IR 05000348/2023090
| ML23229A118 | |
| Person / Time | |
|---|---|
| Site: | Farley  |
| Issue date: | 08/31/2023 |
| From: | Ladonna Suggs Division Reactor Projects II |
| To: | Brown R Southern Nuclear Operating Co |
| References | |
| EA-23-080 IR 2023090 | |
| Download: ML23229A118 (1) | |
Text
SUBJECT:
JOSEPH M. FARLEY NUCLEAR PLANT - NRC INSPECTION REPORT 05000348/2023090 AND PRELIMINARY WHITE FINDING AND APPARENT VIOLATION
Dear Keith Brown:
The enclosed inspection report documents a finding with an associated apparent violation that the U.S. Nuclear Regulatory Commission (NRC) has preliminarily determined to be White with low-to-moderate safety significance. This involved a self-revealing apparent violation of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix B, Criterion XVI, associated with the failure to identify and correct a condition adverse to quality resulting in the inoperability of the 1B emergency diesel generator (EDG). We assessed the significance of the finding using the significance determination process (SDP) and readily available information. We are considering escalated enforcement for the apparent violation consistent with our Enforcement Policy, which can be found at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. Because we have not made a final determination, no notice of violation is being issued at this time. Please be aware that further NRC review may prompt us to modify the number and characterization of the apparent violation.
The NRCs significance determination process (SDP) is designed to encourage an open dialogue between your staff and the NRC; however, neither the dialogue nor the written information you provide should affect the timeliness of our final determination.
Before we make a final decision on this matter, we are providing you with an opportunity to (1)
attend a regulatory conference where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance, or (2) submit your position on the finding to the NRC in writing. If you request a regulatory conference, it should be held within 40 days of the receipt of this letter, and we encourage you to submit supporting documentation at least one week prior to the conference to make the conference more efficient and effective. The focus of the regulatory conference is to discuss the significance of the finding and not necessarily the root cause(s) or corrective action(s) associated with the finding. If a regulatory conference is held, it will be open for public observation. If you decide to submit only a written response, such submittal should be sent to the NRC within 40 days of your receipt of this letter.
August 31, 2023 If you choose to send a response, please include your perspective of the significance of the finding along with the related facts and assumptions used to reach your determination.
Additionally, your response should be clearly marked as a Response to an Apparent Violation; (EA-23-080) and should include for the apparent violation: (1) the reason for the apparent violation or, if contested, the basis for disputing the apparent violation; (2) the corrective steps that have been taken and the results achieved; (3) the corrective steps that will be taken; and (4) the date when full compliance will be achieved. Your response should be submitted under oath or affirmation and may reference or include previously docketed correspondence, if the correspondence adequately addresses the required response. Additionally, your response should be sent to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Center, Washington, DC 20555-0001 with a copy to Mr. Alan J. Blamey, U.S. Nuclear Regulatory Commission, Region II, within 40 days of the date of this letter. If an adequate response is not received within the time specified or an extension of time has not been granted by the NRC, the NRC will proceed with its enforcement decision or schedule a Regulatory Conference.
If you decline to request a regulatory conference or to submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisite and Limitation sections of Attachment 2 of NRC Inspection Manual Chapter 0609.
Please contact Mr. Alan J. Blamey at 404-997-4415, and in writing, within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision. The final resolution of this matter will be conveyed in separate correspondence.
For administrative purposes, this inspection report provides an update to the apparent violation documented in NRC inspection report 05000348/2023002, 05000364/2023002 (Agency Documents Access and Management System (ADAMS) ML23220A208) dated August 10, 2023.
This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.
Sincerely, LaDonna B. Suggs, Director Division of Reactor Projects Docket No. 05000348 License No. NPF-2
Enclosure:
IR 05000348/2023090 w/Attachment: UNIT 1 B-EDG LUBE OIL LEAK DETAILED RISK EVALUATION
Inspection Report
Docket Number:
05000348
License Number:
Report Number:
Enterprise Identifier:
I-2023-090-0009
Licensee:
Southern Nuclear Operating Company, Inc.
Facility:
Joseph M. Farley Nuclear Plant
Location:
Columbia, AL
Inspection Dates:
July 07, 2023, to August 3, 2023
Inspectors:
P. Meier, Senior Resident Inspector
S. Sandal, Senior Reactor Analyst
Approved By:
LaDonna B. Suggs, Director
Division of Reactor Projects
SUMMARY
The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees
performance by conducting an NRC inspection at Joseph M. Farley Nuclear Plant, in
accordance with the Reactor Oversight Process. The Reactor Oversight Process is the NRCs
program for overseeing the safe operation of commercial nuclear power reactors. Refer to
https://www.nrc.gov/reactors/operating/oversight.html for more information.
