ML18333A333: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
 
(Created page by program invented by StriderTol)
 
Line 15: Line 15:


=Text=
=Text=
{{#Wiki_filter:Clinton Power StationRegulatory ConferenceDivision 2 Diesel GeneratorAir Start Isolation EventNovember 30, 2018 AgendaIntroduction . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . .Brad FewellFinding Cause and Corrective Actions. . . . . . . . . . . . . . .Brad KapellasKey Differences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Gene Kelly/Johnny WeissingerInitial Conditions for Postulated Event, Recovery and Mitigation Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . Johnny Weissinger/Gene KellyRisk Significance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Gene KellyConclusion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .Ted Stoner1 Clinton Power StationRegulatory ConferenceIntroductionBrad FewellSenior Vice President, Regulatory Affairsand General Counsel IntroductionWe agree with the Finding and violationWe recognize our failure to maintain the configuration of an important safety systemWe have taken timely, comprehensive, and broad responsive actions Commission Policy and NRC guidance drive risk evaluations to be realistic and based on best available information NRC risk evaluation does not reflect the as-built, as-operated plant responserecovery, SBO, FLEX, and ELAP by not appropriately crediting:Available time to take recovery actionsProcedures that control the event and drive successful resolutionPRA evaluations should be realistic and based on best available information3 Introduction (cont.)We will show that using realistic and best-available information:Division 2 DG would have been restored and injection available within one hourExpansive time was available to recover AC power and prevent core uncoveryProcedurally directed alternative power recovery actions would have been pursued in parallelObjective data to support different performance shaping factor (PSF) multipliersWe will provide information that the NRC did not previously review and new information that we have recently developedWe had the knowledge, time, and resources to restore AC power and injectionFinding should be characterized as Green4 Clinton Power StationRegulatory ConferenceFinding Cause and Corrective ActionsBrad KapellasPlant Manager Station Event ResponseRoot CauseContrary to Exelon fleet governance for plant status control, operator logs were utilized as the sole means to track plant configurationCorrective Action to Prevent ReoccurrenceIdentify and eliminate legacy site-specific administrative procedures/guidance that allow operator logs as a sole method for plant status controlContinuous Procedure UseCause of the event was not an operating procedure execution issueProcedure directed operator component manipulation error rate is very low (estimated less than two per million manipulations)Corrective Actionsprocedure knowledge and complianceReinforced accountability for equipment status control throughout operationsRevision to safety related operator rounds points Three day station wide campaign for change6Event taken seriously and being used as burning platform to moveculture to sustained levels of high Operational Excellence Clinton Power StationRegulatory ConferenceKey DifferencesGene KellySr. Manager, Risk ManagementJohnny WeissingerDirector, Operations Exelon and NRC Risk Results DifferencesLarge difference in our results, a factor of almost 400standpointKey differences:Actual site response in SBO conditionsAvailable time to recover power and injectionOperator experience and training applied to recovery actionsComplexity associated with power recovery actions8Exelon change in CDFNRC change in CDF1E-8/year3.8E-6/yearRisk analysis should reflect manner in which plant is operated Key Choice Letter DisagreementsNRCPositionExelonPositionAssumption 121 hour available to recover AC power to Division 2 by recovering DG; ELAP declared at 1 hour and FLEX power to Division 2 would commenceDG recovery complicated by SBO load shedding that removes all DC control power from DGFLEX electrical lineup impacts DG componentsAir start valves found isolated within 29 minutes; ELAP not declaredLoad shed recovery proceduralizedand does not complicate DG recoveryELAP not declared/FLEX staging onlyAssumption 13Experience/training considered Low for DG recovery diagnosisOperators have not trained on, experienced, or been exposed to failed DGDG air start valve position easily identified in knowledge-based or procedure-based modeOperators extensively trained on DG malfunctions9 Key Choice Letter Disagreements (cont.)NRCPositionExelonPositionAssumption 2Time to TAF does not appear to credit shutdown cooling isolationOperators will close one shutdown cooling valve per procedure to extend time to TAF from 10.8 hours to about 24 hoursAssumptions 14,23, 24FLEX implementation success credited as LowFLEX lineup experience/training considered Low