IR 05000327/2024090
| ML24066A197 | |
| Person / Time | |
|---|---|
| Site: | Sequoyah  |
| Issue date: | 03/19/2024 |
| From: | Gregory Suber NRC/RGN-II/DRP/RPB5 |
| To: | Jim Barstow Tennessee Valley Authority |
| References | |
| EA-24-008 IR 2024090 | |
| Download: ML24066A197 (19) | |
Text
SUBJECT:
SEQUOYAH, UNITS 1 AND 2 - NRC INSPECTION REPORT 05000327/2024090 AND 05000328/2024090 AND PRELIMINARY GREATER-THAN-GREEN FINDING AND APPARENT VIOLATION
Dear Jim Barstow:
The enclosed inspection report documents a finding and associated apparent violation that the U.S. Nuclear Regulatory Commission (NRC) has preliminarily determined to be of greater than very low safety significance (i.e. greater-than-Green), resulting in the need for further evaluation to determine significance and therefore the need for additional NRC action. As described in Enclosure 1, a self-revealed apparent violation of Technical Specification (TS) 5.4.1, Procedures, was identified for Sequoyah Nuclear Plants failure to establish, implement, and maintain adequate procedures for maintenance activities on the 1B Diesel Generator (DG)
exhaust valves, which resulted in its failure on September 19, 2023. We assessed the significance of the finding using the significance determination process (SDP) and the best available information at the time of the Significance and Enforcement Review Panel on February 21, 2024. Enclosure 2 contains a detailed risk evaluation with the basis of our preliminary significance determination. We are considering escalated enforcement for the apparent violation consistent with our Enforcement Policy, which can be found at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html. Because we have not made a final determination, no notice of violation is being issued at this time. Please be aware that further NRC review may prompt us to modify the number and characterization of the apparent violation.
On February 15, 2024, you informed the NRC that you completed an evaluation of the risk impact of the 1B DG failure to run on September 19, 2023. The NRC was not able to review your evaluation prior to completing the preliminary determination enclosed in this letter but will review it and consider your position as we make our final decision on this matter. The NRCs evaluation is subject to several uncertainties which could affect the outcome of the significance determination. Therefore, before we make a final decision, we request you provide any additional information that you feel would be beneficial in our evaluation of the significance of the finding. Specifically requested is any additional information or perspectives that address mitigation of the dominant accident sequences given the potential for the delayed onset of station blackout plant conditions and any additional information or perspectives regarding the ability to repower containment hydrogen igniters when assessing the potential for large early release frequency.March 19, 2024 On February 28, 2024, you informed the NRC that you completed a Level 1 Evaluation (Root Cause Assessment, RCA) Report (RCAR) to determine the causal factors which resulted in the 1B DG failure to run on September 19, 2023. The NRC was not able to review your RCAR prior to completing the preliminary determination enclosed in this letter but will review it and consider your position as we make our final decision on this matter.
The NRCs SDP is designed to encourage an open dialogue between your staff and the NRC; however, the dialogue nor the written information you provide should affect the timeliness of our final determination.
Before we make a final decision on this matter, we are providing you with an opportunity to (1)
request a Regulatory Conference where you can present to the NRC your perspective on the facts and assumptions the NRC used to arrive at the finding and assess its significance, or (2)
submit your position on the finding to the NRC in writing. If you request a Regulatory Conference, it should be held within 40 days of the receipt of this letter, and we encourage you to submit supporting documentation at least one week prior to the conference in an effort to make the conference more efficient and effective. If a Regulatory Conference is held, it will be open for public observation. If you decide to submit only a written response, such submittal should be sent to the NRC within 40 days of your receipt of this letter.
If you choose to send a response, please include your perspective of the significance of the finding along with the related facts and assumptions used to reach your determination.
Additionally, your response should be clearly marked as a "Response to Apparent Violation; (EA-24-008)" and should include for the apparent violation: (1) the reason for the apparent violation or, if contested, the basis for disputing the apparent violation; (2) the corrective steps that have been taken and the results achieved; (3) the corrective steps that will be taken; and (4) the date when full compliance will be achieved. Your response should be submitted under oath or affirmation and may reference or include previously docketed correspondence if the correspondence adequately addresses the required response. Additionally, your response should be sent to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Center, Washington, DC 20555-0001 with a copy to Mr. Louis McKown, U.S. Nuclear Regulatory Commission, Region II, within 40 days of the date of this letter. If an adequate response is not received within the time specified or an extension of time has not been granted by the NRC, the NRC will proceed with its enforcement decision or schedule a Regulatory Conference.