List of Findings and Violations
Emergency Diesel Generator Lube Oil Coupling Leak
Cornerstone
Significance
Cross-Cutting
Aspect
Report
Section
Mitigating
Systems
Preliminary White
Open
[H.13] -
Consistent
Process
A self-revealed apparent violation (AV) of 10 CFR Part 50, Appendix B, Criterion XVI,
Corrective Action, was identified for the licensees failure to identify nonconforming work
instructions for installation of an emergency diesel generator (EDG) lube oil coupling following
a Unit 1 B EDG coupling assembly failure in November 2022. Specifically, the licensee failed
to adhere to the troubleshooting standards when it did not evaluate available evidence
surrounding the coupling assembly failure. This resulted in another coupling assembly failure
and lube oil leak during a surveillance run on February 26, 2023, rendering the 1B EDG
Additional Tracking Items
None.
INSPECTION SCOPES
Inspections were conducted using the appropriate portions of the inspection procedures (IPs) in
effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with
their attached revision histories are located on the public website at http://www.nrc.gov/reading-
rm/doc-collections/insp-manual/inspection-procedure/index.html. Samples were declared
complete when the IP requirements most appropriate to the inspection activity were met
consistent with Inspection Manual Chapter (IMC) 2515, Light-Water Reactor Inspection
Program - Operations Phase. The inspectors reviewed selected procedures and records,
observed activities, and interviewed personnel to assess licensee performance and compliance
with Commission rules and regulations, license conditions, site procedures, and standards.
INSPECTION RESULTS
Emergency Diesel Generator Lube Oil Coupling Leak
Cornerstone
Significance
Cross-Cutting
Aspect
Report
Section
Mitigating
Systems
Preliminary White
Open
[H.13] -
Consistent
Process
A self-revealed apparent violation (AV) of 10 CFR Part 50, Appendix B, Criterion XVI,
Corrective Action, was identified for the licensees failure to identify nonconforming work
instructions for installation of an emergency diesel generator (EDG) lube oil coupling following
a Unit 1 B EDG coupling assembly failure in November 2022. Specifically, the licensee failed
to adhere to the troubleshooting standards when it did not evaluate available evidence
surrounding the coupling assembly failure. This resulted in another coupling assembly failure
and lube oil leak during a surveillance run on February 26, 2023, rendering the 1B EDG
Description: While Unit 1 was operating (Mode 1) on February 26, 2023, an oil leak of
approximately 22 to 50 gallons per minute (gpm) occurred on the 1B EDG oil circulating
pump discharge pipe coupling during a technical specification (TS) one hour surveillance run.
This rendered the 1B EDG inoperable based on the rate of the oil leak. The 1B EDG was
restored to an operable status on March 3, 2023, following repairs and a modification to
mitigate future failures.
A similar failure at the same location on the 1B EDG occurred while Unit 1 was shutdown
(Mode 5) on November 4, 2022, following a planned coupling replacement. The event was
less significant because the 1B EDG was not required to be operable in Mode 5 and the oil
leak was identified during a maintenance run before crediting the EDG for operability.
However, the approximate leak rate and failure mode were the same as the February 26,
2023, event.
The oil circulating pump discharge coupling is designed to absorb a certain amount of
vibration and accommodate some misalignment between the two adjoining pipes. However,
the vendor instructions provide limits on torquing, allowable misalignment, and minimum pipe
insertion depth. When the coupling is installed in accordance with the vendor instructions, the
coupling is rated for 200 psig with sufficient external restraints to account for end loads
developed by internal pressure. The coupling sees head pressure developed by the
circulating oil pump because it is located at the discharge side. The pump is normally running,
whether the EDG is on or off, to provide constant oil filtration and keep the engine internals
warm while the EDG is in the standby condition. When the EDG is off, the circulating oil is at
approximately 25 psig. When the EDG is running, the oil pressure increases to approximately
114 psig due to the engine driven main oil pump. When the EDG was at normal operating
speed and oil pressures, the vertical pipe run at the discharge of the coupling was pulled out
of the top in an upward angular direction, with the pipe assembly center of rotation located
downstream at a 90-degree elbow and threaded connection to a three-way valve. The
inspectors determined the failure was most likely caused by inadequate installation,
inadequate external restraints, or a combination of both combined with the increased oil
pressure during the 1B EDG run.
Due to the similar failure modes of both coupling assembly events, SNC had an opportunity
to prevent the occurrence in February 2023. The original work order (WO SNC1091597) that
replaced the coupling as part of the planned maintenance in November 2022 appeared to be
sufficient. However, during the November post maintenance test the coupling failed which
provided evidence of the couplings new failure mode. SNC had an opportunity to evaluate
the available evidence via their corrective action program (CAP) to identify the nonconforming
work order instructions that led to the coupling assembly failure. The CAP includes the use of
WOs, such as troubleshooting WOs, to evaluate available evidence and disposition
conditions adverse to quality. The following three paragraphs discuss the link between
Criterion XVI and the troubleshooting process.
The SNC Quality Assurance Topical Report (QATR) describes the methods and establishes
quality assurance program and administrative control requirements that meet 10 CFR 50,
Appendix B. Section 16, Corrective Action, of the QATR describes the methods to meet
Criterion XVI. It states in part, when complex issues arise where it cannot be readily
determined if a condition adverse to quality exists, SNC documents establish the
requirements for documentation and timely evaluation of the issue. This process starts when
a condition report (CR) is written. In accordance with the SNC CAP procedure that fulfills the
regulatory requirements of Criterion XVI (NMP-GM-002, version 16), a CR is defined in part,
as a document that is initiated to identify any condition potentially adverse to quality.