FLEX ergonomics considered PoorNRC inspections confirm that FLEX strategy meets regulatory requirementsFLEX trained in accordance with Systematic Approach to TrainingFLEX tasks similar to normal EO tasks & performed in non-adverse conditionsAssumption15Div3 to Div2 AC power cross-tie is ComplexTime required to complete cross-tie is 5-6 hoursProcedure is straightforward and not complexTime-validated at 1.5 hours10 Clinton Power StationRegulatory ConferenceInitial Conditions for Postulated Event, Recovery and Mitigation ActionsJohnny WeissingerDirector, OperationsGene KellySr. Manager, Risk Management Success CriteriaInjection Established Before RPV Water Level Reaches the Top of Active FuelDivision 2 DG is completely recoverable (no equipment malfunction) and operations response would not complicate recoveryNRC did not model or credit Division 2 DG after one hourOne action to close a shutdown cooling valve (1E12-F008), as directed by procedure, extends the time to TAF to about 24 hoursDC batteries provide ability to control RPV pressure using SRVs permitting use of low or high pressure injection sources12 Exelon PerspectiveRPV injection will be restored prior to reactor water level lowering below TAF through multiple, independent, and diverse meansRule-based procedural guidance to restore the DGKnowledge-based identification of the DG air start valvesCross-tie of the Division 3 DG to the Division 2 busUse of FLEXIdentifying the closed air start valves, reopening them, and restarting the DG per procedure terminates the postulated eventSignificant time available before deterioration of plant conditionsOperators are extremely knowledgeable and experienced with DG operationAll actions to identify the valves and restart DG are proceduralizedAir start valves are readily identifiable and accessibleReopening a manual ball valve is a simple taskEmergency battery lighting and portable flashlights availableSignificant resources onsite to support13 Bus Alignment During Div 1 & 2 DG Unavailability14Division 1 4160VDivision 2 4160VDivision 3 4160V138 kV SwitchyardRATB XFMRERAT XFMRDiv1 DGDiv2 DGDiv3 DGSystem Outage WindowUnplanned out-of-serviceDivision 1Division 2Division 3AC DistributionXAC DistributionOAC DistributionODiesel GeneratorXDiesel GeneratorXDiesel GeneratorORHR-A / SDCXRHR-B / SDCOHPCSXLPCSXRHR-CODC BatteriesODC BatteriesODC BatteriesOPlant is in Mode 4 Cold ShutdownTime To Boil ~4 hours345 kV Switchyard Overview of Station Response to a SBOLOOP/Station BlackoutTime ExtensionOperations ResponseShutdown Cooling Isolation(extends time to TAF from 10.8 hrsto ~24 hrs)DC Battery Load Shedding(extends battery life from 2.3 hrsto 24 hrs)Control RPV Pressure for Low Pressure InjectionPower RecoveryAlign Div2 DG to startFLEXDiv3 DG cross-tie to Div2 busRestore Offsite PowerEmergency ResponseDeclare ALERTActivate ERO15 Loss of AC Power Procedure 4200.0116SBO is not a beyond design basis external eventDefinitions are in accordance with CPS licensing basis LOOP Procedure Direction for ELAP Declaration17HIGH ASSURANCE that power will be recovered within 4 hours includes:-Division 2 DG air start valves identified out of position-No maintenance performed on Division 2 DG during outage-No degraded conditions for the Division 2 DG existedShift Manager has High Assurance ELAP does not exist Entry into ELAPOperators are exhaustively trained on the DGs and Loss of AC Power due to high risk significanceFive simulator scenarios, 26 exam questions, biennial training in last two yearsOperator JPMs for DGs include resetting trips/lockouts and manually bypassing the air start system to manually start the engine with 100% pass rates administered a total of 50 times in the last two yearsERO is trained on LOOP/FLEXERO drills include simulated loss of power and/or loss of DGTSC personnel experienced in plant restorationRestoration of power is high prioritySix CPS Shift Managers were surveyed for four potential ELAP scenariosAll surveyed Shift Managers stated they would not declare an ELAP during scenarios where action was taken to recover power within the 4-hour SBO coping periodAll Shift Managers stated they would not enter ELAP/FLEX procedures once the DG air start valves are identified out of positionAll Shift Managers surveyed stated they would pre-stage FLEX equipment to improve plant risk28 SROs from other stations (including non-Exelon) were given CPS procedures and scenarios that recreated the postulated scenarioAll SROs stated that they remain in the LOOP procedure and NOT enter ELAP18No ELAP entry conditions Recovery Pathway #1:  Division 2 DG RestorationTime validation for a CPS EO to walkdown and identify the out of position air start valves using only system knowledge was 11 minutesTime validation for a CPS EO to identify and correct the out of position air start valves per procedure was 29 minutesDG full lineup completed within 40 minutes and in service within 50 minutesJPM performed by non-CPS EOs to identify out