ML22125A273

Transmittal of Final Waterford Steam Electric Station, Unit 3 Accident Sequence Precursor Report (Licensee Event Report 382-2021-001) (Letter)

ML22125A273
Person / Time
Site:	Waterford
Issue date:	05/10/2022
From:	James Drake Plant Licensing Branch IV
To:	Entergy Operations
Drake, J.
References
LER 2021-001-00
Download: ML22125A273 (19)

Text

May 10, 2022 Site Vice President Entergy Operations, Inc.

Waterford Steam Electric Station, Unit 3 17265 River Road Killona, LA 70057-3093

SUBJECT:

TRANSMITTAL OF FINAL WATERFORD STEAM ELECTRIC STATION, UNIT 3 ACCIDENT SEQUENCE PRECURSOR REPORT (LICENSEE EVENT REPORT 382-2021-001)

Dear Sir or Madam:

By letter dated October 28, 2021 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML21301A192), Entergy Operations, Inc. (the licensee) submitted Licensee Event Report (LER) 382-2021-001, Loss of Offsite Power Due to Hurricane Ida, to the U.S. Nuclear Regulatory Commission staff for the Waterford Steam Electric Station, Unit 3, pursuant to Title 10 of the Code of Federal Regulations Section 50.73.

The preliminary accident sequence precursor (ASP) analysis of this event resulted in a mean conditional core damage probability (CCDP) greater than or equal to 1x10-4 and, therefore, was transmitted to the licensee on January 31, 2022 (ML22026A378; not publicly available), to allow for a 60-day formal review in accordance with Regulatory Issue Summary 2006-24, Revised Review and Transmittal Process for Accident Sequence Precursor Analyses, dated December 6, 2006 (ML06090007). The licensee provided comments on April 11, 2022 (ML22101A187). These comments are summarized along with the Office of Nuclear Regulatory Research responses in Appendix C of the final ASP analysis report, which is provided in the enclosure to this letter.

Final ASP Analysis Summary. A brief summary of the final ASP analysis, including the results, is provided below.

Loss of Offsite Power Due to Hurricane Ida. This event is documented in LER 382-2021-001 and Inspection Report 05000382/2021003, dated November 13, 2021.

Executive Summary. On August 26, 2021, the plant entered Procedure OP-901-521, "Severe Weather and Flooding," in response to a hurricane watch being issued for St. Charles Parish due to Hurricane Ida. On August 27, 2021, the hurricane watch was elevated to a hurricane warning. On August 28, 2021, the licensee determined that a plant shutdown was required per Procedure OP-901-521 due to the hurricane conditions projected by the National Weather Service to reach the site. At 0813 Central Daylight Time (CDT) on August 29, 2021, operators commenced a plant shutdown and subsequent reactor coolant system (RCS) cooldown using the steam generator (SG) atmospheric dump valves.

On August 29, 2021, the site experienced a loss of offsite power (LOOP) at 1804 CDT. The LOOP resulted in a loss of power to the reactor coolant pumps, the running spent fuel pool cooling pump, and the auxiliary feedwater pump. Both safety-related emergency diesel generators (EDGs) automatically started and reenergized their respective safety buses.

Operators restarted the RCS cooldown via the SG atmospheric dump valves. The plant declared an Unusual Event at 1812 CDT. In addition, operators manually started emergency feedwater pump A to feed the SGs. At 1933 CDT, operators placed shutdown cooling train A in service. At 2338 CDT, the plant entered Mode 5 (cold shutdown). On August 31, 2021, at 2330 CDT, offsite power was restored, and the Unusual Event was exited 15 minutes later after both safety buses were realigned to offsite power.

This ASP analysis reveals that the most likely core damage sequence is a weather-related LOOP initiating event and the subsequent (postulated) failure of both EDGs resulting in a station blackout (SBO) with the successful (initial) operation of the turbine-driven emergency feedwater pump. The operators successfully declared an extended loss of alternating current power, but the postulated failure of diverse and flexible coping strategies (FLEX) diesel generators to charge safety related batteries is assumed to result in core damage because no credit is provided for continued operation of turbine-driven emergency feedwater without RCS makeup.

This accident sequence accounts for approximately 68 percent of the total CCDP for this event.

Although the mean CCDP of 5x10-4 for this event was high, the risk of core damage was mitigated due to hurricane preparations performed by the licensee prior to the storm reaching the plant. In addition, the risk impacts of this event was mitigated because defense-in-depth and plant-wide safety margins were maintained.