The SNC Quality Assurance Program as described in the QATR is also applied to certain
equipment and activities that are not safety related but support safe plant operations. These
activities include those pertaining to maintenance and the assessment and evaluation of
failed items while restoring to their intended condition, such as troubleshooting. As described
in the QATR, SNC commits to compliance with ASME NQA-1-1994. Subpart 2.18 of the
NQA-1-1994 requires that an assessment of failure cause and required maintenance shall
be consistent with the type of item failure and the importance of the item. It further requires
that for failures identified that could have serious effect on safety or operability, an
engineering evaluation shall be performed and documented to substantiate or revise the
failure assessment and corrective action planning.
SNC initiated CR 10920885 to identify the November 4, 2022, 1B EDG lube oil leak and
coupling assembly failure. The licensee closed the CR to WO SNC1399361 to implement
corrective actions in accordance with procedure NMP-GM-002-001, version 43.0, Corrective
Action Program Instructions. Therefore, the WO was a part of the CAP as defined in NMP-
GM-002-001. Based on the WO description and inspector interviews with Farley maintenance
and engineering personnel, the purpose of WO SNC1399361 was to provide instructions for
identifying the cause and correct the failed coupling assembly. The specific repair activities
required to address the failure were unknown thus requiring more evidence about what
happened and how it happened in accordance with NMP-MA-012-003, Maintenance
Standards and Guidelines, for troubleshooting. NMP-MA-012-003 refers to NMP-AD-002,
Conduct of Problem Solving and Troubleshooting, for more specific troubleshooting
performance standards. Due to the unknown repair activities needed to address the coupling
assembly issue related to a failure of a risk significant safety related EDG, at minimum, NMP-
AD-002 requires simple troubleshooting. The amount of troubleshooting rigor increases if the
immediate cause of the failure is not identified.
SNC did not implement the troubleshooting standards when completing WO SNC1399361.
Based on the completed WO record and interviews, maintenance personnel did not identify
an immediate cause of the coupling assembly failure before restoring 1B EDG to operable
status. The corrective actions to address the failure consisted of disassembling and
inspecting the coupling and the circulating oil pump discharge check valve for foreign
material. Maintenance personnel did not identify foreign material or issues with the operation
of the check valve or coupling. Even without a specific cause, the coupling and check valve
were replaced with new like-for-like replacements. The WO lacked any additional information
or documentation to support potential causes or mitigative actions. No engineering
evaluations were performed either. If an immediate cause cannot be identified, NMP-AD-002
requires operational decision-making per procedure NMP-OS-003, Operational Decision
Making Issue Evaluation Process, before restoring the equipment to operable status. One
purpose of the operational decision-making process is for evaluating decisions, such as
potential mitigative actions, affecting the reliability of safety related equipment like the 1B
EDG.
Following the February 26, 2023, 1B EDG coupling assembly failure, the licensee performed
a more rigorous evaluation in which they determined more specific instructions were required
to address the coupling assembly failure. The WO used to repair the failure (SNC1447993)
provided specific guidance for as-found data collection and documentation. Additional steps
required as-left data regarding the adequacy of the piping arrangement to ensure a correct
coupling piping insertion depth. Nothing conclusive was found regarding the immediate
cause. Therefore, the licensee implemented WO SNC1449078 to modify the external
restraints. This solution was developed to prevent the lube oil piping from pulling out of the
top of the coupling. The modification consisted of adding a welded restraint to the existing
rigid structure and replacing the original conduit clamps with u-bolts to increase the rigidity of
the lube oil piping.
If the preventative actions discussed above had been implemented following the November
2022 coupling assembly failure, it is reasonable to assume the February 2023 failure would
have been prevented or minimized to maintain the availability or operability of the 1B
EDG. The licensees causal analysis (CAR 3922914) completed on July 3, 2023, further
supports this conclusion. The analysis determined the 1B EDG coupling assembly failure was
directly caused by the loosening and re-tightening of the piping during the coupling
replacement which resulted in some loss of pipe thread engagement. This reduced the pipe
assembly rigidity such that the end loads created from the upward motion of the lube oil flow
and pressure created a moment arm that rotated the pipe assembly such that the upper
vertical run of pipe dislodged from the coupling. The analysis also determined that additional
restraints would have prevented the failure.
Corrective Actions: Following the February 2023 event, the licensee added additional external
restraints to the 1B EDG circulation pump lube oil pipe before restoring it back to an operable
status. An extent of condition was performed on all the other EDGs. The concern identified in
this report only applied to the 1-2A and 2B EDG as they have the same coupling in the same
configuration as the 1B EDG. The licensee evaluated the 1-2A and 2B EDGs coupling for
adequate installation and monitored for movement during runs. In May 2023, the vulnerability
of the coupling failure was eliminated on the 1-2A and 2B EDG following a modification that
replaced the coupling with hard pipe. The same modification for the 1B EDG is planned for
July 2025.