If you decline to request a Regulatory Conference or to submit a written response, you relinquish your right to appeal the final SDP determination, in that by not doing either, you fail to meet the appeal requirements stated in the Prerequisite and Limitation sections of Attachment 2 of NRC Inspection Manual Chapter 0609.
Please contact Mr. Louis McKown via phone at 404-997-4545, and in writing, within 10 days from the issue date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision. The final resolution of this matter will be conveyed in separate correspondence.
For administrative purposes, this inspection report provides an update to the apparent violation documented in NRC inspection report 05000327/2023004 AND 05000328/2023004, dated February 12, 2024 (Agency Documents Access and Management System (ADAMS) Accession Number ML24040A073). This letter, its enclosure, and your response (if any) will be made available for public inspection and copying at http://www.nrc.gov/reading-rm/adams.html and at the NRC Public Document Room in accordance with Title 10 of the Code of Federal Regulations 2.390, Public Inspections, Exemptions, Requests for Withholding.
Sincerely, Gregory F. Suber, Deputy Director Division of Reactor Projects Docket Nos. 05000327 and 05000328 License Nos. DPR-77 and DPR-79
Enclosures:
1. Inspection Report 2. UNIT 1 B-EDG DETAILED RISK EVALUATION
Inspection Report
Docket Numbers: 05000327 and 05000328
License Numbers: DPR-77 and DPR-79
Report Numbers: 05000327/2024090 and 05000328/2024090
Enterprise Identifier: I-2024-090-0002
Licensee: Tennessee Valley Authority
Facility: Sequoyah, Units 1 and 2
Location: Soddy Daisy, TN 37379
Inspection Dates: February 05, 2024 to February 27, 2024
Inspectors: D. Hardage, Senior Resident Inspector S. Ninh, Senior Project Engineer A. Price, Resident Inspector S. Sandal, Senior Reactor Analyst
Approved By: Gregory F. Suber, Deputy Director Division of Reactor Projects
Enclosure 1
SUMMARY
The U.S. Nuclear Regulatory Commission (NRC) continued monitoring the licensees performance by conducting a NRC inspection at Sequoyah, Units 1 and 2, in accordance with the Reactor Oversight Process. The Reactor Oversight Process is the NRCs program for overseeing the safe operation of commercial nuclear power reactors. Refer to https://www.nrc.gov/reactors/operating/oversight.html for more information.
List of Findings and Violations
Failure to establish and implement adequate maintenance procedures on the 1B Diesel Generator Cornerstone Significance Cross-Cutting Report Aspect Section Mitigating Preliminary greater-than-Green [H.12] - Avoid 71111.15 Systems AV 05000327,05000328/2023004-01 Complacency Open EA-24-008 A self-revealed apparent violation (AV) of Technical Specification (TS) 5.4.1,
Procedures, was identified. The licensees procedures for maintenance on the 1B Diesel Generator (DG) were not adequately prescribed and/or accomplished in accordance with documented instructions and procedures of a type appropriate to the circumstances.
Specifically, the licensee failed to adequately establish and implement maintenance instructions and practices that reasonably ensured the reliability, availability, and operability of the 1B DG. The 1B DG failed on September 19, 2023, during a surveillance run due to a piston failure that required the DG to be placed in an emergency shutdown condition. The most probable direct cause of the failure was an improperly tightened rocker arm adjustment screw locknut which resulted in severe damage to the associated power pack.
Additional Tracking Items
None.
INSPECTION SCOPES
Inspections were conducted using the appropriate portions of the inspection procedures (IPs) in effect at the beginning of the inspection unless otherwise noted. Currently approved IPs with their attached revision histories are located on the public website at http://www.nrc.gov/reading-rm/doc-collections/insp-manual/inspection-procedure/index.html. Samples were declared complete when the IP requirements most appropriate to the inspection activity were met consistent with Inspection Manual Chapter (IMC) 2515, Light-Water Reactor Inspection Program - Operations Phase. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel to assess licensee performance and compliance with Commission rules and regulations, license conditions, site procedures, and standards.
INSPECTION RESULTS
Failure to establish and implement adequate maintenance procedures on the 1B Diesel Generator Cornerstone Significance Cross-Cutting Report Aspect Section Mitigating Preliminary greater-than-Green [H.12] - Avoid 71111.15 Systems AV 05000327,05000328/2023004-01 Complacency Open EA-24-008 A self-revealed AV of TS 5.4.1, Procedures, was identified. The licensees procedures for maintenance on the 1B DG were not adequately prescribed and/or accomplished in accordance with documented instructions and procedures of a type appropriate to the circumstances. Specifically, the licensee failed to adequately establish and implement maintenance instructions and practices that reasonably ensured the reliability, availability, and operability of the 1B DG. The 1B DG failed on September 19, 2023, during a surveillance run due to a piston failure that required the DG to be placed in an emergency shutdown condition. The most probable direct cause of the failure was an improperly tightened rocker arm adjustment screw locknut which resulted in severe damage to the associated power pack.
