RA-13-072, County Station Response to Preliminary White Finding from NRC Integrated Inspection Report 05000373-13-004, 05000374-13-004

County Station Response to Preliminary White Finding from NRC Integrated Inspection Report 05000373-13-004, 05000374-13-004

ML13353A119
Person / Time
Site:	LaSalle
Issue date:	12/16/2013
From:	Karaba P Exelon Generation Co
To:	Document Control Desk, NRC/RGN-III
References
EA-13-221, IR-13-004, RA-13-072
Download: ML13353A119 (12)

Text

RA1 3-072 December 16, 2013 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 LaSalle County Station, Units 1 and 2 Facility Operating License Nos. NPF-11 and NPF-18 NRC Docket Nos. 50-373 and 50-374

Subject:

LaSalle County Station Response to Preliminary White Finding from NRC Integrated Inspection Report 05000373/2013004; 05000374/2013004

References:

1) Letter from K. G. O'Brien (U. S. Nuclear Regulatory Commission) to M. J.

Pacilio (Exelon Generation Company, LLC), "LaSalle County Station, Units 1 and 2, NRC Integrated Inspection Report 05000373 /2013004; 05000374/2013004 and Unit 2 Preliminary White Finding," dated November 15, 2013

2) Letter from P. J. Karaba (Exelon Generation Company, LLC) to M. J. Kunowski (U. S. Nuclear Regulatory Commission), "LaSalle County Station Response to Preliminary White Finding from NRC Integrated Inspection Report 05000373/2013004; 05000374/20130004," dated November 22, 2013 In Reference 1, the NRC identified a preliminary White finding for the failure of LaSalle County Station personnel to follow procedure LOP-CW- 1 0, "Dewatering the Circulating Water System,"

Revision 32, on April 25, 2013. Specifically, operators performed the waterbox dewatering evolution in a manner inconsistent with procedural guidance by manually adjusting the circulating water isolation valves while the waterbox manways were open. Adjustment of the inlet isolation valve caused a loss of isolation resulting in flooding of the condenser pit and a resultant circulating water pump trip, loss of the normal heat sink, and a manual reactor scram.

Reference 1 provided Exelon Generation Company, LLC (EGC) an opportunity to present its perspective on the facts and assumptions used by the NRC to arrive at the finding and its significance at either a Regulatory Conference or in a written response to the NRC. In Reference 2, EGC notified the NRC of its intent to provide a written response on the significance level of the finding. The Enclosure to this letter provides EGC's perspective on the facts and assumptions used by the NRC to arrive at the finding significance in a written response.

December 16, 2013 U. S. Nuclear Regulatory Commission Page 2 EGC agrees that a finding existed for procedural non-compliance leading to a scram with complications due to the circulating water trip event that occurred on April 25, 2013. EGC has taken actions to identify and correct the causes of the issue. EGC is requesting that the significance determination be re-evaluated based on the additional information enclosed in this letter. EGC concludes that the subject finding is of very low safety significance (i.e., Green).

There are no regulatory commitments contained within this letter. Should you have any questions concerning this letter, please contact Mr. Guy V. Ford, Jr., Regulatory Assurance Manager, at (815) 415-2800.

Respectfully, Peter J. Karaba Site Vice President LaSalle County Station

Enclosure:

Exelon Risk Assessment of LaSalle Unit 2 April 25, 2013 Scram Event cc: NRC Document Control Desk NRC Regional Administrator - Region III NRC Senior Resident Inspector - LaSalle County Station

