative impacts on EDG recovery would only occur after an EDG failure when demanded during a LOOP. The modeling of EDG failure probabilities is an important aspect of a PRA model, but EDG failure is not an expected outcome. EDGs are more likely to successfully operate when demanded, than they are to fail.

• The negative impacts on EDG recovery would not be relevant if the EDG failure involves a non-recoverable failure mechanism. If the EDG failure is a rapid, catastrophic failure (e.g., significant mechanical issue like a broken rod or shaft), then the EDG would not be recoverable. The status of non-critical trips would have no impact.

• The negative impacts on EDG recovery are limited by the short duration available for recovery. Even if the EDG failure is such that it could be recovered or repaired, the short timeline of the event scenario makes recovery unlikely to succeed. The time available would depend on the details of the event scenario, status of other equipment, and plant design features. Typically, in a PRA model the time available to restore an EDG after loss of all offsite and onsite ac power is four hours, or less.

• The potential negative impacts on EDG recovery are mitigated if operators take appropriate protective or mitigative actions for an impending EDG failure.

Having all non-critical trips active does provide additional protection for the EDG. The potential negative impacts of bypassing non-critical trips during LOOPs are related to EDG failures that can progress and result in non-recoverable failures, but the potential negative impacts are limited due to mitigating features (e.g., annunciators and monitoring by operators) and the unlikely conditions that would need to occur.

1.4 Potential benefits of bypassing non-critical trips during LOOP conditions The practice of bypassing EDG non-critical trips during LOOP conditions can have potential beneficial impacts. Bypassing non-critical trips can prevent inadvertent stopping of an EDG when it would have otherwise run acceptably (e.g., EDG trips due to a spurious trip signal).

Bypassing of non-critical trips can also allow the operators more time and flexibility to monitor EDG conditions and determine if continued operation is appropriate. This can prevent unnecessary entry into SBO accident conditions, which can introduce additional challenges to continued core cooling and restoration of ac power. The premature entry to an SBO condition is also complicated by the plants adoption FLEX strategies and entry to their extended loss of all ac power procedures. This can further complicate recovery as focus is shifted away from the safety-related installed EDGs to portable equipment that may be less reliable. While the FLEX 3

equipment does provide additional redundancy for the plant, there may be situations where allowing operators to focus on continued operation of the EDGs is preferred.

One example of a time-critical decision to continue operation of an EDG by bypassing a non-critical trip is demonstrated by the loss of ac power event that occurred at the Vogtle station in 1990 (NRC, 1990). Vogtle unit 1 was in cold shutdown with reactor coolant level lowered to mid-loop level when a loss of all ac power occurred. One EDG was unavailable due to maintenance.

The other EDG automatically started and carried loads on its safety bus for 80 seconds, then it tripped. After approximately 18 minutes the EDG was restarted and tripped again. The trip signals were observed for high jacket water temperature, low jacket water pressure, and low turbocharger oil pressure. After 36 minutes into the incident, operators started the EDG again using manual emergency start and bypassing non-critical trips. The EDG started, loaded the safety bus, and continued to run without further incident for over three hours until an offsite power source could be restored.

During the approximately 36 minutes without any source of ac power and no cooling to the reactor, the reactor coolant system temperature rose from about 90 F to 136 F. Without the EDG running in an emergency bypass condition, the coolant would have continued to rise and reached boiling conditions. A later investigation indicated that the most probable cause of the EDG trips involved failure of jacket water temperature trip sensors. The event demonstrates the potential benefit of bypassing non-critical trips, while continuing to monitor and trouble-shoot issues. This allows operators to maintain ac power sources for core cooling, which was critical in this plant configuration with reduced inventory level and a relatively short time to reach core boiling conditions.

2.0 Evaluation of change in risk associated with EDG recovery Potential benefits and potential negative impacts can be identified with the approach to bypassing non-critical EDG protective trips during LOOP conditions, but the exact impacts and risks of those impacts are not known. If the trip bypassing approaches were to impact the reliability and unavailability of EDGs, then the impacts would be reflected in the plant-specific operating experience that is collected and routinely updated to estimate parameters in the SPAR models and licensees PRA models2. However, it is unlikely that operating experience would provide any insight into the performance of EDGs and protective trips during actual LOOP conditions. Occurrences of LOOP conditions are infrequent, and failures of EDGs when demanded during LOOP conditions are rare. The vast majority of failure and unavailability records are collected during routine testing and maintenance.

