ML24214A330

MD 8.3 Evaluation for EDG Repeated Failures

ML24214A330
Person / Time
Site:	Cook
Issue date:	07/25/2024
From:	NRC/RGN-III/DORS/ERPB
To:
Shared Package
ML24214A294	List: ML24214A325 ML24214A330
References
Download: ML24214A330 (1)

Text

MD 8.3 Evaluation Decision Documentation for Reactive Inspection (Deterministic and Risk Criteria Analyzed)

PLANT:

D.C. Cook EVENT DATE:

7/23/2024 DETERMINISTIC CRITERIA EVALUATION DATE:

7/25/2024 During a scheduled surveillance on July 23, 2024, at 22:41 EST, the Emergency Diesel Generator (EDG) 2AB failed to stabilize at the required 60 Hz. Initially, the frequency stabilized at 59.35 Hz and did not meet the acceptance criteria of 59.4 Hz. When operators took manual control and attempted to raise frequency, it smoothly increased to 59.7 Hz but jumped to 60.2 Hz with a small adjustment. Decreasing the frequency had the opposite effect, and the EDG could not stabilize at 60 Hz.

Previously, on May 21, 2024, EDG 2AB failed to maintain its frequency during a planned surveillance. The frequency indication was erratic, prompting the licensee to take manual control locally at the EDG. The licensee attributed the failure to corrosion on a relay that interfered with the setpoint signal for frequency. The relay was cleaned and placed back in service, and the 2AB EDG was successfully ran twice during post-maintenance testing. The licensee did not obtain forensic information from the relay, such as resistance measurements. The 2AB EDG was within its planned preventative maintenance (PM) frequency of 12 refueling cycles (18 years), with the last PM performed 13 years prior to the failure.

Over the past two years, the licensee experienced failures with the 2CD EDG involving frequency issues. The licensee attributed those failures to malfunctioning digital reference units (DRUs), due to a manufacturing issue (10 CFR 21 ADAMS# ML23312A231). In August 2023, the 2CD EDG failed a slow-speed start monthly surveillance due to an unacceptable frequency drop, caused by a degraded DRU. The vendor discovered a cracked solder connection within the DRU. Similarly, in October 2022, during a refueling outage, the 2CD EDG failed a test due to an unacceptable frequency drop, attributed to a malfunctioning DRU. The defective DRU was sent to the vendor but returned unrepaired as the malfunction could not be reproduced.

All four recent EDG failures included erratic frequency behavior. Some of these failures involved intermittent issues, such as the difficulty in reproducing the DRU malfunction from October 2022, highlighting the challenge in diagnosing causes. At the time of the 2024 failures, all DRUs have been replaced with components verified to have reworked solder connections.

For context, each reactor unit is equipped with two redundant EDGs, totaling four EDGs.

Y/N DETERMINISTIC CRITERIA N

1. Involved operations that exceeded, or were not included in, the design bases of the facility Remarks: No operations that exceeded or were not included in the design basis.

N

2. Involved a major deficiency in design, construction, or operation having potential generic safety implications Remarks: No known major deficiencies having generic safety implications.

2 N

3. Led to a significant loss of integrity of the fuel, primary coolant pressure boundary, or primary containment boundary of a nuclear reactor Remarks: No known loss of integrity to any fuel barrier.

N

4. Led to the loss of a safety function or multiple failures in systems used to mitigate an actual event Remarks: No loss of safety function or multiple failures in systems used to mitigate an actual event occurred.

N

5. Involved possible adverse generic implications Remarks: No known generic implications.

N

6. Involved significant unexpected system interactions Remarks: No known significant unexpected system interactions.

Y

7. Involved repetitive failures or events involving safety-related equipment or deficiencies in operations Remarks: As discussed on page 1, there have been four instances of EDG failures involving erratic frequency behavior in the past two years. Two of these failures exhibited intermittent erratic frequency behavior in the 2CD EDG, which the licensee attributed to defective DRUs with cracked solder connections. Cracked solder connections were subsequently found in other DRUs examined, including spare DRUs and those installed in other EDGs. The third failure was attributed to corroded relay contacts in the 2AB EDG. Although the erratic frequency behavior ceased immediately after cleaning the contacts, the licensee did not collect forensic information, such as resistance measurements of the corroded contacts.