To identify general risk insights, a postulated hurricane resulting in a LOOP of similar duration was evaluated for three other plants that have experienced hurricane-related LOOPs in the past 25 years. These three test cases show that risk from postulated SBO scenarios results in high CCDPs for long duration LOOPs for plants with only two safety-related EDGs that cannot be cross-tied with another unit. While FLEX mitigation strategies reduce the risk of SBO, the appropriate credit in risk evaluations to account for those strategies is determined by current FLEX equipment types and their associated failure rates and probabilities.

Summary of Analysis Results. The final mean CCDP for this operational event is 5x10-4.

If you have any questions, please contact me at (301) 415-8378 or via email at Jason.Drake@nrc.gov.

Sincerely, Digitally signed by Jason Jason J. J. Drake Date: 2022.05.10 Drake 11:43:59 -04'00' Jason J. Drake, Project Manager Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-382

Enclosure:

Final ASP Analysis cc: Listserv

ENCLOSURE FINAL ACCIDENT SEQUENCE PRECURSOR ANALYSIS WATERFORD STEAM ELECTRIC STATION, UNIT 3 LOSS OF OFFSITE POWER DUE TO HURRICANE IDA (LER 382-2021-001) - PRECURSOR

Final ASP Analysis - Precursor Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Waterford Steam Loss of Offsite Power Due to Hurricane Ida Electric Station (Unit 3)

LER: 382-2021-001 Event Date: 8/29/2021 CCDP = 5x10-4 IR: 05000382/2021003 Combustion Engineering Two-Loop Pressurized-Water Reactor (PWR) with a Plant Type:

Large, Dry Containment Plant Operating Mode Mode 4 (0% Reactor Power)

(Reactor Power Level):

Analyst: Reviewer: Completion Date: 5/4/2022 Christopher Hunter Mehdi Reisi Fard 1 EXECUTIVE

SUMMARY

On August 26, 2021, the plant entered procedure OP-901-521, "Severe Weather and Flooding,"

in response to a hurricane watch being issued for St. Charles Parish due to Hurricane Ida. On August 27th, the hurricane watch was elevated to a hurricane warning. On August 28th, the licensee determined that a plant shutdown was required per OP-901-521 due to the hurricane conditions projected by the National Weather Service (NWS) to reach the site. At 0813 Central Daylight Time (CDT) on August 29th, operators commenced a plant shutdown and subsequent reactor coolant system (RCS) cooldown using the steam generator (SG) atmospheric dump valves (ADVs).

On August 29th, the site experienced a loss of offsite power (LOOP) at 1804 CDT. The LOOP resulted in a loss of power to the reactor coolant pumps (RCPs), the running spent fuel pool (SFP) cooling pump, and the auxiliary feedwater (AFW) pump. Both safety-related emergency diesel generators (EDGs) automatically started and reenergized their respective safety buses.

Operators restarted the RCS cooldown via the SG ADVs. The plant declared an Unusual Event at 1812 CDT. In addition, operators manually started emergency feedwater (EFW) pump A to feed the SGs. At 1933 CDT, operators placed shutdown cooling (SDC) train A in service. At 2338 CDT, the plant entered Mode 5 (Cold Shutdown). On August 31st, at 2330 CDT, offsite power was restored, and the Unusual Event was exited 15 minutes later after both safety buses were realigned to offsite power.

This accident sequence precursor (ASP) analysis reveals that the most likely core damage sequence is a weather-related LOOP initiating event and the subsequent (postulated) failure of both EDGs resulting in a station blackout (SBO) with the successful (initial) operation of the turbine-driven emergency feedwater (TDEFW) pump. The operators successfully declared an extended loss of alternating current power (ELAP), but the postulated failure of FLEX diesel generators to charge safety related batteries is assumed to result in core damage because no credit is provided for continued operation of TDEFW without RCS makeup. This accident sequence accounts for approximately 68 percent of the total conditional core damage probability (CCDP) for this event. Although the mean CCDP of 5x10-4 for this event was high, the risk of core damage was mitigated due to hurricane preparations performed by the licensee prior to the storm reaching the plant. In addition, the risk impacts of this event were mitigated because defense-in-depth and plant-wide safety margins were maintained.

1

LER 382-2021-001 To identify general risk insights, a postulated hurricane resulting in a LOOP of similar duration was evaluated for three other plants that have experienced hurricane-related LOOPs in the past 25 years. These three test cases show that risk from postulated SBO scenarios results in high CCDPs for long duration LOOPs for plants with only two safety-related EDGs that cannot be cross-tied with another unit. While FLEX mitigation strategies reduce the risk of SBO, the appropriate credit in risk evaluations to account for those strategies is determined by current FLEX equipment types and their associated failure rates and probabilities.

