IR 05000382/2025090
| ML25097A205 | |
| Person / Time | |
|---|---|
| Site: | Waterford  |
| Issue date: | 04/09/2025 |
| From: | Geoffrey Miller NRC/RGN-IV/DORS |
| To: | Sullivan J Entergy Operations |
| References | |
| EAF-RIV-2025-0090 IR 2025090 | |
| Download: ML25097A205 (1) | |
Text
April 09, 2025
SUBJECT:
WATERFORD STEAM ELECTRIC STATION, UNIT 3 - NRC INSPECTION REPORT 05000382/2025090 AND PRELIMINARY WHITE FINDING
Dear Joseph Sullivan:
On March 20, 2025, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at Waterford Steam Electric Station, Unit 3. On April 3, 2025, the NRC inspectors discussed the results of this inspection with you and other members of your staff. The results of this inspection are documented in the enclosed report.
The enclosed report discusses a preliminary White finding (i.e., a finding with low to moderate safety significance that may require additional NRC inspections), with an associated apparent violation. As described in the enclosed report, NRC inspectors determined the failure to properly develop and implement adequate maintenance instructions for the fuel linkage connection to the mechanical governor for emergency diesel generator A was a performance deficiency that was within the licensees ability to foresee and correct.
As described in section 71111.24 of the enclosed report, on October 10, 2024, while troubleshooting emergency diesel generator A post-maintenance test trip, the linkage from the governor to the diesel fuel oil racks was discovered to be disconnected. The linkage was reconnected and emergency diesel generator A completed a successful surveillance test on the same day. On February 4, 2025, it was discovered that the linkage was incorrectly assembled as the washer was in the wrong location. Damage (mechanical wearing) of the governors pivot arm was also discovered. A review of maintenance work instructions indicate that this condition likely existed since June 2016. The NRC assessed the significance of the finding using the significance determination process (SDP) and readily available information. The final resolution of this finding will be conveyed in separate correspondence.
The finding has an associated apparent violation which is being considered for escalated enforcement in accordance with the NRC Enforcement Policy, which can be found on the NRC website at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. The apparent violation involves the failure to have adequate work instructions for activities affecting quality in accordance with of Title 10 of the Code of Federal Regulations (10 CFR) 50, Appendix B, Criterion V.
In accordance with NRC Inspection Manual Chapter 0609, we intend to complete our evaluation using the best available information and issue our final significance determination and enforcement decision, in writing, within 90 days from the date of this letter. The NRCs significance determination process encourages an open dialogue between your staff and the NRC; however, the dialogue should not impact the timeliness of our final determination.
Before we make a final decision on this matter, we are providing you with an opportunity to either: (1) attend a regulatory conference where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance, or (2) submit your position on the finding to the NRC in writing. If you request a regulatory conference, it should be held within 40 days of the receipt of this letter, and we encourage you to submit supporting documentation at least one week prior to the conference to make the conference more efficient and effective. The focus of the regulatory conference is to discuss the significance of the finding and not necessarily the root cause(s) or corrective action(s)
associated with the finding. If a regulatory conference is held, it will be open for public observation. If you decide to submit only a written response, such submittal should be sent to the NRC within 40 days of your receipt of this letter.
If you choose to respond in writing, your response should be clearly marked as a Response to Apparent Violation in NRC Inspection Report 05000382/2025090; EAF-RIV-2025-0090 and should include for the apparent violation: (1) the reason for the apparent violation or, if contested, the basis for disputing the apparent violation; (2) the corrective steps that have been taken and the results achieved; (3) the corrective steps that will be taken; and (4) the date when full compliance will be achieved. Your response may reference or include previously docketed correspondence if the correspondence adequately addresses the required response. To the extent possible, your response should not include any personal privacy or proprietary information so that it can be made available to the public without redaction.
Additionally, your written response should be sent to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington DC 20555-0001 with a copy to the Director, Division of Operating Reactor Safety, U.S. Nuclear Regulatory Commission, Region IV, 1600 East Lamar Blvd., Arlington, Texas 76011-4511, and the NRC Resident Inspector at Waterford Steam Electric Station, Unit 3, and emailed to R4Enforcement@nrc.gov, within 40 days of the date of this letter. If an adequate response is not received within the time specified or an extension of time has not been granted by the NRC, the NRC will proceed with its enforcement decision or schedule a regulatory conference.
Please contact John Dixon at (817) 200-1574 within 10 days from the issue date of this letter to notify the NRC of your intention to attend a regulatory conference or provide a written response.
If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision.
If you decline to request a regulatory conference or to submit a written response, you relinquish your right to appeal the final significance determination process determination, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisite and Limitation sections of Attachment 2 of NRC Inspection Manual Chapter 0609.
In accordance with 10 CFR 2.390 of the NRCs Agency Rules of Practice and Procedure, a copy of this letter, its enclosure, and your response, if you choose to provide one, will be made available electronically for public inspection in the NRC Public Document Room and from the NRCs Agencywide Documents Access and Management System (ADAMS), accessible from the NRC website at http://www.nrc.gov/reading-rm/adams.html. If you have any questions concerning this matter, please contact John Dixon of my staff at (817) 200-1574.
Sincerely, Geoffrey B. Miller, Director Division of Operating Reactor Safety Docket No. 05000382 License No. NPF-38
Enclosures:
(1) Inspection Report (2) Detailed Risk Evaluation
Inspection Report
Docket Number:
05000382
License Number:
Report Number:
Enterprise Identifier:
I-2025-090-0005
Licensee:
Entergy Operations, Inc.