Given the lack of clear consequences resulting from the bypassing of EDG protective trips, a risk assessment of the issue can only provide insights to the potential impacts and should be used to characterize a bounding, or worst-case, estimate of change in risk. As discussed above, the SPAR models do not have the resolution to assess the impacts of individual protective trips being bypassed, but they can provide perspective on how impactful EDG recovery can be on the core damage frequency (CDF) results. The following section describes the approach for 2

Current operating experience data analyses do not include a formal statistical analysis of plant-to-plant variability or identification of outliers, but there appear to be no indications of variability introduced by strategies for bypassing trips. Such statistical evaluations may be considered in future studies. Also, note that no statistically significant trends have been observed for EDG failure and unavailability probabilities in the recent 10-year period (INL, 2019).

4 estimating the change in risk associated with EDG failures that would prevent recovery during the required mission time.

2.1 Modeling of equipment failure recovery in PRA models The modeling of recovery of failed equipment in PRA models is an area of uncertainty that requires careful evaluation before applying credit for repair and restoring an equipment failure.

The ASME/ANS PRA Standard (ASME/ANS, 2009) includes a requirement that specifies NOT to model repair of hardware unless adequately justified by data:

DO NOT MODEL the repair of hardware faults, unless the probability of repair is justified through an adequate analysis or examination of data.

If repair is modeled, then additional requirements specify how data is collected and evaluated for applicability. These requirements establish a significant level-of-effort and analysis to justify giving credit for any recovery of failed equipment in a PRA model.

The Idaho National Laboratory performs routine evaluations of EDG failure and unavailability data with the most recent update published in 2019 (INL, 2019). The report uses available repair time data to estimate probabilities of exceeding the required repair time for a failed EDG. The repair times are based on reported unplanned EDG unavailability, i.e., unavailability not associated with scheduled maintenance or routine surveillance. The data do not represent repair under actual emergency conditions, but they do provide the best available information about the duration required to restore an EDG. The data evaluation is used to estimate the probability of exceeding a given repair time constraint. The typical recovery times modeled in the SPAR models range from one to four hours, though there may be some event sequences that extend for longer times. The probability of exceeding a 1-hour repair time is 0.9. The probability of exceeding a 4-hour repair time is 0.76. These results demonstrate that recovery of a failed EDG has a very high probability of failure. Taken collectively, the EDG data suggest that EDG recovery is expected to be unsuccessful in most cases.

The SPAR models include events that represent the failure probabilities of EDG recovery, and these are available for the model analysts to use. However, given the limitations of the data, the uncertainty about applicability to actual demand conditions, and the stringent requirements of the PRA Standard, an analyst may determine that no credit should be given for recovery of a failed EDG. The SPAR models are used in many of NRCs risk-informed programs. Many of the applications of the models (e.g., those supporting the Significance Determination Process and the Accident Sequence Precursor Program) involve retrospective analyses of events or conditions that have occurred. In these cases, the analysts have the benefit of knowing the specific failure causes involved and can appropriately judge if credit for recovery should be applicable.

While events modeling EDG recovery probabilities are included in the SPAR models, the events are not always used. In some applications, analysts determine that applying credit for recovering a failed EDG is not appropriate. One notable example is the Level 3 PRA project (NRC, 2022), which was developed by RES staff and uses many of the same PRA modeling conventions as the SPAR models. No credit is given for EDG recovery in the Level 3 PRA model due to lack of data. This approach is consistent with ASME/ANS PRA standard for cases where the probability of repair is difficult to justify due to the uncertainties associated with the specific EDG failure causes and insufficient data on EDG repair probability. Note that if no credit 5

is given for EDG recovery, then the risk impact of bypassing non-critical trips is minimized. The PRA assumes that all EDG failures are non-recoverable regardless of the approach for bypassing EDG protective trips.

2.2 Risk assessment approach Estimating the risk impact of bypassing EDG non-critical trips is challenged by several uncertainties associated with the issue, which include:

• PRA models generally do not have the resolution to assess impacts of individual EDG protective trips and the potential failures that could be related to bypassing trips.

• The impacts of bypassing EDG non-critical trips (including potential beneficial and negative impacts) are not clearly established.

• Potential negative impacts of bypassing EDG non-critical trips could influence EDG recovery, but modeling of EDG recoveries is an area of PRA modeling uncertainty and may not always be appropriate.

Despite these challenges, the SPAR models can provide insights on the potential impacts of bypassing EDG trips and the influence on EDG recovery.