Description:
On September 19, 2023, Sequoyah was performing a scheduled 24-hour run of the 1B DG. 1B DG was started at 1121 and at approximately 1544, operations received multiple Main Control Room and local annunciator alarms including high crankcase pressure followed by low jacket water level. The operator performed an emergency stop of the 1B DG in accordance with the annunciator response procedure.
The onsite Class 1E AC electrical distribution system supplies electrical power to two power trains shared between the two units. The AC sources for the shared loads are distributed across both units shutdown boards. However, the impacts of an inoperable offsite power or DG on the opposite units shutdown board differ from the impacts of an inoperable offsite or DG on an associated units shutdown board, due to the loads powered from the respective board.
Sequoyah Units 1 and 2 entered LCO 3.8.1 Condition B for one Train B DG inoperable.
Sequoyah Units 1 and 2 TS 3.8.1 requires four DGs capable of supplying the onsite Class 1E AC Electrical Power Distribution System, to be operable in Modes 1-4; if a DG is inoperable, it shall be returned to operable status within 7 days or in accordance with the Risk-Informed Completion Time Program. The DGs must demonstrate the capability to run continuously at full load for at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in order to ensure that they can support safety-related plant equipment independently of offsite electrical power sources.
10 CFR Part 50.73(a)(2)(i)(B) requires a Licensee Event Report (LER) for any operation or condition which was prohibited by the plants TS except when the TS is administrative nature.
As part of the failure investigation, inspection of the 1B2 engine discovered water leaking into cylinder #14. The 1B DG is comprised of two diesel engines identified as 1B1 and 1B2 coupled to a common electrical generator. Further inspection showed an approximately 3-inch diameter hole in the piston associated with 1B2 engine cylinder #14. The cylinder #14 exhaust valve bridge adjusting screw locknut nut associated with one pair of the exhaust valves was found loose on top of the head along with valve spring retainer pieces. This condition is consistent with the exhaust valve falling into the cylinder during operation and causing damage to the piston/cylinder head.
Sequoyah had performed the four-year preventive maintenance procedure, PM 063604820, on the 1B DG in January 2023. This maintenance, in part, directs the technicians to check/set the exhaust valve lash settings, which requires the loosening and retightening the exhaust valve bridge adjuster locknut. Table 5.9.7 Top Timing Table shows the lash setting performed and initialed for each cylinder. Knowledgeable craft interviewed early, and later causal analyses provided differing understandings of expectations for execution of the valve lash verification and rocker arm locknut adjustments. These were established as skill of the craft using terms such as tighten vice obtaining readily attainable specified values consistent with MMTP-104, Guidelines and Methodology for Assembling and Tensioning Threaded Connections, Revision 13.
The failure of the 1B DG resulted from the loss of proper lash adjustment of the rear valve bridge on cylinder #14. During operation of the 1B DG following maintenance, the exhaust valve bridge adjuster locknut on cylinder #14 separated from the adjustment screw, indicating that the locknut was not adequately tightened. The separated locknut allowed the adjuster screw to loosen, significantly increasing the clearance between the rocker arm and the valve bridge. As the adjustment screw loosened further, the valve bridge spring no longer compressed resulting in a loss of the spherical spring seat mating with the cylinder head. This ultimately resulted in a complete loss of retention of the exhaust valve, which then fell into the cylinder causing the observed cylinder damage and loss of jacket water cooling as the loose exhaust valve was struck by the piston head during each stroke.
Corrective Actions: The 1B DG was emergency stopped and Sequoyah units 1 and 2 entered LCO 3.8.1 Condition B for one Train B DG inoperable. Sequoyah technicians performed corrective maintenance on the 1B DG which included the replacement of impacted power packs followed by post maintenance and operability testing including a new 24-hour run. In subsequent maintenance outages on the remaining station DGs, Sequoyah staff ensured all exhaust valve rocker arm adjusting screw locknuts were torqued in accordance with vendor recommendations. The licensee ordered a failure analysis of the failed cylinder to be completed and ensured that the latest vendor recommendations for exhaust valve bridge lash adjustment were incorporated into the station's 4-, 6-, and 12-year preventive maintenance instructions consistent with MMTP-104.
