ML23074A075
| ML23074A075 | |
| Person / Time | |
|---|---|
| Site: | Surry  |
| Issue date: | 03/16/2023 |
| From: | John Klos Plant Licensing Branch II |
| To: | Stoddard D Virginia Electric & Power Co (VEPCO) |
| Klos, J | |
| References | |
| R-2016-ASP-0001, EPID R-2016-ASP-0001 | |
| Download: ML23074A075 (1) | |
Text
March 16, 2023 Mr. Daniel G. Stoddard Senior Vice President and Chief Nuclear Officer Innsbrook Technical Center 5000 Dominion Blvd.
Glen Allen, VA 23060-6711
SUBJECT:
TRANSMITTAL OF FINAL SURRY POWER STATION, UNIT 1 ACCIDENT SEQUENCE PRECURSOR REPORT (EPID R-2016-ASP-0001)
Dear Mr. Stoddard:
By letter dated September 19, 2022, (Agencywide Documents Access and Management System (ADAMS) Accession No. ML22263A429), Surry Power Station, Unit 1 submitted licensee event report (LER) No. 50-280/2022-002-00 to the U.S. Nuclear Regulatory Commission (NRC) staff pursuant to Title 10 of the Code of Federal Regulations (10 CFR)
Section 50.73. As part of the Accident Sequence Precursor (ASP) Program, the NRC staff reviewed the event to identify potential precursors and to determine the probability of the event leading to a core damage state. The results of the analysis are provided in the enclosure to this letter.
The NRC does not request a formal analysis review, in accordance with Regulatory Issue Summary 2006-24, Revised Review and Transmittal Process for Accident Sequence Precursor Analyses, (ML060900007), because the analysis resulted in an increase in core damage probability (CDP) of less than 1x10-4.
Final ASP Analysis Summary. A brief summary of the final ASP analysis, including the results, is provided below.
Failure of Unit 1 EDG Results in an Operation or Condition Prohibited by TS. This event is documented in LER 50-280/2022-002-00 and IR Executive Summary. On July 18, 2022, the emergency diesel generator (EDG) 1 was removed from service to perform the monthly surveillance test. Approximately 20 minutes after reaching full load, EDG 1 experienced a partial loss of load. The main control room operators noted that the generator load had lowered, and the generator output current indication was above normal.
Local field operators noted a change in engine sound normally associated with decreasing load and subsequently unloaded EDG 1, which ran unloaded for approximately 30 minutes before being shut down normally.
Licensee troubleshooting identified that a lead to the generator exciter was grounded. A physical inspection of this lead revealed a failure between the generator brush rigging and the panel wiring at the bolted connection point. A bridge and megger check on the generator stator
was satisfactory. Further troubleshooting of the generator rotor indicated a hard ground on one out of eight (8) rotor poles.
The licensee determine that repair activities would exceed TS allowed outage time (AOT) of 7 days. Therefore, a request for enforcement discretion was requested from the U.S. NRC and was verbally approved on July 24th. This enforcement discretion allowed a 2-day extension to the AOT to complete the EDG 1 repairs. Post-maintenance testing was completed and EDG 1 was returned to service on July 26th.
The mean CDP for this event is 3x10-5 and, therefore, this event is a precursor. The dominant hazard for this ASP analysis are internal fires, which contribute approximately 89 percent of the total CDP. The risk from internal events contributes approximately 11 percent of the total CDP, while internal floods, high winds (including hurricanes and tornados), and seismic events are minimal risk contributors for this analysis. Note that the internal fire modeling in the Surry SPAR model is largely based on the results of the individual plant examinations of external events (IPEEE) that was completed in 1997, which is a key uncertainty associated with this analysis. The licensee does not have any fire risk information provided in their licensee amendment requests to date to perform any comparisons. The evaluation of internal fires in the IPEEE studies are known to have significant conservatisms. However, some assumptions and techniques used in the IPEEE could have led to the underestimation of some fire scenarios.