Corrective Action References:
CR 10951589: Identified the 1B EDG leak in February 2023
WO SNC1449078: Implementation of modification to the 1B EDG external supports
TE 1123337: Extent of condition evaluation
WO SNC1462848 & SNC1462849: Implementation of the modification to eliminate the
coupling on the 1-2A and 2B EDGs
CAR 392214: 1B EDG lube oil leak Equipment Reliability Checklist (causal evaluation)
Performance Assessment:
Performance Deficiency: The failure to adhere to the troubleshooting standards as required
by procedure NMP-MA-012-003, version 7.1, Maintenance Standards and Guidelines, and
NMP-AD-002, version 13.8, Conduct of Problem Solving and Troubleshooting following a
substantial 1B EDG lube oil leak on November 4, 2022, was a performance deficiency. As a
result, the licensee failed to identify the nonconforming work order instructions used to
address the November 2022 coupling assembly failure which resulted in another failure that
rendered the 1B EDG inoperable on February 26, 2023.
Screening: The inspectors determined the performance deficiency was more than minor
because it was associated with the Equipment Performance attribute of the Mitigating
Systems cornerstone and adversely affected the cornerstone objective to ensure the
availability, reliability, and capability of systems that respond to initiating events to prevent
undesirable consequences. Specifically, the condition affected the reliability of the 1B EDG to
perform its design basis function.
Significance: The inspectors assessed the significance of the finding using IMC 0609
Appendix AProperty "Inspection Manual Chapter" (as page type) with input value "NRC Inspection Manual 0609</br></br>Appendix A" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., The Significance Determination Process (SDP) for Findings At-Power. The
affected cornerstone was Mitigating Systems, as determined by IMC 0609, Attachment 4,
Initial Characterization of Findings. The inspectors screened the performance deficiency
using Exhibit 2 of Appendix A and determined a detailed risk evaluation was required
because the degraded condition represented a loss of the PRA function of one train of a
multi-train TS system for greater than its TS allowed outage time.
A Region II Senior Reactor Analyst performed a detailed risk evaluation. The finding was
preliminarily determined to be of low to moderate safety significance (White). The preliminary
risk estimate was obtained by performing a conditional analysis of the B-train emergency
diesel generator (EDG) using a 115-day exposure period. The dominant Standardized Plant
Analysis Risk (SPAR) model sequences were associated with Loss of Offsite Power (LOOP)
initiators accompanied by common mode failure of the emergency diesel generators and
random early failure of the Turbine Driven Auxiliary Feedwater (TDAFW) pump in
combination with the inability to recover offsite and onsite electrical power sources. See
Attachment, UNIT 1 B-EDG LUBE OIL LEAK DETAILED RISK EVALUATION, for a
summary of the preliminary risk determination analysis.
Cross-Cutting Aspect: H.13 - Consistent Process: Individuals use a consistent, systematic
approach to make decisions. Risk insights are incorporated as appropriate. The licensee
made assumptions about the acceptability of the coupling repair in November 2022 without
formally evaluating the available evidence. In addition, in making the decision to restore the
1B EDG to operable status following the November 2022 repairs, the licensee failed to
consider the risk significance of a potential similar failure while in Mode 1. (DM.1)
Enforcement:
Violation: 10 CFR 50 Appendix B Criterion XVI Corrective Action, states, in part, measures
shall be established to assure that conditions adverse to quality, such as nonconformances
are promptly identified and corrected.
Technical Specification (TS) Limiting condition for operations (LCO) 3.0.1 requires, in part,
that LCOs shall be met during the modes of Applicability. TS LCO 3.8.1, AC Sources,
requires, in part, two operable diesel generator sets capable of supplying the onsite Class 1E
distribution systems while in Modes 1, 2, 3, or 4.
Contrary to the above, on November 4, 2022, the licensee failed to identify and correct a
condition adverse to quality associated with nonconforming work instructions for the
installation of a lube oil coupling assembly for the Unit 1B emergency diesel generator (EDG)
following a coupling assembly failure and substantial lube oil leak. In addition, from
December 7, 2022, to March 3, 2023, while the plant was in the modes of Applicability, the 1B
EDG was inoperable. Specifically, the licensee did not adequately disposition the failure via
troubleshooting WO SNC1399361 used to implement corrective actions in accordance with
procedure NMP-GM-002-001, Corrective Action Program Instructions, version 43.0. The
disposition was inadequate because the licensee failed to adhere to its troubleshooting
standards and did not evaluate available evidence surrounding the coupling assembly failure
after the immediate cause of the failure could not be identified during implementation of WO
SNC1399361. As a result, following the failure on November 4, 2022, repairs to the EDG
were limited to replacement of the coupling assembly in accordance with the existing
nonconforming work instructions. This resulted in the inoperability of the EDG due to a similar
failure on February 26, 2023, during a surveillance run. With the 1B EDG inoperable, the
licensee failed to meet the LCO in accordance with TS 3.0.1 and 3.8.1 between December 7,
2022, and March 3, 2023.
Enforcement Action: This violation is being treated as an apparent violation pending a final
significance (enforcement) determination.
EXIT MEETINGS AND DEBRIEFS
The inspectors verified no proprietary information was retained or documented in this report.
On August 29, 2023, the inspectors presented the NRC inspection results to Dan
Williams, Site Regulatory Affairs Manager, and other members of the licensee staff.
