IR 05000395/2023090
| ML23268A467 | |
| Person / Time | |
|---|---|
| Site: | Summer  |
| Issue date: | 10/04/2023 |
| From: | Ladonna Suggs Division Reactor Projects II |
| To: | Carr E Dominion Energy |
| References | |
| EA-23-093, EPID I-2023-090-0008 IR 2023090 | |
| Download: ML23268A467 (18) | |
Text
SUBJECT:
VIRGIL C. SUMMER NUCLEAR STATION - NRC INSPECTION REPORT 05000395/2023090 AND PRELIMINARY YELLOW FINDING AND APPARENT VIOLATION
Dear Eric S. Carr:
The enclosed inspection report documents a finding with an associated apparent violation that the U.S. Nuclear Regulatory Commission (NRC) has preliminarily determined to be Yellow with substantial safety significance. This involved a self-revealed apparent violation of Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix B, Criterion XVI, Corrective Action, which was identified for the licensee failing to correct a condition adverse to quality resulting in the inoperability of the A emergency diesel generator (EDG). We assessed the significance of the finding using the significance determination process (SDP) and the best available information at the time of the significance and enforcement review panel on September 13, 2023. We are considering escalated enforcement for the apparent violation consistent with our Enforcement Policy, which can be found at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. Because we have not made a final determination, no notice of violation is being issued at this time. Please be aware that further NRC review may prompt us to modify the number and characterization of the apparent violation.
The NRCs significance determination process is designed to encourage an open dialogue between your staff and the NRC; however, neither the dialogue nor the written information you provide should affect the timeliness of our final determination.
Before we make a final decision on this matter, we are providing you with an opportunity to (1)
attend a regulatory conference where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance, or (2) submit your position on the finding to the NRC in writing. If you request a regulatory conference, it should be held within 40 days of the receipt of this letter, and we encourage you to submit supporting documentation at least one week prior to the conference to make the conference more efficient and effective. The focus of the regulatory conference is to discuss the significance of the finding and not necessarily the root cause(s) or corrective action(s) associated with the finding. If a regulatory conference is held, it will be open for public observation. If you decide to submit only a written response, such submittal should be sent to the NRC within 40 days of your receipt of this letter.
October 4, 2023 If you choose to send a response, please include your perspective of the significance of the finding along with the related facts and assumptions used to reach your determination.
Additionally, your response should be clearly marked as a Response to an Apparent Violation; (EA-23-093) and should include for the apparent violation: (1) the reason for the apparent violation; (2) the corrective steps that have been taken and the results achieved; (3) the corrective steps that will be taken; and (4) the date when full compliance will be achieved. Your response should be submitted under oath or affirmation and may reference or include previously docketed correspondence, if the correspondence adequately addresses the required response.
Additionally, your response should be sent to the U.S. Nuclear Regulatory Commission, ATTN:
Document Control Center, Washington, DC 20555-0001 with a copy to Mr. David E.
Dumbacher, U.S. Nuclear Regulatory Commission, Region II, within 40 days of the date of this letter. If an adequate response is not received within the time specified or an extension of time has not been granted by the NRC, the NRC will proceed with its enforcement decision or schedule a regulatory conference.
If you decline to request a regulatory conference or to submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisite and Limitation sections of Attachment 2 of NRC Inspection Manual Chapter 0609.
Please contact Mr. David E. Dumbacher at 404-997-4628, and in writing, within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision.
The final resolution of this matter will be conveyed in separate correspondence.
For administrative purposes, this inspection report provides an update to the apparent violation documented in NRC inspection report 05000395/2023002 (Agency Documents Access and Management System (ADAMS) ML23223A006) dated August 14, 2023.
This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with 10 CFR 2.390, Public Inspections, Exemptions, Requests for Withholding.
Sincerely, LaDonna B. Suggs, Acting Director Division Of Reactor Projects Docket No. 05000395 License No. NPF-12
Enclosure:
IR 05000395/2023090 w/Attachment: A-EDG Fuel Oil Leak Detailed Risk Evaluation
Inspection Report
Docket Number:
05000395
License Number:
Report Number:
Enterprise Identifier:
I-2023-090-0008
Licensee:
Dominion Energy
Facility:
Virgil. C. Summer Nuclear Station
Location:
Jenkinsville, SC
Inspection Dates:
August 10, 2023 to September 13, 2023
Inspectors:
N. Childs, Senior Project Engineer
M. Read, Senior Resident Inspector
S. Sandal, Senior Reactor Analyst
Approved By:
LaDonna B. Suggs, Director
Division of Reactor Projects
SUMMARY
The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees
performance by conducting an NRC inspection at Virgil. C. Summer, in accordance with the
Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for
overseeing the safe operation of commercial nuclear power reactors. Refer to
https://www.nrc.gov/reactors/operating/oversight.html for more information.
