ML24066A197
| ML24066A197 | |
| Person / Time | |
|---|---|
| Site: | Sequoyah  (DPR-077, DPR-079) |
| Issue date: | 03/19/2024 |
| From: | Gregory Suber NRC/RGN-II/DRP/RPB5 |
| To: | Jim Barstow Tennessee Valley Authority |
| References | |
| EA-24-008 IR 2024090 | |
| Download: ML24066A197 (19) | |
See also: IR 05000327/2024090
Text
Jim Barstow
Vice President Nuclear Regulatory
Affairs & Support Services
Tennessee Valley Authority
Chattanooga, TN 37402-2801
SUBJECT:
SEQUOYAH, UNITS 1 AND 2 - NRC INSPECTION REPORT
05000327/2024090 AND 05000328/2024090 AND PRELIMINARY GREATER-
THAN-GREEN FINDING AND APPARENT VIOLATION
Dear Jim Barstow:
The enclosed inspection report documents a finding and associated apparent violation that the
U.S. Nuclear Regulatory Commission (NRC) has preliminarily determined to be of greater than
very low safety significance (i.e. greater-than-Green), resulting in the need for further evaluation
to determine significance and therefore the need for additional NRC action. As described in
Enclosure 1, a self-revealed apparent violation of Technical Specification (TS) 5.4.1,
Procedures, was identified for Sequoyah Nuclear Plants failure to establish, implement, and
maintain adequate procedures for maintenance activities on the 1B Diesel Generator (DG)
exhaust valves, which resulted in its failure on September 19, 2023. We assessed the
significance of the finding using the significance determination process (SDP) and the best
available information at the time of the Significance and Enforcement Review Panel on February
21, 2024. Enclosure 2 contains a detailed risk evaluation with the basis of our preliminary
significance determination. We are considering escalated enforcement for the apparent violation
consistent with our Enforcement Policy, which can be found at http://www.nrc.gov/about-
nrc/regulatory/enforcement/enforce-pol.html. Because we have not made a final determination,
no notice of violation is being issued at this time. Please be aware that further NRC review may
prompt us to modify the number and characterization of the apparent violation.
On February 15, 2024, you informed the NRC that you completed an evaluation of the risk
impact of the 1B DG failure to run on September 19, 2023. The NRC was not able to review
your evaluation prior to completing the preliminary determination enclosed in this letter but will
review it and consider your position as we make our final decision on this matter. The NRCs
evaluation is subject to several uncertainties which could affect the outcome of the significance
determination. Therefore, before we make a final decision, we request you provide any
additional information that you feel would be beneficial in our evaluation of the significance of
the finding. Specifically requested is any additional information or perspectives that address
mitigation of the dominant accident sequences given the potential for the delayed onset of
station blackout plant conditions and any additional information or perspectives regarding the
ability to repower containment hydrogen igniters when assessing the potential for large early
release frequency.
March 19, 2024
J. Barstow
2
On February 28, 2024, you informed the NRC that you completed a Level 1 Evaluation (Root
Cause Assessment, RCA) Report (RCAR) to determine the causal factors which resulted in the
1B DG failure to run on September 19, 2023. The NRC was not able to review your RCAR prior
to completing the preliminary determination enclosed in this letter but will review it and consider
your position as we make our final decision on this matter.
The NRCs SDP is designed to encourage an open dialogue between your staff and the NRC;
however, the dialogue nor the written information you provide should affect the timeliness of our
final determination.
Before we make a final decision on this matter, we are providing you with an opportunity to (1)
request a Regulatory Conference where you can present to the NRC your perspective on the
facts and assumptions the NRC used to arrive at the finding and assess its significance, or (2)
submit your position on the finding to the NRC in writing. If you request a Regulatory
Conference, it should be held within 40 days of the receipt of this letter, and we encourage you
to submit supporting documentation at least one week prior to the conference in an effort to
make the conference more efficient and effective. If a Regulatory Conference is held, it will be
open for public observation. If you decide to submit only a written response, such submittal
should be sent to the NRC within 40 days of your receipt of this letter.
If you choose to send a response, please include your perspective of the significance of the
finding along with the related facts and assumptions used to reach your determination.
Additionally, your response should be clearly marked as a "Response to Apparent Violation;
(EA-24-008)" and should include for the apparent violation: (1) the reason for the apparent
violation or, if contested, the basis for disputing the apparent violation; (2) the corrective steps
that have been taken and the results achieved; (3) the corrective steps that will be taken; and
(4) the date when full compliance will be achieved. Your response should be submitted under
oath or affirmation and may reference or include previously docketed correspondence if the
correspondence adequately addresses the required response. Additionally, your response
should be sent to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Center,
Washington, DC 20555-0001 with a copy to Mr. Louis McKown, U.S. Nuclear Regulatory
Commission, Region II, within 40 days of the date of this letter. If an adequate response is not
received within the time specified or an extension of time has not been granted by the NRC, the
NRC will proceed with its enforcement decision or schedule a Regulatory Conference.