ATTACHMENT: UNIT 1 B-EDG LUBE OIL LEAK DETAILED RISK EVALUATION
SUMMARY
The Farley Unit 1 B-train emergency diesel generator (EDG) was rendered inoperable due to a
large lube oil leak on February 26, 2023, during a routine surveillance test. The leak was the
result of the licensees failure to implement maintenance procedures to address issues with the
reassembly of the failed lube oil coupling that occurred during maintenance activities in
November 2022. A risk evaluation using a 115-day exposure period estimated an increase in
risk, delta-Core Damage Frequency (delta-CDF), of 5.25E-06/year (preliminarily consistent with
a White finding).
BACKGROUND
On February 26, 2023, a large oil leak occurred on the Unit 1 B-train emergency diesel
generator (EDG) oil circulating pump discharge pipe Flexmaster coupling during a routine
surveillance test which rendered the 1B EDG inoperable. With an 845-gallon sump capacity, the
estimated run time of the EDG without operator intervention varied between 10 and 35 minutes.
A similar failure at the same location on the 1B EDG occurred on November 4, 2022, following a
planned coupling replacement. The event was less significant because the 1B EDG was not
required to be operable at the time of the failure and the oil leak was identified during a
maintenance run before crediting the EDG for operability. However, the approximate leak rate
and failure mode were the same as the February 26, 2023, event.
The Flexmaster coupling is designed to absorb a certain amount of vibration and accommodate
some misalignment between the two adjoining pipes. The vendor instructions provide limits on
torquing, allowable misalignment, and minimum pipe insertion depth. When the coupling is
installed in accordance with the vendor instructions, the coupling is rated for 200 psig with
external restraints to account for end loads developed by internal pressure. The coupling sees
pressure developed by the circulating oil pump because it is located on the pump discharge
piping. The pump is normally running, whether the EDG is on or off, to provide constant oil
filtration and keep the diesel engine internals warm while the EDG is in the standby condition.
When the EDG is off, the circulating oil is at approximately 30 psig. When the EDG is running,
the oil pressure increases to approximately 100 psig due to the engine driven main oil pump.
When the EDG was at normal operating speed and oil pressures on November 4, 2022, and
February 26, 2023, the vertical pipe run at the discharge of the coupling was pulled from the top
of the coupling in an upward angular direction, causing the lube oil leak.
Between the maintenance activities in November 2022 and the February 2023 failure, the 1B
EDG had been operated one time for a successful routine surveillance test on January 3, 2023.
Following the February 26, 2023, failure the licensee completed repairs to the lube oil coupling
and returned the 1B EDG to available status on March 2, 2023.
PERFORMANCE DEFICIENCY
The failure to adhere to the troubleshooting standards as required by procedure NMP-
MA012003, version 7.1, Maintenance Standards and Guidelines, and NMP-AD002, version
13.8, Conduct of Problem Solving and Troubleshooting following a substantial Unit 1 B
emergency diesel generator (1B EDG) lube oil leak due to a coupling assembly failure on
November 4, 2022, was a performance deficiency (PD). As a result, an additional coupling
assembly failure rendered the 1B EDG inoperable on February 26, 2023.
EXPOSURE TIME
The exposure period being considered by the risk evaluation will begin at the completion of the
24-hour surveillance test 11/07/2022 following replacement of the coupling and end following
completion of repairs to the 1B EDG on 03/02/2023 (approximately 115 days or T plus 4 days
of repair time). The full exposure time is being considered because the affected coupling sees
considerably higher pressures only when the EDG is operating, and lube oil pressure is being
established by the engine driven pump. Based on this, system degradation is not likely to occur
while the EDG is in a standby keep-warm mode of operation.
SAFETY IMPACT
The failed lube oil fitting for the Unit 1 B-train EDG resulted in the EDGs inability to continue to
run and supply power to the B-train ESF bus in response to a loss of the normal offsite power
supply. Once the leak initiates, the lube oil sump level would continue to decrease without
operator detection and intervention and result in the essential low oil pressure engine trip (low
lube oil pressure alarm and switch setpoints reached).
RISK ANALYSIS/CONSIDERATIONS
1.
A 115-day condition exposure period was used for the analysis.
2.
FLEX mitigating strategies and equipment were credited in the analysis using a 24-hour
Probabilistic Risk Assessment (PRA) mission time. FLEX equipment reliability was modeled
using information contained in PWROG-18042-NP, Revision 1, FLEX Equipment Data
Collection and Analysis, (ADAMS ML22123A259). A sensitivity case with no FLEX credit
was also performed.
3.
The Farley Standardized Plant Analysis Risk (SPAR) model does not include Fire or Internal
Flooding sequences so the licensees PRA model will be used as best available information
for the risk of those initiators.
4.