The approach for assessing the potential risk impact of bypassing EDG non-critical trips is to consider the overall impact of EDG recovery on the CDF results. A nominal case is developed for a sampling of SPAR models where CDF is calculated with credit for potential EDG recovery using the EDG non-recovery probabilities as described in (INL, 2019). Next, a conditional case is developed where CDF is calculated assuming EDG recovery is not possible. The difference between the conditional and nominal CDF values provides a sensitivity to how important EDG recovery is to the overall CDF results.

A selection of individual SPAR models was chosen to provide a range of potential CDF impacts related to EDG recovery. The plants that are expected to have the largest impacts are those that have a high baseline risk associated with SBO scenarios. The SPAR-DASH risk dashboard was consulted to gather information about the SBO risk across the operating reactor population.

SPAR-DASH compiles the risk results from all SPAR models, including CDF values, risk importance measures, and important accident sequences. The dashboard results were consulted to identify models with higher than average and lower than average risk associated with station blackout sequences. Three plant SPAR models were selected with high SBO risk.

These included models where the highest contributing SBO accident sequence has a CDF value greater than 3x10-6 per reactor-year.

• Ginna

• Shearon Harris

• Monticello Similarly, three plant SPAR models were identified with lower-than-average SBO risk. Each of these models has its highest contributing SBO accident sequence with a CDF value less than 3x10-7 per reactor-year.

• Braidwood, units 1 & 2

• Limerick, units 1 & 2

• LaSalle, unit1 1 & 2 6

The unit 1 SPAR models for each of these plants were evaluated, along with the higher SBO risk models, listed above. The SPAR model for Catawba unit 1 was also included, as this was identified as a higher SBO risk plant during an earlier evaluation of this issue (Wood, 2020).

3.0 Risk assessment results and conclusions The SPAR models were evaluated as described in Section 2.2. The change in CDF was calculated for each plant SPAR model comparing nominal credit for EDG recovery versus no credit for recovery. The CDF results are compared against the risk criteria described in Appendix B of the RES office instruction for the Generic Issue Program (NRC, 2019). Figure B-2 from the office instruction is replicated here. This figure demonstrates the criteria for considering the change in CDF (i.e., CDF increase associated with the issue) versus the plants baseline CDF.

consideration Figure B-2 Core damage frequency (CDF) criteria for the GI Program (replicated from RES office instruction TEC-002)

The area in the lower left of the figure is indicative of issues that should be excluded from further evaluation due to low risk significance. The area in the upper right indicates issues of high risk significance that should continue in the generic issue process. The gray area in between indicates an area where integrated decision-making should consider additional relevant information. The boundaries of the gray area are not definitive and are to be interpreted as indicative values only.

3.1 Risk assessment results for removing credit for EDG recovery The change in CDF results were calculated by comparing the nominal CDF result with credit for EDG recovery to the conditional case with no credit for EDG recovery. The SPAR models for the seven plants identified in Section 2.2 were evaluated. The results from these representative plants are expected to cover the range of results for all plants, as they include results from plant models ranging from high to low CDF contributions from SBO sequences.

The change in CDF versus baseline CDF results are shown in Figure 1. The black and gray lines represent potential boundaries of the gray area, as described in the Generic Issue Program office instruction. Using this interpretation of the risk criteria, the results for Ginna, Limerick 1, LaSalle 1, and Braidwood 1 SPAR models suggest excluding further analysis. The 7

results for Monticello, Shearon Harris, and Catawba 1 fall into the gray area. Several of the results appear close to the lower-risk representative border (i.e., the black line) and could be judged to be in a different region based other integrated decision-making considerations.

Impact of no credit for EDG recovery CDF from Internal Events Only 1.00E-04 1.00E-05 Change in CDF Monticello S. Harris Ginna Catawba 1 1.00E-06 Limerick 1 LaSalle 1 Braidwood 1 1.00E-07 1.00E-06 1.00E-05 1.00E-04 1.00E-03 Baseline CDF Figure 1. Increase in CDF due to removing EDG recovery credit vs. baseline CDF (internal events only)

It is important to note that the results in Figure 1 include only the internal events modeled in the SPAR models. The internal events modeling includes internal challenges to plant operation, such as loss of coolant accidents, transients, support system failures, and losses of offsite power. It typically does not include other hazards such as fires and flooding, and it does not include external hazards, such as seismic events, tornados, hurricanes, and other high wind or severe weather events.