Facility:
Waterford Steam Electric Station, Unit 3
Location:
Killona, LA
Inspection Dates:
January 8, 2025 - March 20, 2025
Inspectors:
K. Chambliss, Senior Resident Inspector
K. Cook-Smith, Resident Inspector
C. Young, Senior Reactor Analyst
Approved By:
John L. Dixon, Jr., Chief
Reactor Projects Branch D
Division of Operating Reactor Safety
1-2
SUMMARY
The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees performance by conducting an integrated inspection at Waterford Steam Electric Station, Unit 3, in accordance with the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for overseeing the safe operation of commercial nuclear power reactors. Refer to https://www.nrc.gov/reactors/operating/oversight.html for more information.
List of Findings and Violations
Emergency Diesel Generator A Failure to Run Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Preliminary White EAF-RIV-2025-0090 AV 05000382/2025090-01 Open
[H.12] - Avoid Complacency 71111.24 The inspectors reviewed a self-revealed finding of preliminary White significance and associated apparent violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions,
Procedures, and Drawings, for the licensees failure to have adequate emergency diesel generator maintenance procedures. Specifically, work orders related to governor replacements and the connection to the fuel oil linkage mechanism were inadequate. These inadequate maintenance procedures resulted in misalignment of the rod end, mechanical interference, and led to the mechanical linkage separating during a post-maintenance test run.
Additional Tracking Items
None.
1-3
INSPECTION SCOPES
Inspections were conducted using the appropriate portions of the inspection procedures (IPs) in effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with their attached revision histories are located on the public website at http://www.nrc.gov/reading-rm/doc-collections/insp-manual/inspection-procedure/index.html. Samples were declared complete when the IP requirements most appropriate to the inspection activity were met consistent with Inspection Manual Chapter (IMC) 2515, Light-Water Reactor Inspection Program - Operations Phase. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel to assess licensee performance and compliance with Commission rules and regulations, license conditions, site procedures, and standards.
REACTOR SAFETY
71111.24 - Testing and Maintenance of Equipment Important to Risk
The inspectors evaluated the following testing and maintenance activities to verify system operability and/or functionality:
Post-Maintenance Testing (PMT) (IP Section 03.01) (1 Sample)
(1)emergency diesel generator A governor replacement maintenance and various maintenance activities associated with the governor linkage on March 10,
INSPECTION RESULTS
Emergency Diesel Generator A Failure to Run Cornerstone Significance Cross-Cutting Aspect Report Section Mitigating Systems Preliminary White EAF-RIV-2025-0090 AV 05000382/2025090-01 Open
[H.12] - Avoid Complacency 71111.24 The inspectors reviewed a self-revealed finding of preliminary White significance and associated apparent violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, for the licensees failure to have adequate emergency diesel generator maintenance procedures. Specifically, work orders related to governor replacements and the connection to the fuel oil linkage mechanism were inadequate. These inadequate maintenance procedures resulted in misalignment of the rod end, mechanical interference, and led to the mechanical linkage separating during a post-maintenance test run.
Description:
On October 7, 2024, while performing a 24-hour surveillance test on emergency diesel generator (EDG) A, an operator secured the diesel due to irregular reactive megavolt ampere reactive (MVAR) oscillations. On October 9, after troubleshooting and repairing the issue, the licensee began a post-maintenance test run of the diesel when it tripped due to a reverse power relay signal. The licensee postulated the probable cause was a sensitive relay that tripped due to installed monitoring equipment that was connected to the same relay. The licensee removed the monitoring equipment and recalibrated the relay. On October 10, they began a subsequent post maintenance test and the diesel immediately tripped on a mechanical overspeed trip. The licensee discovered the cause of this trip was one of the rod
1-4 end linkages between the governor and the fuel oil linkage was disconnected. Further review of the reverse power trip determined the linkage became disconnected during the run on October 9.
On October 10, the fuel oil linkage to the governor was reconnected and torqued using technical document TD-C629.0045, Cooper-Bessemer KSV Diesel Generator Nuclear Power Plant Emergency Stand-by Operation and Maintenance Manual, revision 22, and a post-maintenance test of the diesel was completed satisfactorily, and EDG A was declared operable.
On February 4, 2025, the licensee inspected the same joint and found it had been incorrectly assembled; the installed washer was in the incorrect location resulting in mechanical wearing of the governors pivot arm. The washer was placed underneath the bolt in lieu of its vendor-specified position in between the linkage and the governor pivot arm as a spacer. The licensee determined the washer was correctly placed in 2015, and subsequent work done between 2016 and 2018 incorrectly relocated the washer. As a result of this incorrectly placed washer, the rod end was mechanically binding with the governor pivot arm and causing the corner of the governor pivot arm to deform.
The Cooper-Bessemer technical document TD-C629.0045, illustrated the correct assembly of the rod end joint. The installed sub-assembly containing the bolt did not have the washer in the correct location; instead, it was located under the hex head versus between the rod end and the pivot arm. The joint was therefore not assembled in accordance with this drawing.
The licensee concluded the failure mechanism of this linkage was the misalignment of the rod end causing interference between the rod end and the governor pivot arm. Starting of the diesel in this condition resulted in these two components interfering with each other, therefore loosening the torqued linkage connection. Vibration of the diesel then further loosened the connection until the fastener completely backed out of the governor pivot arm. This incorrect assembly of the linkage represented a loss of configuration control for EDG A because of inadequate maintenance procedures.
Multiple work orders were executed that contributed to this failure:
1. June 2016: the rod ends of EDG A were replaced using work order WO-00434438
due to wear on these joints. This work order did not mention placement of the washer.
2. January 2018: the mechanical governor was replaced using work order WO-
00482368. During this maintenance activity the rod end linkage appears to have been disassembled as part of this replacement. This work order also did not mention placement of the washer.
3. January 6, 2024: the governor was replaced using work order WO-00579374. This
work order did not mention loosening the rod end connection. However, the bolt may have been inadvertently loosened by a maintenance technician during this 10-year preventative maintenance activity that replaced the governor.