2 EVENT DETAILS 2.1 Event Description On August 26, 2021, the plant entered procedure OP-901-521, "Severe Weather and Flooding,"

in response to a hurricane watch being issued for St. Charles Parish due to Hurricane Ida. On August 27th, the hurricane watch was elevated to a hurricane warning. On August 28th, the licensee determined that a plant shutdown was required per OP-901-521 due to the hurricane conditions projected by the NWS to reach the Waterford site. At 0813 CDT on August 29th, operators commenced a plant shutdown and subsequent RCS cooldown using the SG ADVs.

On August 29th, the site experienced a LOOP at 1804 CDT. The LOOP resulted in a loss of power to the RCPs, the running SFP cooling pump, and the AFW pump. Both safety-related EDGs automatically started and reenergized their respective safety buses. Operators restarted the RCS cooldown via the SG ADVs. The plant declared an Unusual Event at 1812 CDT. In addition, operators manually started EFW pump A to feed the SGs. At 1933 CDT, operators placed SDC train A in service. At 2338 CDT, the plant entered Mode 5 (Cold Shutdown). On August 31st, at 2330 CDT, offsite power was restored, and the Unusual Event was exited 15 minutes later after both safety buses were realigned to offsite power. Additional information is provided in Licensee Event Report (LER) 382-2021-001, Loss of Offsite Power Due to Hurricane Ida.

2.2 Cause The high winds, heavy rain, and localized flooding brought by Hurricane Ida resulted in damage to both sources of offsite power. The licensee determined that the hurricane force winds experienced on August 29th were within the design basis of the plant.

2.3 Sequence of Key Events Table 1 provides the sequence of key events:

Table 1. Sequence of Key Events August 26, 2021 The licensee entered off-normal procedure OP-901-521 in response to a Hurricane Watch being issued for St. Charles Parish due to Hurricane Ida.

August 27, 2021 A Hurricane Warning was issued for St. Charles Parish, and hurricane preparations continued.

August 28, 2021 The licensee determined a plant shutdown would be required as directed by OP-901-521 due to the hurricane conditions projected by the NWS to reach the site.

2

LER 382-2021-001 August 29, 2021 0813 Operators commenced a manual plant shutdown.

1031 The plant entered Mode 3 (Hot Standby).

1320 Operators commenced a manual RCS cooldown using both SG ADVs.

1720 The plant entered Mode 4 (Cold Shutdown). Depressurization was in progress to achieve SDC conditions.

1804 LOOP occurred, which resulted in a loss of power to the RCPs, the running SFP cooling pump, and the AFW pump. Both safety-related EDGs automatically started and reenergized their respective safety buses. Operators entered emergency operating procedure OP-902-003, "Loss of Offsite Power/Loss of Forced Circulation Recovery," and off-normal procedure OP-901-513, "Spent Fuel Pool Cooling Malfunction.

1806 Operators declare entry into Mode 3 based on exceeding 350°F by representative core exit thermocouple (CET) temperatures.

1812 Licensee declares Unusual Event as result of the LOOP.

1827 Operators commence lowering RCS temperature using the SG ADVs.

1848 Operators restore RCS temperature below 350°F and plant reenters Mode 4.

1900 Operators manually start EFW pump A to feed the SGs.

1933 SDC train A placed in service.

2211 SDC train B placed in service.

2338 The plant enters Mode 5 (Cold Shutdown).

August 31, 2021 2235 Offsite power was restored.

2345 The plant exits the Unusual Event after both safety buses were realigned to offsite power.

2.4 Additional Information The following event detail is provided as additional information that was not explicitly accounted for in this analysis.

• On September 30, 2021, the licensee completed an evaluation to validate the RCS temperature excursion that occurred following the LOOP. This evaluation concluded that the plant did not exceed Mode 4 conditions based on the RCS average temperature (Tavg) not exceeding 350°F. Whether the plant reentered Mode 3 after the LOOP occurred would not affect this analysis.

• On September 4th, the licensee identified that the PTED fire dampers were closed. It was determined that the fire dampers closed due to a fire suppression system actuation during the hurricane. Closed fire dampers could potentially impact the long-term functionality of PTED by limiting the amount of air flow through the PTEDs radiator. It is unknown how long the PTED could operate with the fire dampers closed. However, operators would have indications of the fire suppression system actuation and could reopen the dampers. This issue was not treated explicitly in the best estimate calculation but was identified as a key uncertainty and evaluated in Section 4.3.

3

LER 382-2021-001 3 MODELING 3.1 Basis for ASP Analysis The ASP Program performs independent analyses for initiating events. ASP analyses of initiating events account for all failures/degraded conditions and unavailabilities (e.g., equipment out for maintenance) that occurred during the event, regardless of licensee performance.1 Additional LERs were reviewed to determine if concurrent unavailabilities existed during the August 29th event. Discussions with Region 4 staff indicate that no licensee performance deficiency associated with this event has been identified; however, the LER remains open. No windowed events were identified.