List of Findings and Violations
Failure to Identify and Correct a Condition Adverse to Quality Associated with the EDG Fuel
Oil System
Cornerstone
Significance
Cross-Cutting
Aspect
Report
Section
Mitigating
Systems
Preliminary Yellow
Open
None (NPP)
A self-revealed finding that has preliminarily been determined to be Yellow (substantial safety
significance) and associated apparent violation (AV) of Title 10 of the Code of Federal
Regulations (10 CFR) Part 50, Appendix B, Criterion XVI, Corrective Action, was identified
when the licensee failed to identify and correct a condition adverse to quality (CAQ) for the
EDG fuel oil system that left the system vulnerable to piping cracks and eventually resulted in
the failure of the A EDG during testing on November 2, 2022. Specifically, inspectors
determined that, based on the failure history of the EDGs and the licensees documented
conclusions that attributed pipe cracks to prior maintenance events, the licensee had sufficient
information to identify the existence of a condition adverse to quality related to the design of
the EDG fuel oil system. This condition caused threaded fuel oil piping connections to be
vulnerable to maintenance activities that over torqued, strained, or impacted the piping.
Despite the challenge to maintain leak-tight connections and repeat occurrences of cracked
piping, no significant changes were made to maintenance practices, procedures or system
design, and the licensee continued to reactively monitor for leakage even after vulnerabilities
were identified.
Additional Tracking Items
None.
INSPECTION SCOPES
Inspections were conducted using the appropriate portions of the inspection procedures (IPs) in
effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with
their attached revision histories are located on the public website at http://www.nrc.gov/reading-
rm/doc-collections/insp-manual/inspection-procedure/index.html. Samples were declared
complete when the IP requirements most appropriate to the inspection activity were met
consistent with Inspection Manual Chapter (IMC) 2515, Light-Water Reactor Inspection
Program - Operations Phase. The inspectors reviewed selected procedures and records,
observed activities, and interviewed personnel to assess licensee performance and compliance
with Commission rules and regulations, license conditions, site procedures, and standards.
INSPECTION RESULTS
Failure to Identify and Correct a Condition Adverse to Quality Associated with the EDG Fuel
Oil System
Cornerstone
Significance
Cross-Cutting
Aspect
Report
Section
Mitigating
Systems
Preliminary Yellow
Open
None (NPP)
A self-revealed finding that has preliminarily been determined to be Yellow (substantial safety
significance) and associated AV of Title 10 of the Code of Federal Regulations (10 CFR) Part
50, Appendix B, Criterion XVI, Corrective Action, was identified when the licensee failed to
identify and correct a CAQ for the EDG fuel oil system that left the system vulnerable to
piping cracks and eventually resulted in the failure of the A EDG during testing on November
2, 2022. Specifically, inspectors determined that, based on the failure history of the EDGs
and the licensees documented conclusions that attributed pipe cracks to prior maintenance
events, the licensee had sufficient information to identify the existence of a condition adverse
to quality related to the design of the EDG fuel oil system. This condition caused threaded
fuel oil piping connections to be vulnerable to maintenance activities that over torqued,
strained, or impacted the piping. Despite the challenge to maintain leak-tight connections and
repeat occurrences of cracked piping, no significant changes were made to maintenance
practices, procedures or system design, and the licensee continued to reactively monitor for
leakage even after vulnerabilities were identified.
Description: On November 2, 2022, during the performance of a 24-hour surveillance test,
operations identified a small leak on the 3/4 fuel piping header supplying the A EDG right
bank cylinders fuel injectors. The leakage was monitored and observed to increase over
several hours until operations stopped the surveillance test, secured the engine, and
prepared the EDG for repairs. During troubleshooting and repairs, the licensee identified that
a crack between the threads of the male end of the pipe had propagated 140-degrees around
the circumference of the pipe. The location of the crack was in a section of piping that
experienced vibrations during operation. The original design of the fuel oil delivery piping
included threaded connections for ease of maintenance. An engineering assessment
determined that the EDG was unlikely to have been able to perform its 24-hour mission time.
Inspectors reviewed historical condition reports (CRs) and maintenance records and noted
that the A and B EDGs have experienced fuel oil piping cracking near the left and right fuel
header connections where vibrations are present. Inspectors noted that, on March 2, 2020,
during repairs to correct minor fuel oil leakage under WO1909952 step 2, the licensee
identified a crack on the A EDG 1 x 1/2 reducer bushing on the left bank header. A CR was
not generated to document the cracked bushing. During the retest on March 5, 2020, fuel oil
leakage was identified, and the licensee initiated CR 20-00712 as a non-condition adverse to
quality (NCAQ) to document the leakage. After subsequent repairs on March 6, 2020, during
the maintenance retest, the licensee identified a leak and a crack on the newly installed pipe
nipple that was attached to a new bushing installed on March 5, 2020, which was
documented in CR-20-00735 as an NCAQ. The nipple was replaced, and no further
evaluation was performed.
Licensee procedure SAP-0999, Corrective Action Program, Revision 19, step 1.2.3 required
the determination of CR category and evaluation type using examples and guidance in
Enclosures A and J. Although maintenance rework items were identified as NCAQs and did
not require evaluations, the identification of cracked bushing and fittings should have been
identified as a CAQ because both components were found degraded in a condition that had
the potential to inhibit a safety-related structure, system, and component from satisfactory
performance of a safety-related function. This may have driven an evaluation of previous
conditions, cause of the issue, and extent of condition, but guidance in Enclosure A to
determine the level of evaluation would have been subjective based on the perceived
consequence. Since the component cracked, it should have received at least a D-OTH
evaluation which would have identified the most probable cause of the cracks. Since the
failure was treated as a broke/fix, even though the components were cracked prior to the
maintenance window, the licensee missed an opportunity to identify if a CAQ existed.