The previous issues of intermittent erratic frequency behavior, a fourth failure due to frequency, and the replacement of all DRUs with components verified to have reworked solder connections prior to the last two failures, along with the lack of the licensees forensic analysis for the third failure, raise questions about the licensee's maintenance practices and problem identification and resolution efforts. Additionally, the repeated EDG failures raise concerns about the overall reliability of the EDGs.

N

8. Involved questions or concerns pertaining to licensee operational performance Remarks: No known issues involving operational performance.

3 CONDITIONAL RISK ASSESSMENT RISK ANALYSIS BY: Josh Havertape DATE: 7/25/2024 Brief Description of the Basis for the Assessment (may include assumptions, calculations, references, peer review, or comparison with licensees results):

A regional senior reactor analyst (SRA), using SAPHIRE version 8.2.10, and the D.C. Cook SPAR model version 8.82, completed a condition assessment for the degraded 2AB emergency diesel generator (EDG) frequency control condition. The SRA represented the degraded condition with the basic event for 1AB EDG failure to start (FTS) as a surrogate for the 2AB EDG since the SPAR model is combined, multi-unit, model. FTS was used since the EDG was neither electrically loaded nor reached a steady state operating condition. The nominal test and maintenance model was used with the exception that the supplemental diesels were determined to be available for use during the period of the condition assessment. As such, their corresponding test and maintenance events were set to FALSE. The exposure period was assumed to be 32 days, which corresponded to the last successful test of the EDG. However, it was recognized that the exposure period could be larger due to unidentified latent conditions which would increase the risk associated with the degraded condition and is a source of uncertainty in this evaluation.

A best estimate conditional core damage probability (CCDP) estimate was represented by setting the basic event for EDG 1AB FTS, EPS-DGN-FS-1AB, equal to TRUE. This fails the 1AB EDG and invokes a potential common cause failure (CCF) to start of the other train EDG.

The estimated conditional core damage probability (CCDP) and incremental CCDP are:

2.7E-6/year and 6.6E-7/year, respectively.

Based on discussions with inspectors, the SRA assessed that there was uncertainty whether the EDG 1AB was recoverable because frequency response of the EDG was erratic when manual control was taken. Therefore, a sensitivity case was run to evaluate potential recovery of the 1AB EDG. Using SPAR-H, a human error probability (HEP) of 0.5 was estimated for this recovery action. The SRA noted that a previous MD 8.3 evaluation for an EDG speed control issue at D.C. Cook (ML24199A199) on May 21st, 2024, estimated an HEP of 0.2. However, in the current evaluation the HEP was adjusted to reflect challenges associated with EDG speed control, which were not experienced on May 21st, 2024. For the sensitivity case the SRA substituted the 1AB EDG recovery HEP for the 1AB EDG failure probability. In addition, to account for potential latent degraded conditions and common cause aspects, all EDG start, run, and CCF event probabilities were doubled. The estimated conditional core damage probability (CCDP) and incremental CCDP are: 2.4E-6/year and 3.8E-7/year, respectively.

Sensitivity cases showed the best estimate CCDP is insensitive to the HEP, but ICCDP was sensitive. Both cases were insensitive to FLEX credit. In both cases the dominant accident sequence was weather-related loss of offsite power, CCF of the EDGs, and failure to restore offsite power or emergency on-site power.

This assessment did not account for contribution by external events, which would only increase the risk. Fire risk would be considered a non-trivial contributor.

4 The estimated conditional core damage probability (CCDP) is 2.4 to 2.7E-6/yr and places the risk in the range of no additional follow-up and special inspection.

RESPONSE DECISION USING THE ABOVE INFORMATION AND OTHER KEY ELEMENTS OF CONSIDERATION AS APPROPRIATE, DOCUMENT THE RESPONSE DECISION TO THE EVENT OR CONDITION, AND THE BASIS FOR THAT DECISION DECISION AND DETAILS OF THE BASIS FOR THE DECISION: There have been four instances of EDG failures involving erratic frequency behavior in the past two years. Two of these failures exhibited intermittent erratic frequency behavior in the 2CD EDG, which the licensee attributed to defective DRUs with cracked solder connections. Cracked solder connections were subsequently found in other DRUs, including spare DRUs and those installed in other EDGs. The NRC evaluated these failures for a reactive inspection (ML23243B001) and determined that the risk level ranged from no additional follow-up to a special inspection. It ultimately concluded that a special inspection was not actionable at that time, given the absence of additional information to review by a special inspection and the ongoing extent of condition investigation by the licensee. Instead, a focused baseline inspection was conducted, which did not identify any performance deficiencies.