Enclosure EGC Risk Assessment of LaSalle Unit 2 April 25, 2013 Loss of CW Event 1.0 Executive Summary LaSalle County Station received a preliminary WHITE finding for procedural non-compliance leading to a scram with complications due to a loss of circulating water (CW) event that occurred on April 25, 2013. At the time of LaSalle's loss of CW event, both trains of residual heat removal were available to support the function of decay heat removal. Both of these residual heat removal trains were available and provided adequate defense-in-depth, mitigating the event and protecting the health and safety of the public. In addition to the two preferred methods of decay heat removal, the emergency containment venting system, structure, or components (SSCs) were available at the time of the event. There was no degradation of support systems for frontline defenses, including essential service water, room cooling, instrument air and electrical power. In accordance with plant processes, just prior to the conduct of the evolution, the operators obtained refresher training in the simulator on response actions should a loss of CW occur and were assigned detailed actions including the starting of suppression pool cooling for heat removal should it be necessary. The time available to perform the actions was substantial. The quantitative PRA analysis developed in support of this event does not fully account for the specific plant configuration, the briefings of all involved in the evolution, and time available to perform the actions.

Clearly these qualitative attributes reduce the calculated risk for this event. Additionally, EGC's perspective is that the NRC methodology delineated in the Risk Assessment Standardization Project (RASP) Handbook is overly conservative and may not provide a realistic evaluation of the event.

Given the conservative use of PRA in assessing this event, EGC suggests use of a blended approach in line with the 1995 Policy Statement and Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, to augment probabilistic results.

When the qualitative aspects of the event are considered with the quantitative result, EGC concludes the subject performance deficiency is of very low safety significance (GREEN).

1

2.0 Background On April 25, 2013, a self-revealing event occurred and resulted in a loss of CW and manual reactor scram. An NRC finding was identified with respect to the failure of station personnel to follow the procedure LOP-CW-1 0, Dewatering the Circulating Water System, revision 32. This finding was assessed by the NRC using Inspection Manual Chapter (IMC) 0609 Appendix A, The Significance Determination Process (SDP) for Findings At-Power for the initiating events cornerstone. The NRC Senior Reactor Analyst (SRA) used the LaSalle -specific Standardized Plant Analysis Risk (SPAR) model to perform a risk evaluation. In accordance with the RASP Handbook guidance, the initiating event "Loss of Condenser Heat Sink" was set to 1.0 in the SPAR model to represent the event. The NRC SPAR model calculated a conditional core damage probability (CCDP) of 1.6E-6, which represents a finding of low-to-moderate safety significance (WHITE) [1]. Using the same methodology, EGC calculated the CCDP as 9.7E-7 using its site -specific PRA model [2].

Since both calculated risk values (1.6E-6 and 9.7E-7) are close to the GREEN to WHITE threshold (1.OE-6), a close examination of the qualitative factors associated with risk assessment is critical.

3.0 Methodology This EGC risk analysis used the initial risk assessment performed in accordance with the RASP Handbook as a starting point. The risk results were reviewed in detail to ensure an accurate representation of the risk significance of the event. This review revealed that the PRA results were dominated by PRA model events that have significant uncertainty. Additionally, this review revealed that the calculation methodology outlined in the RASP Handbook for event SDP analysis may produce overly conservative results.

Based on these two issues, it was concluded that a blended approach, using both quantitative and qualitative insights, was the most appropriate method to determine the significance of the loss of CW event. The blended approach also examines the PRA model results, defense in depth, safety margin, event duration, and recovery capability to provide a balanced assessment of the actual risk of the event. Consideration of these inputs provides a balanced assessment that is risk-informed, rather than solely numerically risk-based.

2

4.0 NRC Policy for PRA Usage The NRC Policy Statement [3] on the expanded use of PRA advocates expansion of probabilistic methods in a manner that complements the NRC's deterministic approaches and traditional defense-in-depth philosophy. Probabilistic risk assessment is to be used where practical within the bounds of state-of-the-art PRA technology, and evaluations are to be as realistic as practicable.

The concept of a blended approach is consistent with ideas stated in RG 1.174 [4],

which, consistent with the integrated approaches laid out in the Policy Statement, stresses a decision-making process which evaluates defense-in-depth philosophy and maintenance of sufficient safety margins alongside probabilistic methods. Furthermore, RG 1.174 prescribed quantitative risk metrics to be used as core damage frequency (CDF) and large early release frequency (LERF), and noted that risk impacts that are not reflected (or inadequately reflected) by changes to CDF and LERF, should be addressed [4]. The regulatory guide states that characterizing uncertainty is a strength of probabilistic methods, and these uncertainties should be addressed in the decision-making process.