4. October 10, 2024: the licensee reassembled this linkage using WO-54199975 after
the discovered linkage disconnection. This work order also did not mention placement of the washer (the washer was incorrectly placed as described above).
Entergy fleet procedure EN-MA-107, Post-Maintenance Testing, revision 1, Step 5.2.4 requires post-maintenance testing procedures to ensure that no new deficiency has been introduced through maintenance activities. The licensees post-maintenance testing instructions failed to identify any new deficiencies were introduced during maintenance
1-5 activities on EDG A. For example, free range of motion checks are considered skill of the craft and may or may not have been performed. This activity could have identified the mechanical interference. Specifically, the maintenance activities conducted on the diesel generator governor contributed to subsequent trips of the emergency diesel generator.
During this period, EDG B also underwent similar maintenance. In June 2016, the rod ends of EDG B were replaced using work order WO-0042899. The analogous rod end linkage for EDG B was correctly reassembled after this maintenance, two washers were used, but only one washer was correctly placed as a spacer between the rod end linkage and the governor pivot arm. As part of the extent of condition of the October 10, 2024, event, the linkage was torque checked on EDG B - no looseness was noted at that time. As such, configuration control of EDG B was maintained, while configuration control of EDG A was not. EDG B was also started and run to verify operability while EDG A was inoperable.
Licensee procedure EN-DC-178, System Walkdowns, revisions 7 through 16, requires that monthly walkdowns, later revised to quarterly walkdowns, of Category/Tier 1 systems are to be performed; the EDGs are Category/Tier 1 systems. The procedure directs verifying plant configuration is within design requirements as well as inspecting material condition deficiencies. These walkdowns provided opportunities for the licensee to have identified the linkage configuration issue and the pivot arm damage prior to EDG A failure on October 10, 2024.
Corrective Actions: The licensee entered this issue into the corrective action program. The condition report initiated an equipment failure evaluation with the following corrective actions:
- (1) evaluate the need to add a step to the emergency diesel pre-startup checks procedure for operators to visually inspect the governor and corresponding linkages,
- (2) update the governor replacement preventative maintenance to include a full inspection and tightness check of the governor and its linkages, and
- (3) update the model work order for the governor replacement to be more specific and precise when governor linkage bolts are removed, including how to install them with torquing requirements and using a thread-locking fluid.
Corrective Action References: CR-WF3-2024-04988 and CR-WF3-2025-00386.
Performance Assessment:
Performance Deficiency: The failure to properly develop and implement adequate maintenance instructions for the fuel linkage connection to the mechanical governor for EDG A was a performance deficiency. Specifically, the maintenance instructions for the governor replacement and the rod bearing replacement did not include adequate instructions for the installation of all required parts to ensure that mechanical binding did not occur.
Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to properly implement adequate maintenance instructions and practices contributed to the mechanical linkage coming apart and EDG A failing to run.
Significance: The inspectors assessed the significance of the finding using IMC 0609 Appendix A, The Significance Determination Process (SDP) for Findings At-Power. The inspectors determined the finding impacted mitigating systems and used exhibit 2 to evaluate
1-6 the condition. The inspectors determined the finding represented a loss of PRA function of one train of a multi-train TS system for greater than its TS allowed outage time. Therefore, a detailed risk evaluation was performed by a regional senior reactor analyst.
This evaluation is provided as Enclosure 2. Based on the results of this evaluation, the finding was determined to have a preliminary significance of low-to-moderate safety significance (White).
Cross-Cutting Aspect: H.12 - Avoid Complacency: Individuals recognize and plan for the possibility of mistakes, latent issues, and inherent risk, even while expecting successful outcomes. Individuals implement appropriate error reduction tools. Specifically, the licensee did not recognize the incorrect washer placement when conducting maintenance activities, nor did they recognize that the work being done could impact adjacent connections, and as such the procedures to perform maintenance were inadequate to ensure that the connection was correctly assembled. This led to damage of the mechanical governors pivot arm and inoperability of the diesel.
Enforcement:
Violation: Title 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings, requires, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and that the instructions, procedures, or drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. The licensee established work orders WO-00434438 (replacement of the rod ends), WO-00482368 (first replacement of the governor for the train A emergency diesel generator), WO-00579374 (second replacement of the governor for the train A emergency diesel generator), and WO-54199975 (reassembly of the rod end linkage after it was found disconnected), in part, to meet this requirement.
Contrary to the above, from June 2016 to February 4, 2025, the licensee failed to adequately develop and implement instructions, procedures, or drawings for an activity affecting quality of a type appropriate to the circumstances, and to include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. Specifically, the licensees work orders for the replacement of the rod ends, replacement of the governor, and reconnecting of the rod end joint for emergency diesel generator A failed to include adequate maintenance and post-maintenance inspection instructions. The instructions did not include appropriate quantitative or qualitative acceptance criteria for the installation of all required parts, to include tightness checks of adjacent connections and linkages and post-maintenance inspections to ensure that mechanical binding did not occur. This resulted in the failure of emergency diesel generator A to run.
Enforcement Action: This violation is being treated as an apparent violation pending a final significance (enforcement) determination.
1-7
EXIT MEETINGS AND DEBRIEFS
The inspectors verified no proprietary information was retained or documented in this report.
- On April 3, 2025, the inspectors presented the NRC inspection results to Joseph Sullivan, Site Vice President, and other members of the licensee staff.