The third failure was attributed to corroded relay contacts in the 2AB EDG. Although the erratic frequency behavior ceased immediately after cleaning the contacts, the licensee did not collect forensic information, such as resistance measurements of the corroded contacts. The NRC evaluated this failure for a reactive inspection (ML24165A108) and again determined that the risk level ranged from no additional follow-up to a special inspection. Again, the NRC determined that another focused baseline inspection was warranted because the cause appeared to be different from the previous failures. This second focused inspection was scheduled to start on July 29, 2024.

This third reactive inspection evaluation addresses a fourth EDG failure involving frequency issues, which occurred on July 23, 2024, before the start of the second focused baseline inspection. The resulting estimated conditional core damage probability (CCDP) is 2.4 to 2.7E-6/yr, which again places the risk in the range of no additional follow-up and special inspection. Considering the previous issues of intermittent erratic frequency behavior, a fourth failure due to frequency, and the replacement of all DRUs with components verified to have reworked solder connections prior to the last two failures, along with the lack of the licensees forensic analysis for the third failure, raise questions about the licensee's maintenance practices and problem identification and resolution efforts. Additionally, the repeated EDG failures raise concerns about the overall reliability of the EDGs. Therefore, a special inspection is now recommended.

5 BRANCH CHIEF: Néstor J Féliz Adorno /RA/

DATE: 07/29/2024 SRA: Joshua Havertape /RA/

DATE: 07/29/2024 DIVISION DIRECTOR: Jason Kozal /RA/

DATE: 07/30/2024 DIVISION DIRECTOR:

DATE:

DEPUTY RA: Mohammed Shuaibi /RA/

DATE: 07/29/2024 ADAMS ACCESSION NUMBER: ML24214A330 ADAMS PACKAGE ACCESSION NUMBER: ML24214A294 EVENT NOTIFICATION REPORT NUMBER (as applicable):

Internal Distribution List is at the end of this document.

6 Decision Documentation for Reactive Inspection (Deterministic-only Criteria Analyzed)

PLANT:

EVENT DATE:

EVALUATION DATE:

Brief Description of the Significant Event or Degraded Condition: Refer to Page 1.

REACTOR SAFETY Y/N IIT Deterministic Criteria N

1. Led to a Site Area Emergency Remarks: No emergency declaration was made.

N

2. Exceeded a safety limit of the licensee's technical specifications Remarks: No safety limits were exceeded.

N

3. Involved circumstances sufficiently complex, unique, or not well enough understood, or involved safeguards concerns, or involved characteristics the investigation of which would best serve the needs and interests of the Commission Remarks: Did not involved such circumstances.

Y/N SI Deterministic Criteria N

4. Significant failure to implement the emergency preparedness program during an actual event, including the failure to classify, notify, or augment onsite personnel Remarks: Licensee did not meet the criteria to declare an event.

N

5. Involved significant deficiencies in operational performance which resulted in degrading, challenging, or disabling a safety system function or resulted in placing the plant in an unanalyzed condition for which available risk assessment methods do not provide an adequate or reasonable estimate of risk.

Remarks: Operators responded as expected.

7 RADIATION SAFETY Y/N IIT Deterministic Criteria N

1. Led to a significant radiological release (levels of radiation or concentrations of radioactive material in excess of 10 times any applicable limit in the license or 10 times the concentrations specified in 10 CFR Part 20, Appendix B, Table 2, when averaged over a year) of byproduct, source, or special nuclear material to unrestricted areas Remarks: No radiological release was involved.

N

2. Led to a significant occupational exposure or significant exposure to a member of the public. In both cases, significant is defined as five times the applicable regulatory limit (except for shallow-dose equivalent to the skin or extremities from discrete radioactive particles)

Remarks: No occupational or public exposure was involved.