The best estimate result does not include credit for repair of the 1B EDG. In general, no
recovery or repair action should be credited where any of the considerations in Risk
Assessment Standardization Project (RASP) Manual Section 6.8 are not met (e.g., there is
not sufficient time, there are no cues that there is a problem, there are not sufficient
resources, and there is no procedure or training). There would be no alarm indicating a
problem until sufficient lube oil inventory had been lost resulting in a low-pressure alarm and
subsequent trip of the EDG (approximately 5 psig difference between alarm and trip
setpoints). In addition, there were no procedures or training of operators that addressed the
necessary repair actions. There was also some uncertainty regarding whether there would
be sufficient time for the repair actions to be completed. A sensitivity case was performed to
determine how sensitive the analysis results were with respect to repair credit.
Systems Analysis Program for Hands-On Integrated Reliability Evaluations (SAPHIRE) software
version 8.2.8 and Farley SPAR model version 8.81 were used for the evaluation.
1.
The SPAR model was modified to allow the ability to evaluate the sensitivity of the model
with respect to application of repair credit. The 1B EDG fault tree logic was modified by
adding a basic event for repair of the 1B EDG following a lube oil leak. The basic event was
only used for the sensitivity case.
The model was also modified to further evaluate the run history of the 1B EDG and to
account for run time occurring between the completion of the 24-hour surveillance test on
11/07/2022 and the failure that occurred on 02/26/2023. This approach is discussed in
Volume 1, Section 2.5 of the RASP manual. Two separate time intervals were identified.
Interval 1: This time interval had an exposure period of 57 days which began at the
completion of the November 24-hour surveillance (11/07/2022) and ended at the completion
of the January routine slow start surveillance test (01/03/2023). The January surveillance
test included approximately two hours of run time without a failure being observed. The fault
tree logic was modified to separate the fail-to-run (FTR) basic event into two separate
events to allow estimation of the risk where failure occurs after two hours of operation
(beginning after one hour of operation modeled by the load-run basic event).
Time Interval 1 also included event tree (ET) post-processing rules to look for B EDG FTR
basic event in the cutsets and substitute the appropriate recovery terms based on time of
EDG operation before failure (1 through 4-hour recoveries were considered).
The SAPHIRE Convolution Event Mapping tool was also used to generate the convolution
event mapping using the new FTR basic event.
Interval 2: The second time interval had an exposure period of 54 days which began at the
completion of the January slow start surveillance test (01/03/2023) and ended at the point of
failure that occurred approximately one hour into the February slow start surveillance test
(02/26/2023). Because the failure was observed following successful completion of the 1-
hour load-run basic event window and at the start of the fail-to-run event window, this time
interval was modeled as a fail-to-run conditional failure (without using the modifications
discussed for Interval 1). In accordance with the guidance in Section 2.5 of the RASP
manual four days of repair time was added to this interval for a total exposure period of 58
days.
2.
Basic events were adjusted in the base SPAR model to: (1) enable FLEX sequences, (2)
account for best estimate reliability of FLEX equipment using industry failure data at a 24-
hour mission time, and (3) remove credit for use of back-up FLEX diesel generators (N+1)
given failure of the first FLEX generator (N). Based on the unavailability of industry reliability
data for load-run basic events, the model was adjusted to ignore those failures. A sensitivity
case was performed giving no credit for FLEX mitigation of the performance deficiency.
These adjusted values were used for both the nominal and conditional case as the
performance deficiency did not impact FLEX strategies.
3.
The following SPAR model event sequences were used in evaluating the nominal and
conditional cases:
INTERNAL EVENTS
SEISMIC
HURRICANE
TORNADO
4.
The run history of the EDG was used to determine the binning of accumulated run time for
the 24-hour PRA mission time (condition inception time assumed unknown for the
sensitivity).
Interval 1: Change set EDG_1BEXT_FTR was used to perform an ECA condition
assessment with the following changes and a 57-day condition exposure period:
Basic Event
Nominal Value
Conditional Value
EPS-DGN-FR-DG1B
2.678E-02
TRUE
EPS-DGN-FR-DG1BEXT
2.563E-02
1.0
EPS-DGN-FR-DG1B was set to TRUE to allow common cause failure probabilities to be
calculated by SAPHIRE correctly and EPS-DGN-FR-DG1BEXT was set to 1.0 to allow ET
post-processing substitutions for power recovery to be accounted for correctly.
Interval 2: Change set EDG_1B_FTR was used to perform an ECA condition assessment
with the following changes and an exposure period of 58-days (including repair).
Basic Event
Nominal Value
Conditional Value
EPS-DGN-FR-DG1B
2.678E-02
TRUE
CALCULATIONS
Best Estimate:
The base model was adjusted to enable FLEX mitigating sequences using a 24-hour mission
time, disable success of N+1 diesel generators, and adjust equipment reliability to PWROG
failure data. Change set EDG_1BEXT_FTR was used to perform an ECA condition assessment
using a 57-day exposure time for Interval 1. Change set EDG_1B_FTR was used to perform an
ECA condition assessment for the remaining 58-days of the exposure period (Interval 2) and the
results were summed for each sequence being evaluated.
Interval
Internal
Seismic
Hurricane
Wind
Tornado
Int. Flood
Fire
Total
6.05E-07
3.52E-09
1.98E-08
2.14E-08
1.51E-09
-
-
6.35E-07
3.58E-09
2.02E-08
2.22E-08
1.54E-09
-
-
Total
1.24E-06
7.10E-09
4.00E-08
4.36E-08
3.05E-09
1.60E-08*
3.90E-06*
5.25E-06
- The NRC SPAR model does not include internal flood or fire sequences, so information
obtained from the licensee using their PRA model was considered best available information for
the analysis. The values for internal flooding and fire do not include any recovery credit for
equipment impacted by the performance deficiency.