Corrective Action References: CRs 1881328, 1882753, 1900849
Performance Assessment:
Performance Deficiency: The inspectors determined that the licensee's failure to adequately establish and implement maintenance instructions and practices was a performance deficiency reasonably within their ability to foresee and prevent. Specifically, during performance of exhaust valve lash adjustment in accordance with maintenance instruction PM 063604820, appropriate tightening of the exhaust valve bridge adjuster locknut on DG 1B2 cylinder #14 was not performed. This resulted in the loss of retention of the exhaust valve while in service causing damage to the associated cylinder and loss of jacket water cooling.
Screening: The inspectors determined the performance deficiency was more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone and adversely affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, the failure to properly implement adequate maintenance instructions and practices contributed to the failure of the 1B DG.
Significance: The inspectors assessed the significance of the finding using IMC 0609 Appendix A, The Significance Determination Process (SDP) for Findings At-Power. The inspectors reviewed IMC 0609, Attachment 4, Initial Characterization of Findings, and determined that the finding affects the Mitigating Systems cornerstone. The inspectors screened the performance deficiency using Exhibit 2 of Appendix A and determined a detailed risk evaluation was required because the degraded condition represented a loss of the Probabilistic Risk Assessment (PRA) function of one train of a multi-train TS system for greater than its TS allowed outage time.
A Region II Senior Reactor Analyst performed a detailed risk evaluation. The finding was determined to be preliminarily greater-than-Green. The preliminary risk estimate was obtained by performing a run time failure conditional analysis of the B-train emergency diesel generator (EDG) using a 246-day exposure period evaluated over eight run intervals. The dominant Standardized Plant Analysis Risk (SPAR) model sequences were associated with fire initiating events that involved impact to the normal offsite power supply, unavailability of the A-train EDG, resulting in station blackout (SBO) plant conditions, followed by a reactor coolant pump seal failure or turbine-driven auxiliary feedwater pump failure. Because the B-train EDG would have been expected to operate for some period at nominal failure likelihood prior to onset of SBO conditions, additional analysis of the impact of the delayed SBO on the mitigation of the dominant accident sequences will be necessary before reaching a final determination of significance. Additional evaluation would also be necessary prior to making any determination of the estimated increase in large early release frequency due to the delayed onset of SBO and the potential for repowering the containment hydrogen igniters from Diverse and Flexible Coping Strategy (FLEX) diesel generator sources. See Enclosure 2 UNIT 1 B-EDG DETAILED RISK EVALUATION, for a summary of the basis for the preliminary risk determination.
Cross-Cutting Aspect: H.12 - Avoid Complacency: Individuals recognize and plan for the possibility of mistakes, latent issues, and inherent risk, even while expecting successful outcomes. Individuals implement appropriate error reduction tools. In this case and as associated with this finding, the licensee failed to ensure that error reduction tools such as specified values appropriate to the situation were implemented in lieu of skill of the craft during the performance of PM 063604820.
Enforcement:
Violation: Sequoyah Unit 1 TS 5.4.1 requires, in part, that written procedures shall be established, implemented, and maintained for the applicable activities recommended in Appendix A of Regulatory Guide (RG) 1.33, Quality Assurance Program Requirements (Operation), Revision 2. Appendix A to RG 1.33, Section 9.a, states that maintenance that can affect the performance of safety-related equipment should be performed in accordance with written procedures, documented instructions, or drawings appropriate to the circumstances.
Sequoyah PM 063604820 is a preventive maintenance procedure that includes instructions for the adjustment of the safety-related DG exhaust valve bridge adjuster locknut, an activity that can affect the performance of DGs safety-related function.
Sequoyah Units 1 and 2 TS 3.8.1 requires, in part, four DGs capable of supplying the onsite Class 1E AC Electrical Power Distribution System, to be operable in Modes 1 through 4; if a DG is inoperable, it shall be returned to operable status within 7 days or in accordance with the Risk-Informed Completion Time Program.
Contrary to the above, on January 25, 2023, the licensee failed to establish, implement, and maintain a procedure appropriate to the circumstances of the 1B DG maintenance as required in TS 5.4.1, resulting in the licensees failure to meet the DG operability requirements in TS 3.8.1. Specifically, the licensee failed to establish, implement, and maintain appropriate preventive maintenance instructions under PM 063604820 to properly tighten the rear exhaust valve bridge adjuster locknut on the 1B DG cylinder #14, leading to the failure of the DG on September 19, 2023, during a surveillance test.
Hence, further, contrary to the above, from January 25, 2023, through September 29, 2023, the licensee failed to provide four operable DGs capable of supplying the onsite Class 1E AC Electrical Power Distribution System. Specifically, given performance of the inadequate preventive maintenance activity in January 2023, the 1B DG was unable to support design-basis events.
Enforcement Action: This violation is being treated as an apparent violation pending a final significance (enforcement) determination.