The internal events modeling in PRA has a mature modeling approach. The internal events models are typically developed first when developing a PRA, and much of the internal events modeling is employed to assess impacts of other hazards and then to extend the modeling to include important other hazard contributors. So, the internal events CDF results give an important indication of a plants risk. However, they do not necessarily represent a complete measure of risk. There are many other hazard types that can induce a loss of offsite power condition and demand for EDGs.

Other hazard types are included in the SPAR models. However, the SPAR models do not include a complete list of all applicable hazards for all models. In maintaining SPAR models for all the operating reactor sites, the scope and level of detail may not always match those of the licensees PRA models. While some of the SPAR models have been updated with all applicable hazards based on detailed information shared from the licensees models, many of the SPAR models are focused on internal events only.

8 3.2 Risk assessment results including other hazards While many of the SPAR models do not include a full scope of all hazard models, there are twelve SPAR models that have been updated in recent years to include all applicable hazards.

These models also have gone through a detailed comparison to the licensees PRA model and results. A sample of these all hazard SPAR models were selected to evaluate the change in CDF for all modeled hazards when credit for EDG recovery is removed. The SPAR models were selected for the following plants.

• Columbia

• Shearon Harris

• Salem, unit 1

• Sequoyah, unit 1 Of the SPAR models assessed in Figure 1 of Section 3.1, only the Shearon Harris SPAR model includes all hazards modeling. The remaining six SPAR models that were assessed in Section 3.1 are reassessed to include the change in CDF from internal events, seismic events, and high wind events. These models include a general framework for assessing seismic and high wind events. The site-specific hazard frequencies are modeled with surrogate reference values to assess the fragilities of significant plant equipment.

The change in CDF versus baseline CDF results, including all applicable hazards, are shown in Figure 2.

Impact of no credit for EDG recovery CDF including All Modeled Hazards 1.00E-04 Monticello 1.00E-05 S. Harris Change in CDF Salem 1 Sequoyah 1 Ginna Catawba 1 Limerick 1 Braidwood 1 1.00E-06 LaSalle 1 Columbia 1.00E-07 1.00E-06 1.00E-05 1.00E-04 1.00E-03 Baseline CDF Figure 2. Increase in CDF due to removing EDG recovery credit vs. baseline CDF (all modeled hazards) 9 The results for Columbia, Shearon Harris, Salem 1, and Sequoyah 1 include a full scope of all applicable hazards. The results for all other models include internal events, seismic events, and high wind events.

The results for Ginna and Limerick 1 SPAR models suggest excluding further analysis. The result for Salem 1 appears around the representative boundary of the high risk area. The result is mainly driven by the high baseline CDF with the inclusion of internal fire scenarios, but the internal fire risk does not significantly contribute to the change in CDF. All other results fall into the gray area. With the inclusion of all applicable hazards, the change in CDF generally increases compared to Figure 1. The baseline CDF values of all assessed plants also increases when including all hazards.

3.3 Implementation of FLEX strategies not assessed Another consideration is the implementation of flexible strategies for coping with an extended loss of all ac power, or FLEX strategies, in response to NRC order EA-12-049 (NRC, 2012). The FLEX strategies are being incorporated into PRA models and show reduced CDF values associated with losses of offsite power. The FLEX strategies are not included in this risk assessment.

The SPAR models are in the process of being updated with the latest reliability data for FLEX equipment, but the updated models were not available to support this risk assessment. Further, the addition of the FLEX strategies in the models introduces changes to the LOOP modeling approach and can extend the timeline of accident sequences to be consistent with the plants FLEX implementation plans. These differences can introduce small changes in the CDF results that may require additional discussion and explanation, which are not relevant to the EDG trip bypassing issue. For these reasons, preliminary results with credit for the FLEX strategies are not presented.

Prior evaluations of SPAR models comparing results both with and without credit for FLEX show little influence on the importance of EDG recovery. The conclusions of this risk assessment are not expected to change whether FLEX strategies are credited or not. However, the plants implementations of FLEX strategies are expected to reduce their CDF associated with SBO scenarios. The amount of CDF reduction varies from plant-to-plant, and further development of the FLEX modeling is required before CDF results are calculated.

3.4 Conclusions and other considerations The risk assessment results provide valuable insights into the risk significance of the approaches to bypassing non-critical EDG trips. The risk assessment approach considers the change in risk associated with removing credit for recovering a failed EDG. The risk assessment results do not directly represent the impacts of bypassing EDG non-critical trips. The non-recoverable failure of an EDG is one potential negative impact of bypassing non-critical trips, but there may also be potential benefits of bypassing trips. The exact impacts of the approaches to bypassing EDG trips are not known. Therefore, the risk assessment results should be considered a bounding estimate of the potential negative impacts and should be weighed with other considerations.