Dominant SPAR model cutsets were associated with LOOP initiators accompanied by common
mode failure of the emergency diesel generators and random early failure of the Turbine Driven
Auxiliary Feedwater (TDAFW) pump in combination with the inability to recover offsite and
onsite electrical power sources.
Sensitivity 1 (Condition Exposure Period):
Case A:
To evaluate the sensitivity of the analysis results with respect to the application of the full
exposure period (including repair) of 115 days (T) without use of time intervals discussed in
Section 2.5 of the RASP manual, the risk was estimated using the normal 1B EDG FTR basic
event (EPS-DGN-FR-DG1B).
ECA condition assessments utilizing a 115-day exposure period were performed with
conditional change sets EDG_1B_FTR.
Internal
Seismic
Hurrican
e
Wind
Tornado
Int.
Flood
Fire
Total
1.26E-
7.10E-
4.00E-08
4.41E-
3.05E-
1.60E-
08*
3.90E-
06*
5.27E-
The sensitivity confirmed that the low amount of EDG run time between the start of the
exposure period and the failure resulted in very little change in analysis results when modeling
as a fail-to-run without using the time interval method described in the RASP manual. Because
the results were relatively unchanged, the remaining sensitivities were performed without using
the time interval approach.
Case B:
Additionally, to account for the potential for a demand-based degradation on the reliability of the
failed lube oil coupling, a reduced exposure period of 58 days (including 4 days of repair) was
also evaluated. This exposure period would begin following completion of the last successful
surveillance test of the 1B EDG on 01/03/2023 and end at completion of repairs to the EDG on
03/02/2023. This sensitivity was performed to determine if assumptions regarding the number of
lube oil system pressure spikes (i.e., the number of 1B EDG start demands) were influential in
analysis outcomes. In addition, reducing the exposure period to 58-days also approximates a
T/2 approach to the assumed condition exposure period.
Internal
Seismic
Hurrican
e
Wind
Tornado
Int.
Flood
Fire
Total
6.35E-
3.58E-
2.02E-08
2.22E-
1.54E-
8.07E-
09*
1.97E-
06*
2.66E-
- The NRC SPAR model does not include internal flood or fire sequences, so information
obtained from the licensee using their PRA model was considered best available information for
the analysis. The values for internal flooding and fire do not include any recovery credit for
equipment impacted by the performance deficiency.
The reduced exposure period of 58-days did not alter overall conclusions of the analysis.
Because the forces acting on the failed coupling were significantly higher with the EDG in
operation than a standby condition, the analyst concluded that treating the condition as a run-
time failure with a full exposure period of 115 days was most appropriate to the circumstances.
Dominant cutsets were associated with LOOP initiators accompanied by common mode failure
of the emergency diesel generators and random failure of the TDAFW pump in combination with
the inability to recover offsite and onsite electrical power sources.
Sensitivity 2: (No FLEX Credit):
To evaluate the sensitivity of analysis results with respect to crediting of FLEX mitigation
strategies, the basic event for operator failure to enter extended loss of AC power procedures
was set to 1.0 for both the nominal and conditional cases.
FLX-XHE-XE-ELAP = 1.0
ECA condition assessments utilizing a 115-day exposure period were performed with
conditional change set EDG_1B_FTR.
Internal
Seismic
Hurrican
e
Wind
Tornado
Int.
Flood
Fire
Total
5.46E-
1.06E-
2.09E-07
1.95E-
1.98E-
6.93E-
08*
1.69E-
05*
2.29E-
- The NRC SPAR model does not include internal flood or fire sequences, so information
obtained from the licensee using their PRA model was considered best available information for
the analysis. The values were roughly estimated by using the ratio of internal flooding and fire
sequences respective to the contribution by internal events and applying those ratios to the
SPAR model results for internal events with no FLEX credit. A ratio of 1.27E-02 was used for
internal flooding and a ratio of 3.10 was used for fire sequences. The values for internal flooding
and fire do not include any recovery credit for equipment impacted by the performance
deficiency.
Dominant SPAR model cutsets were associated with LOOP initiators accompanied by common
mode failure of the emergency diesel generators and failure to control TDAFW pump locally
under blackout conditions in combination with the inability to recover offsite and onsite electrical
power sources.
Although the sensitivity results were greater than E-06 and had the potential to alter overall
conclusions of the analysis, incorporation of FLEX strategies for mitigation of station blackout
(SBO) accident sequences was determined to be reasonable and most appropriate to the
circumstances of the evaluation.
Sensitivity 3: (Repair):
To evaluate the sensitivity of analysis results with respect to operator actions for repair from a
lube oil leak, the basic event for operator failure to recover from the leak (EPS-XHE-XL-LEAK)
was set to 0.1 for both the nominal and conditional cases. This value was chosen as a
screening value only to explore the sensitivity of the results with respect to repair credit.