If you decline to request a Regulatory Conference or to submit a written response, you
relinquish your right to appeal the final SDP determination, in that by not doing either, you fail to
meet the appeal requirements stated in the Prerequisite and Limitation sections of Attachment 2
of NRC Inspection Manual Chapter 0609.
Please contact Mr. Louis McKown via phone at 404-997-4545, and in writing, within 10 days
from the issue date of this letter to notify the NRC of your intentions. If we have not heard from
you within 10 days, we will continue with our significance determination and enforcement
decision. The final resolution of this matter will be conveyed in separate correspondence.
For administrative purposes, this inspection report provides an update to the apparent violation
documented in NRC inspection report 05000327/2023004 AND 05000328/2023004, dated
February 12, 2024 (Agency Documents Access and Management System (ADAMS) Accession
Number ML24040A073).
J. Barstow
3
This letter, its enclosure, and your response (if any) will be made available for public inspection
and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document
Room in accordance with Title 10 of the Code of Federal Regulations 2.390, Public
Inspections, Exemptions, Requests for Withholding.
Sincerely,
Gregory F. Suber, Deputy Director
Division of Reactor Projects
Docket Nos. 05000327 and 05000328
License Nos. DPR-77 and DPR-79
Enclosures:
1. Inspection Report
2. UNIT 1 B-EDG DETAILED RISK EVALUATION
cc w/ encl: Distribution via LISTSERV
Signed by Suber, Gregory
on 03/19/24
SUNSI Review
Non-Sensitive
Sensitive
Publicly Available
Non-Publicly Available
OFFICE
RII/DRP
RII/DRP
RII/DRP
RII/DRP
RII/EICS
HQ/NRR/DRO
NAME
S. Ninh
D. Hardage
S. Sandal
L. McKown
M. Kowal
R. Felts
DATE
3/7/2024
3/7/2024
3/7/2024
3/7/2024
3/7/2024
3/13/2024
OFFICE
HQ/NRR/DRA
HQ/OE
RII/DRP
NAME
M. Franovich
D. Bradley
G. Suber
DATE
3/16/2024
3/12/2024
3/19/2024
Enclosure 1
U.S. NUCLEAR REGULATORY COMMISSION
Inspection Report
Docket Numbers:
05000327 and 05000328
License Numbers:
Report Numbers:
05000327/2024090 and 05000328/2024090
Enterprise Identifier:
I-2024-090-0002
Licensee:
Tennessee Valley Authority
Facility:
Sequoyah, Units 1 and 2
Location:
Soddy Daisy, TN 37379
Inspection Dates:
February 05, 2024 to February 27, 2024
Inspectors:
D. Hardage, Senior Resident Inspector
S. Ninh, Senior Project Engineer
A. Price, Resident Inspector
S. Sandal, Senior Reactor Analyst
Approved By:
Gregory F. Suber, Deputy Director
Division of Reactor Projects
2
SUMMARY
The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees
performance by conducting a NRC inspection at Sequoyah, Units 1 and 2, in accordance with
the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for
overseeing the safe operation of commercial nuclear power reactors. Refer to
https://www.nrc.gov/reactors/operating/oversight.html for more information.
List of Findings and Violations
Failure to establish and implement adequate maintenance procedures on the 1B Diesel
Generator
Cornerstone
Significance
Cross-Cutting
Aspect
Report
Section
Mitigating
Systems
Preliminary greater-than-Green
AV 05000327,05000328/2023004-01
Open
[H.12] - Avoid
Complacency
A self-revealed apparent violation (AV) of Technical Specification (TS) 5.4.1,
Procedures, was identified. The licensees procedures for maintenance on the 1B Diesel
Generator (DG) were not adequately prescribed and/or accomplished in accordance with
documented instructions and procedures of a type appropriate to the circumstances.
Specifically, the licensee failed to adequately establish and implement maintenance
instructions and practices that reasonably ensured the reliability, availability, and operability of
the 1B DG. The 1B DG failed on September 19, 2023, during a surveillance run due to a
piston failure that required the DG to be placed in an emergency shutdown condition. The
most probable direct cause of the failure was an improperly tightened rocker arm adjustment
screw locknut which resulted in severe damage to the associated power pack.
Additional Tracking Items
None.
3
INSPECTION SCOPES
Inspections were conducted using the appropriate portions of the inspection procedures (IPs) in
effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with
their attached revision histories are located on the public website at http://www.nrc.gov/reading-
rm/doc-collections/insp-manual/inspection-procedure/index.html. Samples were declared
complete when the IP requirements most appropriate to the inspection activity were met
consistent with Inspection Manual Chapter (IMC) 2515, Light-Water Reactor Inspection
Program - Operations Phase. The inspectors reviewed selected procedures and records,
observed activities, and interviewed personnel to assess licensee performance and compliance
with Commission rules and regulations, license conditions, site procedures, and standards.