1-8
DOCUMENTS REVIEWED
Inspection
Procedure
Type
Designation
Description or Title
Revision or
Date
Corrective Action
Documents
CR-WF3-YYYY-
XXXX
24-04988, 2025-00386
Procedures
System Walkdowns
7-16
Procedures
Post-Maintenance Testing
Work Orders
00434438,
00482368,
00579374,
54199975
Detailed Risk Evaluation
Plant Name/Unit Number: Waterford 3
Inspection Report #: 2025-090
Enforcement Action #: EAF-RIV-2025-0090
BACKGROUND
On October 7, 2024, while performing a 24-hour surveillance test on emergency diesel
generator (EDG) A, operators secured the EDG after approximately two hours of operation due
to unusual indications, including irregular MVAR swings and lowering amperage. Following
initial troubleshooting and corrective maintenance, a post-maintenance test run of the EDG was
initiated on October 9. After approximately three hours of operation, which included over one
hour at full loading, the EDG tripped with a reverse power relay flag and generator fault alarm.
The initial probable cause was thought to be a sensitive relay that tripped due to installed
monitoring equipment that was connected to the same relay as a result of the previous
troubleshooting efforts. After removing the monitoring equipment and recalibrating the relay, a
subsequent post-maintenance test was initiated on October 10, during which the diesel
immediately tripped on a mechanical overspeed trip. Following approximately five hours of
additional troubleshooting, the licensee discovered that the linkage between the governor and
the fuel rack was disconnected due to a threaded bolt backing out of a linkage joint. After
approximately three hours of corrective maintenance, EDG A was restored to a functional
condition. The licensee subsequently determined that the failure of this connection joint was the
cause of the EDG trip that occurred during the run on October 9. The last 10-year preventive
maintenance activity, which included replacement of the mechanical governor, had been
performed in January 2024.
PERFORMANCE DEFICIENCY
The failure to properly develop and implement adequate maintenance instructions for the fuel
linkage connection to the mechanical governor for EDG A was a performance deficiency.
Specifically, the maintenance instructions for the governor replacement and the rod bearing
replacement did not include adequate instructions for the installation of all required parts to
ensure that mechanical binding did not occur.
IMPACT ON SAFETY FUNCTION(S)
The analyst assumed that the performance deficiency resulted in a condition that, following a
certain amount of runtime, would have caused EDG A to fail to maintain its design basis
function for its PRA mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The safety function provided by the EDG would be
necessary to mitigate any design basis event that includes a loss of offsite power (LOOP)
condition.
EXPOSURE TIME
The analyst assumed that the condition of the bolted connection joint of the governor arm
degraded (i.e., loosened to the point of becoming disconnected) with runtime of the EDG such
that its ultimate failure (i.e., a runtime failure, such as what was experienced during the testing
scenario described above) would have occurred at some point during a design basis event
involving an EDG demand, if such an event were to have occurred while this latent condition
was present. Based on a review of the number of successful run hours achieved prior to the
failure that occurred on October 9, 2024, and the associated dates of those runs, the analyst
2-2
concluded that up to and including a surveillance testing run that was completed on July 8,
24, the EDG would not have been subject to this particular failure mechanism during its 24-
hour mission time. The analyst concluded that beginning on July 8, 2024, the EDG was in a
condition where it would have failed to run for its 24-hour mission time during its next demand.
Therefore, the analyst determined that an exposure time of 94 days (which includes 93 days of
exposure time for a fail-to-run (FTR) condition plus one day of repair time, consistent with the
actual conditions and events referenced above) would be applicable for the analysis.
INFLUENTIAL ASSUMPTIONS
The analyst assumed that the performance deficiency resulted in EDG A being in a
condition where it would have failed to run during an applicable design basis event for its
required mission time during the exposure time discussed above.
For the conditional risk case, the analyst assumed that the probability of successfully
recovering offsite electrical power (OEP) during a loss of offsite power (LOOP) sequence
in which EDG A would fail to run due to this condition would be higher than nominal due
to the additional recovery time available as a result of the EDG not being subject to this
failure mechanism for some initial portion of its mission time following a LOOP event.
For station blackout (SBO) sequences involving this EDG A failure condition, the analyst
assumed that the safety function of EDG A would: a) not be recoverable within two
hours, and b) be nominally recoverable at the 24-hour and 72-hour points.
Based on the linkage failure having occurred after several hours of normal operation on
October 9, including over one hour of full loading operation, the analyst assumed that
the initial EDG performance issues experienced on October 7 (which led to an initial 48-
hour period of unplanned unavailability) were unrelated to the degraded condition
resulting from the performance deficiency.
The analyst assumed that the use of Diverse and Flexible Coping (FLEX) Strategies for
SBO events should be credited.
MODELING APPROACH
The Waterford SPAR Model version TLU11 (based on version 8.81) along with SAPHIRE
software version 8.2.11 were used for the evaluation. The analyst determined that the degraded
condition described above would be most appropriately modeled based on the basic event EPS-
DGN-FR-DG3A (Diesel Generator 3A-S Fails to Run). To allow for more detailed modeling of
the condition, the analyst replaced the basic event EPS-DGN-FR-DG3A in the Fault Tree EPS-
DG3AS-HARDWARE (Failure of DG3AS Hardware), an OR gate, with two new constituent
basic events EPS-DGN-FR-DG3A-INTE1 and EPS-DGN-FR-DG3A-INTL1, which represent
EDG A FTR probabilities during early window and late window portions of the total 24-hours
mission time, respectively. The analyst considered actual EDG run time completed during the
assumed exposure time during which this failure did not occur. Four simplified consecutive
runtime intervals comprising the total exposure time were identified based on this information
as summarized in Table 1 below:
2-3
Table 1.
Interval
Duration
(days)
Date of
Run
Runtime
(hr)
Early Mission
Time (hr)
Late Mission
Time (hr)
9/26 - 10/9
10/9/2024
5.25
5.25
18.75
9/3 - 9/26
9/26/2024
6.25
11.5
2.5
8/8 - 9/3
9/3/2024
6.46
17.96
6.04
7/8 - 8/8
8/8/2024
5.08
23.04
0.96
The analyst assumed that EDG A would not be subject to this failure mechanism for an early
window initial portion of its mission time during each of these intervals, such that the basic
event EPS-DGN-FR-DG3A-INTE1 would represent a nominal FTR probability during the early
mission time window of each interval, and the basic event EPS-DGN-FR-DG3A-INTL1 would
represent a 1.0 FTR probability during the late mission time window of each interval. Although
removed from the fault tree logic referenced above, the original FTR basic event EPS-DGN-FR-
DG3A was set to TRUE for the conditional cases to allow for applicable automatic adjustment to
the common cause factor EPS-DGN-CF-FR (Common Cause Failure of Diesel Generators to
Run).