EPS-XHE-XL-LEAK = 1.0E-01
ECA condition assessments utilizing a 115-day exposure period were performed with
conditional change set EDG_1B_FTR.
Internal
Seismic
Hurrican
e
Wind
Tornado
Int.
Flood
Fire
Total
9.90E-
5.86E-
3.38E-08
3.42E-
2.65E-
9.00E-
09*
1.20E-
06*
2.28E-
- The NRC SPAR model does not include internal flood or fire sequences, so information
obtained from the licensee using their PRA model was considered best available information for
the analysis. The values for internal flooding and fire included licensee-assigned recovery credit
for equipment impacted by the performance deficiency and initiating event sequence. Those
recovery credits ranged in value from E-04 to E-01 depending on the event sequence.
Dominant cutsets were associated with LOOP initiators accompanied by common mode failure
of the emergency diesel generators and random failure of the TDAFW pump in combination with
the inability to recover offsite and onsite electrical power sources.
Although the analysis results demonstrated some sensitivity with respect to the assignment of
repair credit, the overall conclusions regarding the risk remained in the E-06 range.
Other Evaluations:
The licensee completed an evaluation using the Farley PRA model to estimate the risk increase
due to the failure of the 1B EDG. The licensees evaluation indicated that fire-induced LOOP
sequences resulting in a station blackout and accompanied by failures of the reactor coolant
pump seals and turbine driven auxiliary feedwater pump were among the dominant contributors
to the overall risk estimate. The quantified results were generally comparable to the SPAR
model results indicating the estimated risk was in the E-06 range for similar condition exposure
periods and treatment of repair credit.
The licensee also completed a technical evaluation of the lube oil coupling failure. The
evaluation noted that the forces associated with starting the EDG may possibly introduce a
demand-based contributor to the coupling failure mechanism (meaning that enough starts may
have to occur before running engine forces would be sufficient to result in the failure). Ultimately
the evaluation determined that the failure was most likely to occur with the EDG in operation as
opposed to standby due to the large difference in system pressure and that a definitive
conclusion regarding time to failure could not be determined based on either cycles or running
time.
DELTA CDF FOR EXPOSURE TIME
The overall results are summarized below:
EVENT SEQUENCE
Best
Estimate
delta-CDP
Sensitivity #1
- T/2 Exposure
delta-CDP
Sensitivity #2
- No FLEX
delta-CDP
Sensitivity #3
- Repair
delta-CDP
INTERNAL EVENTS
1.24E-06
6.35E-07
5.46E-06
9.90E-07
SEISMIC
7.10E-09
3.58E-09
1.06E-08
5.86E-09
HURRICANE
4.00E-08
2.02E-08
2.09E-07
3.38E-08
4.36E-08
2.22E-08
1.95E-07
3.42E-08
TORNADO
3.05E-09
1.54E-09
1.98E-08
2.65E-09
INTERNAL FLOODING*
1.60E-08
8.07E-09
6.93E-08**
9.00E-09***
FIRE*
3.90E-06
1.97E-06
1.69E-05**
1.20E-06***
TOTAL
5.25E-06
2.66E-06
2.29E-05
2.28E-06
- The NRC SPAR model does not include internal flood or fire sequences, so information
obtained from the licensee using their PRA model was considered best available information for
the analysis.
- The values were roughly approximated by using the best estimate ratio of internal flooding and
fire sequences respective to the contribution by internal events and applying those ratios to the
SPAR model results for internal events with no FLEX credit. A ratio of 1.27E-02 was used for
internal flooding and a ratio of 3.10 was used for fire sequences.
- The values for internal flooding and fire included licensee-assigned recovery credit (where
applicable) for equipment impacted by the performance deficiency and initiating event
sequence.
Considering that the ECA module of SAPHIRE calculates the difference in core damage
probability over a given exposure time, and that changes in CDF over the same period are
numerically equivalent, the change in CDF due to the finding would be on the order of 5.25E-
06/year.
EXTERNAL EVENTS CONSIDERATIONS
Internal event estimates were greater than 1E-07, therefore external events were also included
in the risk evaluation. Fire and Internal Events sequences were dominant contributors to the
overall risk estimate.
LARGE EARLY RELEASE FREQUENCY IMPACT
The finding was evaluated in accordance with Inspection Manual Chapter (IMC) 0609, Appendix
HProperty "Inspection Manual Chapter" (as page type) with input value "NRC Inspection Manual 0609, Appendix</br></br>H" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., Containment Integrity Significance Determination Process, as a Type A finding. Although the
estimated change in core damage frequency (delta-CDF) was greater than 1E-07/year, the
dominant accident sequences did not involve steam generator tube rupture or interfacing
system LOCAs. Therefore, the issue associated with the lube oil leak on the B-train EDG would
not be expected to be a significant contributor to an increase in large early release frequency
(delta-LERF) risk. Delta-CDF was determined to be the risk metric of interest for this evaluation.
CONCLUSIONS/RECOMMENDATIONS
The estimated risk increase (delta-CDF) over the nominal case for the inoperability of the B-train
EDG was 5.25E-06/year, which was consistent with a preliminary finding of low to moderate
(White) significance.