3.2 Analysis Type This event was modeled as a weather-related LOOP initiating event using a test and limited use version of the Waterford Steam Electric Plant (Unit 3) revision 8.58 SPAR model created in April 2022. This SPAR model was revised based on the review of the licensees final integrated plant (FIP) for the FLEX mitigation strategies. The changes to base SPAR model event tree and associated fault trees associated with the FLEX mitigation strategies included the following:

• The credit for the FLEX mitigation strategies was activated for postulated SBO scenario for which an extended loss of AC power (ELAP) is declared.

• The requirement for operators to perform a deep load shed of the DC buses to extend the safety-related batteries depletion time during a postulated SBO to allow for the implementation of the FLEX mitigation strategies was added to the SBO-ELAP event tree.

• The FLEX-MUP fault tree was modified to require the safety injection tanks (SITs) and the two permanently installed charging pumps to prevent onset of reflux cooling at approximately 17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> after the extended loss of AC power (ELAP) conditions began.

• A human failure event was added to the FLEX-TDP2 and FLEX-TDP3 fault trees to account for operators needing to align an alternate suction source to the TDEFW pump for long-term operation. The condensate storage pool provides sufficient inventory for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of operation. The wet cooling tower (WCT) basins (via gravity drain) provide an additional 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> of inventory. The WCT basins can be refilled by gravity draining from the circulating water intake piping or the suction of the TDEFW pump will be transferred to the refueling water storage pool, which will extend TDEFW operation past 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

• Because of the large uncertainty in modeling assumptions related to availability and reliability of components and strategies for mission times that are well beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and the unclear basis for requiring AC power recovery within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the 72-hour AC power requirement was eliminated from the SBO-ELAP event tree. In addition, the FTR 1 ASP analyses also account for any degraded condition(s) that were identified after the initiating event occurred if the failure/degradation exposure time(s) overlapped the initiating event date.

4

LER 382-2021-001 events for FLEX diesel generators and pumps mission times were reset to be consistent with the 24-hour mission time used in the SPAR model.2

• Credit is provided for the plant to reach a safe and stable end state without offsite power recovery within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if TDEFW flow is maintained and RCS makeup is initiated prior to the onset of reflux cooling. MELCOR calculations show that there is sufficient steam pressure of operation of the TDEFW pump for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

3.3 SPAR Model Modifications The following additional SPAR model modifications were required for this initiating event analysis:

• FLEX Reliability Parameters. The base SPAR models currently use the reliability parameters of permanently installed equipment as placeholders for FLEX equipment because FLEX-specific reliability parameters were not available when the FLEX logic was incorporated into the SPAR models. Updated FLEX reliability parameters were recently provided to the NRC and Idaho National Laboratory (INL) by the Pressurized Water Reactor Owners Group (PWROG). This analysis uses this data because it is more representative of the as-built, as-operated plant. However, this data is still considered to be preliminary data as future modifications to the current FLEX data collection and evaluation process are considered and, therefore, is a modeling uncertainty for this analysis, and is evaluated in Section 4.3.

• PTED Reliability Parameters. In addition to the two safety-related EDGs, Waterford has a PTED generator. The PTED was permanently installed in its own enclosure in May 2021 and is no longer portable. Plant procedures direct operators to start and align the PTED to an unenergized safety bus given the postulated failure of one of the safety-related EDGs. The PTED is limited to supplying only one safety-related bus by procedure and design. Credit for the PTED is already included in the Waterford base SPAR model. However, the reliability parameters used in the base SPAR model are the same as those used for the safety-related EDGs, which are judged to be too optimistic for the PTED because the PTED is neither covered by technical specifications nor the maintenance rule prior to the event. Currently, INL does not have the data to evaluate reliability parameters for generators such as the PTED. The absence of specific data to generate reliability parameters for the PTED introduces significant uncertainty into this analysis. This analysis uses 5x and 10x multipliers of the safety-related EDG reliability parameters for failure to run (FTR) and failure to start (FTS) PTED reliability parameters.

The use of these multipliers is identified as a key uncertainty for this analysis, which is evaluated in Section 4.3.

• Degraded PTED Battery. After the storm, the PTED batteries were found to be failed. It is postulated that the batteries were damaged as a result of over-discharging following the power outage from the hurricane. In addition, age-related degradation of the 2 While the LOOP lasted for 54 hours6.25e-4 days <br />0.015 hours <br />8.928571e-5 weeks <br />2.0547e-5 months <br />, the mission time for this analysis was kept at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, which is the current state of practice. Consideration of mission times significantly longer than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> could introduce significant uncertainties. However, limiting the mission time to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> could lead to an underestimation of risk for long-duration LOOPs. The use of the 24-hour mission time was considered qualitatively and determined not to impact this analysis's general insights and conclusions substantially.