RG 1.174 [4] states that the more emphasis that is put on risk insights and PRA results in the decision-making process, the more requirements have to be placed on the PRA in terms of both scope and how well the risk and change in risk is assessed. Thus, it is recognized that there are situations where probabilistic frameworks may not ideally characterize risk and should be augmented, as necessary, with qualitative information to make a more complete decision.

5.0 PRA Model Uncertainty Of the sources of uncertainty identified in RG 1.174, only parameter and model uncertainty are relevant to the evaluation of this event. Parameter uncertainty relates to the variation in PRA input values, such as equipment failure rates, initiating event frequencies and human error probabilities. Model uncertainty is due to the industry's incomplete state of knowledge and differing opinions on how models should be formulated. For the loss of CW event, the dominant PRA cutset results contain PRA basic events with significant uncertainty. These events include: 1) human error probabilities related to operator actions and 2) phenomenological impact on emergency core cooling system (ECCS) pumps following containment leak, rupture or venting.

Phenomenological impacts are defined in the ANS/ASME PRA Standard [19] and include generation of harsh environments affecting temperature, pressure, debris, water level, humidity, etc. that could impact the success of the system or function under consideration.

3

Both types of events in the dominant PRA cutset results have significant model and parameter uncertainty; and are applicable to the EGC and NRC SPAR models as the LaSalle model was used as the basis for the NRC SPAR model. LaSalle PRA model uncertainty was investigated for the 2011 A PRA model in accordance with the ASME/ANS PRA Standard and documented in LS-PSA-013 [5], LaSalle PRA Summary Notebook. Appendix B of that document highlights not only the uncertainty sources identified in NUREG - 1855 [6] such as operator actions, it also notes LaSalle-specific sources of uncertainty, and includes the use of the soft vent and loss of RPV makeup sources as a model uncertainty. Because both PRA models are built from similar assumptions, the uncertainties are similar. Therefore, consideration of qualitative insights should be applied to both EGC and NRC PRA model results.

5.1 Operator Action Uncertainty Both NRC and EGC PRA model cutset results for this event indicate that operator actions, including failures to initiate suppression pool cooling (SPC) or to vent primary containment, have a dominant impact on quantitative results for the loss of condenser scenarios. The RASP Handbook states that in the interest of consistency, a single human failure event (HFE) probability of 1.0E -5 should be used. The RASP Handbook allows using a probability of 1.0E-6 with proper justification. Such justification may include: 1) illustration that the action is well-practiced, 2) familiar with expansive time to respond, 3) has numerous indications of the need for action, 4) procedural guidance and training that leads to monitoring of plant status to assess the efficacy of response, thus allowing opportunity for self-correction, and 5) low workload [7]. These factors were satisfied relative to the key operator actions important to a loss of condenser event.

Further, other human reliability analysis (HRA) literature; specifically EPRI report, TR-1021081, Establishing Minimum Acceptable Values for Probabilities of Human Failure Events, [8] provides justification for using lower probabilities for human failure events.

The initiation of suppression pool cooling is an example used in the EPRI report where a human error probability could even be considered negligible.

The task to establish decay heat removal is well-established in procedural guidance, training, and experience of operating staff. Just prior to the event: 1) operators obtained refresher training in the simulator on scram response actions due to a loss of CW, 2) had pre-job briefs on scram response actions just prior to the evolution, and 3) had detailed job assignments just prior to the scram including starting suppression pool cooling. These activities essentially made the potential failure to initiate SPC when required a negligible contributor to the risk.

4

These event specific mitigating factors are not accounted for in the HRA methods; therefore, these factors have not been incorporated into the PRA numerical results.