Given that the overall CDP without internal fires is 3x10-6, this condition exceeds the precursor threshold regardless.
Summary of Analysis Results. This operational event resulted in a best estimate of CDP of 3x10-5. The detailed ASP analysis can be found in the enclosure.
If you have any questions, please contact the Project Manager, John Klos at 301-415-5136 or via email at John.Klos@nrc.gov.
Sincerely,
/RA/
John Klos, Project Manager Plant Licensing Branch II-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos.
50-280
Enclosure:
Failure of Unit 1 EDG Results in an Operation or Condition Prohibited by TS cc: Listserv
Enclosure ENCLOSURE Failure of Unit 1 EDG Results in an Operation or Condition Prohibited by TS
1 Final ASP Analysis - Precursor Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Surry Power Station (Unit 1)
Failure of Unit 1 EDG Results in an Operation or Condition Prohibited by TS Event Date: 7/25/2022 LER:
280-2022-002 CDP =
3x10-5 IR: 05000280/2022004 Plant Type:
Westinghouse Three-Loop Pressurized-Water Reactor (PWR) with a Dry, Subatmospheric Containment Plant Operating Mode (Reactor Power Level):
Mode 1 (100% Reactor Power)
Analyst:
Reviewer:
Completion Date:
Christopher Hunter Latonia Enos-Sylla 3/6/2023 1
EXECUTIVE
SUMMARY
On July 18, 2022, the emergency diesel generator (EDG) 1 was removed from service to perform the monthly surveillance test. Approximately 20 minutes after reaching full load, EDG 1 experienced a partial loss of load. The main control room (MCR) operators noted that the generator load had lowered, and the generator output current indication was above normal.
Local field operators noted a change in engine sound normally associated with decreasing load and subsequently unloaded EDG 1, which ran unloaded for approximately 30 minutes before being shut down normally.
Licensee troubleshooting identified that a lead to the generator exciter was grounded. A physical inspection of this lead revealed a failure between the generator brush rigging and the panel wiring at the bolted connection point. A bridge and megger check on the generator stator was satisfactory. Further troubleshooting of the generator rotor indicated a hard ground on one out of eight (8) rotor poles.
The licensee determine that repair activities would exceed technical specifications (TS) allowed outage time (AOT) of 7 days. Therefore, a request for enforcement discretion was requested from the U.S. Nuclear Regulatory Commission (NRC) and was verbally approved on July 24th.
This enforcement discretion allowed a 2-day extension to the AOT to complete the EDG 1 repairs. Post-maintenance testing was completed and EDG 1 was returned to service on July 26th.
The mean core damage probability (CDP) for this event is 3x10-5 and, therefore, this event is a precursor. The dominant hazard for this accident sequence precursor (ASP) analysis are internal fires, which contribute approximately 89 percent of the total CDP. The risk from internal events contributes approximately 11 percent of the total CDP, while internal floods, high winds (including hurricanes and tornados), and seismic events are minimal risk contributors for this analysis. Note that the internal fire modeling in the Surry SPAR model is largely based on the results of the individual plant examinations of external events (IPEEE) that was completed in 1997, which is a key uncertainty associated with this analysis. The licensee does not have any fire risk information provided in their licensee amendment requests to date to perform any comparisons. The evaluation of internal fires in the IPEEE studies are known to have significant conservatisms. However, some assumptions and techniques used in the IPEEE
LER 280-2022-002 2
could have led to the underestimation of some fire scenarios. Given that the overall CDP without internal fires is 3x10-6, this condition exceeds the precursor threshold regardless.
2 EVENT DETAILS 2.1 Event Description On July 18, 2022, the EDG 1 was removed from service to perform the monthly surveillance test. Approximately 20 minutes after reaching full load, EDG 1 experienced a partial loss of load. The MCR operators noted that the generator load had lowered, and the generator output current indication was above normal. Local field operators noted a change in engine sound normally associated with decreasing load and subsequently unloaded EDG 1, which ran unloaded for approximately 30 minutes before being shut down normally.