Additionally, inspectors noted the following events in 2003 and 2014, which illustrate a history
of similar failures of the EDG fuel oil system piping:
On October 21, 2003, while performing maintenance testing on the A EDG, the right
bank fuel supply line ruptured at the threaded connection. The licensee documented
NCN-03-03500 and attributed the crack to manual manipulation of the pipe. The pipe
nipple was replaced, and the 10-foot crossover pipe between the left and right fuel oil
header banks was shortened to minimize piping spring.
On August 20, 2014, the A EDG left bank 3/4 x 2 nipple developed a 120 drops per
minute leak. The licensee initiated CR 14-04564 to repair the connection. During
repairs, mechanics identified a hairline crack in the threads. The nipple was replaced,
and the licensee initiated CR 14-04592 to document the hairline crack. The CR
actions included a quick cause evaluation and assignments for engineering to inspect
other threaded connections for evidence of leakage during the next runs of the A and
B EDGs. The quick cause evaluation noted the 2003 pipe crack on the opposite side
of the A EDG and determined that the single impact event during a 2003
maintenance activity damaged the left bank nipple and over 11 subsequent years of
operation, the crack developed due to fatigue.
On November 4, 2014, the B EDG right bank 3/4 x 15 nipple developed a small
leak. The licensee initiated CR 14-05797 to repair the connection. During repairs,
mechanics identified a hairline crack in the threads. The pipe nipple was replaced,
and the D-OTH evaluation by engineering stated that the most likely cause was a
single impact event followed by subsequent high stress low cycle fatigue. The
licensee established a corrective action to monitor the system for early signs of
leakage during EDG runs.
Each of these instances of piping or bushing cracks were remediated by replacement of the
components and monitoring for future leakage from similar components. The EDG fuel oil
system was designed to be robust to withstand the expected high vibrations for the life of the
plant. Due to the standby nature of EDGs at nuclear power plants, which only run during
testing and events involving a loss of offsite power, it is rare that an EDG would operate more
than 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> per year. Although the EDG fuel oil system cracks were separated by many
years between events, the total run time of the EDGs between failures was small compared
to the expected life of the system. The licensee had evidence that maintenance activities,
including piping manipulation and impact events could not only damage multiple connections,
but the damage may not reveal itself through an open crack for years. This vulnerability of the
EDG system is exacerbated by the use of schedule-40 piping with tapered threads that is
more susceptible to cracking than thicker piping or different connection designs.
Inspectors determined that, based on the failure history of the EDGs and the licensees
documented conclusions that attributed pipe cracks to prior maintenance events, the licensee
had sufficient information to identify that a CAQ existed with the design of the EDG fuel oil
system that caused the threaded connections to be vulnerable to maintenance activities that
over torqued, strained, or impacted the piping. This vulnerability in the system was most
prevalent in the left and right bank fuel oil connections which were subject to high vibrations
during EDG operation. Despite the challenge to maintain leak-tight connections and the
history of cracked pipes, no significant changes were made to maintenance practices or
procedures, and the licensee continued to reactively monitor for leakage even after
vulnerabilities were identified. The licensee also did not make any substantive changes to the
design of the system to reduce the vulnerability to maintenance-induced challenges.
The licensee treated individual pipe failures as broke/fix rather than identifying the system
vulnerability. The licensee had evidence prior to the November 2022 failure of the A EDG
supply header pipe that cracks could propagate rapidly during EDG operation as seen in the
October 2003 rupture of the same A EDG supply header pipe. CRs documenting failures in
2020 were classified as NCAQs and represented a missed opportunity for the licensee to
perform an evaluation to identify whether a common CAQ existed and determine if previous
failures in 2003 and 2014 were indicative of a more significant problem with the EDG fuel oil
system piping.
Corrective Actions: The licensee replaced the cracked pipe nipple on the A EDG and
reperformed the 24-hour surveillance test. The licensee also replaced the same nipple on the
B EDG to extend the life of the piping.
Corrective Action References: CR 1211780
Performance Assessment:
Performance Deficiency: The licensee's failure to identify and correct a CAQ for the EDG fuel
oil system that left the system vulnerable to piping cracks was a performance deficiency.
Screening: The inspectors determined the performance deficiency was more than minor
because it was associated with the design control attribute of the mitigating systems
cornerstone and adversely affected the cornerstone objective to ensure the availability,
reliability, and capability of systems that respond to initiating events to prevent undesirable
consequences. Specifically, the condition caused the threaded fuel oil piping connections to
be vulnerable to maintenance activities which resulted in the failure of a pipe nipple and
inoperability of the A EDG on November 2, 2022.
Significance: The inspectors assessed the significance of the finding using IMC 0609
Appendix AProperty "Inspection Manual Chapter" (as page type) with input value "NRC Inspection Manual 0609</br></br>Appendix A" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., The Significance Determination Process (SDP) for Findings At-Power. The
affected cornerstone was mitigating systems, as determined by IMC 0609, Attachment 4,
Initial Characterization of Findings. The inspectors screened the performance deficiency
using Exhibit 2 of Appendix A and determined a detailed risk evaluation was required
because the degraded condition represented a loss of the Probabilistic Risk Assessment
(PRA) function of one train of a multi-train Technical Specification (TS) system for greater
than its TS allowed outage time.