To apply credit for the additional time available for OEP recovery during LOOP sequences in
which EDG A was assumed to not fail due to the identified condition during the early mission
time window, the analyst created sets of event tree post-processing rules to identify cutsets in
which the conditional late window FTR event EPS-DGN-FR-DG3A-INTL1 appeared ANDed
with any of the following applicable OEP recovery failure probability terms from the model and
adjusting these terms:
OEP-XHE-XL-NR01HGR (Operator Fails to Recover Offsite Power in 1 Hour, Grid-Related)
OEP-XHE-XL-NR01HPC (Operator Fails to Recover Offsite Power in 1 Hour, Plant-Centered)
OEP-XHE-XL-NR01HSC (Operator Fails to Recover Offsite Power in 1 Hour, Swyd-Centered)
OEP-XHE-XL-NR01HWR (Operator Fails to Recover Offsite Power in 1 Hour, Weather-related)
OEP-XHE-XL-NR02HGR (Operator Fails to Recover Offsite Power in 2 Hours, Grid-Related)
OEP-XHE-XL-NR02HPC (Operator Fails to Recover Offsite Power in 2 Hours, Plant-Centered)
OEP-XHE-XL-NR02HSC (Operator Fails to Recover Offsite Power in 2 Hours, Swyd-Centered)
OEP-XHE-XL-NR02HWR (Operator Fails to Recover Offsite Power in 2 Hours, Weather-
related)
OEP-XHE-XL-NR24HGR (Operator Fails to Recover Offsite Power in 24 Hrs, Grid-Related)
OEP-XHE-XL-NR24HPC (Operator Fails to Recover Offsite Power in 24 Hrs, Plant-Centered)
OEP-XHE-XL-NR24HSC (Operator Fails to Recover Offsite Power in 24 Hrs, Swyd-Centered)
OEP-XHE-XL-NR24HWR (Operator Fails to Recover Offsite Power in 24 Hrs, Weather-related)
OEP-XHE-XL-NR72HGR (Operator Fails to Recover Offsite Power in 72 Hrs, Grid-Related)
OEP-XHE-XL-NR72HPC (Operator Fails to Recover Offsite Power in 72 Hrs, Plant-Centered)
OEP-XHE-XL-NR72HSC (Operator Fails to Recover Offsite Power in 72 Hrs, Swyd-Centered)
OEP-XHE-XL-NR72HWR (Operator Fails to Recover Offsite Power in 72 Hrs, Weather-related)
For each runtime interval, the analyst decreased each of the above OEP recovery failure
probabilities (when appearing in cutsets with the conditional late window FTR event) as
2-4
applicable by increasing the available OEP recovery time by the amount of early window EDG
runtime applicable for that interval.
The analyst also considered application of recovery credit to recover a failed EDG in an SBO
sequence. The analyst noted that the model contains nominal EDG recovery failure probabilities
that are applicable at the 1-hour, 2-hour, 24-hour, and 72-hour points in an SBO sequence
(where the 24-hours and 72-hour recovery points are associated with an extended loss of AC
power (ELAP) scenario wherein FLEX strategies are credited). Based on an assumption that
EDG A failure would not be recoverable at the 1-hour or 2-hour points in the conditional case,
the analyst adjusted the basic events EPS-XHE-XL-NR01H and EPS-XHE-XL-NR02H
(Operator Fails to Recover Emergency Diesel in 1 Hour or 2 Hours, respectively) to represent
the condition that EDG B and the permanent temporary EDG (PTED) would be nominally
recoverable while EDG A would be unrecoverable. This adjustment consisted of taking the cube
root of the nominal recovery failure probability and squaring the result. This adjustment was
applied in the conditional case via event tree post-processing rules that identified cutset results
in which the late window FTR event EPS-DGN-FR-DG3A-INTL1 appeared ANDed with either
of the above 1-hour or 2-hour EDG recovery failure events. Based on the assumption that this
particular FTR condition for EDG A would be representative of a nominally recoverable general
FTR condition at both the 24-hour and 72-hour points, the analyst left the basic events EPS-
XHE-XL-NR24H and EPS-XHE-XL-NR72H (Operator Fails to Recover Emergency Diesel in 24
Hours or 72 Hours, respectively) at their nominal values for the conditional case.
Based on a review of licensee operating procedures that do not allow the PTED to be in a non-
functional condition for maintenance or testing purposes concurrently with either EDG A or B,
the analyst also added event tree post-processing rules to identify and eliminate cutset results
containing mutually exclusive testing/maintenance conditions consisting of the basic event EPS-
DGN-TM-TEDG (Temporary Emergency Diesel Generator Unavailable Due To Test and
Maintenance) together with either EPS-DGN-TM-DG3A or EPS-DGN-TM-DG3
- B.
To credit the use of FLEXProperty "Contact" (as page type) with input value "B.</br></br>To credit the use of FLEX" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., the analyst adjusted the basic event FLX-XHE-XE-ELAP (Operators
Fail to Declare ELAP When Beneficial) probability to 1.0E-2 for both the nominal and conditional
risk cases.
In addition to the total 93 days of exposure time reflected in the analysis approach described
above involving the four runtime intervals, the analyst considered one day of repair time to be
added to the conditional risk case, consistent with the stated assumptions above. This condition
was represented by setting the basic event EPS-DGN-TM-DG3A (DG 3A-S Unavailable Due to
Test and Maintenance) to TRUE in the events and conditions assessment (ECA) workspace for
an exposure time of one day.