of position air start valvesAll six EOs identified closed air start valves using procedure within 32 minutesDG full lineup completed within 37 minutesMultiple operators, engineers, and technicians would respond, improving DG recovery time19Division 2 DG will be recovered in < 1 hour Rule-Based Operator Response to Division 2 DGFailure to Start20Knowledge / Training-Based ResponseEOs are trained to check the air start system after any DG start. The EO is also cued by the alarm card.The out of position air start valves will be identified during this walkdown.Procedure / Rule-Based ResponseA supervisor and additional EOs arrive to support with the procedure in hand. The out of position air start valves are identified by procedure.EO resets DG lockouts and Engine Start(bus energized)EO commences DG lineup and restores valves per procedureEO requests DG standby procedure. Walks down DG.Dedicated Safe Shutdown EO arrives and reports Failure to Start alarm and no visible equipment damageMultiple means to identify out of position air start valvesDG is recovered.Air start valves are restored by procedure.The Div2 DG starts and restores power.Identification of closed air start valves and no visible damage provides Shift Manager High Assurance of Division 2 power recoveryLOOP/SBO Entered Operator Response to Division 2 DGFailure to Start (Rule-Based)21 22Dedicated EO requests a copy of the DG procedures from the Control RoomOperator Alarm Response (Rule-Based)
{{#Wiki_filter:Clinton Power Station Regulatory Conference Division 2 Diesel Generator Air Start Isolation Event November 30, 2018
Operator Alarm Response (Rule-Based)23DG recovered completely by proceduresOn Page 6 of DG operating procedureOpening of the air start valves is procedurally governedRestoration of DC control power following load shed is procedurally governed and does not complicate DG recoveryLoad shed circuits are recovered per Loss of AC Power procedure Operator Response to Division 2 DGFailure to Start (Knowledge-Based)24Starting air receiver pressure is 225-250 psigand did not lower as expected following DG start signal Operator Validates DG Starting Air Parameters25EO identifies closed air start valves based on alarms and local indicationsDivision 2 DG Local Air Start PressureLocated on gauge board, as found during the eventDivision 2 DG Air Receiver Pressure Tech Spec LCO 3.8.3Not on operator rounds prior to event0 psigRequired to log on operator roundsNormal pressure is 225-250 psig Operator Response to Division 2 DGFailure to Start26This flow path was most recently trained in 2017Air start path can be easily traced back to the receiversEO JPM to start the DG by overriding the air start system solenoids/lineup; 100% pass rate across 27 Operators in 2017 Operator Validates Air Start System Did Not Actuate Through Equipment Checks27If the DG received starting air, an oil spray/mist would be visible below the exhaust of the six air start motors Operator Response to Division 2 DGFailure to Start28Walking down the air start system is trained and performed with the monthly DG runsEOs trained to check air start system response after DG start Operator Identifies Out Of Position Air Start Valves29Left over tie wraps from clearance order tags as found on 5/17/18Division 2 DG air start valve in the Operator Response to Division 2 DGFailure to Start30Video DG Restoration SummaryIdentification of the out of position air start valves will occur in either knowledge or rule-based space Air start valves are time validated to be identified by knowledge in 11 minutes and procedure in 29 minutesDG recovery is simple task (open air start valves) using regularly executed DG lineup procedureIdentification of closed air start valves and no visible damage provides Shift Manager High Assurance of Division 2 power recoveryAn ELAP will not be declaredOCC/ERO technical support and large number of resources31We had knowledge, time, and resources to restore Division 2 DG Impact of Actual Response:  Div 2 DG RecoveryRealistic modeling of Division 2 DG recovery, by itself, leads to GREEN significance320.005(99.5% success)0.2 (80% success)Considerable available time, and operator experienceand training assure high successPSFNRC Diagnosis SettingExelon PositionSPAR-H HEPReduction FactorImpact on FindingAvailable Time(required time <1 hr)Nominal1 hrExpansiveonly need 2 hrs, but 24 hrsavailable~50GREENExperience/TrainingLowNominal~10GREEN Minimum Shift Staffing33Shift Manager (SRO)2 Senior Reactor Operators3 Reactor OperatorsControl Room Team6 Equipment OperatorsDedicated OnDutySecurity Force Members2 RP TechniciansChemistryTechnician1 IM/EM ERO Outage Response Staffing137 -Minimum craft staffing on any shift during the affected window of C1R1834Control Room Team6 Senior Reactor Operators5 Reactor Operators27 Equipment Operators30 Mechanics44 Instrument Maintenance Technicians16 Electricians11 Radiation Protection Technicians4 Chemistry TechniciansShift Manager (SRO)
 