Licensee troubleshooting identified that a lead to the generator exciter was grounded. A physical inspection of this lead revealed a failure between the generator brush rigging and the panel wiring at the bolted connection point. A bridge and megger check on the generator stator was satisfactory. Further troubleshooting of the generator rotor indicated a hard ground on one out of eight (8) rotor poles.
The licensee determine that repair activities would exceed TS AOT of 7 days. Therefore, a request for enforcement discretion was requested from the NRC and was verbally approved on July 24th. This enforcement discretion allowed a 2-day extension to the AOT to complete the EDG 1 repairs. Post-maintenance testing was completed and EDG 1 was returned to service on July 26th. Additional information is provided in licensee event report (LER) 280-2022-002, Failure of Unit 1 EDG Results in an Operation or Condition Prohibited by TS (ML22263A429).
2.2 Cause A physical inspection of the field lead identified a failure between the generator brush rigging and the panel wiring at the bolted connection point. Additional troubleshooting of the generator rotor revealed a hard ground on 1 of the 8 poles. The failure of the lead caused additional electrical stress on the insulation system of the field that resulted in the first coil on the pole closest to the field connection to fail to ground. A vendor failure analysis confirmed the ground and identified that the ground was caused by corrosion between the lugs of the field lead.
3 MODELING 3.1 Basis for ASP Analysis The ASP Program uses SDP results for degraded conditions when available (and applicable). A Green finding (i.e., very low safety significance) was identified associated with this condition.
However, the licensee performance deficiency was due to an inadequate cause evaluation and, therefore, no detailed risk evaluation was performed. Therefore, an independent ASP analysis was performed to determine the potential risk significance of this condition. See IR 05000280/2022004 (ML23041A023) for additional information; the LER is closed. A search of Surry Power Station LERs did not reveal any windowed events.
3.2 Analysis Type This degraded condition was evaluated using a test and limited use (TLU) version of the Surry SPAR model created in February 2023. This SPAR model includes the following hazards:
- Internal events,
LER 280-2022-002 3
- Internal fires,
- Internal floods,
- High winds (including hurricanes and tornados), and
- Seismic events.
This TLU model includes revisions to the version 8.80 SPAR model of record based on the review of the licensees final integrated plan (FIP) for the FLEX mitigation strategies (ML15279A345).
3.3 SPAR Model Modifications The following additional SPAR model modifications were required for this analysis:
FLEX Reliability Parameters. The base SPAR models currently use the reliability parameters of permanently installed equipment as placeholders for FLEX equipment because FLEX-specific reliability parameters were not available when the FLEX logic was incorporated into the SPAR models. Updated FLEX reliability parameters are provided in Table 6-1 in Pressurized Water Reactor Owners Group (PWROG) 18042NP, FLEX Equipment Data Collection and Analysis, Revision 1 (ML22123A259).
This analysis uses this data because it is more representative of the as-built, as-operated plant.
3.4 Exposure Time The last successful test for EDG 1 was completed a month prior to failure. Because the exact time of failure is unknown, the exposure time was calculated using the following equation from Section 2.4 of Volume 1 (internal events) of the Risk Assessment of Operational Events (or RASP) Handbook (ML17348A149):
=
2 + = 30 2 + 9 = 24 This exposure time is a key uncertainty for this analysis, which is discussed further in Section 4.4.
3.5 Analysis Assumptions The following modeling assumptions were required to reflect the plant status and event circumstances for this initiating event assessment:
Basic event EPS-DGN-LR-DG1 (diesel generator 1 fails to load run) was set to TRUE because the EDG 1 would have failed to run within the first hour of operation due to pole ground fault. No credit for recovery of the EDG 1 was provided in this analysis.