A Region II Senior Reactor Analyst performed a detailed risk evaluation. The finding was
preliminarily determined to be of substantial safety significance (Yellow). The preliminary risk
estimate was obtained by performing a run-time failure conditional analysis of the A-train
EDG using a 162-day exposure period evaluated over six run intervals. The dominant
Standardized Plant Analysis Risk (SPAR) model sequences were associated with fire
initiating events with impact to the normal offsite power supply, random failure/unavailability
of the B-train EDG, and the inability to restore power from the 13.8 kV source and operator
failure to control the Turbine Driven Essential Feedwater (TDEFW) pump following battery
depletion. See Attachment, A-EDG Fuel Oil Leak Detailed Risk Evaluation, for a summary
of the preliminary risk determination analysis.
Cross-Cutting Aspect: Not Present Performance. No cross-cutting aspect was assigned to
this finding because the inspectors determined the finding did not reflect present licensee
performance.
Enforcement:
Violation: 10 CFR Part 50 Appendix B, Criterion XVI Corrective Action, states, in part that,
measures shall be established to assure that conditions adverse to quality, such as failures,
malfunctions, deficiencies, deviations, defective material and equipment, and
nonconformances are promptly identified and corrected.
Section 16, Corrective Action, of the V.C. Summer Quality Assurance Program Description,
Revision 2 (2014), described the methods to meet Criterion XVI, which stated, in part, when
complex issues arise where it cannot be readily determined if a condition adverse to quality
exist, [the licensee] documents establish the requirements for documentation and timely
evaluation of the issue.
Licensee procedure SAP-0999, Corrective Action Program, Revision 12 (2014), step 6.3.1
stated, When an issue is recognized that it is not meeting performance expectations, the
event should be documented via a CR. An example of a condition that required a CR is The
failure mechanism has implications that may affect multiple systems or components.
Contrary to the above, following discovery of cracked components in the EDG fuel oil system
dating back to 2003, the licensee fixed the cracked piping/fittings but failed to identify and
correct the failure mechanism that affected the fuel oil system piping on both the A and B
EDGs, eventually leading to the failure of the A EDG fuel oil piping during testing on
November 2, 2022. Specifically, CRs documenting failures in 2020 were classified as NCAQs
and represented a missed opportunity for the licensee to perform an evaluation to identify
whether a common CAQ existed and determine if previous failures in 2003 and 2014 were
indicative of a more significant problem with the EDG fuel oil system piping.
Enforcement Action: This violation is being treated as an AV pending a final significance
(enforcement) determination.
EXIT MEETINGS AND DEBRIEFS
The inspectors verified no proprietary information was retained or documented in this report.
On September 28, 2023, the inspectors presented the NRC inspection results to Mr.
Robert Justice, Site Vice President, and other members of the licensee staff.
ATTACHMENT: A-EDG FUEL OIL LEAK DETAILED RISK EVALUATION
OVERALL RISK SUMMARY
The V.C. Summer A-train EDG was rendered inoperable due to a fuel header through-wall leak
discovered during a surveillance test. The crack size and associated leak rate increased until the
licensee terminated the surveillance test approximately six hours into a planned 24-hour run. Analysis of
the condition indicated that the A-train EDG would not have been able to operate for its mission time and
would have prevented the EDG from providing its emergency power safety function. A risk evaluation
using a 162-day exposure period preliminarily estimated an increase in the change in core damage
frequency (delta-CDF) of 2.92E-05/year (consistent with a Yellow finding).
PERFORMANCE DEFICIENCY
The licensee's failure to identify and correct a CAQ for the EDG fuel oil system that left the system
vulnerable to piping cracks was a performance deficiency.
The inspectors determined the performance deficiency was more than minor because it was associated
with the design control attribute of the mitigating systems cornerstone and adversely affected the
cornerstone objective to ensure the availability, reliability, and capability of systems that respond to
initiating events to prevent undesirable consequences. Specifically, the condition caused the threaded
fuel oil piping connections to be vulnerable to maintenance activities which resulted in the failure of a
pipe nipple and inoperability of the 'A' EDG on November 2, 2022.
The analyst noted that the performance deficiency was also more than minor because it was associated
with the equipment performance attribute of the mitigating systems cornerstone and adversely affected
the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to
initiating events to prevent undesirable consequences. Specifically, the condition caused the threaded
fuel oil piping connections to be vulnerable to maintenance activities which resulted in the failure of a fuel
oil pipe nipple and inoperability of the A-train EDG on November 2, 2022.
EXPOSURE TIME
The component run-time failure approach discussed in Section 2.5 of Volume 1 of the Risk Assessment
Standardization Project (RASP) Manual was used to evaluate the condition exposure time. The run
history of the A-train EDG prior to the failure in November 2022 was used to determine the number of
intervals of accumulated operation for its 24-hour PRA mission time (precise condition inception time was
unknown, but the vibration-induced degradation mechanism was assumed to progress only during
operation of the EDG). The final time interval included the A-train EDG repair time after the leak was
identified during the surveillance test. A total exposure time of 162 days divided into six run intervals was
used for the analysis. The condition exposure period began on May 24, 2022, and ended following
repairs to the A-train EDG on November 2, 2022.