Event Recovery TimelineActivities in Series35Start2 hours4 hours6 hours8 hours10 hours12 hoursRestore Div2 DG to Service (50min)Complete DC Load Shed (1 hour)Commence FLEX Pre-Staging (1 hour)ERO Is Staffed (Alert) (1 hour)Complete Div3 to Div2 X-Tie (1.5 hours)End of SBO. Commence FLEX (4 hours)FLEX is ready for RPV injection (5 hours*)RCS Boiling Begins (4 hours)Shutdown Cooling Isolated within 6 hoursTime to TAF (No Operator Actions) (10.8 hours)Time to TAF (SDC isolated or RPV pressure controlled low with Batteries) (~24hours)Substantial time available for mitigation actionseven if performed in series5 hours is the worst case for FLEX RPV injection and 8 hours is the worst case FLEX heat removal and suppression pool makeup. RPV injection commences before TAF in all cases.*1 hour subtracted from FLEX times because they overlap with the first hour of SBO actions.
Agenda
Recovery Pathway #2: Cross-Tie Div3 DG to Div2 Bus36-Bus cross-tie completion validated to complete in 1.5 hours-Open one in-plant disconnect-Open four relay test switches-Remove one relay control power fuse-Control Room performs breaker alignments-Tools pre-staged in operations locked cages and all manipulations in general plant areas-Switchgear breaker and disconnect training occurs every two years-Four page procedure with pictures, locations, and diagrams simplify execution Cross-Tie Div3 DG to Div2 Bus During SBO37Division 1 4160VDivision 2 4160VDivision 3 4160V345kV Switchyard138 kV SwitchyardRATB XFMRERAT XFMRDiv1 DGDiv2 DGDiv3 DGSystem Outage WindowUnplanned Out of serviceDivision 1Division 2Division 3AC DistributionXAC DistributionOAC DistributionODiesel GeneratorXDiesel GeneratorXDiesel GeneratorORHR-A / SDCXRHR-B / SDCOHPCSXLPCSXRHR-CODC BatteriesODC BatteriesODC BatteriesO Impact of Actual Response: Div 3 to Div 2 Cross-Tie38-Tie HEP-Tie HEP0.096(90.4% success)0.27(73% success)PSFNRC Action SettingExelon PositionSPAR-H HEPReduction FactorImpact on FindingAvailable Time(required time ~1.5 hr)Nominal(13 hours)Extra(24 hours)~7GREENExperience/TrainingLowNominalErgonomicsPoorNominalComplexityHighModerateRealistic modeling of Division 3 cross-tie, coupled with higher likelihood of offsite power recovery within 24 hours, leads to Green Recovery Pathway #3:FLEX Implementation and Timeline39FLEX equipment pre-staged in parallel until implementation required FLEX Implementation and TimelineBy 2 hours:  Briefs complete, teams ready to dispatchBy 4 hours:  Pre-staging complete, hoses and cables run to location, FLEX generator running in standby; plant realignment occurs when directed by Control Room SupervisorBy 6 hours:  Battery charger in service powering Division 2 batteries, low pressure RPV makeup is availableBy 8 hours:  Decay heat removal and suppression pool makeup availableMinimum Personnel:  6 Operators, 6 Security Force Members (for 3 hours), 2 Radiation Protection Technicians, 1 Chemistry TechnicianOutage Personnel: At least 15 Qualified Operators + Supervision, Electrical and Mechanical maintenance dispatched by the ERO to support as necessary40 FLEX Training and ExperienceTask specific procedures are located in field FLEX cabinetseach section to ensure all required manipulations are completedMost tasks are similar to normal EO tasksRacking breakersStarting FLEX generator (similar to TSC generator)Routing cable or hosesTrained in accordance with the Systematic Approach to TrainingFrom NRC Inspection Report TI-41EOs trained and proficient with FLEX equipment and procedures Impacts of Actual Response:  FLEX Alignment 420.002(99.8% success)0.25(75% success)PSFNRC Action SettingExelon PositionSPAR-H HEPReduction FactorImpact on FindingAvailable Time(required time ~4 hr)Nominal(13 hours)Extra(24 hours)~12GREENExperience/TrainingLowNominalErgonomicsPoorNominalComplexityHighNominalRealistic modeling of FLEX deployment, coupled with higher likelihood of offsite power recovery within 24 hours, leads to Green RPV Pressure ControlSRVs are available for pressure control for > 24 hoursDivision 1 and 2 DC batteries analyzed with > 24 hours capacity with outage loadsADS accumulators and backup air bottles fully chargedProcedure guidance to stabilize pressure in multiple proceduresStation Blackout, Loss of Shutdown Cooling, EOP-1, FLEXEOP-1 directs holding RPV pressure < 104 psiguntil shutdown cooling restoredTime to boil is 4 hours, SRV usage not needed until at least 8 hours43RPV pressure controlled to allow use of low pressure injection systems InjectionMultiple diverse injection systems available after Division 2 AC power restored using proceduralizedactions43 gpm(4000 gallon tank), injects at any pressure, no field actions requiredWithin 1 minute, start RHR-B/C water leg pump from Control Room50 gpmwith RPV depressurized, no field actions requiredManually start RHR-C for Low Pressure Coolant Injection (LPCI)Align RHR-B from shutdown cooling to LPCI modeAdditional injection systems using proceduralizedactionsFLEX pump direct injection from Ultimate Heat SinkSuppression Pool Transfer Pump using FLEX generator powerFire pump injection (direct to RPV or using hoses)44Any one path restores RPV level Impact of Actual Response Pressure/Inventory Control 45Exelon HEPNRC HEPSDC Isolation0.022 (98% success)Not modeledRealistic modeling of loss of shutdown cooling actions and RPV pressure control, coupled with multiple sources of injection, leads to GreenMaintain RPV Pressure (Using Division 1 or 2 Batteries)0.001(99.9% success)Not modeledBoth actions procedurally directedSuccess of EITHER action extends time to TAF to about 24 hoursIncreases Available Time for Diagnosis and Action to restore onsite equipmentIncreases likelihood of offsite power recoveryDivision 1 and 2 batteries available for RPV pressure control (SRVs) for 24 hoursRPV pressure control enhances ability for low or high pressure injection sources Recovery and Mitigation ActionsSummaryIdentification of out of position air start valves will occurDG recovery is simple task (open air start valves)Shift Manager has High Assurance of Division 2 power recoveryActivities to restore power taken in parallel but controlled to minimize conflicts Other defense-in-depth actions provide additional success paths within the available time46AC power and injection recovered quickly and successfully Clinton Power StationRegulatory ConferenceRisk SignificanceGene KellySr. Manager, Risk Management Risk Assessment for Safety SignificanceFor White significance, NRC must conclude the SBO condition would not be successfully mitigated because:Division 2 DG not recovered within 1 hourandELAP declared at 1 hourandShutdown cooling valve not isolatedandRPV pressure not controlledandDivision 3 to Division 2 AC power cross-tie procedurally complexandFLEX strategy inadequate and not sufficiently trainedWhite significance not based on realistic or best available information48 Clinton Power StationRegulatory ConferenceConclusionTed StonerSite Vice President ConclusionWe had the knowledge, time, and resources to restore AC powerNRC policy and guidance dictate risk evaluations to be realistic and based on the best available informationBest available information includes:Reflecting a realistic response to the eventRecognizing extensive operator training and experienceAppropriately crediting FLEXUsing the best available information as presented today and applying the 50Green significance}}
* Introduction . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . Brad Fewell
* Finding Cause and Corrective Actions. . . . . . . . . . . . . . . Brad Kapellas
* Key Differences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Gene Kelly/Johnny Weissinger
* Initial Conditions for Postulated Event, Recovery and Mitigation Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . Johnny Weissinger/Gene Kelly
* Risk Significance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Gene Kelly
* Conclusion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ted Stoner 1
 