4 ANALYSIS RESULTS 4.1 Results The mean CDP for this analysis is calculated to be 2.5x10-5. The ASP Program threshold is 1x10-6 for degraded conditions; therefore, this event is a precursor. The parameter uncertainty results for this analysis provided below:
LER 280-2022-002 4
Table 1. Parameter Uncertainty Results 5%
Median Point Estimate Mean 95%
3.4x10-6 1.6x10-5 2.3x10-5 2.5x10-5 7.8x10-5 4.2 Dominant Hazards1 The dominant hazard for this analysis is internal fires (CDP = 2.1x10-5), which contribute approximately 89 percent of the total CDP. Internal events contribute approximately 11 percent (CDP = 2.6x10-6), while internal flooding, high winds (including hurricanes and tornados), and seismic events are minimal contributors to the total CDP for this analysis 4.3 Dominant Sequences The dominant accident sequence is a large fire in emergency switchgear room 1J electrical cabinets 15J2 through 15J11 sequence 2-17-3-3 (CDP = 8.8x10-6), which contributes approximately 38 percent of the total CDP. The sequences that contribute at least 10 percent to the total CDP are provided in the following table. These dominant sequences are shown graphically in Figures A-1, A-2, A-3, and A-4 of Appendix A.
Table 2. Dominant Sequences Sequence CDP Description FRI-ESGR-F313 2-17-3-3 8.8x10-6 38.1% Fire in emergency switchgear room 1J electrical cabinets 15J2 through 15J11 results in a loss of offsite power (LOOP); emergency power system failure results in station blackout (SBO);
the turbine-driven auxiliary feedwater (AFW) pump successfully maintains inventory in the steam generators (SGs); operators declare ELAP; the FLEX diesel generators successfully charge the safety-related batteries; RCS makeup fails; and operators fail to recover AC power in 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> results in core damage.
FRI-MCR-SF 2-16 3.9x10-6 16.7% Fire in the MCR that requires evacuation of operators and results in a LOOP; the emergency power system is successful; the AFW system fails; failure of feed and bleed cooling results in core damage.
FRI-ESGR-F313 2-17-3-8 2.7x10-6 11.5% Fire in emergency switchgear room 1J electrical cabinets 15J2 through 15J11 results in a LOOP; emergency power system failure results in SBO; the turbine-driven AFW pump successfully maintains inventory in the SGs; operators declare ELAP; the FLEX diesel generators fail to charge the safety-related batteries; and operators fail to recover AC power in 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> results in core damage.
1 The CDPs provided in Sections 4.2 and 4.3 are point estimates.
LER 280-2022-002 5
4.4 Key Uncertainties The following are the key uncertainties of this ASP analysis.
Internal Fire Modeling. The internal fire modeling in the Surry SPAR model is largely based on the results of the IPEEE that was completed in 1997, which is a key uncertainty for this analysis. The evaluation of internal fires in the IPEEE studies are known to have significant conservatisms. However, some assumptions and techniques used in the IPEEE could have led to the underestimating of some fire scenarios. The risk-informed applications (e.g., technical specification change) for Surry were reviewed to determine if additional insights could be identified to assess the uncertainties associated with SPAR fire modeling. The Surry license amendment requests to date state that the licensee does not have a PRA for internal fires and references its fire safe shutdown equipment list performed for the Surry fire protection program. Therefore, no quantitative information is available for comparison. Given that the overall CDP without internal fires is 3x10-6, this condition exceeds the precursor threshold regardless.
Exposure Time. The exact time of when the pole ground occurred on EDG 1 is unknown. A sensitivity analysis was performed to determine the risk of the maximum exposure time of 39 days, which includes the 9 days of repair time. The mean CDP for this exposure time is 4x10-5 for internal events, internal fires, internal floods, high winds (including hurricanes and tornados) and seismic events. In addition, a sensitivity calculation was performed to determine the minimum exposure time required for the CDP to exceed the precursor threshold of 1x10-6. It was determined that if the pole ground fault on the EDG 1 occurred right before discovery on July 18th, the risk of this condition would still exceed the precursor threshold.