RISK ANALYSIS/CONSIDERATIONS
Assumptions
1.
The A-train EDG was assumed to have been able to operate an additional three hours beyond the
point that the licensee voluntarily terminated the surveillance test on November 2, 2022. This
assumption was made to avoid the overly conservative assumption that the A-EDG function had
completely failed six hours into its test. The three-hour time estimate was made based on the
reported rate of increase in leakage during the surveillance test which was assumed to be
proportional to the rate of crack growth (or 140 degrees approximately six hours into the surveillance
test). This assumption could be considered non-conservative because the crack propagation, if
allowed to continue, could reasonably have been expected to exhibit exponential growth
characteristics (vs. linear) leading to more rapid failure of the EDG and potentially adding additional
condition exposure time to the analysis. The run history of the A-train EDG was examined, and it was
determined that the EDG had been operated successfully approximately one week prior to the start
of the analysis exposure period of May 24, 2022. This indicates that the assumption, while potentially
non-conservative, would not significantly impact the overall exposure period or conclusions resulting
from the analysis.
2.
The condition was assumed to only continue to degrade when the EDG was operated and not when
in a standby status. Consequently, the component run-time failure approach discussed in Section 2.5
of Volume 1 of the RASP manual was used to evaluate the condition exposure time. Based on the
run history of the A-train EDG a condition exposure period of 162 days, divided into six separate run
intervals, and including repair time was used for the analysis. To explore the sensitivity of the
analysis results with respects to use of the run-time failure approach, a sensitivity case will be
performed that does not divide the 162-day exposure period into time intervals.
3.
No repair credit for the failure of the A-train EDG fuel header was included in the analysis.
4.
Diverse and Flexible Coping Strategies (FLEX) mitigating strategies and equipment were credited in
the analysis using a 24-hour PRA mission time. FLEX equipment reliability was modeled using
information contained in PWROG-18042-NP, Revision 1, FLEX Equipment Data Collection and
Analysis, (ADAMS ML22123A259). A sensitivity case with no FLEX credit was also performed.
Systems Analysis Program for Hands-On Integrated Reliability Evaluations (SAPHIRE) software version
8.2.8 and V.C. Summer SPAR model version 8.80 was used for the evaluation.
1.
The SPAR model was modified with the assistance of Idaho National Lab to account for the capability
of powering the A-or B-train 7.2 kV Engineered Safety Features (ESF) bus from the 13.8 kV section
of the Parr hydro unit switchyard. This offsite power supply is an underground feed via transformer
XTF-5052 that has the capability of providing power to either ESF bus and does not require manning
or start-up of the Parr hydro unit. No credit was provided in the analysis for start-up and operation of
the Parr hydro unit as an alternate source of electrical power. In addition, the SPAR model was also
modified to account for the ability of both the A and B-train emergency auxiliary transformers (XTF-31
and XTF-4) to supply offsite power to both ESF buses.
2.
The approach discussed in Section 2.5 of the RASP manual was used to evaluate the condition
exposure time. The run history of the EDG prior to the failure in November 2022 was used to
determine the number of intervals of accumulated operation of the EDG for the 24-hour PRA mission
time (condition inception time unknown but the vibration-induced degradation of the fuel line was
assumed to progress during operation of the EDG). The final time interval includes the EDG repair
time after the leak was identified. The table below summarizes the intervals that were used for the
analysis.
Date
Interval
Exposure
Period (days)
Interval Run
Time (hrs)
Cumulative Run
(hrs)
Time to
Failure (hrs)
5/24/22 11:05 PM
-
-
5.0
5.0
24.0
6/14/22 11:15 PM
21
2.0
7.0
19.0
7/12/22 11:39 PM
28
1.0
8.0
17.0
8/17/22 12:00 AM
35
3.0
11.0
16.0
9/6/22 11:19 PM
21
2.0
13.0
13.0
10/5/22 12:26 AM
28
2.0
15.0
11.0
11/2/22 6:31 PM
29
9.0
24.0
9.0
The fault tree logic for the A-train EDG was modified to split the fail-to-run (FTR) basic event into two
separate components so that adjustments could be made to credit EDG operation prior to failure. The
SAPHIRE convolution mapping tool was then used to update model convolution events using the new
fault tree logic.
For the conditional case the model was adjusted using change set 1AEXT_EDG_FTR which set event
EPS-DGN-FR-1A to TRUE so that the FTR common cause change would be calculated by SAPHIRE.
The change set also set the new basic event EPS-DGN-FR-1AEXT to 1.0 so the failure would show up in
cutsets for post-processing adjustment made for credited EDG run time.
For each time interval the mission time for basic events EPS-DGN-FR-1AT2 and EPS-DGN-FR-1AEXT
were adjusted to reflect the estimated run time before failure and each time interval also included ET
post-processing to look for A EDG FTR basic event EPS-DGN-FR-1AEXT in the cutsets and substitute
the appropriate recovery terms based on credited EDG operation. The following table shows the mission
time adjustments made to EPS-DGN-FR-1AT2 and EPS-DGN-FR-1AEXT for each time interval.