Clinton Power Station Regulatory Conference Introduction Brad Fewell Senior Vice President, Regulatory Affairs and General Counsel
 
Introduction
* We agree with the Finding and violation
* We recognize our failure to maintain the configuration of an important safety system
* We have taken timely, comprehensive, and broad responsive actions
* We disagree with the Findings preliminary significance of White
  - Commission Policy and NRC guidance drive risk evaluations to be realistic and based on best available information
  - NRC risk evaluation does not reflect the as-built, as-operated plant response
* NRCs risk evaluation assumptions do not reflect how CPS would respond to DG recovery, SBO, FLEX, and ELAP by not appropriately crediting:
  - Operators extensive knowledge, training, and experience
  - Available time to take recovery actions
  - Procedures that control the event and drive successful resolution PRA evaluations should be realistic and based on best available information 3
 
Introduction (cont.)
* We will show that using realistic and best-available information:
  - Division 2 DG would have been restored and injection available within one hour
  - Expansive time was available to recover AC power and prevent core uncovery
  - Procedurally directed alternative power recovery actions would have been pursued in parallel
  - Objective data to support different performance shaping factor (PSF) multipliers
* We will provide information that the NRC did not previously review and new information that we have recently developed
* We had the knowledge, time, and resources to restore AC power and injection Finding should be characterized as Green 4
 
Clinton Power Station Regulatory Conference Finding Cause and Corrective Actions Brad Kapellas Plant Manager
 
Station Event Response
* Root Cause
  - Contrary to Exelon fleet governance for plant status control, operator logs were utilized as the sole means to track plant configuration
* Corrective Action to Prevent Reoccurrence
  - Identify and eliminate legacy site-specific administrative procedures/guidance that allow operator logs as a sole method for plant status control
* Continuous Procedure Use
  - Cause of the event was not an operating procedure execution issue
  - Procedure directed operator component manipulation error rate is very low (estimated less than two per million manipulations)
* Corrective Actions
  - Implemented I know because I looked initiative station wide to improve administrative procedure knowledge and compliance
  - Reinforced accountability for equipment status control throughout operations
  - Revision to safety related operator rounds points
  - Three day station wide campaign for change Event taken seriously and being used as burning platform to move culture to sustained levels of high Operational Excellence 6
 
Clinton Power Station Regulatory Conference Key Differences Gene Kelly Sr. Manager, Risk Management Johnny Weissinger Director, Operations
 
Exelon and NRC Risk Results - Differences Exelon change in CDF  NRC change in CDF 1E-8/year            3.8E-6/year
* Large difference in our results, a factor of almost 400
* The difference is not in PRA methods  both use similar approaches from a PRA standpoint
* Key differences:
  - Actual site response in SBO conditions
  - Available time to recover power and injection
  - Operator experience and training applied to recovery actions
  - Complexity associated with power recovery actions Risk analysis should reflect manner in which plant is operated 8
 
Key Choice Letter Disagreements NRC Position                                          Exelon Position Assumption 12
* 1 hour available to recover AC power to Division
* Air start valves found isolated within 29 minutes; 2 by recovering DG; ELAP declared at 1 hour and       ELAP not declared FLEX power to Division 2 would commence
* DG recovery complicated by SBO load shedding
* Load shed recovery proceduralized and does not that removes all DC control power from DG              complicate DG recovery
* FLEX electrical lineup impacts DG components
* ELAP not declared/FLEX staging only Assumption 13
* Experience/training considered Low for DG
* DG air start valve position easily identified in recovery diagnosis                                    knowledge-based or procedure-based mode
* Operators have not trained on, experienced, or
* Operators extensively trained on DG malfunctions been exposed to failed DG 9
 
Key Choice Letter Disagreements (cont.)
NRC Position                                          Exelon Position Assumption 2
* Time to TAF does not appear to credit shutdown
* Operators will close one shutdown cooling valve cooling isolation                                      per procedure to extend time to TAF from 10.8 hours to about 24 hours Assumptions 14, 23, 24
* FLEX implementation success credited as Low
* NRC inspections confirm that FLEX strategy meets regulatory requirements
* FLEX lineup experience/training considered Low
* FLEX trained in accordance with Systematic Approach to Training
* FLEX ergonomics considered Poor
* FLEX tasks similar to normal EO tasks &
performed in non-adverse conditions Assumption 15
* Div 3 to Div 2 AC power cross-tie is Complex
* Procedure is straightforward and not complex
* Time required to complete cross-tie is 5-6 hours
* Time-validated at 1.5 hours 10
 
Clinton Power Station Regulatory Conference Initial Conditions for Postulated Event, Recovery and Mitigation Actions Johnny Weissinger Director, Operations Gene Kelly Sr. Manager, Risk Management
 
Success Criteria Injection Established Before RPV Water Level Reaches the Top of Active Fuel
* Division 2 DG is completely recoverable (no equipment malfunction) and operations response would not complicate recovery
  -  NRC did not model or credit Division 2 DG after one hour
* One action to close a shutdown cooling valve (1E12-F008), as directed by procedure, extends the time to TAF to about 24 hours
  -  Does not appear to be modeled in NRCs analysis
* DC batteries provide ability to control RPV pressure using SRVs permitting use of low or high pressure injection sources
  -  Does not appear to be modeled in NRCs analysis 12
 
Exelon Perspective
* RPV injection will be restored prior to reactor water level lowering below TAF through multiple, independent, and diverse means
  - Rule-based procedural guidance to restore the DG
  - Knowledge-based identification of the DG air start valves
  - Cross-tie of the Division 3 DG to the Division 2 bus
  - Use of FLEX
* Identifying the closed air start valves, reopening them, and restarting the DG per procedure terminates the postulated event
  - Significant time available before deterioration of plant conditions
  - Operators are extremely knowledgeable and experienced with DG operation
  - All actions to identify the valves and restart DG are proceduralized
  - Air start valves are readily identifiable and accessible
  - Reopening a manual ball valve is a simple task
  - Emergency battery lighting and portable flashlights available
  - Significant resources onsite to support 13
 