EXIT MEETINGS AND DEBRIEFS
The inspectors verified no proprietary information was retained or documented in this report.
- On February 27, 2024, the inspectors presented the NRC inspection results to Mr. Tom Marshall, Site Vice President, and other members of the licensee staff.
DOCUMENTS REVIEWED
Inspection Type Designation Description or Title Revision or
Procedure Date
71111.15 Corrective 1881328 Unit 1 received 09/19/2023
Action unexpected alarms
Documents resulting in emergency
stopping 1B DG
71111.15 Corrective 1882753 Perform inspection of 09/26/2023
Action locking nuts on the rocker
Documents assembly for 2B diesel
generator
71111.15 Corrective 1900849 EDG engine 1B2 exhaust 01/02/2024
Action valve failure
Documents
71111.15 Miscellaneous SQN-0-24-008 R0 PRA Evaluation 02/15/2024
Response
UNIT 1 B-EDG DETAILED RISK EVALUATION
OVERALL RISK SUMMARY
The Sequoyah Unit 1 B-train emergency diesel generator (EDG) was rendered inoperable due
to significant damage to the #14-cylinder assembly during a surveillance test on September 19,
23. A conditional risk evaluation using a 246-day exposure period preliminarily estimated an
increase in Core Damage Frequency (delta-CDF) of 2.68E-05/year for Unit 1 and 2.10E-05/year
for Unit 2. The Standardized Plant Analysis Risk (SPAR) model dominant sequences were
associated with station blackout (SBO) scenarios that did not include consideration of the
reactor decay heat removal and Reactor Coolant System (RCS) cooldown that would occur as
the result of the delayed onset nature of SBO plant conditions following the initial loss of offsite
power. Additional evaluation of the impact of the delayed onset of SBO conditions will be
necessary to refine the preliminary risk estimates before making a final significance
determination.
EXPOSURE TIME
The component run time failure approach discussed in Section 2.5 of Volume 1 of the Risk
Assessment Standardization Project (RASP) Manual was used to evaluate the condition
exposure time. The run history of the B-train EDG prior to the failure in September 2023 was
used to determine the number of intervals of accumulated operation for its 24-hour Probabilistic
Risk Assessment (PRA) mission time (condition inception time unknown but the degradation
was assumed to progress only during operation of the EDG). The final time interval included the
B-train EDG repair time after the failure was identified during the surveillance test. A total
exposure time of 246 days divided into eight run intervals, including repair time, was used for
the analysis.
RISK ANALYSIS/CONSIDERATIONS
Assumptions
1. The condition was assumed to only continue to degrade when the EDG was operated and
not when in a standby status. Consequently, the component run time failure approach
discussed in Section 2.5 of Volume 1 of the RASP manual was used to evaluate the
condition exposure time. Based on the run history of the B-train EDG, a condition exposure
period of 246 days, divided into eight separate run intervals, and including repair time, was
used for the analysis. To explore the sensitivity of the evaluation method, a sensitivity case
will be performed that does not divide the 246-day exposure period into separate time
intervals.
2. No repair credit for the failure of the B-train EDG was included in the analysis.
3. Diverse and Flexible Coping Strategies (FLEX) mitigating strategies and equipment were
credited in the analysis using a 24-hour PRA mission time. FLEX equipment reliability was
modeled using information contained in PWROG-18042-NP, Revision 1, FLEX Equipment
Data Collection and Analysis, (ADAMS ML22123A259). A sensitivity case with no FLEX
credit was also performed.
Systems Analysis Program for Hands-On Integrated Reliability Evaluations (SAPHIRE) software
Version 8.2.9 and Sequoyah SPAR model Version 8.82 were used for the evaluation.
1. The SPAR model was modified to account for the FLEX implementation strategy at
Sequoyah. A new SBO-ELAP event tree and top events were created with the following key
characteristics:
deployment and are in enclosures on the auxiliary building roof was created to query
the ability to power the battery chargers following Extended Loss of AC Power
(ELAP) declaration. Success of the 480V FLEX DGs would extend battery availability
for remainder of sequences.
- A top event was created for powering the 6.9kV shut down boards from the 3 MW
6.9kV FLEX DGs which are permanently installed and located in a separate building
from the EDGs. Success of the 6.9kV FLEX DGs provides the ability to power in-
plant equipment like Motor-Drive Auxiliary Feedwater (MDAFW) and Safety Injection
(SI) pumps (in addition to FLEX mitigating equipment). The 6.9kV FLEX DGs can be
used to power the battery chargers should the 480V FLEX DGs fail. DC load
shedding at Sequoyah does not impact the ability to power components such as the
MDAFW pumps or SI pumps from the 6.9kV FLEX DGs. The corresponding top
events were modified to reflect the availability of safety-related components for
mitigation given the success of the 6.9kV FLEX DGs.