N

3. Involved the deliberate misuse of byproduct, source, or special nuclear material from its intended or authorized use, which resulted in the exposure of a significant number of individuals Remarks: No known deliberate misuse and no exposure.

N

4. Involved byproduct, source, or special nuclear material, which may have resulted in a fatality Remarks: Did not involve nuclear material which may have resulted in a fatality.

N

5. Involved circumstances sufficiently complex, unique, or not well enough understood, or involved safeguards concerns, or involved characteristics the investigation of which would best serve the needs and interests of the Commission Remarks: No sufficiently complex circumstances warranting Commission interest.

Y/N AIT Deterministic Criteria N

6. Led to a radiological release of byproduct, source, or special nuclear material to unrestricted areas that resulted in occupational exposure or exposure to a member of the public in excess of the applicable regulatory limit (except for shallow-dose equivalent to the skin or extremities from discrete radioactive particles)

Remarks: No radiological release of nuclear material exceeding regulatory limits.

8 N

7. Involved the deliberate misuse of byproduct, source, or special nuclear material from its intended or authorized use and had the potential to cause an exposure of greater than 5 rem to an individual or 500 mrem to an embryo or fetus Remarks: No deliberate misuse of materials was involved.

N

8. Involved the failure of radioactive material packaging that resulted in external radiation levels exceeding 10 rads/hr or contamination of the packaging exceeding 1000 times the applicable limits specified in 10 CFR 71.87 Remarks: No failure of radioactive material packaging was involved.

N

9. Involved the failure of the dam for mill tailings with substantial release of tailings material and solution off site Remarks: No failure of a dam for mill tailings was involved.

Y/N SI Deterministic Criteria N

10. May have led to an exposure in excess of the applicable regulatory limits, other than via the radiological release of byproduct, source, or special nuclear material to the unrestricted area; specifically occupational exposure in excess of the regulatory limits in 10 CFR 20.1201 exposure to an embryo/fetus in excess of the regulatory limits in 10 CFR 20.1208 exposure to a member of the public in excess of the regulatory limits in 10 CFR 20.1301 Remarks: No exposure in excess of the applicable regulatory limits was involved.

N

11. May have led to an unplanned occupational exposure in excess of 40 percent of the applicable regulatory limit (excluding shallow-dose equivalent to the skin or extremities from discrete radioactive particles)

Remarks: No unplanned occupation exposure was involved.

N

12. Led to unplanned changes in restricted area dose rates in excess of 20 rem per hour in an area where personnel were present, or which is accessible to personnel Remarks: No unplanned changes in restricted area dose rates were involved.

N

13. Led to unplanned changes in restricted area airborne radioactivity levels in excess of 500 DAC in an area where personnel were present, or which is accessible to personnel and where the airborne radioactivity level was not promptly recognized and/or appropriate actions were not taken in a timely manner Remarks: No unplanned changes in airborne radioactivity levels were involved.

9 N

14. Led to an uncontrolled, unplanned, or abnormal release of radioactive material to the unrestricted area for which the extent of the offsite contamination is unknown; or, that may have resulted in a dose to a member of the public from loss of radioactive material control in excess of 25 mrem (10 CFR 20.1301(e)); or, that may have resulted in an exposure to a member of the public from effluents in excess of the ALARA guidelines contained in Appendix I to 10 CFR Part 50 Remarks: No uncontrolled, unplanned, or abnormal releases of radioactive material to the unrestricted area were involved.

N

15. Led to a large (typically greater than 100,000 gallons), unplanned release of radioactive liquid inside the restricted area that has the potential for ground-water, or offsite, contamination Remarks: No large, unplanned release of radioactive liquid inside the restricted area was involved.

N

16. Involved the failure of radioactive material packaging that resulted in external radiation levels exceeding 5 times the accessible area dose rate limits specified in 10 CFR Part 71, or 50 times the contamination limits specified in 49 CFR Part 173 Remarks: No failure of radioactive materials packaging was involved.

N

17. Involved an emergency or non-emergency event or situation, related to the health and safety of the public or on-site personnel or protection of the environment, for which a 10 CFR 50.72 report has been submitted that is expected to cause significant, heightened public or government concern Remarks: There was no 10 CFR 50.72 report submitted nor expected for this event.