Given the uncertainty in base human error probability (HEP) values, EGC concludes it is appropriate to consider the qualitative mitigating factors that were applicable to this event; and overall these factors would lower the likelihood of operator failures and lower the actual risk significance of the event.

5.2 ECCS Pump Responses to Containment Conditions The PRA model includes the potential failure of ECCS pumps due to containment conditions following a containment leak, rupture or venting [9, 10]. The probabilities assigned to this failure mode are considered a key source of uncertainty in the LaSalle PRA model. In the base PRA model, the assumptions related to this failure mode are not significant as the PRA results are not dominated by this failure mode. However, for the loss of CW SDP evaluation, this failure mode is a key part of the accident sequences. Failure probabilities were assigned based on the current state of PRA knowledge; however, significant uncertainty remains surrounding the probability of ECCS pump motor failure due to steam environment, ECCS pump suction binding due to steam environment in the suppression pool, containment failure locations and reactor building response to containment venting. Given the dominant nature of these uncertain events, it is necessary to use qualitative insights regarding defense in depth to augment the PRA model results.

6.0 RASP Handbook Limitations There is process uncertainty with respect to the RASP Handbook's basis for event SDP evaluations. A revision to the RASP Handbook was issued in early 2013 that modified the process for event SDP evaluations. The industry is currently in discussions with the NRC to identify and resolve concerns with the new methodology presented in the RASP Handbook. These process concerns were discussed at a public meeting on November 4, 2013 pertaining to potential non-realistic methods to calculate risk and for potential misalignment of the risk metrics [18]. Several of the key issues are outlined below.

A significant issue identified is that the event SDP's methodology uses CCDP as the metrics as opposed to delta CDF. This is problematic from both a programmatic standpoint and a technical standpoint.

From a NRC policy perspective, the use of CCDP appears to be in conflict with the basis of the Reactor Oversight Process (ROP) in terms of the risk metrics used to assess event significance as delta CDF. There currently is no justification of the use of CCDP in the SDP Basis documentation. The basis states that "there are currently no acceptance guidelines for CCDF or CCDP" [12]. Additionally, the use of CCDP is inconsistent with the risk metrics used in RG 1.174.

5

From an ROP programmatic perspective, the use of CCDP for event based SDPs causes an inconsistency with all of the other PRA based ROP indicators. With this inconsistency, the performance indicators (PI) results are no longer comparable to SDP event analysis results. In other words, a WHITE PI finding is no longer equivalent to a white event SDP in terms of risk significance.

From a technical standpoint, the use of CCDP, given the RASP Handbook methodology, does not provide for a realistic assessment of the risk of the actual event.

The RASP Handbook methodology requires that the average maintenance PRA be used and the initiating event of interest be set to 1.0. This methodology accounts only for the event that occurred and does not take into account any plant specific configurations, status of mitigating equipment, or other mitigating factors. Under this approach, all loss of condenser events would be assessed the same color regardless of the plant configuration, operator response and equipment failures.

One option identified during the NRC public meeting on November 4, 2013 was to apply qualitative insights to event SDPs to ensure an accurate risk assessment. This is the approach taken in this risk assessment. It is concluded that probabilistic methodology alone should not be the only tool used to assess event related SDPs until the identified issues are resolved.

7.0 Integrated Decision -making Analysis In the interest of performing an integrated approach which utilizes qualitative as well as quantitative input, the attributes of defense-in-depth, safety margin, extent of condition, degree of degraded program, exposure time, recovery actions and other factors are considered below.

7.1 Defense-in-Depth At the time of LaSalle's loss of CW event, both trains of residual heat removal were available to support the function of decay heat removal. Both of these residual heat removal trains were available and provided adequate defense-in-depth, mitigating the event and protecting the health and safety of the public. In addition to the two preferred methods of decay heat removal, the emergency containment venting system, structure, or components (SSCs) were available at the time of the event. There was no degradation of support systems for frontline defenses, including essential service water, room cooling, instrument air and electrical power. Each defensive layer functioned properly when exercised during the event. In addition, the reactor core isolation cooling (RCIC) system was "protected equipment" per the requirements of LOP-CW-1 0, which meant that no maintenance or work was allowed on RCIC during this evolution. RCIC was available to support transient response immediately following the event.