Interval
Exposure
Period (days)
Time to
Failure (hrs)
EPS-DGN-FR-1AT2
Mission Time (hrs)
EPS-DGN-FR-1AEXT
Mission Time (hrs)
21
18
2
17
7
35
15
4
13
11
28
10
6
9
15
3.
A conditional case was performed for every interval bin and the results were summed to determine
the overall risk estimate.
4.
Basic events were adjusted in the base SPAR model to enable FLEX sequences and account for
best estimate reliability of FLEX equipment using industry failure data at a 24-hour mission time.
Based on the unavailability of industry reliability data for load-run basic events, the model was
adjusted to ignore those failures. A sensitivity case will also be performed giving no credit for FLEX
mitigation of the performance deficiency. These adjusted values were used for both the nominal and
conditional case as the performance deficiency did not impact FLEX strategies.
5.
Two new Human Error Probability (HEP) basic events were created to model operator actions to
recover offsite power supplies. The first HEP (ACP-XHE-XM-PARRHYDRO) estimates the failure to
manually align the 13.8 kV offsite source from Parr hydro switchyard to either the A-or B-train 7.2 kV
ESF bus. The second HEP (ACP-XHE-XA-ALT1DA(B)) estimates the failure to manually align either
XTF-31 to the B-and A-train ESF buses or XTF-4 to the A-and B-train ESF buses. Development of
the HEPs was documented using SPAR-H worksheets.
ACP-XHE-XM-PARRHYDRO = 4.4E-02
ACP-XHE-XA-ALT1DA(B) = 5.40E-03
6.
SAPHIRE condition assessments were performed using the event tree direct solve method where
cutset results were gathered for sequences other than internal events. Conditional case change set
1AEXT_EDG_FTR was used to evaluate the change in risk that could be attributed to the EDG
failure for each time interval being evaluated over the 162-day exposure period.
Change Set 1AEXT_EDG_FTR (shown for interval 1)
Basic Event
Nominal
Conditional
EPS-DGN-FR-1A
2.68E-02
TRUE
EPS-DGN-FR-1AEXT
5.88E-03
1.0
7.
SAPHIRE condition assessments were also performed using the ECA module to generate dominant
sequence and cutset reports. Conditional case change set 1AEXT_EDG_FTR_ECA was used in the
condition assessments.
Change Set 1AEXT_EDG_FTR_ECA (shown for interval 1)
Basic Event
Nominal
Conditional
EPS-DGN-FR-1A
2.68E-02
TRUE
EPS-DGN-FR-1AEXT
5.88E-03
1.0
EPS-DGN-FR-1AT2
2.10E-02
2.10E-02
EPS-DGN-TM-1A
1.51E-02
1.51E-02
CALCULATIONS
Best Estimate:
Interval
Exposure
(days)
Fire
Delta-CDP
Internal
Events
Delta-CDP
High Wind
Delta-CDP
Seismic
Delta-CDP
Tornado
Delta-CDP
Internal
Flooding
Delta-CDP
21
3.81E-06
1.18E-07
9.20E-08
5.75E-09
3.07E-10
5.81E-12
28
4.78E-06
8.67E-08
8.04E-08
7.67E-09
4.09E-10
4.76E-12
35
5.97E-06
1.11E-07
1.03E-07
9.59E-09
5.11E-10
6.14E-12
21
3.59E-06
7.19E-08
6.73E-08
5.75E-09
3.06E-10
3.74E-12
28
4.79E-06
1.00E-07
9.47E-08
7.67E-09
4.07E-10
5.75E-12
29
5.05E-06
1.10E-07
1.04E-07
7.95E-09
4.22E-10
5.96E-12
Total
162
2.80E-05
5.98E-07
5.41E-07
4.44E-08
2.36E-09
3.22E-11
SAPHIRE condition assessments were performed using the direct solve method and conditional case
change set 1AEXT_EDG_FTR. The overall estimated increase in risk was a delta core damage
probability (delta-CDP) of 2.92E-05. FIRE sequences were determined to be strongly dominant in the
results with INTERNAL EVENTS and HIGH WINDS also significant sequence contributors. SAPHIRE
ECA condition assessments were performed to generate dominant sequence and cutset reports.
Dominant FIRE cutsets were associated with fire initiating events in the 1DB switchgear room, station
transformer area, and turbine building. These fire initiators result in a plant transient with either fire
damage impacting B-train power or random failure/unavailability of the B EDG accompanied by the
inability to restore power from the 13.8 kV source and operator failure to control the Turbine Driven
Essential Feedwater (TDEFW) pump following battery depletion.
Dominant INTERNAL EVENT and HIGH WIND cutsets were associated with weather-related loss of
offsite power with failure to align the 13.8 kV source accompanied by random failures of the B EDG and
FLEX DG and failure to recover offsite power sources.
Sensitivity 1 - No Time Intervals
To explore the sensitivity of the analysis results due to application of the run-time treatment of exposure
time, this sensitivity will determine the estimated increase in risk-based on the full exposure period
without the use of time intervals or post-processing to adjust power recovery terms.