INSPECTION RESULTS
Failure to establish and implement adequate maintenance procedures on the 1B Diesel
Generator
Cornerstone
Significance
Cross-Cutting
Aspect
Report
Section
Mitigating
Systems
Preliminary greater-than-Green
AV 05000327,05000328/2023004-01
Open
[H.12] - Avoid
Complacency
A self-revealed AV of TS 5.4.1, Procedures, was identified. The licensees procedures for
maintenance on the 1B DG were not adequately prescribed and/or accomplished in
accordance with documented instructions and procedures of a type appropriate to the
circumstances. Specifically, the licensee failed to adequately establish and implement
maintenance instructions and practices that reasonably ensured the reliability, availability,
and operability of the 1B DG. The 1B DG failed on September 19, 2023, during a surveillance
run due to a piston failure that required the DG to be placed in an emergency shutdown
condition. The most probable direct cause of the failure was an improperly tightened rocker
arm adjustment screw locknut which resulted in severe damage to the associated power
pack.
Description: On September 19, 2023, Sequoyah was performing a scheduled 24-hour run of
the 1B DG. 1B DG was started at 1121 and at approximately 1544, operations received
multiple Main Control Room and local annunciator alarms including high crankcase pressure
followed by low jacket water level. The operator performed an emergency stop of the 1B DG
in accordance with the annunciator response procedure.
The onsite Class 1E AC electrical distribution system supplies electrical power to two power
trains shared between the two units. The AC sources for the shared loads are distributed
across both units shutdown boards. However, the impacts of an inoperable offsite power or
DG on the opposite units shutdown board differ from the impacts of an inoperable offsite or
DG on an associated units shutdown board, due to the loads powered from the respective
board.
Sequoyah Units 1 and 2 entered LCO 3.8.1 Condition B for one Train B DG inoperable.
Sequoyah Units 1 and 2 TS 3.8.1 requires four DGs capable of supplying the onsite Class 1E
AC Electrical Power Distribution System, to be operable in Modes 1-4; if a DG is inoperable, it
shall be returned to operable status within 7 days or in accordance with the Risk-Informed
Completion Time Program. The DGs must demonstrate the capability to run continuously at
4
full load for at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in order to ensure that they can support safety-related plant
equipment independently of offsite electrical power sources.
10 CFR Part 50.73(a)(2)(i)(B) requires a Licensee Event Report (LER) for any operation or
condition which was prohibited by the plants TS except when the TS is administrative nature.
As part of the failure investigation, inspection of the 1B2 engine discovered water leaking into
cylinder #14. The 1B DG is comprised of two diesel engines identified as 1B1 and 1B2
coupled to a common electrical generator. Further inspection showed an approximately 3-
inch diameter hole in the piston associated with 1B2 engine cylinder #14. The cylinder #14
exhaust valve bridge adjusting screw locknut nut associated with one pair of the exhaust
valves was found loose on top of the head along with valve spring retainer pieces. This
condition is consistent with the exhaust valve falling into the cylinder during operation and
causing damage to the piston/cylinder head.
Sequoyah had performed the four-year preventive maintenance procedure, PM 063604820,
on the 1B DG in January 2023. This maintenance, in part, directs the technicians to check/set
the exhaust valve lash settings, which requires the loosening and retightening the exhaust
valve bridge adjuster locknut. Table 5.9.7 Top Timing Table shows the lash setting performed
and initialed for each cylinder. Knowledgeable craft interviewed early, and later causal
analyses provided differing understandings of expectations for execution of the valve lash
verification and rocker arm locknut adjustments. These were established as skill of the craft
using terms such as tighten vice obtaining readily attainable specified values consistent with
MMTP-104, Guidelines and Methodology for Assembling and Tensioning Threaded Connections,
Revision 13.
The failure of the 1B DG resulted from the loss of proper lash adjustment of the rear valve
bridge on cylinder #14. During operation of the 1B DG following maintenance, the exhaust
valve bridge adjuster locknut on cylinder #14 separated from the adjustment screw, indicating
that the locknut was not adequately tightened. The separated locknut allowed the adjuster
screw to loosen, significantly increasing the clearance between the rocker arm and the valve
bridge. As the adjustment screw loosened further, the valve bridge spring no longer
compressed resulting in a loss of the spherical spring seat mating with the cylinder head. This
ultimately resulted in a complete loss of retention of the exhaust valve, which then fell into the
cylinder causing the observed cylinder damage and loss of jacket water cooling as the loose
exhaust valve was struck by the piston head during each stroke.