LER 280-2022-002 A-1 Appendix A: Key Event Trees Figure A-1. IE-FRI-ESGR-F313 Event Tree Figure A-2. LOOP Event Tree IE-FRI-ESGR-F313 Large Fire in Room 1J electrical cabinets 15J2 through 15J11 TRANSFER EVENT TREE NODE SET TO TRUE FOR TRANSFER End State (Phase - CD) 1 OK 2
LOOP LOOP LOSS OF OFFSITE POWER RPS-L FS = FTF-LOOP REACTOR TRIP EPS FS = FTF-SBO EMERGENCY POWER AFW FS = FTF-LOOP-RECOVERY AUXILIARY FEEDWATER PORV PORVS ARE CLOSED LOSC FS = FTF-LOSC RCP SEAL COOLING MAINTAINED HPI FS = FTF-LOOP-RECOVERY HIGH PRESSURE INJECTION FAB FS = FTF-LOOP-RECOVERY FEED AND BLEED OPR-06H OFFSITE POWER RECOVERY (IN 6 HRS)
CSR FS = FTF-LOOP-RECOVERY CONTAINMENT SPRAY RECIRC HPR FS = FTF-LOOP-RECOVERY HIGH PRESSURE RECIRC End State (Phase - CD)
AFW-L 1
OK LOSC-L 2
LOOP-1 PORV-L HPI-L 3
OK 4
CD 5
CD CSR-L 6
OK HPR-L 7
CD CSR-L 8
CD HPI-L 9
CD AFW-L FAB-L 10 OK 11 CD 12 CD CSR-L 13 OK HPR-L 14 CD CSR-L 15 CD FAB-L 16 CD 17 SBO 18 ATWS 19 CD
LER 280-2022-002 A-2 Figure A-3. SBO Event Tree Figure A-4. SBO-ELAP Event Tree EPS FS = FTF-SBO EMERGENCY POWER AFW-B FS = FTF-SBO AUXILIARY FEEDWATER PORV-B FS = FTF-SBO PORV USING SBO FAULT TREE FLAGS RCPSEALLOCA-SBO RCP Seal LOCA - SLOCA with N9000 seals OPR-04H OFFSITE POWER RECOVERY (IN 4 HOURS)
DGR-04H OPERATOR FAILS TO RECOVER EMERGENCY DIESEL IN 4 HOURS End State (Phase - CD)
OPR-01H 1
SBO-1 OPR-01H 2
OK DGR-01H 3
SBO-ELAP OPR-01H 4
SBO-2 OPR-01H 5
OK DGR-01H 6
CD OPR-01H 7
SBO-2 OPR-01H 8
OK DGR-01H 9
CD OPR-01H 10 SBO-3 OPR-01H 11 OK DGR-01H 12 CD SBO-ELAP SBO - Extended Loss of AC Power ELAP ELAP is declared when it is needed FLEX-DLSHED Deep Load Shedding per FSGs OPR OFFSITE POWER RECOVERY FLEX-480 FLEX diesel is operable and connected to buses AFW-MAN-TDP Long term manual control of TD AFW pump - no FLEX pump FLEX-SGP FS = FTF-LOOP FLEX SG pump is operable FLEX-MUP Boron injection and RCS makeup with FLEX pump End State (Phase - CD)
OPR-14H 1
SBO-1 OPR-14H FLEX-TDP2 2
OK 3
CD FLEX-TDP2 4
OK 5
CD 6
CD FLEX-TDP3 7
OK FLEX-TDP3 8
CD OPR-04H 9
SBO-1 OPR-04H FLEX-TDP3 10 OK FLEX-TDP3 11 CD OPR-04H 12 SBO-1 OPR-04H FLEX-TDP3 13 OK FLEX-TDP3 14 CD
ML23074A075 OFFICE NRR/DORL/LPL2-1/PM NRR/DORL/LPL2-1/LA NRR/DORL/LPL2-1/A(BC)
NRR/DORL/LPL2-1/PM NAME JKlos KGoldstein MMarkley (EMiller for)
J.Klos DATE 03/13/2023 03/15/2023 03/16/2023 03/16/2023