10 The risk assessment results performed for this study focus on the potential changes in CDF values related to the issue. Results for LERF were not assessed. Although changes in LERF are considered as part of the generic issue evaluation risk criteria, the issue of EDG non-critical trip bypassing is not expected to significantly influence the change in LERF. The risk assessment approach to consider the impacts of EDG non-recovery probabilities influences SBO accident sequences that are modeled in the PRA. The SBO accident sequences typically do not significantly contribute to LERF results, which are mainly influenced by containment bypass scenarios, e.g., steam generator tube ruptures or interfacing-systems loss of coolant accidents.

The risk assessment results, as shown in Section 3.1 and 3.2, describe the change in CDF related to EDG recovery for ten operating reactor SPAR models. The majority of the CDF results fall into the gray area between low and high risk significance. Some of the results (e.g.,

results for Ginna and Limerick 1) suggest low risk significance and no further evaluation. Only one result (Salem 1) shows indication of high risk significance that would require continuing the generic issue evaluation process.

In addition to the risk assessment results, other considerations that can influence the decision-making include:

• The exact impacts of bypassing EDG non-critical trips during LOOP conditions are not clearly established.

• There may be potential benefits (e.g., prevention of entry into SBO conditions) and potential negative impacts (e.g., impacts on reparability) of bypassing EDG non-critical trips during LOOP conditions.

• The potential negative impacts of bypassing EDG non-critical trips can be mitigated by appropriate operator monitoring and response during actual demand events which can provide a similar degree of mitigation as the non-critical trips.

• The risk assessment results provide perspective on the impacts of EDG recovery, which is related to potential negative impacts of bypassing EDG trips, and should be considered as a bounding estimate of the issue. A more realistic assessment is expected to show a reduced benefit in terms of delta CDF.

• EDG recovery is an area of PRA uncertainty that data suggests is unlikely to succeed and should only be credited when appropriately justified. The ability to repair a failed EDG is highly dependent on the specific nature of the failure, availability of appropriate resources, and priority of repair compared to other mitigative actions.

• Implementation of FLEX strategies are expected to reduce plants SBO risk and reduce the significance of this issue.

Based on the risk assessment results and the above considerations, the approach to bypassing EDG non-critical trips does not have a high-risk impact. The bounding assessment shows the change in CDF is less than 1x10-5 per reactor-year for all of the assessed plants. No further risk evaluation is deemed necessary based on these results and consideration of the potential impacts of the issue.

4.0 References ASME/ANS, 2009 American Society of Mechanical Engineers and American Nuclear Society, Standard for Level 1/Large Early Release Frequency Probabilistic 11 Risk Assessment for Nuclear Power Plant Applications, ASME RA-Sa-2009, Addenda to ASME/ANS RA-S-2008, February 2009.

INL, 2019 Idaho National Laboratory, Enhanced Component Performance Study:

Emergency Diesel Generators 1998-2018, INL/EXT-19-54609, September 2019.

INL, 2022 Idaho National Laboratory, Reactor Operational Experience Results and Databases, https://nrcoe.inl.gov/, last updated May 2022.

NRC, 1990 U.S. Nuclear Regulatory Commission, Loss of Vital AC Power and the Residual Heat Removal System During Mid-Loop Operations at Vogtle Unit 1 on March 20, 1990, NUREG-1410, June 1990.

NRC, 2011 U.S. Nuclear Regulatory Commission, Dual Unit Reactor Trip and ESF Actuations During Seismic Event with a Loss of Offsite Power, Licensee Event Report 338-2011-003, October 2011.

NRC, 2012 U.S. Nuclear Regulatory Commission, Order Number EA-12-049, Order to Modify Licenses with Regard to Requirements for Mitigation Strategies for BDBEEs, ADAMS ML12056A045, March 2012.

NRC, 2019 U.S. Nuclear Regulatory Commission, Generic Issues Program, RES Office Instruction TEC-002, Revision 3, ADAMS ML18283A564, July 2019.

NRC, 2022 U.S. Nuclear Regulatory Commission, U.S. NRC Level 3 Probabilistic Risk Assessment (PRA) Project Volume 3a: Reactor, At-Power, Level 1 PRA for Internal Events, Draft NUREG, ADAMS ML22067A211, April 2022.

Wood, 2020 Wood, J., Summary of EDG Protection Trips Bypass Risk Significance Assessment, ADAMS ML22048B594, July 2020.

12