6

The only decay heat removal function impacted during this event was the availability of the main condenser, a non-safety related SSC. All safety related equipment remained available. There remained redundant and diverse strategies to remove decay heat following a loss of the main condenser. A loss of CW event is within the station's design basis. It is specifically addressed as an event of moderate frequency within LaSalle's Updated Final Safety Analysis Report (UFSAR) [15].

There is limited dependence on operator actions outside of expected activities such as monitoring normal reactor shutdown, verifying incoming transfer to the power bus, monitoring water level in the vessel, observing coastdown, initiating essential cooling, and monitoring vessel pressure. The intent of the station's design and system response was maintained.

7.2 Safety Margin Safety margin was not impacted by the event. All safety-related equipment remained available. Codes and standards were unaffected by the performance deficiency; so, safety margin was not impacted. Entry into operating procedure LOP-CW-10 required power level restrictions, which provided further safety margin to the applicable decay heat removal systems. Additional margin is provided in the procedure by ensuring no half-scram testing or containment isolation testing is performed. The procedure also ensures no other activities, which has a risk of causing a scram, are performed concurrent with LOP-CW-10.

7.3 Extent of Condition A causal investigation was performed that determined the root cause of the event was unverified assumptions used in lieu of strict procedural adherence [16]. The unverified assumption involved the mind-set of the operators that manual seating of the condenser water box isolation valves to obtain a better seal was not considered troubleshooting.

The troubleshooting section of LOP-CW-1 0 required the manways to be closed to make manual valve adjustments. The extent of condition review conducted in the investigation did not reveal procedural non-compliance to be a pervasive problem.

Corrective actions were targeted at reinforcing expectations for strict procedure compliance with operators, along with coaching to the specific individuals involved in the event. The root cause did not identify any issues that would indicate an overall increase in risk exposure due to the causes identified.

7

7.4 Degree of Degraded Program The event occurrence was due to human error, reflecting procedural non-compliance on an infrequently performed evolution. This was a random error rather than systemic degradation or programmatic weaknesses. The root cause investigation did not reveal any specific programmatic breakdowns that required corrective actions. Corrective actions focused on improved awareness and use of human performance tools and fundamentals. No issues were identified that would indicate an overall increase in risk exposure due to degraded programs.

7.5 Exposure Time The operator performance deficiency regarding strict procedure compliance was an isolated event that cannot easily be assigned an exposure time. This performance deficiency occurred during an infrequently performed evolution. This evolution had been performed two times in the last five years.

7.6 Recovery Actions Substantial time was available in a loss of CW event for recovery of systems or implementation of corrective operator actions, in the event of additional failures. PRA thermal hydraulic calculations demonstrated that core damage is precluded as long as decay heat is recovered within approximately 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> [17].

In addition, more time was actually available due to the power level being limited for the online dewatering evolution. The evolution was performed at approximately 640 MWe (56% rated thermal power). Having substantial response time meant that the Main Control Room would have significant personnel support outside of the control room, more time to properly diagnose the problem, and significant time to implement any needed repairs to decay heat removal systems or restart the circulating water system and recover the main condenser.

8.0 Qualitative Risk Assessment Conclusion This risk assessment examined the loss of CW event in detail including the numerical results obtained using the current RASP Handbook methodology. The numerical results from the NRC's SPAR model were 1.6E-06 slightly over the SDP green-white threshold of 1.0E-06, while the EGC model results were 9.7E-07 and slightly under the SPD green-white threshold.

8

Given the nature of PRA numerical analysis and the principles outlined in RG 1.174, the results from both models (EGC and NRC) were reviewed to assess the following:

• PRA model uncertainty as it relates to key model results, and

• RASP Handbook methodology for event SDP.