SAFEGUARDS/SECURITY Y/N IIT Deterministic Criteria N

1. Involved circumstances sufficiently complex, unique, or not well enough understood, or involved safeguards concerns, or involved characteristics the investigation of which would best serve the needs and interests of the Commission Remarks: The circumstances surrounding the event did not involve safeguards.

N

2. Failure of licensee significant safety equipment or adverse impact on licensee operations as a result of a safeguards initiated event (e.g., tampering).

10 Remarks: No safeguards initiated event was involved.

N

3. Actual intrusion into the protected area Remarks: No intrusion into the protected area.

Y/N AIT Deterministic Criteria N

4. Involved a significant infraction or repeated instances of safeguards infractions that demonstrate the ineffectiveness of facility security provisions Remarks: No infractions demonstrating ineffectiveness of facility security provisions were involved.

N

5. Involved repeated instances of inadequate nuclear material control and accounting provisions to protect against theft or diversions of nuclear material Remarks: No instances of inadequate nuclear material control and accounting provisions were involved.

N

6. Confirmed tampering event involving significant safety or security equipment Remarks: No tampering was involved.

N

7. Substantial failure in the licensees intrusion detection or package/personnel search procedures which results in a significant vulnerability or compromise of plant safety or security Remarks: No failures in the licensees intrusion detection or package/personnel search procedures were involved.

Y/N SI Deterministic Criteria N

8. Involved inadequate nuclear material control and accounting provisions to protect against theft or diversion, as evidenced by inability to locate an item containing special nuclear material (such as an irradiated rod, rod piece, pellet, or instrument)

Remarks: No inadequate nuclear material control and accounting provisions were involved.

N

9. Involved a significant safeguards infraction that demonstrates the ineffectiveness of facility security provisions

11 Remarks: No safeguards infractions were involved.

N

10. Confirmation of lost or stolen weapon Remarks: No weapons were lost or stolen.

N

11. Unauthorized, actual non-accidental discharge of a weapon within the protected area Remarks: No discharge of a weapon occurred.

N

12. Substantial failure of the intrusion detection system (not weather related)

Remarks: There were not failures of the intrusion detection system.

N

13. Failure to the licensees package/personnel search procedures which results in contraband or an unauthorized individual being introduced into the protected area Remarks: No failures of package/personnel search procedures were involved.

N

14. Potential tampering or vandalism event involving significant safety or security equipment where questions remain regarding licensee performance/response, or a need exists to independently assess the licensees conclusion that tampering, or vandalism was not a factor in the condition(s) identified Remarks: No tampering or vandalism was involved.

12 RESPONSE DECISION USING THE ABOVE INFORMATION AND OTHER KEY ELEMENTS OF CONSIDERATION AS APPROPRIATE, DOCUMENT THE RESPONSE DECISION TO THE EVENT OR CONDITION, AND THE BASIS FOR THAT DECISION.

DECISION AND DETAILS OF THE BASIS FOR THE DECISION:

BRANCH CHIEF:

DATE:

SRA:

DATE:

DIVISION DIRECTOR:

DATE:

DIVISION DIRECTOR:

DATE:

ADAMS ACCESSION NUMBER: ML24214A330 ADAMS PACKAGE ACCESSION NUMBER: ML24214A294 EVENT NOTIFICATION REPORT NUMBER (as applicable):

Distribution: Michelle.Simmons@nrc.gov; Scott.Morris@nrc.gov; Jason.Carneal@nrc.gov; John.Giessner@nrc.gov; Mohammed.Shuaibi@nrc.gov; Blake.Welling@nrc.gov; Ray.McKinley@nrc.gov;Mark.Franke@nrc.gov; Gregory.Suber@nrc.gov; LaDonna.Suggs@nrc.gov; Laura.Pearson@nrc.gov; Jason.Kozal@nrc.gov; Billy.Dickson@nrc.gov; David.Curtis@nrc.gov; Jonathan.Feibus@nrc.gov; Geoffrey.Miller@nrc.gov; Michael.Hay@nrc.gov; Thomas.Briley@nrc.gov; Doris.Chyu@nrc.gov; Joshua.Havertape@nrc.gov; Dariusz.Szwarc@nrc.gov; NRR_Reactive_Inspection.Resource@nrc.gov