2. The approach discussed in Section 2.5 of the RASP manual was used to evaluate the
condition exposure time. The run history of the B EDG prior to the failure in September
23 was used to determine the number of intervals of accumulated operation of the EDG
for the 24-hour PRA mission time (condition inception time unknown but the engine
degradation mechanism was assumed to only progress during operation of the EDG). The
final 10 days being considered in the exposure time includes the EDG repair time after the
failure occurred.
- The fault tree logic for the B-train EDG was modified to split the fail-to-run basic
event into two separate components so that adjustments could be made to credit
EDG operation prior to failure. The SAPHIRE convolution mapping tool was then
used to update model convolution events using the new fault tree logic.
- For the conditional case, the model was adjusted using change set
1BEXT_EDG_FTR which set event EPS-DGN-FR-1B to TRUE so that the FTR
common cause change would be calculated by SAPHIRE. The change set also set
the new basic event EPS-DGN-FR-1BEXT to 1.0 so the failure would show up in
cutsets for post-processing adjustment made for credited EDG run time.
- For each time interval, the mission time for basic events EPS-DGN-FR-1BT2 and
EPS-DGN-FR-1BEXT were adjusted to reflect the estimated run time before failure
and each time interval also included ET post-processing to look for B EDG FTR
basic event EPS-DGN-FR-1BEXT in the cutsets and substitute the appropriate
recovery terms based on credited EDG operation.
3. For each time interval, event tree post-processing rules were used to substitute the
appropriate recovery terms based on credited EDG operation. This had the effect of
crediting some amount of time of 1B EDG operation prior to its failure when estimating the
likelihood of non-recovery of power sources to the shutdown boards. As an example, if the
EDG would be expected to operate for approximately six hours (at nominal failure
likelihood) prior to failure due to the performance deficiency, the one- and four-hour non-
recovery terms for Loss of Offsite Power (LOOP) recovery would be adjusted to seven and
ten hours respectively.
4. A conditional case was performed for every interval bin and the results were summed to
determine the overall risk estimate.
5. The following SPAR model event sequences were used in evaluating the nominal and
conditional cases:
- INTERNAL EVENTS
- FIRE
- SEISMIC
- TORNADO
- EXTERNAL FLOODING
6. SAPHIRE condition assessments were performed using the event tree direct solve method
where cutset results were gathered for sequences other than internal events. Conditional
case change set 1B_EDG_FTR was used to evaluate the change in risk that could be
attributed to the EDG failure for each time interval being evaluated over 236 days of the
exposure period. The final 10 days of repair time was estimated by performing a condition
assessment with the 1B EDG Test and Maintenance basic event (EPS-DGN-TM-1B) set to
TRUE for the conditional case.
7. SAPHIRE condition assessments were also performed using the ECA module to generate
dominant sequence and cutset reports. Conditional case change set 1B_EDG_FTR was
used in the condition assessments.
CALCULATIONS
Best Estimate:
Exposure Fire Int. Evnt Hi-Wind Seismic Int. Flood Tornado Ext. Flood
Interval (days) -CDP -CDP -CDP -CDP -CDP -CDP -CDP
26 1.49E-06 8.72E-07 3.26E-07 1.99E-08 9.19E-09 3.12E-09 9.26E-10
24 1.40E-06 8.17E-07 3.03E-07 1.84E-08 8.55E-09 2.87E-09 8.55E-10
38 2.24E-06 1.31E-06 4.83E-07 2.92E-08 1.35E-08 4.55E-09 1.35E-09
28 1.67E-06 9.78E-07 3.58E-07 2.15E-08 9.90E-09 3.34E-09 9.97E-10
28 1.68E-06 9.93E-07 3.61E-07 2.15E-08 9.90E-09 3.34E-09 9.97E-10
35 2.13E-06 1.26E-06 4.55E-07 2.68E-08 1.25E-08 4.18E-09 1.25E-09
29 1.79E-06 1.07E-06 3.81E-07 2.22E-08 1.03E-08 3.46E-09 1.03E-09
28 1.75E-06 1.07E-06 3.72E-07 2.15E-08 9.97E-09 3.34E-09 9.97E-10
Repair 10 5.69E-07 3.64E-07 9.99E-08 5.21E-09 3.23E-09 7.67E-10 2.19E-10
Total 246 1.47E-05 8.74E-06 3.14E-06 1.86E-07 8.71E-08 2.90E-08 8.62E-09
SAPHIRE condition assessments were performed using the direct solve method and conditional
case change set 1B_EDG_FTR. The overall estimated increase in risk was a change in Core
Damage Probability (delta-CDP) of 2.68E-05. FIRE sequences were determined to be strongly
dominant in the results with INTERNAL EVENTS and HIGH WINDS also significant sequence
contributors. SAPHIRE ECA condition assessments were performed to generate dominant
sequence and cutset reports.