5

LER 382-2021-001 batteries likely contributed to the failure. The exact time of when the batteries were unable to support starting of the PTED after the LOOP occurred is currently unknown.

However, the battery had sufficient voltage to support starting the PTED within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the LOOP occurred. To evaluate this consideration, the EPS-TEDG fault tree was modified as shown in Figure B-1 in Appendix B.

3.4 Analysis Assumptions The following modeling assumptions were required to reflect the plant status and event circumstances for this initiating event assessment:

• LOOP Initiating Event. The probability of IE-LOOPWR (loss of offsite power (weather-related)) was set to 1.0 due to the loss of offsite power. All other initiating event probabilities were set to zero.

• Offsite Power Recovery Credit. Offsite power was recovered to the safety buses approximately 53 hours6.134259e-4 days <br />0.0147 hours <br />8.763227e-5 weeks <br />2.01665e-5 months <br /> after the LOOP occurred. Since it was not possible to restore offsite power to the safety buses within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, basic events OEP-XHE-XL-NR01HWR (operators fail to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />), OEP-XHE-XL-NR02HWR (operators fail to recover offsite power in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />), and OEP-XHE-XL-NR24HWR (operators fail to recover offsite power in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) were set TRUE.

• Credit for FLEX N+1 Equipment. The base SPAR models credit both the FLEX N and N+1 trains of equipment. At Waterford, the FLEX N equipment is permanently staged in its required locations, while the N+1 train equipment is located in the FLEX building. The licensee considered pre-staging the FLEX N+1 equipment as directed by their severe weather procedure. However, they determined that pre-staging the FLEX N+1 equipment was not needed because river flooding was unlikely. Due to the hurricane adverse environmental conditions that licensee personnel would encounter in moving, making the appropriate connections (e.g., hoses, electrical wires, spool pieces, etc.),

and starting FLEX N+1 equipment, the probabilities for human failure events (HFEs)

FLX-XHE-XM-4802 (operators fail to stage or run or load or refuel redundant FLEX diesel generator) and FLX-XHE-XM-SGP2 (operators fail to stage or run or supply or refill FLEX SG pump) were increased by an order of magnitude to 0.5. The credit provided for the FLEX N+1 equipment is identified as a key uncertainty for this analysis, and it is evaluated in Section 4.3.

• Degraded PTED Battery. New basic event EPS-TEDG-FAILED (PTED failed if both EDGs FTR) was set to TRUE to model that the PTED would fail if started 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (or later) after the LOOP occurred.

• Treatment of Test and Maintenance. Nominal test and maintenance probabilities are typically used in all ASP analyses because plants could be undergoing these activities when an initiating event occurs. However, hurricanes appear to be an outlier given the usual warning time prior to a potential LOOP with most plants having severe weather procedures that direct the immediate restoration of structures, systems, and components (SSCs) that are unavailable due to test and maintenance activities. In addition, these procedures preclude taking any SSC out of service until after the storm has passed.

Waterford entered their severe weather procedure on August 26th. Therefore, the licensee had a minimum of 42 hours4.861111e-4 days <br />0.0117 hours <br />6.944444e-5 weeks <br />1.5981e-5 months <br /> to restore any SSCs that were out for maintenance which would be sufficient time for the licensee to restore affected SSCs for all but the 6

LER 382-2021-001 most significant maintenance activities. Given these considerations, all test and maintenance probabilities were set to zero for this analysis. The use of zero test and maintenance model is identified as a key uncertainty for this analysis, which is evaluated in Section 4.3.

4 ANALYSIS RESULTS 4.1 Analysis Results and Evaluation of Key Uncertainties The mean CCDP for this analysis is calculated to be 5.0x10-4. The ASP Program threshold for initiating events is a CCDP of 10-6 or the plant-specific CCDP of an uncomplicated reactor trip with a non-recoverable loss of feed water and the condenser heat sink, whichever is greater.

This CCDP equivalent for Waterford Electric Steam Plant (Unit 3) is 2x10-6. Therefore, this event is a precursor. The parameter uncertainty CCDP results are provided in the table below:

Table 2. Parameter Uncertainty Results 5% Median Point Estimate Mean 95%

5.0x10-5 2.7x10-4 4.5x10-4 5.0x10-4 1.6x10-3 4.2 Dominant Sequences3 The dominant accident sequence is a weather-related LOOPWR sequence 15-3-10 (CCDP =

3.1x10-4), which contributes approximately 68 percent of the total CCDP. The sequences that contribute at least 5.0 percent to the total CCDP are provided in the following table. These dominant sequences are shown graphically in Figures A-1, A-2, and A-3 of Appendix A.