Corrective Actions: The 1B DG was emergency stopped and Sequoyah units 1 and 2
entered LCO 3.8.1 Condition B for one Train B DG inoperable. Sequoyah technicians
performed corrective maintenance on the 1B DG which included the replacement of impacted
power packs followed by post maintenance and operability testing including a new 24-hour
run. In subsequent maintenance outages on the remaining station DGs, Sequoyah staff
ensured all exhaust valve rocker arm adjusting screw locknuts were torqued in accordance
with vendor recommendations. The licensee ordered a failure analysis of the failed cylinder to
be completed and ensured that the latest vendor recommendations for exhaust valve bridge
lash adjustment were incorporated into the station's 4-, 6-, and 12-year preventive
maintenance instructions consistent with MMTP-104.
Corrective Action References: CRs 1881328, 1882753, 1900849
5
Performance Assessment:
Performance Deficiency: The inspectors determined that the licensee's failure to adequately
establish and implement maintenance instructions and practices was a performance
deficiency reasonably within their ability to foresee and prevent. Specifically, during
performance of exhaust valve lash adjustment in accordance with maintenance instruction
PM 063604820, appropriate tightening of the exhaust valve bridge adjuster locknut on DG
1B2 cylinder #14 was not performed. This resulted in the loss of retention of the exhaust
valve while in service causing damage to the associated cylinder and loss of jacket water
cooling.
Screening: The inspectors determined the performance deficiency was more than minor
because it was associated with the Equipment Performance attribute of the Mitigating
Systems cornerstone and adversely affected the cornerstone objective to ensure the
availability, reliability, and capability of systems that respond to initiating events to prevent
undesirable consequences. Specifically, the failure to properly implement adequate
maintenance instructions and practices contributed to the failure of the 1B DG.
Significance: The inspectors assessed the significance of the finding using IMC 0609
Appendix A, The Significance Determination Process (SDP) for Findings At-Power. The
inspectors reviewed IMC 0609, Attachment 4, Initial Characterization of Findings, and
determined that the finding affects the Mitigating Systems cornerstone. The inspectors
screened the performance deficiency using Exhibit 2 of Appendix A and determined a
detailed risk evaluation was required because the degraded condition represented a loss of
the Probabilistic Risk Assessment (PRA) function of one train of a multi-train TS system for
greater than its TS allowed outage time.
A Region II Senior Reactor Analyst performed a detailed risk evaluation. The finding was
determined to be preliminarily greater-than-Green. The preliminary risk estimate was
obtained by performing a run time failure conditional analysis of the B-train emergency diesel
generator (EDG) using a 246-day exposure period evaluated over eight run intervals. The
dominant Standardized Plant Analysis Risk (SPAR) model sequences were associated with
fire initiating events that involved impact to the normal offsite power supply, unavailability of
the A-train EDG, resulting in station blackout (SBO) plant conditions, followed by a reactor
coolant pump seal failure or turbine-driven auxiliary feedwater pump failure. Because the B-
train EDG would have been expected to operate for some period at nominal failure likelihood
prior to onset of SBO conditions, additional analysis of the impact of the delayed SBO on the
mitigation of the dominant accident sequences will be necessary before reaching a final
determination of significance. Additional evaluation would also be necessary prior to making
any determination of the estimated increase in large early release frequency due to the
delayed onset of SBO and the potential for repowering the containment hydrogen igniters
from Diverse and Flexible Coping Strategy (FLEX) diesel generator sources. See Enclosure 2
UNIT 1 B-EDG DETAILED RISK EVALUATION, for a summary of the basis for the
preliminary risk determination.
Cross-Cutting Aspect: H.12 - Avoid Complacency: Individuals recognize and plan for the
possibility of mistakes, latent issues, and inherent risk, even while expecting successful
outcomes. Individuals implement appropriate error reduction tools. In this case and as
associated with this finding, the licensee failed to ensure that error reduction tools such as
specified values appropriate to the situation were implemented in lieu of skill of the craft
during the performance of PM 063604820.
6
Enforcement:
Violation: Sequoyah Unit 1 TS 5.4.1 requires, in part, that written procedures shall be
established, implemented, and maintained for the applicable activities recommended in
Appendix A of Regulatory Guide (RG) 1.33, Quality Assurance Program Requirements
(Operation), Revision 2. Appendix A to RG 1.33, Section 9.a, states that maintenance that
can affect the performance of safety-related equipment should be performed in accordance
with written procedures, documented instructions, or drawings appropriate to the
circumstances.
Sequoyah PM 063604820 is a preventive maintenance procedure that includes instructions
for the adjustment of the safety-related DG exhaust valve bridge adjuster locknut, an activity
that can affect the performance of DGs safety-related function.
Sequoyah Units 1 and 2 TS 3.8.1 requires, in part, four DGs capable of supplying the onsite
Class 1E AC Electrical Power Distribution System, to be operable in Modes 1 through 4; if a
DG is inoperable, it shall be returned to operable status within 7 days or in accordance with
the Risk-Informed Completion Time Program.