Dominant FIRE cutsets were associated with fire initiating events in the shutdown board rooms
resulting in a LOOP. The LOOP is accompanied by common mode failure of the A-train
emergency diesel generator leading to an SBO with Reactor Coolant Pump (RCP) seal failure
resulting in core damage.
Dominant INTERNAL EVENT and HIGH WIND cutsets were associated with weather-related
LOOP with common mode failure of the A-train emergency diesel generator leading to an SBO
with either RCP seal failure (INTERNAL EVENT) or random failure of the turbine-driven auxiliary
feedwater pump to run (HIGH WIND).
Sensitivity 1 - No Time Intervals
To explore the sensitivity of the analysis results due to application of the run time treatment of
exposure time, this sensitivity will determine the estimated increase in risk-based on the full
exposure period without the use of time intervals or post-processing to adjust power recovery
terms.
SAPHIRE condition assessments were performed using the direct solve method and conditional
case change set 1B_EDG_FTR for the full 246-day exposure period.
Exposure Fire Int. Evnt Hi-Wind Seismic Int. Flood Tornado Ext. Flood
(days) -CDP -CDP -CDP -CDP -CDP -CDP -CDP
246 1.93E-05 1.23E-05 3.64E-06 1.82E-07 8.71E-08 2.90E-08 8.76E-09
The overall estimated increase in risk was a delta-CDP of 3.55E-05.
As expected, the sensitivity results were higher without consideration of the run history of the B
EDG or consideration for the increased time that would have been available to potentially
recover power sources for the affected safety bus. The higher estimate would not have been
sufficient to alter the overall conclusions of the analysis. The use of the run time failure
methodology was determined to be the most appropriate treatment of exposure time for the
analysis.
Sensitivity 2 - Use of SAPHIRE ECA vs. Direct Solve Method
Because SAPHIRE ECA was used to generate reports for the dominant sequence cutsets, the
information was readily available to assess the impact of the use of SAPHIRE ECA on the
quantification of results.
SAPHIRE ECA condition assessments were performed for the full exposure period (no run
intervals used) with the B EDG FTR basic event set to TRUE for the conditional case.
Exposure Fire Int. Evnt Hi-Wind Seismic Int. Flood Tornado Ext. Flood
(days) -CDP -CDP -CDP -CDP -CDP -CDP -CDP
246 2.05E-05 1.23E-05 3.86E-06 4.73E-07 9.76E-08 3.07E-08 8.33E-09
The overall estimated increase in risk was a delta-CDP of 3.73E-05.
The analyst noted that the analysis results were slightly higher than the use of no time intervals
in Sensitivity 1, but more significantly higher than the best estimate using the run time failure
approach. As with Sensitivity 1, the higher estimate would not have been sufficient to alter the
overall conclusions of the analysis.
Sensitivity 3 - No FLEX
To evaluate the sensitivity of analysis results with respect to crediting of FLEX mitigation
strategies, the basic event for operator failure to enter ELAP procedures was set to 1.0 for both
the nominal and conditional cases.
FLX-XHE-XE-ELAP = 1.0
SAPHIRE ECA condition assessments were performed for the full exposure period (no run
intervals used) with the B EDG FTR basic event set to TRUE for the conditional case.
Exposure Fire Int. Evnt Hi-Wind Seismic Int. Flood Tornado Ext. Flood
(days) -CDP -CDP -CDP -CDP -CDP -CDP -CDP
246 2.89E-05 1.83E-05 5.48E-06 5.47E-07 1.08E-07 4.85E-08 1.70E-08
The overall estimated increase in risk was a delta-CDP of 5.34E-05.
Although the analysis results demonstrated some sensitivity with respect to the crediting of the
FLEX, its importance in the risk estimate was tempered by dominant cutsets that involved early
failure of the Turbine-Drive Auxiliary Feedwater (TDAFW) pump or RCP seal failures where
FLEX mitigation is not credited in the base SPAR model based on the assumption that the SBO
occurs at the time of the LOO
- P. Although not a strongly influential factor, inclusion of FLEX
mitigation was determined to be most appropriate to the circumstances and was considered in
the best estimate case.
CROSS-UNIT IMPACT
Because the EDGs have the capability of supplying power to the other units associated
shutdown boards, the impact of the performance deficiency on Unit 2 was assessed. The fail-to-
run basic event for the 2B EDG (EPS-DGN-FR-2B) was used as a surrogate for the cross-unit
impact and set to TRUE because the SPAR model is a Unit 1 model. An ECA condition
assessment over the entire 246-day exposure period was performed using FIRE sequences.