The goal of this review was to ensure the model results when compared to the actual event, represented an accurate representation of the risk.

In summary, the review identified that the PRA results were dominated by events with significant uncertainty. Given the PRA model uncertainty, it was concluded that the principles in RG 1.174 for an integrated approach should be applied to determine the risk significance of the event. Additionally, the new revision of the RASP Handbook introduced a new PRA calculation methodology for event based SDPs resulting in industry concerns and questions. A method of resolving the concerns for this particular SDP is to consider qualitative insights in addition to the quantitative results.

The qualitative insights demonstrate that this particular loss of CW event involved lower human error probabilities than standard HRA calculations would indicate, due to the preparation, training, and execution of response actions by Operations. Also, preparations for the CW evolution ensured availability of risk-significant equipment which preserved defense-in-depth and safety margins. A loss of condenser event, similar to the event that occurred, is an event in the UFSAR that is documented to occur with a moderate frequency. This event had no extenuating circumstances that would cause result in an increase in risk. All safety related equipment remained operable to mitigate and respond to the event. This event impacted only non-safety related equipment.

For the above reasons, using a blended approach of risk insights supplemented by qualitative insights, EGC asserts that the safety significance of this performance deficiency is of very low risk significance (GREEN).

9.0 References

1. O'Brien, K.G., LaSalle County Station, Units 1 and 2 NRC Integrated Inspection Report 05000373/2013004; 05000374/2013004 and Unit 2 Preliminary White Finding, November 2013.

2. Mearhoff, D. and Addis, H., LS-SDP-03, Risk Significance of Procedural Non-Compliance Leading to a SCRAM with Complications, Revision 1, 2013.

3. 60 FR 42622, Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement, Federal Register, Volume 60, Number 158, p.

42622, August 1995.

4. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, Office of Nuclear Regulatory Research, May 2001.

9

5. Addis, H.J. and Burns, E.T., LS-PSA-013, LaSalle PSA Summary Notebook, Revision 7, March 2013.

6. Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, NUREG- 1 855, Volume 1, March 2009.

7. Risk Assessment of Operational Events, Volume 1 - Internal Events, Revision 2, January 2013.

8. Parry, G., Establishing Minimum Acceptable Values for Probabilities of Human Failure Events, 1021081, EPRI, October 2010.

9. NUREG/CR-4832 Volume 3 Pt. 1, Analysis of the LaSalle Unit 2 Nuclear Power Plant - Internal Events Accident Sequence Quantification, Sandia National Laboratories, August 1992.

10.Addis, H.J. and Burns, E.T., LS-PSA-002, LaSalle PSA Event Tree Notebook, Revision 7, February 2013.

11. Reactor Oversight Process (ROP) Basis Document, NRC Inspection Manual, IMC 0308, November 2007.

12. Significance Determination Process Basis Document, NRC Inspection Manual, IMC 0308 Att. 3, October 2006.

13. Technical Basis for Performance Indicators, NRC Inspection Manual, IMC 0308 Att. 1, November 2007.

14.Travers, W. D., Recommendations for Reactor Oversight Process Improvements, SECY-99-007, January 1999.

15. Decrease in Heat Removal by the Secondary System, LSCS UFSAR Section 15.2.5, Revision 19, April 2012.

16. Myers et al., Trip of Running CW Pumps and Unit 2 Manual SCRAM due to Procedure Adherence when Isolating a Main Water Condenser Waterbox, Root Cause Investigation, July 2013.

17.Addis, H.J., and Andersen, V.M, LaSalle PSA Human Reliability Analysis Notebook, Revision 7, January 2013.

18. Summary of the Public Meeting to Discuss Staff Guidance Used to Estimate the Safety Significance of Inspection Findings that Cause Initiating Event Occurrences, dated December 2, 2013 19.ASME/American Nuclear Society, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-Sa-2009, March 2009.

10