Contrary to the above, on January 25, 2023, the licensee failed to establish, implement, and
maintain a procedure appropriate to the circumstances of the 1B DG maintenance as
required in TS 5.4.1, resulting in the licensees failure to meet the DG operability
requirements in TS 3.8.1. Specifically, the licensee failed to establish, implement, and
maintain appropriate preventive maintenance instructions under PM 063604820 to properly
tighten the rear exhaust valve bridge adjuster locknut on the 1B DG cylinder #14, leading to
the failure of the DG on September 19, 2023, during a surveillance test.
Hence, further, contrary to the above, from January 25, 2023, through September 29, 2023,
the licensee failed to provide four operable DGs capable of supplying the onsite Class 1E AC
Electrical Power Distribution System. Specifically, given performance of the inadequate
preventive maintenance activity in January 2023, the 1B DG was unable to support design-
basis events.
Enforcement Action: This violation is being treated as an apparent violation pending a final
significance (enforcement) determination.
EXIT MEETINGS AND DEBRIEFS
The inspectors verified no proprietary information was retained or documented in this report.
On February 27, 2024, the inspectors presented the NRC inspection results to Mr. Tom
Marshall, Site Vice President, and other members of the licensee staff.
7
DOCUMENTS REVIEWED
Inspection
Procedure
Type
Designation
Description or Title
Revision or
Date
Corrective
Action
Documents
1881328
Unit 1 received
unexpected alarms
resulting in emergency
stopping 1B DG
09/19/2023
Corrective
Action
Documents
1882753
Perform inspection of
locking nuts on the rocker
assembly for 2B diesel
generator
09/26/2023
Corrective
Action
Documents
1900849
EDG engine 1B2 exhaust
valve failure
01/02/2024
Miscellaneous
SQN-0-24-008 R0
PRA Evaluation
Response
02/15/2024
Enclosure 2
UNIT 1 B-EDG DETAILED RISK EVALUATION
OVERALL RISK SUMMARY
The Sequoyah Unit 1 B-train emergency diesel generator (EDG) was rendered inoperable due
to significant damage to the #14-cylinder assembly during a surveillance test on September 19,
2023. A conditional risk evaluation using a 246-day exposure period preliminarily estimated an
increase in Core Damage Frequency (delta-CDF) of 2.68E-05/year for Unit 1 and 2.10E-05/year
for Unit 2. The Standardized Plant Analysis Risk (SPAR) model dominant sequences were
associated with station blackout (SBO) scenarios that did not include consideration of the
reactor decay heat removal and Reactor Coolant System (RCS) cooldown that would occur as
the result of the delayed onset nature of SBO plant conditions following the initial loss of offsite
power. Additional evaluation of the impact of the delayed onset of SBO conditions will be
necessary to refine the preliminary risk estimates before making a final significance
determination.
EXPOSURE TIME
The component run time failure approach discussed in Section 2.5 of Volume 1 of the Risk
Assessment Standardization Project (RASP) Manual was used to evaluate the condition
exposure time. The run history of the B-train EDG prior to the failure in September 2023 was
used to determine the number of intervals of accumulated operation for its 24-hour Probabilistic
Risk Assessment (PRA) mission time (condition inception time unknown but the degradation
was assumed to progress only during operation of the EDG). The final time interval included the
B-train EDG repair time after the failure was identified during the surveillance test. A total
exposure time of 246 days divided into eight run intervals, including repair time, was used for
the analysis.
RISK ANALYSIS/CONSIDERATIONS
Assumptions
1.
The condition was assumed to only continue to degrade when the EDG was operated and
not when in a standby status. Consequently, the component run time failure approach
discussed in Section 2.5 of Volume 1 of the RASP manual was used to evaluate the
condition exposure time. Based on the run history of the B-train EDG, a condition exposure
period of 246 days, divided into eight separate run intervals, and including repair time, was
used for the analysis. To explore the sensitivity of the evaluation method, a sensitivity case
will be performed that does not divide the 246-day exposure period into separate time
intervals.
2.
No repair credit for the failure of the B-train EDG was included in the analysis.
3.
Diverse and Flexible Coping Strategies (FLEX) mitigating strategies and equipment were
credited in the analysis using a 24-hour PRA mission time. FLEX equipment reliability was
modeled using information contained in PWROG-18042-NP, Revision 1, FLEX Equipment
Data Collection and Analysis, (ADAMS ML22123A259). A sensitivity case with no FLEX
credit was also performed.
Systems Analysis Program for Hands-On Integrated Reliability Evaluations (SAPHIRE) software
Version 8.2.9 and Sequoyah SPAR model Version 8.82 were used for the evaluation.
2
1.
The SPAR model was modified to account for the FLEX implementation strategy at
Sequoyah. A new SBO-ELAP event tree and top events were created with the following key
characteristics:
A top event for the FLEX 480V Diesel Generator (DG) sets which do not require
deployment and are in enclosures on the auxiliary building roof was created to query
the ability to power the battery chargers following Extended Loss of AC Power
(ELAP) declaration. Success of the 480V FLEX DGs would extend battery availability
for remainder of sequences.