SAPHIRE condition assessments were performed using the direct solve method and conditional case
change set 1AEXT_EDG_FTR for the full 162-day exposure period.
Exposure
(days)
Fire
Delta-CDP
Internal
Events
Delta-CDP
High Wind
Delta-CDP
Seismic
Delta-CDP
Tornado
Delta-CDP
Internal
Flooding
Delta-CDP
162
3.87E-05
1.92E-06
1.45E-06
4.44E-08
2.33E-09
1.22E-10
The overall estimated increase in risk was a delta-CDP of 4.22E-05.
As expected, the sensitivity results were higher without consideration of the run history of the A EDG or
consideration for the increased time that would have been available to potentially recover power sources
for the affected ESF bus. The higher estimate would not have been sufficient to alter the overall
conclusions of the analysis. The use of the run-time failure methodology was determined to be the most
appropriate treatment of exposure time for the analysis.
Sensitivity 2 - Increase Parr Switchyard Alignment Human Error Probability (HEP)
To evaluate the sensitivity of analysis results with respect to operator actions for alignment of the Parr
hydro 13.8 kV offsite power supply, the basic event for operator failure (ACP-XHE-XM-PARRHYDRO)
was increased by a factor of 2x for both the nominal and conditional cases.
ACP-XHE-XM-PARRHYDRO = 8.8E-02
SAPHIRE direct solve condition assessments were performed with conditional change set
1AEXT_EDG_FTR. Dominant event sequences FIRE, INTERNAL EVENTS, and HIGH WIND were
utilized for the sensitivity.
Interval
Exposure (days)
Fire
Delta-CDP
Internal Events
Delta-CDP
High Wind
Delta-CDP
21
7.53E-06
2.35E-07
1.85E-07
28
9.52E-06
1.71E-07
1.60E-07
35
1.19E-05
2.21E-07
2.07E-07
21
7.15E-06
1.42E-07
1.34E-07
28
9.63E-06
1.99E-07
1.88E-07
29
1.01E-05
2.18E-07
2.06E-07
Total
162
5.58E-05
1.19E-06
1.08E-06
The overall estimated increase in risk was a delta-CDP of 5.81E-05.
The analyst noted that the analysis results were strongly sensitive to consideration of operator actions to
align the Parr hydro 13.8 kV power supply to the B-train ESF bus. This sensitivity was consistent with the
number of SPAR model dominant cutsets containing that basic event. The sensitivity demonstrated that
increasing the HEP by a factor of two approximately doubled the estimated increase in risk but would not
have altered the overall conclusions of the analysis. Additionally, the analyst noted that given the
proportional impact on the analysis results, reducing the HEP by half would also not be expected to lower
the risk estimate enough to change the overall analysis conclusions.
Sensitivity 3 - No FLEX
To evaluate the sensitivity of analysis results with respect to crediting of FLEX mitigation strategies, the
basic event for operator failure to enter extended loss of AC power procedures was set to 1.0 for both the
nominal and conditional cases.
FLX-XHE-XE-ELAP = 1.0
SAPHIRE direct solve condition assessments were performed with conditional change set
1AEXT_EDG_FTR. Dominant event sequences FIRE, INTERNAL EVENTS, and HIGH WIND were
utilized for the sensitivity.
Interval
Exposure (days)
Fire
Delta-CDP
Internal Events
Delta-CDP
High Wind
Delta-CDP
21
3.75E-06
1.15E-07
1.23E-07
28
5.01E-06
1.78E-07
1.91E-07
35
6.26E-06
2.38E-07
2.52E-07
21
3.83E-06
1.57E-07
1.67E-07
28
5.11E-06
2.22E-07
2.36E-07
29
5.38E-06
2.46E-07
2.60E-07
Total
162
2.93E-05
1.16E-06
1.23E-06
The overall estimated increase in risk was a delta-CDP of 3.17E-05.
FLEX mitigation of the finding was not a strongly influential factor in the analysis results. This was
primarily due to the top SPAR cutsets involving Station Blackout (SBO) sequences accompanied by early
failure of the TDEFW pump. Under these conditions core damage can occur quickly and there would not
be sufficient time to implement the phase two FLEX strategies. Although not a strongly influential factor,
inclusion of FLEX mitigation was determined to be most appropriate to the circumstances and was
considered in the best estimate case.
Sensitivity 4 - Probabilistic Safety Analysis (PSA) Values
To assess the sensitivity of the SPAR model analysis results with respect to values used in the licensees
model the following adjustments were made:
Flagset
Basic Event
Description
Value
Value
N/A
ACP-XHE-XM-PARRHYDRO
OPERATOR FAILS TO ALIGN BACKUP
POWER FROM PARR HYDRO
4.40E-02
7.39E-02
N/A
EFW-XHE-XM-CNTRL
OPERATOR FAILS TO OPERATE EFW
TDP AFTER BATTERY DEPLETION
3.00E-01
1.60E-02
FRI-IB2202-T4
EFW-TDP-FR-XPP8
EFW TDP XPP-8 FAILS TO RUN
TRUE
5.93E-02
FRI-IB2202-CMPT-9
EFW-TDP-FR-XPP8
EFW TDP XPP-8 FAILS TO RUN
TRUE
5.93E-02
FRI-YD03-CMPT-10
ACP-XHE-XM-PARRHYDRO
OPERATOR FAILS TO ALIGN BACKUP
POWER FROM PARR HYDRO
4.40E-02
TRUE
The basic events were selected based on their relative importance to dominant SPAR model sequences
and the differences in treatment between the licensees model and the SPAR model. The PSA values for
ACP-XHE-XM-PARRHYDRO and EFW-XHE-XM-CNTRL were used for used for the nominal and
conditional case for the sensitivity. Failure of EFW-TDP-FR-XPP8 was removed from the fire scenarios
for fire area IB2202 where the licensees PSA did not assume fire-induced loss of the pump. Additionally,
ACP-XHE-XM-PARRHYDRO was added to the switchyard fire scenario to account for fire-induced
unavailability of the Parr hydro switchyard power source.