Table 3. Dominant Sequences Sequence CCDP  % Description LOOPWR 15-03-10 3.1x10-4 68.0% Weather-related LOOP initiating event; emergency power system failure results in SBO; EFW successfully operates; operators fail to restore AC power prior to normal battery depletion (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />); operators declare ELAP; FLEX diesel generator fails to charge safety-related batteries is assumed to result in core damage because no credit is provided for continued operation of TDEFW without RCS makeup.

LOOPWR 15-12 7.6x10-5 16.9% Weather-related LOOP initiating event; emergency power system failure results in SBO; EFW fails; operators fail to restore AC power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> results in core damage.

LOOPWR 14 3.7x10-5 8.2% Weather-related LOOP initiating event; emergency power system is successful; EFW fails resulting in core damage.

3 The CCDPs provided in this section are point estimates.

7

LER 382-2021-001 4.3 Key Uncertainties The following are the key uncertainties of this ASP analysis. The results of any sensitivity analyses performed to evaluate these uncertainties are provided in Table 4.

• Treatment of Test and Maintenance. To evaluate the uncertainty associated with the use of a zero test and maintenance model in the best estimate analysis, a sensitivity calculation was performed using nominal test and maintenance probabilities. This calculation resulted in a mean CCDP of 6.5x10-4 (an increase of 31 percent of the best estimate CCDP).

• PTED Reliability Parameters. Two sensitivity calculations were performed to evaluate the uncertainty associated with the lack of PTED reliability data. The first calculation used 3x/5x multipliers for the FTR and FTS failure parameters for the PTED. The second calculation used the FLEX reliability parameters. These calculations resulted in mean CCDPs of 4.8x10-4 (a decrease of 3 percent of the best estimate CCDP) and 5.0x10-4 (a negligible change from the best estimate CCDP).

• Crediting the FLEX N+1 Equipment. Two sensitivity calculations were performed to evaluate the uncertainty associated with crediting the FLEX N+1 equipment. The first calculation assumed the nominal human error probabilities (HEPs) for the FLEX N+1 equipment. The second calculation assumed that the operators failed to move, connect, and start the FLEX N+1 equipment due to the storm conditions. These calculations resulted in mean CCDPs of 2.8x10-4 (a decrease of 29 percent of the best estimate CCDP) and 6.0x10-4 (an increase of 21 percent of the best estimate CCDP).

• FLEX Hardware Reliability. This analysis uses FLEX hardware reliability parameters provided to the NRC and INL by the PWROG. This data is considered to be preliminary data as future modifications to the current FLEX data collection and evaluation process are considered. Although this data is deemed more representative of the as built, as operated plant, the FLEX hardware reliability data is considered to a key uncertainty in this analysis. Therefore, sensitivity calculations were performed by decreasing and increasing the FLEX hardware reliability parameters by a factor of two. These calculations resulted in mean CCDPs of 3x10-4 (a decrease of 40 percent of the best estimate CCDP) and 8.4x10-4 (an increase of 71 percent of the best estimate CCDP).

• FLEX Human Reliability. Detailed human reliability analysis (HRA) was not performed for FLEX mitigation strategies for the SPAR models. Placeholder values for the HEPs that were judged to be reasonable by model developers are currently used. A review of these HEPs did not identify any significant issues and are judged to be reasonable for this analysis. Future HRA of these actions will likely result in HEP increases for some HFEs and decreases for others. Therefore, sensitivity calculations were performed by decreasing and increasing the FLEX HEPs by a factor of five. These calculations resulted in mean CCDPs of 4.7x10-4 (a decrease of 4 percent of the best estimate CCDP) and 6.5x10-4 (an increase of 32 percent of the best estimate CCDP).

• PTED Fire Damper Closure. To evaluate the uncertainty associated with the closed PTED fire dampers, a sensitivity calculation was performed assuming the closed fire damper resulted in a nonrecoverable failure of the PTED. This calculation resulted in a mean CCDP of 6.3x10-4 (an increase of 27 percent of the best estimate CCDP).

8

LER 382-2021-001

• Crediting Long-Term TDEFW Pump Operation to Achieve Safe and Stable End State.

The licensee comments on the preliminary ASP analysis (see Appendix C for additional information) include their belief that long-term TDEFW pump operation is sufficient to achieve a safe and stable end state given the postulated failure of the FLEX mitigation strategies. The licensee has strategies in place to continue operation of the TDEFW pump without DC power (e.g., alternative SG level measurement and pump speed indication). And as previously noted, there is sufficient steam pressure and suction source inventory to operate the TDEFW pump for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Therefore, the status of the RCS is the key concern on whether this credit should be provided. Licensee calculations indicate that reflux cooling will start approximately 17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> after a postulated SBO occurs. However, this estimate is conservative for this event because the plant was shutdown for approximately 7.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> and was in Mode 4 conditions.