A top event was created for powering the 6.9kV shut down boards from the 3 MW
6.9kV FLEX DGs which are permanently installed and located in a separate building
from the EDGs. Success of the 6.9kV FLEX DGs provides the ability to power in-
plant equipment like Motor-Drive Auxiliary Feedwater (MDAFW) and Safety Injection
(SI) pumps (in addition to FLEX mitigating equipment). The 6.9kV FLEX DGs can be
used to power the battery chargers should the 480V FLEX DGs fail. DC load
shedding at Sequoyah does not impact the ability to power components such as the
MDAFW pumps or SI pumps from the 6.9kV FLEX DGs. The corresponding top
events were modified to reflect the availability of safety-related components for
mitigation given the success of the 6.9kV FLEX DGs.
2.
The approach discussed in Section 2.5 of the RASP manual was used to evaluate the
condition exposure time. The run history of the B EDG prior to the failure in September
2023 was used to determine the number of intervals of accumulated operation of the EDG
for the 24-hour PRA mission time (condition inception time unknown but the engine
degradation mechanism was assumed to only progress during operation of the EDG). The
final 10 days being considered in the exposure time includes the EDG repair time after the
failure occurred.
The fault tree logic for the B-train EDG was modified to split the fail-to-run basic
event into two separate components so that adjustments could be made to credit
EDG operation prior to failure. The SAPHIRE convolution mapping tool was then
used to update model convolution events using the new fault tree logic.
For the conditional case, the model was adjusted using change set
1BEXT_EDG_FTR which set event EPS-DGN-FR-1B to TRUE so that the FTR
common cause change would be calculated by SAPHIRE. The change set also set
the new basic event EPS-DGN-FR-1BEXT to 1.0 so the failure would show up in
cutsets for post-processing adjustment made for credited EDG run time.
For each time interval, the mission time for basic events EPS-DGN-FR-1BT2 and
EPS-DGN-FR-1BEXT were adjusted to reflect the estimated run time before failure
and each time interval also included ET post-processing to look for B EDG FTR
basic event EPS-DGN-FR-1BEXT in the cutsets and substitute the appropriate
recovery terms based on credited EDG operation.
3
3.
For each time interval, event tree post-processing rules were used to substitute the
appropriate recovery terms based on credited EDG operation. This had the effect of
crediting some amount of time of 1B EDG operation prior to its failure when estimating the
likelihood of non-recovery of power sources to the shutdown boards. As an example, if the
EDG would be expected to operate for approximately six hours (at nominal failure
likelihood) prior to failure due to the performance deficiency, the one- and four-hour non-
recovery terms for Loss of Offsite Power (LOOP) recovery would be adjusted to seven and
ten hours respectively.
4.
A conditional case was performed for every interval bin and the results were summed to
determine the overall risk estimate.
5.
The following SPAR model event sequences were used in evaluating the nominal and
conditional cases:
INTERNAL EVENTS
FIRE
SEISMIC
TORNADO
EXTERNAL FLOODING
6.
SAPHIRE condition assessments were performed using the event tree direct solve method
where cutset results were gathered for sequences other than internal events. Conditional
case change set 1B_EDG_FTR was used to evaluate the change in risk that could be
attributed to the EDG failure for each time interval being evaluated over 236 days of the
exposure period. The final 10 days of repair time was estimated by performing a condition
assessment with the 1B EDG Test and Maintenance basic event (EPS-DGN-TM-1B) set to
TRUE for the conditional case.
7.
SAPHIRE condition assessments were also performed using the ECA module to generate
dominant sequence and cutset reports. Conditional case change set 1B_EDG_FTR was
used in the condition assessments.
4
CALCULATIONS
Best Estimate:
Interval
Exposure
(days)
Fire
-CDP
Int. Evnt
-CDP
Hi-Wind
-CDP
Seismic
-CDP
Int. Flood
-CDP
Tornado
-CDP
Ext. Flood
-CDP
1
26
1.49E-06
8.72E-07
3.26E-07
1.99E-08
9.19E-09
3.12E-09
9.26E-10
2
24
1.40E-06
8.17E-07
3.03E-07
1.84E-08
8.55E-09
2.87E-09
8.55E-10
3
38
2.24E-06
1.31E-06
4.83E-07
2.92E-08
1.35E-08
4.55E-09
1.35E-09
4
28
1.67E-06
9.78E-07
3.58E-07
2.15E-08
9.90E-09
3.34E-09
9.97E-10
5
28
1.68E-06
9.93E-07
3.61E-07
2.15E-08
9.90E-09
3.34E-09
9.97E-10
6
35
2.13E-06
1.26E-06
4.55E-07
2.68E-08
1.25E-08
4.18E-09
1.25E-09
7
29
1.79E-06
1.07E-06
3.81E-07
2.22E-08
1.03E-08
3.46E-09
1.03E-09
8
28
1.75E-06
1.07E-06
3.72E-07
2.15E-08
9.97E-09
3.34E-09
9.97E-10
Repair
10
5.69E-07
3.64E-07
9.99E-08
5.21E-09
3.23E-09
7.67E-10
2.19E-10
Total
246
1.47E-05
8.74E-06
3.14E-06
1.86E-07
8.71E-08
2.90E-08
8.62E-09
SAPHIRE condition assessments were performed using the direct solve method and conditional
case change set 1B_EDG_FTR. The overall estimated increase in risk was a change in Core
Damage Probability (delta-CDP) of 2.68E-05. FIRE sequences were determined to be strongly
dominant in the results with INTERNAL EVENTS and HIGH WINDS also significant sequence
contributors. SAPHIRE ECA condition assessments were performed to generate dominant
sequence and cutset reports.