Bus Alignment During Div 1 & 2 DG Unavailability 345 kV Switchyard Plant is in Mode 4 - Cold Shutdown RAT-B XFMR              RPV Water Level 235 to 250 above TAF Time To Boil ~4 hours Division 1 4160V                  Division 2 4160V                        Division 3 4160V Unplanned out-of-Div 1 DG                service                                          Div 3 DG Div 2 DG System Outage Window Division 1          Division 2        Division 3 138 kV Switchyard                            AC Distribution  X AC Distribution  O AC Distribution  O Diesel Generator X Diesel Generator X Diesel Generator O ERAT XFMR                  RHR-A / SDC      X RHR-B / SDC      O HPCS            X LPCS            X RHR-C            O DC Batteries    O DC Batteries    O DC Batteries    O 14
 
Overview of Station Response to a SBO LOOP/Station Blackout Operations Response Power Recovery                Time Extension                Emergency Response Shutdown Cooling      Declare ALERT Restore Offsite                    Isolation Power                    (extends time to TAF from 10.8 hrs to ~24 hrs)        Activate ERO Align Div 2 DG to start                      DC Battery Load Shedding (extends battery Div 3 DG cross-tie            life from 2.3 hrs to to Div 2 bus                      24 hrs)
Control RPV FLEX                    Pressure for Low Pressure Injection 15
 
Loss of AC Power Procedure 4200.01
* Definitions are in accordance with CPS licensing basis SBO is not a beyond design basis external event 16
 
LOOP Procedure Direction for ELAP Declaration HIGH ASSURANCE that power will be recovered within 4 hours includes:
- Division 2 DG air start valves identified out of position
- No maintenance performed on Division 2 DG during outage
- No degraded conditions for the Division 2 DG existed Shift Manager has High Assurance ELAP does not exist 17
 
Entry into ELAP
* Operators are exhaustively trained on the DGs and Loss of AC Power due to high risk significance
  - Five simulator scenarios, 26 exam questions, biennial training in last two years
  - Operator JPMs for DGs include resetting trips/lockouts and manually bypassing the air start system to manually start the engine with 100% pass rates administered a total of 50 times in the last two years
* ERO is trained on LOOP/FLEX
  - ERO drills include simulated loss of power and/or loss of DG
  - TSC personnel experienced in plant restoration
  - Restoration of power is high priority
* Six CPS Shift Managers were surveyed for four potential ELAP scenarios
  - All surveyed Shift Managers stated they would not declare an ELAP during scenarios where action was taken to recover power within the 4-hour SBO coping period
  - All Shift Managers stated they would not enter ELAP/FLEX procedures once the DG air start valves are identified out of position
  - All Shift Managers surveyed stated they would pre-stage FLEX equipment to improve plant risk
* 28 SROs from other stations (including non-Exelon) were given CPS procedures and scenarios that recreated the postulated scenario
  - All SROs stated that they remain in the LOOP procedure and NOT enter ELAP No ELAP entry conditions 18
 
Recovery Pathway #1: Division 2 DG Restoration
* Time validation for a CPS EO to walkdown and identify the out of position air start valves using only system knowledge was 11 minutes
* Time validation for a CPS EO to identify and correct the out of position air start valves per procedure was 29 minutes
  - DG full lineup completed within 40 minutes and in service within 50 minutes
* JPM performed by non-CPS EOs to identify out of position air start valves
  - All six EOs identified closed air start valves using procedure within 32 minutes
  - DG full lineup completed within 37 minutes
* Multiple operators, engineers, and technicians would respond, improving DG recovery time Division 2 DG will be recovered in < 1 hour 19
 
Rule-Based Operator Response to Division 2 DG Failure to Start Dedicated Safe Shutdown EO arrives      EO requests DG          EO commences            EO resets DG and reports Failure to      standby              DG lineup and            lockouts and LOOP/SBO Entered Start alarm and no        procedure.            restores valves          Engine Start visible equipment damage Walks down DG.             per procedure        (bus energized)
Knowledge / Training-Based Response            Procedure / Rule-Based Response           DG is recovered.
EOs are trained to check the air start         A supervisor and additional EOs arrive    Air start valves are system after any DG start. The EO is also      to support with the procedure in hand. restored by procedure.
cued by the alarm card.
The out of position air start valves are  The Div 2 DG starts The out of position air start valves will be    identified by procedure.                  and restores power.
identified during this walkdown.
Multiple means to identify out of position air start valves Identification of closed air start valves and no visible damage provides Shift Manager High Assurance of Division 2 power recovery 20
 
Operator Response to Division 2 DG Failure to Start (Rule-Based) 21
 
Operator Alarm Response (Rule-Based)
Dedicated EO requests a copy of the DG procedures from the Control Room 22
 
Operator Alarm Response (Rule-Based)
Opening of the air start valves is procedurally governed On Page 6 of DG operating procedure Restoration of DC control power following load shed is procedurally governed and does not complicate DG recovery Load shed circuits are recovered per Loss of AC Power procedure DG recovered completely by procedures 23
 
Operator Response to Division 2 DG Failure to Start (Knowledge-Based)
Starting air receiver pressure is 225-250 psig and did not lower as expected following DG start signal 24
 