FIRE sequences were selected because they were the most dominant in the analysis results.
The condition analysis for Unit 2 yielded an estimated delta-CDP of 1.61E-05 vs. the Unit 1
delta-CDP of 2.05E-05 for un-binned FIRE sequences. The analyst noted that the Unit 2 risk
estimate for FIRE sequences was approximately 79% of the Unit 1 results. Applying that level of
reduction to the overall binned Unit 1 results (as a representative impact to Unit 2) would
produce an estimated delta-CDP of 2.10E-05 for Unit 2.
LICENSEE EVALUATION
The licensee provided the NRC with an evaluation of the estimated increase in risk of the Unit 1
B-train EDG failure on February 15, 2024. The licensees evaluation included an analysis of the
impact of delayed onset of SBO conditions on mitigation of the key accident sequences
including those associated with RCP seal failure and TDAFW pump failure. Additional NRC
review of the licensees evaluation will be performed prior to reaching a final decision regarding
the significance of the finding.
DELTA CDF FOR EXPOSURE TIME
The overall preliminary results are summarized below:
Best Sensitivity #1 Sensitivity #2 Sensitivity #3
EVENT SEQUENCE Estimate No Intervals SAPHIRE ECA No FLEX ECA
FIRE 1.47E-05 1.93E-05 2.05E-05 2.89E-05
INTERNAL EVENTS 8.74E-06 1.23E-05 1.23E-05 1.83E-05
HIGH WINDS 3.14E-06 3.64E-06 3.86E-06 5.48E-06
SEISMIC 1.86E-07 1.82E-07 4.73E-07 5.47E-07
INTERNAL FLOODING 3.23E-09 8.71E-08 9.76E-08 1.08E-07
TORNADO 2.90E-08 2.90E-08 3.07E-08 4.85E-08
EXTERNAL FLOODING 8.62E-09 8.76E-09 8.33E-09 1.70E-08
TOTAL 2.68E-05 3.55E-05 3.73E-05 5.34E-05
Considering that SAPHIRE calculates the difference in Core Damage Probability over a given
exposure time, and that changes in CDF over the same period are numerically equivalent, the
change in CDF due to the finding would be on the order of 2.68E-05/year for Unit 1.
EXTERNAL EVENTS CONSIDERATIONS
Internal event risk estimates were greater than 1E-07, therefore all other external event
sequences were evaluated in the risk assessment.
LARGE EARLY RELEASE FREQUENCY IMPACT
The finding was evaluated in accordance with IMC 0609, Appendix H, Containment Integrity
Significance Determination Process, as a Type A finding. The dominant sequences in the
analysis are LOOP sequences and not Steam Generator Tube Rupture (SGTR) or Interfacing
System Loss of Coolant Accident (ISLOCA). The 6.9KV FLEX DGs can power the hydrogen
igniters through the 480V shutdown power distribution system. Additionally, the 480V FLEX
DGs can also be aligned to provide power to the hydrogen igniter supply transformers, if
required. The ability to restore power to the hydrogen igniters from FLEX equipment reduces the
likelihood of containment failure for SBO scenarios. For a LOOP/SBO sequence to represent
large early release frequency (LERF), core damage and containment failure must occur early in
the sequence and prior to the implementation of the site emergency plan for evacuation. The
analyst determined that additional evaluation would be warranted prior to making any
determination of delta-LERF risk. Specifically, the dominant cutsets would be reviewed to
determine if they represent a loss of secondary heat removal and failure of the FLEX DGs
simultaneously with an early failure of other mitigating equipment.
CONCLUSIONS/RECOMMENDATIONS
The preliminary estimated risk increase (delta-CDF) over the nominal case for the inoperability
of the Unit 1 B-train EDG was 2.68E-05/year (Unit 1) and 2.10E-05/year for Unit 2 (due to the
cross-unit impact). The dominant SPAR model sequences were associated with fire initiating
events that involved impact to the normal offsite power supply, unavailability of the A-train EDG
due to random failure or fire damage, resulting in station blackout (SBO) plant conditions,
followed by a reactor coolant pump seal failure or
turbine-driven auxiliary feedwater pump failure. Because the B-train EDG would have been
expected to operate for some period at nominal failure likelihood prior to onset of SBO
conditions, additional analysis of the impact of the delayed SBO on the potential mitigation of
the dominant accident sequences will be necessary before reaching a final determination of
significance. Accordingly, the finding is best characterized as preliminary greater-than-Green.
8