Dominant FIRE cutsets were associated with fire initiating events in the shutdown board rooms
resulting in a LOOP. The LOOP is accompanied by common mode failure of the A-train
emergency diesel generator leading to an SBO with Reactor Coolant Pump (RCP) seal failure
resulting in core damage.
Dominant INTERNAL EVENT and HIGH WIND cutsets were associated with weather-related
LOOP with common mode failure of the A-train emergency diesel generator leading to an SBO
with either RCP seal failure (INTERNAL EVENT) or random failure of the turbine-driven auxiliary
feedwater pump to run (HIGH WIND).
Sensitivity 1 - No Time Intervals
To explore the sensitivity of the analysis results due to application of the run time treatment of
exposure time, this sensitivity will determine the estimated increase in risk-based on the full
exposure period without the use of time intervals or post-processing to adjust power recovery
terms.
5
SAPHIRE condition assessments were performed using the direct solve method and conditional
case change set 1B_EDG_FTR for the full 246-day exposure period.
Exposure
(days)
Fire
-CDP
Int. Evnt
-CDP
Hi-Wind
-CDP
Seismic
-CDP
Int. Flood
-CDP
Tornado
-CDP
Ext. Flood
-CDP
246
1.93E-05
1.23E-05
3.64E-06
1.82E-07
8.71E-08
2.90E-08
8.76E-09
The overall estimated increase in risk was a delta-CDP of 3.55E-05.
As expected, the sensitivity results were higher without consideration of the run history of the B
EDG or consideration for the increased time that would have been available to potentially
recover power sources for the affected safety bus. The higher estimate would not have been
sufficient to alter the overall conclusions of the analysis. The use of the run time failure
methodology was determined to be the most appropriate treatment of exposure time for the
analysis.
Sensitivity 2 - Use of SAPHIRE ECA vs. Direct Solve Method
Because SAPHIRE ECA was used to generate reports for the dominant sequence cutsets, the
information was readily available to assess the impact of the use of SAPHIRE ECA on the
quantification of results.
SAPHIRE ECA condition assessments were performed for the full exposure period (no run
intervals used) with the B EDG FTR basic event set to TRUE for the conditional case.
Exposure
(days)
Fire
-CDP
Int. Evnt
-CDP
Hi-Wind
-CDP
Seismic
-CDP
Int. Flood
-CDP
Tornado
-CDP
Ext. Flood
-CDP
246
2.05E-05
1.23E-05
3.86E-06
4.73E-07
9.76E-08
3.07E-08
8.33E-09
The overall estimated increase in risk was a delta-CDP of 3.73E-05.
The analyst noted that the analysis results were slightly higher than the use of no time intervals
in Sensitivity 1, but more significantly higher than the best estimate using the run time failure
approach. As with Sensitivity 1, the higher estimate would not have been sufficient to alter the
overall conclusions of the analysis.
Sensitivity 3 - No FLEX
To evaluate the sensitivity of analysis results with respect to crediting of FLEX mitigation
strategies, the basic event for operator failure to enter ELAP procedures was set to 1.0 for both
the nominal and conditional cases.
FLX-XHE-XE-ELAP = 1.0
SAPHIRE ECA condition assessments were performed for the full exposure period (no run
intervals used) with the B EDG FTR basic event set to TRUE for the conditional case.
6
Exposure
(days)
Fire
-CDP
Int. Evnt
-CDP
Hi-Wind
-CDP
Seismic
-CDP
Int. Flood
-CDP
Tornado
-CDP
Ext. Flood
-CDP
246
2.89E-05
1.83E-05
5.48E-06
5.47E-07
1.08E-07
4.85E-08
1.70E-08
The overall estimated increase in risk was a delta-CDP of 5.34E-05.
Although the analysis results demonstrated some sensitivity with respect to the crediting of the
FLEX, its importance in the risk estimate was tempered by dominant cutsets that involved early
failure of the Turbine-Drive Auxiliary Feedwater (TDAFW) pump or RCP seal failures where
FLEX mitigation is not credited in the base SPAR model based on the assumption that the SBO
occurs at the time of the LOOP. Although not a strongly influential factor, inclusion of FLEX
mitigation was determined to be most appropriate to the circumstances and was considered in
the best estimate case.