Operator Validates DG Starting Air Parameters Division 2 DG Local Air Start Pressure Division 2 DG Air Receiver Pressure Located on gauge board, as found during the event Tech Spec LCO 3.8.3 0 psig Required to log on operator rounds Normal pressure Not on operator rounds prior to event                                          is 225-250 psig EO identifies closed air start valves based on alarms and local indications 25
 
Operator Response to Division 2 DG Failure to Start This flow path was most recently trained in 2017 Air start path can be easily traced back to the receivers EO JPM to start the DG by overriding the air start system solenoids/lineup; 100% pass rate across 27 Operators in 2017 26
 
Operator Validates Air Start System Did Not Actuate Through Equipment Checks If the DG received starting air, an oil spray/mist would be visible below the exhaust of the six air start motors 27
 
Operator Response to Division 2 DG Failure to Start Walking down the air start system is trained and performed with the monthly DG runs EOs trained to check air start system response after DG start 28
 
Operator Identifies Out Of Position Air Start Valves Division 2 DG air start valve in the      Left over tie wraps from clearance order normal Locked Open position            tags as found on 5/17/18 Tags Plus straps left on air start valves 29
 
Operator Response to Division 2 DG Failure to Start Video 30
 
DG Restoration Summary
* Identification of the out of position air start valves will occur in either knowledge or rule-based space
* Air start valves are time validated to be identified by knowledge in 11 minutes and procedure in 29 minutes
* DG recovery is simple task (open air start valves) using regularly executed DG lineup procedure
* Identification of closed air start valves and no visible damage provides Shift Manager High Assurance of Division 2 power recovery
  - An ELAP will not be declared
* OCC/ERO technical support and large number of resources We had knowledge, time, and resources to restore Division 2 DG 31
 
Impact of Actual Response: Div 2 DG Recovery Exelons DG HEP          NRCs DG HEP 0.005                    0.2 (99.5% success)         (80% success)
* Realistic modeling of Division 2 DG recovery, by itself, leads to GREEN significance
  - NRCs sensitivity case #3 (using Exelons HEP) shows Green SPAR-H HEP Impact on PSF          NRC Diagnosis Setting    Exelon Position    Reduction  Finding Factor Expansive Available Time          Nominal (required time <1 hr)         1 hr only need 2 hrs, but    ~50      GREEN 24 hrs available Experience/Training          Low                  Nominal          ~10      GREEN Considerable available time, and operator experience and training assure high success 32
 
Minimum Shift Staffing Control Room Team Shift Manager (SRO) 2 Senior Reactor Operators      3 Reactor Operators Dedicated On Duty Security Force Members 6 Equipment Operators 1 IM/EM                                2 RP Technicians      Chemistry ERO                                                        Technician 33
 
Outage Response Staffing
* 137 - Minimum craft staffing on any shift during the affected window of C1R18 Control Room Team Shift Manager (SRO)                       16 Electricians 6 Senior Reactor Operators 5 Reactor Operators 27 Equipment Operators 4 Chemistry Technicians 30 Mechanics 11 Radiation Protection Technicians 44 Instrument Maintenance Technicians 34
 
Event Recovery Timeline Activities in Series Start 2 hours  4 hours    6 hours  8 hours  10 hours 12 hours Restore Div 2 DG to Service (50 min)
Complete DC Load Shed (1 hour)
Commence FLEX Pre-Staging (1 hour)
ERO Is Staffed (Alert) (1 hour)
Complete Div 3 to Div 2 X-Tie (1.5 hours)
End of SBO. Commence FLEX (4 hours)
FLEX is ready for RPV injection (5 hours*)
RCS Boiling Begins (4 hours)
Shutdown Cooling Isolated within 6 hours Time to TAF (No Operator Actions) (10.8 hours)
Time to TAF (SDC isolated or RPV pressure controlled low with Batteries) (~24 hours) 5 hours is the worst case for FLEX RPV injection and 8 hours is the worst case FLEX heat removal and suppression pool makeup. RPV injection commences before TAF in all cases.
    *1 hour subtracted from FLEX times because they overlap with the first hour of SBO actions.
Substantial time available for mitigation actions even if performed in series 35
 
Recovery Pathway #2:
Cross-Tie Div 3 DG to Div 2 Bus
- Bus cross-tie completion validated to complete in 1.5 hours
  - Open one in-plant disconnect
  - Open four relay test switches
  - Remove one relay control power fuse
  - Control Room performs breaker alignments
  - Tools pre-staged in operations locked cages and all manipulations in general plant areas
  - Switchgear breaker and disconnect training occurs every two years
  - Four page procedure with pictures, locations, and diagrams simplify execution 36
 
Cross-Tie Div 3 DG to Div 2 Bus During SBO 345kV Switchyard RAT-B XFMR Division 1 4160V                  Division 2 4160V                      Division 3 4160V Unplanned Out of Div 1 DG                service                                        Div 3 DG Div 2 DG System Outage Window Division 1          Division 2        Division 3 138 kV Switchyard                            AC Distribution  X AC Distribution  O AC Distribution  O Diesel Generator X Diesel Generator X Diesel Generator O ERAT XFMR                  RHR-A / SDC      X RHR-B / SDC      O HPCS            X LPCS            X RHR-C            O DC Batteries    O DC Batteries    O DC Batteries    O 37
 