RESULTS
With the assumptions and modeling approach described above, the analyst obtained an
increase in average annual core damage frequency (delta-CDF) result of 1.27E-6/year
associated with internal events.
EXTERNAL EVENTS
The increase in risk associated with external events was also evaluated. Using the same
modeling approach as described above for internal events, the analyst evaluated the risk
contribution from the external events modeled in SPAR, which included hurricane (HCN),
2-5
tornado, high straightline winds (HWD), and seismic events. The analyst obtained a total result
of 3.38E-6/year for delta-CDF associated with these external events. The analyst noted that
94% of this total external event risk contribution was coming from HWD events (7.62E-7, or
2.5%) and HCN events (2.41E-6, or 71.4%). These two external event risk contributions are
further addressed in the qualitative considerations and sensitivity analyses sections below.
Since the SPAR model did not include modeling of fire events, the analyst determined that best
available information associated with the risk attributable to fire events would be obtained from
the analysts review of the licensees fire PRA model results for this condition. Based on this
review the analyst concluded that the increase in risk for this condition associated with fire
events was best estimated to be a delta-CDF of 4.83E-6/year.
DOMINANT SEQUENCES
Dominant sequences contributing to the delta-CDF results for internal events involved LOOP
events with failure of all EDGs (i.e., SBO events) with either: 1) failures to recover either OEP or
EDG function within two hours and FLEX failures, or 2) failures to recover either OEP or EDG
function within two hours and either: a) failure of emergency feedwater, or b) pressurizer safety
valve fails open. For external events, hurricane and high wind sequences resulted in additional
LOOP frequency being added to the same dominant sequence types noted above.
The significance of the impact of the finding on large early release frequency (LERF) was also
evaluated. The analyst evaluated the increase in LERF using Inspection Manual Chapter (IMC) 0609, Appendix H, Containment Integrity Significance Determination Process. The finding was
treated as a Type A finding in because it could influence the likelihood of accidents leading to
core damage as well as being a contributor to LER
- F. Additionally, the finding was evaluated for
potential increase in the likelihood of a consequential steam generator tube rupture (C-SGTR).
The analyst reviewed all sequences contributing to delta-CDF for any elements affecting LERF.
The analyst identified sequences in which the emergency feedwater (EFW) function failed as
representing additional core damage sequences (i.e., in addition to the plants corresponding
baseline CDF risk) that involve High-Dry-Low (HDL) conditions, which have the potential to
result in a C-SGTR. The analyst assumed a C-SGTR conditional probability of 2E-1 would be
applicable for this category of sequences, consistent with guidance from NUREG-2195.
Application of an assumed LERF factor of 1.0 per IMC 0609 Appendix H screening guidance
would result in delta-LERF results of 2.48E-7/year for internal events and 3.36E-7/year for
external events (not including HWD events or Fire events). The analyst assumed that 1E-11
would be a more appropriate screening value for an average LERF factor that would be
applicable for this category of sequences involving a SGTR condition. Application of this factor
to the total delta-CDF associated with the applicable sequences described above yielded delta-
LERF results of 2.48E-8/year for internal events and 3.36E-8/year for external events (not
including HWD events or Fire events). The analyst determined that best available information
regarding LERF risk from Fire events and for internal events would be obtained from a review of
the licensees LERF modeling results. Overall, the analyst determined that risk attributable to
LERF was not a dominant metric in the significance determination for this finding.
QUALITATIVE CONSIDERATIONS
A basis for the selection of this LERF factor screening value is further discussed in Enclosure 3 of NRC
Inspection Report 05000382/2024013 (ADAMS ML24228A261).
2-6
The analyst reviewed licensee operations procedure OP-901-521, Severe Weather and
Flooding, revision 344, which contains a requirement to commence a plant shutdown to Mode 3
between 16 and 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> prior to the projected arrival of hurricane conditions onsite. The
analyst noted that this procedure further directs that, following completion of the plant shutdown
and at the discretion of plant management, a plant cooldown to Mode 4 with shutdown cooling
in service may also be performed. The analyst noted that SPAR at-power PRA modeling applies
for plant conditions in Modes 1, 2, 3, and 4, except for when reactor coolant system temperature
conditions allow for entry to shutdown cooling (SDC) in Mode 4. The analyst considered that risk
for dominant sequences in this case (i.e., LOOP) would likely be somewhat lower in Mode 3
versus full power operations. To the extent that the licensee may successfully achieve Mode 4
conditions with SDC in service prior to the onset of a hurricane event, that corresponding
fraction of the LOOP consequences attributable to the event could be evaluated with a
shutdown risk PRA model in lieu of at-power risk. The analyst noted that shutdown risk in this
scenario, particularly the risk associated with loss of power to support SDC functions, could still
represent substantial risk, especially in an early period of higher decay heat load when
transitioning to Mode 4 and SDC conditions. A sensitivity analysis is explored below to consider
the portion of total risk that is attributable to HCN-induced events for this condition.
The analyst also considered the basis for the current initiating event frequency (IEF) modeling
for the weather-related LOOP (LOOPWR) category of LOOP initiating events in the SPAR
internal events model, which includes subcategories of: a) Extreme weather events such as
events involving high wind conditions, and b) Severe weather events which includes other types
of weather events. The analyst noted that LOOPWR sequences represented a significant
portion of internal event dominant sequences for this evaluation. The analyst also noted that
external event sequences of HWD and HCN also constituted a significant portion of dominant
sequences for this evaluation. The HWD and HCN sequences effectively contributed additional
risk due to a LOOPWR initiating event as a result of applying conditional LOOPWR probabilities
to the associated IEFs for HWD and HCN events. The analyst determined that this combination
of all currently modeled initiating events potentially overestimates the frequency of high wind-
related extreme weather-induced LOOP events. After consulting with staff from Idaho National
Laboratory (INL), the analyst determined that an applicable interim adjustment to offset this
potential double-counting concern would be to exclude the currently modeled HWD external
event contribution from the total risk estimate. This approach is reflected in a sensitivity analysis
discussed below and is also reflected in the best estimate results for this evaluation.