CROSS-UNIT IMPACT
Because the EDGs have the capability of supplying power to the other units associated
shutdown boards, the impact of the performance deficiency on Unit 2 was assessed. The fail-to-
run basic event for the 2B EDG (EPS-DGN-FR-2B) was used as a surrogate for the cross-unit
impact and set to TRUE because the SPAR model is a Unit 1 model. An ECA condition
assessment over the entire 246-day exposure period was performed using FIRE sequences.
FIRE sequences were selected because they were the most dominant in the analysis results.
The condition analysis for Unit 2 yielded an estimated delta-CDP of 1.61E-05 vs. the Unit 1
delta-CDP of 2.05E-05 for un-binned FIRE sequences. The analyst noted that the Unit 2 risk
estimate for FIRE sequences was approximately 79% of the Unit 1 results. Applying that level of
reduction to the overall binned Unit 1 results (as a representative impact to Unit 2) would
produce an estimated delta-CDP of 2.10E-05 for Unit 2.
LICENSEE EVALUATION
The licensee provided the NRC with an evaluation of the estimated increase in risk of the Unit 1
B-train EDG failure on February 15, 2024. The licensees evaluation included an analysis of the
impact of delayed onset of SBO conditions on mitigation of the key accident sequences
including those associated with RCP seal failure and TDAFW pump failure. Additional NRC
review of the licensees evaluation will be performed prior to reaching a final decision regarding
the significance of the finding.
7
DELTA CDF FOR EXPOSURE TIME
The overall preliminary results are summarized below:
EVENT SEQUENCE
Best
Estimate
Sensitivity #1
No Intervals
Sensitivity #2
Sensitivity #3
FIRE
1.47E-05
1.93E-05
2.05E-05
2.89E-05
INTERNAL EVENTS
8.74E-06
1.23E-05
1.23E-05
1.83E-05
3.14E-06
3.64E-06
3.86E-06
5.48E-06
SEISMIC
1.86E-07
1.82E-07
4.73E-07
5.47E-07
3.23E-09
8.71E-08
9.76E-08
1.08E-07
TORNADO
2.90E-08
2.90E-08
3.07E-08
4.85E-08
EXTERNAL FLOODING
8.62E-09
8.76E-09
8.33E-09
1.70E-08
TOTAL
2.68E-05
3.55E-05
3.73E-05
5.34E-05
Considering that SAPHIRE calculates the difference in Core Damage Probability over a given
exposure time, and that changes in CDF over the same period are numerically equivalent, the
change in CDF due to the finding would be on the order of 2.68E-05/year for Unit 1.
EXTERNAL EVENTS CONSIDERATIONS
Internal event risk estimates were greater than 1E-07, therefore all other external event
sequences were evaluated in the risk assessment.
LARGE EARLY RELEASE FREQUENCY IMPACT
The finding was evaluated in accordance with IMC 0609, Appendix H, Containment Integrity
Significance Determination Process, as a Type A finding. The dominant sequences in the
analysis are LOOP sequences and not Steam Generator Tube Rupture (SGTR) or Interfacing
System Loss of Coolant Accident (ISLOCA). The 6.9KV FLEX DGs can power the hydrogen
igniters through the 480V shutdown power distribution system. Additionally, the 480V FLEX
DGs can also be aligned to provide power to the hydrogen igniter supply transformers, if
required. The ability to restore power to the hydrogen igniters from FLEX equipment reduces the
likelihood of containment failure for SBO scenarios. For a LOOP/SBO sequence to represent
large early release frequency (LERF), core damage and containment failure must occur early in
the sequence and prior to the implementation of the site emergency plan for evacuation. The
analyst determined that additional evaluation would be warranted prior to making any
determination of delta-LERF risk. Specifically, the dominant cutsets would be reviewed to
determine if they represent a loss of secondary heat removal and failure of the FLEX DGs
simultaneously with an early failure of other mitigating equipment.
CONCLUSIONS/RECOMMENDATIONS
The preliminary estimated risk increase (delta-CDF) over the nominal case for the inoperability
of the Unit 1 B-train EDG was 2.68E-05/year (Unit 1) and 2.10E-05/year for Unit 2 (due to the
cross-unit impact). The dominant SPAR model sequences were associated with fire initiating
events that involved impact to the normal offsite power supply, unavailability of the A-train EDG
due to random failure or fire damage, resulting in station blackout (SBO) plant conditions,
followed by a reactor coolant pump seal failure or
8
turbine-driven auxiliary feedwater pump failure. Because the B-train EDG would have been
expected to operate for some period at nominal failure likelihood prior to onset of SBO
conditions, additional analysis of the impact of the delayed SBO on the potential mitigation of
the dominant accident sequences will be necessary before reaching a final determination of
significance. Accordingly, the finding is best characterized as preliminary greater-than-Green.