SAPHIRE direct solve condition assessments were performed with conditional change set
1AEXT_EDG_FTR. Dominant event sequences FIRE, INTERNAL EVENTS, and HIGH WIND were
utilized for the sensitivity.
Interval
Exposure (days)
Fire
Delta-CDP
Internal Events
Delta-CDP
High Wind
Delta-CDP
21
4.86E-06
1.91E-07
1.41E-07
28
5.87E-06
1.10E-07
9.78E-08
35
7.34E-06
1.40E-07
1.26E-07
21
4.41E-06
8.98E-08
8.11E-08
28
5.88E-06
1.24E-07
1.13E-07
29
6.17E-06
1.35E-07
1.24E-07
Total
162
3.45E-05
7.90E-07
6.83E-07
The overall estimated increase in risk was a delta-CDP of 3.60E-05.
For the basic events being evaluated, the difference in treatment between the SPAR model and the
licensees model were not strongly influential in the analysis results. Overall, the sensitivity was higher
than the best estimate case but did not alter the resulting conclusions. The most influential factor
appears to be the value used for ACP-XHE-XM-PARRHYDRO which is addressed in Sensitivity 2 of the
evaluation.
LICENSEE EVALUATION
During the development of this detailed risk evaluation, discussions with the licensee indicated
preliminary risk estimates from the licensees risk model were consistent with NRC SPAR model results
with FIRE sequences strongly dominant in the lower portion of the E-05 range. Although the licensees
model or record does not include FLEX equipment, the top cutsets also involved SBO sequences
accompanied by failure of the TDEFW pump which would normally not include credit for FLEX mitigation.
The licensee was developing an analysis to determine if enough decay heat would be removed prior to
the expected run-time failure of the A-train EDG to allow implementation of Phase 2 FLEX strategies to
restore the heat removal function prior to core damage. The licensees evaluation was not completed at
the time of this detailed risk evaluation. A qualitative review of SPAR model cutsets for the top FIRE
sequences indicate that FLEX credit under those conditions had the potential to reduce the estimated
risk of the condition.
DELTA-CDF FOR EXPOSURE TIME
The overall results are summarized below:
EVENT SEQUENCE
Best
Estimate
Sensitivity #1
No Intervals
Sensitivity #2
SWYD HEP 2x
Sensitivity #3
No FLEX
Sensitivity #4
PSA Values
FIRE
2.80E-05
3.87E-05
5.58E-05
2.93E-05
3.45E-05
INTERNAL EVENTS
5.98E-07
1.92E-06
1.19E-06
1.16E-06
7.90E-07
5.41E-07
1.45E-06
1.08E-06
1.23E-06
6.83E-07
SEISMIC
4.44E-08
4.44E-08
-
-
-
TORNADO
2.36E-09
2.33E-09
-
-
-
3.22E-11
1.22E-10
-
-
-
TOTAL
2.92E-05
4.22E-05
5.81E-05
3.17E-05
3.60E-05
Considering that SAPHIRE calculates the difference in core damage probability over a given exposure
time, and that changes in CDF over the same period are numerically equivalent, the change in CDF due
to the finding would be on the order of 2.92E-05/year.
EXTERNAL EVENTS CONSIDERATIONS
Internal event estimates were greater than 1E-07, therefore external events were discussed and
estimated in this risk evaluation. FIRE and HIGH WINDS event sequences were determined to be
significant contributors to the overall estimated risk and were included in sensitivity evaluations with
INTERNAL EVENTS.
LARGE EARLY RELEASE FREQUENCY IMPACT
The finding was evaluated in accordance with IMC 0609, Appendix H, Containment Integrity Significance
Determination Process, as a Type A finding. Although the estimated delta-CDF was greater than 1E-
07/year, the dominant accident sequences did not involve steam generator tube rupture or interfacing
system Loss of Coolant Accidents. Therefore, the issue associated with failure of the A-train EDG would
not be expected to be a significant contributor to an increase in large early release frequency (delta-
LERF) risk in comparison to the delta-CDF risk. Delta-CDF was determined to be the risk metric of
interest for this evaluation.
CONCLUSIONS/RECOMMENDATIONS
The preliminary estimated risk increase (delta-CDF) over the nominal case for the inoperability of the A-
train EDG was 2.92E-05/year, which should be preliminarily considered a finding of substantial (Yellow)
significance.