Given that the dominant sequences applicable for this analysis are SBO events, the analyst also
noted some considerations that would represent challenges to the prospect of repair/recovery of
EDG A if the failure were to have occurred during an actual LOOP condition. The resulting SBO
event would likely involve additional demands and stresses on plant personnel, and working
conditions would likely be less favorable (e.g., emergency lighting). Although it is recognized
that the indications of this kind of failure, along with the operational circumstances under which
it may occur, would be somewhat different for the case of a runtime failure experienced during
an actual LOOP event versus the conditions and indications that occurred during the testing
sequence referenced above, the analyst determined that some relevant insights could be
nonetheless gained from the events that occurred. Specifically, October 10, when the EDG
immediately tripped on mechanical overspeed upon demand, thus indicating the existence of a
problem of a different nature than the troubleshooting efforts of the previous day were centered
around, and with dedicated troubleshooting efforts and resources already ongoing during this
testing activity and the resulting unplanned multi-day equipment outage, approximately five
hours elapsed before the governor linkage connection condition was identified. With the
2-7
establishment of FLEX strategies, if initial troubleshooting efforts to restore either an offsite
power source or an EDG are not successful in a relatively short time period (typically about one
hour), an ELAP condition is declared, and plant resources and priorities are most likely
redirected to implement FLEX functions. Part of the stations response also includes a load
shedding process to extend battery life in accordance with the stations SBO coping strategy,
the results of which would likely further challenge EDG recovery efforts.
SENSITIVITY ANALYSES
Sensitivity #1:
The analyst evaluated the impact of the runtime interval crediting approach on the overall
results.
Table 2.
Delta-CDF (/year)
Risk category
Without
Runtime
Interval Credit
With Runtime
Interval Credit
%
Decrease
Internal Events
2.28E-6
1.27E-6
44.0%
External events minus HWD
2.62E-6
2.62E-6
Totals
4.90E-6
3.89E-6
20.6%
The analyst noted that the lack of impact of this runtime interval approach on external events is
likely attributable to the fact that the dominant sequences included in the external events
category consisted primarily of hurricane-induced LOOPWR events, and the OEP recovery
failure probabilities modeled for LOOPWR events are relatively independent of time available to
perform the action, for the applicable time intervals being considered in this analysis.
Sensitivity #2:
As discussed above, the analyst determined that the risk contribution from the HWD external
event likely represents a double-counting concern relative to a portion of the events that are
reflected currently modeled IEF for LOOPWR internal events. The analyst determined that the
exclusion of HWD events from the external event modeling reduced the total external event risk
result for delta-CDF from 3.38E-6/year to 2.62E-6/year, a reduction of 22.5%.
Sensitivity #3:
Additionally, pursuant to the qualitative consideration discussed above regarding the potential
risk increase due to hurricane events, the analyst determined that the total risk contribution from
hurricane events for this evaluation was a delta-CDF of 2.41E-6/year, which represents 92%
(i.e., all but 2.03E-7/year) of the total external event risk after exclusion of HWD events. As
discussed above, the analyst considered that some fraction of this risk contribution could more
appropriately be evaluated as shutdown risk versus at-power risk, reflecting the likelihood that
the licensee may achieve shutdown conditions with decay heat removal being provided by the
shutdown cooling function prior to being subject to the impacts of a hurricane event.
Table 3.
Risk category
Delta-CDF (/yr)
%
Hurricane Events
2.41E-6
71.4%
2-8
HWD Events
7.62E-7
2.5%
Tornado + Seismic Events
2.08E-7
6.1%
External Event Total
3.38E-6
100%
Sensitivity #4:
The analyst considered the sensitivity of the overall results to the application of EDG recovery
credit at the 24-hour and 72-hour points in an ELAP scenario involving the conditional failure of
EDG A. The nominal values for the 24-hour and 72-hour EDG recovery failure probabilities are
3.9E-1 and 1.38E-1, respectively. As a bounding analysis, the analyst evaluated the effect on
the overall results of applying 100% EDG recovery credit (i.e., recovery failure probabilities of
zero) at the 24-hour and 72-hour points for ELAP sequences involving the conditional failure of
EDG A. This adjustment was applied via event tree post-processing rules that identified and
adjusted cutset results in which the late window FTR event EPS-DGN-FR-DG3A-INTL1
appeared ANDed with either EPS-XHE-XL-NR24H and EPS-XHE-XL-NR72H.
Table 4.
Delta-CDF (/year)
Risk category
Best Estimate
Results
100% EDG A
failure recovery
at 24,72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />
%
Decrease
Internal Events
1.27E-6
1.19E-6
6.3%
External events minus HWD
2.62E-6
2.28E-6
13.0%
Totals
3.89E-6
3.47E-6
10.8%
From these results, the analyst concluded that the overall results were not significantly sensitive
to the degree to which 24-hour and 72-hour recovery credit would apply for EDG A in the event
of its failure due to the condition being analyzed.
LICENSEE PERSPECTIVE/RESULTS
The analyst reviewed risk assessment results provided by the licensee from the use of the
licensees PRA model for the categories of internal events and fire events. These results,
summarized in Table 5 below, reflected a FTR condition for EDG A for an exposure time of 94
days. Also reflected in these results is a plant availability factor (PAF), which represents a
fraction of time that the plant is assumed to be operating at-power, on average, over a given
time period.