However, it is not known exactly how long the plant would have until reflux cooling condition began. Therefore, although there would be no core damage in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in this scenario, there is still a loss RCS inventory through the RCP seals (albeit at a significantly reduced rate when compared to licensee calculations). Given the lack of thermal-hydraulic calculations to support the decision and the level of effort required to complete such calculation, it was determined that credit for continued operation of the TDEFW pump without RCS makeup will not be provided in the best estimate case for this analysis. However, it is acknowledged that this assumption is potentially conservative. To evaluate the uncertainty, a sensitivity calculation was performed assuming long-term TDEFW pump operation alone is sufficient to achieve a safe and stable end state. This calculation resulted in a mean CCDP of 2.5x10-4 (a decrease of 50 percent of the best estimate CCDP). Note that this sensitivity calculation was simplistic in nature and has significant uncertainties associated with it. A refined calculation would require a detailed HRA of the licensee alternate strategies to maintain TDEFW pump flow without DC power.

5 GENERAL RISK INSIGHTS 5.1 Postulated Results at Other Plants To identify general risk insights, a postulated hurricane resulting in a LOOP of similar duration was evaluated for three other plants that have experienced hurricane-related LOOPs in the past 25 years. These analyses all use the following modeling assumptions, which could be conservative or nonconservative for these respective plants:

- Weather-related LOOP event occurred,

- Offsite power was not recoverable within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />,

- If applicable plant was a multi-unit site, all units would be affected by the LOOP,

- A zero test and maintenance model was used,

- FLEX credit was provided with the same reliability parameters used for the Waterford analyses,

- The same level of credit was provided for the N+1 train,

- For the PWR (Plant C), credit is provided for TDEFW or turbine-driven auxiliary feedwater pump to reach safe/stable end state as long as DC power is maintained,

- A 24-hour mission time was used for all equipment and there was no 72-hour AC power recovery requirement, and 9

LER 382-2021-001

- No credit for EDG repair was provided after ELAP declaration.

Table 4. General Risk Insight Results

1. of Mean Plant Plant Type Multi-Unit Notes EDGs CCDP A General Electric Yes 5 6.2x10-5 Each unit has two EDGs that can be shared Type 4 BWR between units. In addition, there is a supplemental diesel generator that can be aligned to either unit. These features significantly reduce the SBO risk and, therefore, limit the overall CCDP for long-duration LOOPs. In addition, the modeling of inter-system CCF of the EDGs between both units introduces significant uncertainties and may result in conservative CCDPs.

B General Electric No 3 2.4x10-4 The third EDG is dedicated to the high-Type 6 BWR pressure coolant spray function and is not credited with resupplying either of the two main safety-related buses. Some additional analysis refinements may reduce the CCDP lower into the 10-4 range. SBO risk is dominant due to having only two EDGs and no additional unit that can supply the two main safety-related buses.

C Combustion Yes 4 5.2x10-5 Each unit has two EDGs than can be shared Engineering 2- between units. The sharing of the other units Loop PWR EDGs significantly reduces the SBO risk and, therefore, limits the overall CCDP for long-duration LOOP. In addition, the modeling of inter-system CCF of the EDGs between both units introduces significant uncertainties and may result in conservative CCDPs.

These three test cases show that risk from postulated SBO scenarios results in high CCDPs for long duration LOOPs for plants with only two safety-related EDGs that cannot be cross-tied with another unit. While FLEX mitigation strategies reduce the risk of SBO, the appropriate credit in risk evaluations to account for those strategies is determined by current FLEX equipment types and their associated failure rates and probabilities.

10

LER 382-2021-001 Appendix A: Key Event Trees Figure A-1. Weather-Related LOOP Event Tree A-1

LER 382-2021-001 EMERGENCY POWER EMERGENCY FEEDWATER SAFETY RELIEF VALVES NOT FAILURE OF RCP SEALS OFFSITE POWER RECOVERY OPERATOR FAILS TO # End State SYSTEM CHALLENGED FOLLOWING LOSS OF IN 2 HRS RECOVER EMERGENCY (Phase - CD)