Table 5.
Risk category
Delta-CDF (/yr)
Delta-LERF (/yr)
Internal Events
6.77E-7
4.74E-9
Fire Events
7.70E-6
2.19E-8
Totals
8.38E-6
2.66E-8
Since the exposure time being considered in this analysis consisted of at-power operation, the
analyst adjusted the above results to reflect removal of the PAF from the modeling by dividing
these results by this factor of 0.884. Additionally, the analyst assumed that there would be some
reduction in risk attributable to the assumption that the degraded condition being analyzed
2-9
would not be the cause of an EDG A FTR condition for some amount of runtime during each of
the previously identified runtime intervals of this exposure period. As such, the above results
would represent on overestimation of the total risk attributable to this condition. The analyst
assumed that the percentage of overall risk reduction evaluated in Sensitivity #1 above would
represent an applicable approximation of the impact of this assumption on the overall results.
Table 6 below reflects these adjustments applied to the licensees modeling results.
Table 6.
Risk category
Delta-CDF (/yr)
Delta-LERF (/yr)
Internal Events
4.25E-7
2.98E-9
Fire Events
4.83E-6
1.37E-8
Totals
5.26E-6
1.67E-8
The analyst also reviewed additional risk analysis results provided by the licensee, which
reflected additional modeling efforts to apply credit for an assumed recovery action to effect
repairs for EDG A if it were to have failed for the identified condition during a design basis
demand (i.e., LOOP event). This additional modeling involved the development of a human
failure event (HFE) to model the probability of recovery/repair failure to be applied in the
conditional case, which was estimated at a probability of 1.64E-2 using human reliability
analysis (HRA) methods, and applying that recovery term to cutsets that included either: a) an
EDG A FTR condition during the first 91 days of the assumed 94-day exposure time (reflecting
an assumption that EDG A would run successfully for more than three hours before failure), or
b) a FTR condition for either the turbine-driven EFW function, the B EDG, or FLEX (reflecting an
assumption that any of these functions would be initially successful for at least three hours of
their mission time). These applicability criteria for recovery credit were based on an assumption
that if either EDG A or any of the other listed functions were successful for at least three hours
of their mission time following a LOOP event, then the time to core damage following an SBO
event would be increased sufficiently to allow for implementation of the assumed recovery/repair
action prior to core damage occurring.
The inclusion of this recovery modeling resulted in the following reductions in risk results from
the licensee PRA model. The following original results reflect factoring out the PAF from the
results noted in Table 5 above.
Table 7.
Delta-CDF (/year)
Risk category
Original
Results
With EDG A
recovery credit
%
Decrease
Internal Events
7.66E-7
9.65E-9
98.7%
Fire Events
8.71E-6
5.86E-7
93.3%
Totals
9.48E-6
5.96E-7
93.7%
Table 8.
Delta-LERF (/year)
Risk category
Original
Results
With EDG A
recovery credit
%
Decrease
2-10
Internal Events
5.36E-9
3.51E-11
99.3%
Fire Events
2.48E-8
2.02E-9
91.9%
Totals
3.02E-8
2.06E-9
93.2%
The analyst considered that this resulting recovery credit impact likely represented an
overestimation of the degree of recovery credit that would be most appropriate for this analysis,
given the nature of EDG A failed condition, the circumstances involved in an SBO event, and
the timing and implications of associated station procedures for ELAP declaration, including the
impacts of deep load shedding processes and shifting of event mitigation strategy to FLEX
implementation. The analyst considered this proposed dynamic treatment of a static PRA model
to incorporate time-dependent aspects to have some potential limited validity if supported by
applicable thermal-hydraulic analysis regarding the core damage timing implications attributable
to certain safety functions; however, the analyst noted that some underlying assumptions
reflected in this proposed approach could be potentially problematic. The existence of a FTR
event in a cutset is not necessarily indicative of a successful performance of the associated
function for any specific portion of the mission time, unless specifically modeled as such.
Additionally, an assumption that a component will not fail for one particular reason during some
certain portion of its mission time does not necessarily constitute success of the function during
that time (i.e., the function could still fail probabilistically for any other reason during the
assumed time period). Finally, to the extent that a certain combination or presence of certain
FTR events may constitute some increased opportunity, timing-wise, for the implementation of
associated recovery action(s), the resulting risk implications would likely be applicable in both
the base case and the conditional case, which could result in the introduction of the recovery
aspect having less of an impact on the delta-risk attributable to the cutsets involving these
events.
UNCERTAINTY ANALYSIS
The analyst performed an uncertainty analysis using the Monte Carlo method with a sample
size of 3,675 on the internal and external events (minus HWD events) results using the
SAPHIRE ECA workspace. These results do not include the applicable reductions in risk that
were credited by applying the OEP recovery probability interval shifting approach.
2-11
5th %
Median
Point Estimate
Mean
95th %
7.27E-7
2.52E-6
4.92E-6
3.60E-6
9.71E-6
The above results also do not include risk contribution from Fire events, which was estimated
from the licensee modeling results.
CONCLUSION
The analyst concluded that the overall preliminary risk significance of the finding was
determined to be low to moderate safety significance (White), based on best estimates of
8.72E-6/year for total delta-CDF and 5.03E-8/year for total delta-LERF, as detailed in the
summary table below. The source of best available information for the best estimate results
below for Fire risk (delta-CDF and delta-LERF) and delta-LERF risk for internal events was
determined to be the analysts review of the licensees modeling results. The results in the
remaining risk categories are based on the analysts use of the NRC SPAR model.
Table 9.
Risk category
Delta-CDF (/yr)
Delta-LERF (/yr)
Internal Events
1.27E-6
2.98E-9
External Events minus HWD
2.62E-6
3.36E-8
Fire
4.83E-6
1.37E-8
Totals:
8.72E-6
5.03E-8