COOLING DIESEL IN 2 HOUR FS = SBO-FTF EPS EFW SRV RCPSI OPR-02H DGR-02H OK OK 2

B 1 01H OK B

01H CD 01H 1

01H OK B

CD 01H 01H 10 1 01H 11 OK B

12 CD 01H DGR-01H Figure A-2. SBO Event Tree A-2

LER 382-2021-001 ELAP DECLARED ELAP IS DECLARED WHEN DEEP LOAD SHEDDING PER FLEX DIESEL GENERATOR FLEX SG PUMP OPERATION LONG-TERM CONTROL OF BORON INJECTION AND RCS AC POWER RECOVERY # End State NEEDED FSGs OPERATION AND BUS AFW TDP - NO FLEX PUMP MAKEUP WITH CHARGING WITHIN 24 HOURS (Phase - CD)

ALIGNMENT PUMPS FLEX ELAP FLEX-DLSHED FLEX-480 FLEX-SGP AFW-MAN-TDP FLEX-MUP OPR-24HR FLEX-TDP3 Figure A-3. SBO-ELAP Event Tree A-3

LER 382-2021-001 Appendix B: Modified Fault Tree TEMPORARY EMERGENCY DIESEL EPS-EPS-DGN-FR-TEDG HE-3.39E- EPS-TEDG-EDGFTR EPS-XHE-XA-TEDG HE-1.00E-TEMPORARY EMERGENCY DIESEL EPS-TEDG-EDGFTR1 EPS-TEDG-EDGFTR2 EPS-DGN-FS-TEDG HE-2.86E-HOUSE EVENT FOR HURRICANE GENERATOR FAILS TO LOAD RUN BOTH EDGs FTR INDIVIDUALLY EPS-DGN-LR-TEDG HE- DIESEL GENERATORS TO RUN 3.70E-EPS-TEDG-FAILED EPS-DGN-CF-FR GENERATOR UNAVAILABLE DUE TO EVENT (WIND MISSILE) BIN 3 EPS-TEDG-EDGFTR3 5.36E-EPS-DGN-TM-TEDG HE-TOR3-WM 1.48E-EVENT (WIND PRESSURE) BIN 3 HE- HE-TOR3-WP EPS-DGN-FR-DG3A 3.39E-HE-EPS-DGN-FR-DG3B 3.39E-Figure B-1. Modified EPS-TEDG Fault Tree B-1

LER 382-2021-001 Appendix C: Comments and Responses on Preliminary Analysis The NRC provided the licensee (Entergy) the preliminary ASP analysis in accordance with Regulatory Issue Summary 2006-24, Revised Review and Transmittal Process for Accident Sequence Precursor Analyses, (ADAMS Accession No. ML060900007) to formally review the analysis because the range of preliminary mean CCDPs exceeded 1x10-3. Entergy provided comments on the preliminary ASP analysis on April 11, 2022 (ADAMS Accession No. ML22101A187). These comments, along with the NRC response, are summarized below.

1. Treatment of Testing and Maintenance: Due to the site's prior knowledge of Hurricane Ida and extensive preparation efforts, there were no test and maintenance activities prior to or during the LOOP. Testing and maintenance in general, and EDG-related components specifically, should not be a contributor in the final ASP analysis.

NRC Response/Action: All test and maintenance probabilities were set to zero for the final ASP analysis (see Section 3.4 for additional information).

2. Credit for Long-Term TDEFW Pump Operations: Due to the specific procedural guidance for operating the TDEFW pump manually, the ability for MCR operators to control EFW Flow control valve position until DC power is lost, the availability of alternate SG instrumentation after loss of DC power, and operator training on controlling the TDEFW pump without DC power, the final ASP analysis should include credit for-long term TDEFW Pump operation.

NRC Response/Action: Credit for the long-term operation of the TDEFW pump to achieve a safe and stable end state without RCS makeup was not provided in the best estimate case. However, this issue was identified as a key uncertainty and evaluated with a sensitivity calculation (see Section 4.3 for additional information).

3. Availability of the FLEX N+1 Diesel Generator: As demonstrated to the Waterford NRC Resident Inspectors the week of March 14, 2022, there was sufficient ability to allow for the connection and use of the FLEX N+1 equipment within the necessary 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from the LOOP. Due to the increased staffing, including operators, engineers and maintenance technicians sequestered on site prior to Hurricane Ida and the availability of alternate FLEX N+1 diesel generator deployment locations, the final ASP analysis should include credit for FLEX N+1 diesel generator availability.

NRC Response/Action: Credit for the FLEX N+1 was provided in the final ASP analysis (see Section 3.4 for additional information).

C-1

ML22125A274 (Package);

ML22125A273 (Letter);

ML22122A190 (ASP Report) *concurrence via e-mail OFFICE NRR/DORL/LPL4/PM* NRR/DORL/LPL4/LA* NRR/DORL/LPL4/BC* NRR/DORL/LPL4/PM*

NAME JDrake PBlechman JDixon-Herrity JDrake DATE 5/4/2022 5/9/2022 5/10/2022 5/10/2022