Impact of Actual Response: Div 3 to Div 2 Cross-Tie Exelons Cross-Tie HEP  NRCs Cross-Tie HEP 0.096                  0.27 (90.4% success)        (73% success)
SPAR-H HEP Impact on PSF          NRC Action Setting    Exelon Position      Reduction  Finding Factor Available Time           Nominal                Extra (required time ~1.5 hr)    (13 hours)           (24 hours)
Experience/Training          Low                Nominal
                                                                          ~7    GREEN Ergonomics              Poor              Nominal Complexity              High              Moderate Realistic modeling of Division 3 cross-tie, coupled with higher likelihood of offsite power recovery within 24 hours, leads to Green 38
 
Recovery Pathway #3:
FLEX Implementation and Timeline FLEX equipment pre-staged in parallel until implementation required 39
 
FLEX Implementation and Timeline
* By 2 hours: Briefs complete, teams ready to dispatch
* By 4 hours: Pre-staging complete, hoses and cables run to location, FLEX generator running in standby; plant realignment occurs when directed by Control Room Supervisor
* By 6 hours: Battery charger in service powering Division 2 batteries, low pressure RPV makeup is available
* By 8 hours: Decay heat removal and suppression pool makeup available
* Minimum Personnel: 6 Operators, 6 Security Force Members (for 3 hours), 2 Radiation Protection Technicians, 1 Chemistry Technician
* Outage Personnel: At least 15 Qualified Operators + Supervision, Electrical and Mechanical maintenance dispatched by the ERO to support as necessary 40
 
FLEX Training and Experience
* Task specific procedures are located in field FLEX cabinets
* Procedures are designed to be Grab and go and have prerequisite steps built into each section to ensure all required manipulations are completed
* Most tasks are similar to normal EO tasks
  - Racking breakers
  - Starting FLEX generator (similar to TSC generator)
  - Routing cable or hoses
* Trained in accordance with the Systematic Approach to Training
* From NRC Inspection Report TI-191: licensee has trained their staff to assure personnel proficiency in the mitigation of beyond DB events EOs trained and proficient with FLEX equipment and procedures 41
 
Impacts of Actual Response: FLEX Alignment Exelons FLEX HEP    NRCs FLEX HEP 0.002              0.25 (99.8% success)      (75% success)
SPAR-H HEP Impact on PSF            NRC Action Setting Exelon Position    Reduction  Finding Factor Available Time          Nominal            Extra (required time ~4 hr)    (13 hours)        (24 hours)
Experience/Training        Low            Nominal
                                                                  ~12    GREEN Ergonomics              Poor            Nominal Complexity              High            Nominal Realistic modeling of FLEX deployment, coupled with higher likelihood of offsite power recovery within 24 hours, leads to Green 42
 
RPV Pressure Control
* SRVs are available for pressure control for > 24 hours
  - Division 1 and 2 DC batteries analyzed with > 24 hours capacity with outage loads
  - ADS accumulators and backup air bottles fully charged
* Procedure guidance to stabilize pressure in multiple procedures
  - Station Blackout, Loss of Shutdown Cooling, EOP-1, FLEX
* EOP-1 directs holding RPV pressure < 104 psig until shutdown cooling restored
* Time to boil is 4 hours, SRV usage not needed until at least 8 hours RPV pressure controlled to allow use of low pressure injection systems 43
 
Injection
* Multiple diverse injection systems available after Division 2 AC power restored using proceduralized actions
  - Within 1 minute, start Standby Liquid Control pump B from Control Room
* 43 gpm (4000 gallon tank), injects at any pressure, no field actions required
  - Within 1 minute, start RHR-B/C water leg pump from Control Room
* 50 gpm with RPV depressurized, no field actions required
  - Manually start RHR-C for Low Pressure Coolant Injection (LPCI)
  - Align RHR-B from shutdown cooling to LPCI mode
* Additional injection systems using proceduralized actions
  - FLEX pump direct injection from Ultimate Heat Sink
  - Suppression Pool Transfer Pump using FLEX generator power
  - Fire pump injection (direct to RPV or using hoses)
Any one path restores RPV level 44
 
Impact of Actual Response - Pressure/Inventory Control Exelon HEP                        NRC HEP SDC Isolation 0.022                        Not modeled (98% success)
Maintain RPV Pressure (Using Division 1 or 2 Batteries) 0.001                        Not modeled (99.9% success)
* Both actions procedurally directed
* Success of EITHER action extends time to TAF to about 24 hours
      - Increases Available Time for Diagnosis and Action to restore onsite equipment
      - Increases likelihood of offsite power recovery
* Division 1 and 2 batteries available for RPV pressure control (SRVs) for 24 hours
* RPV pressure control enhances ability for low or high pressure injection sources Realistic modeling of loss of shutdown cooling actions and RPV pressure control, coupled with multiple sources of injection, leads to Green 45
 
Recovery and Mitigation Actions Summary
* Identification of out of position air start valves will occur
* DG recovery is simple task (open air start valves)
* Shift Manager has High Assurance of Division 2 power recovery
* Activities to restore power taken in parallel but controlled to minimize conflicts
* Other defense-in-depth actions provide additional success paths within the available time AC power and injection recovered quickly and successfully 46
 
Clinton Power Station Regulatory Conference Risk Significance Gene Kelly Sr. Manager, Risk Management
 
Risk Assessment for Safety Significance For White significance, NRC must conclude the SBO condition would not be successfully mitigated because:
  - Division 2 DG not recovered within 1 hour and
  - ELAP declared at 1 hour and
  - Shutdown cooling valve not isolated and
  - RPV pressure not controlled and
  - Division 3 to Division 2 AC power cross-tie procedurally complex and
  - FLEX strategy inadequate and not sufficiently trained White significance not based on realistic or best available information 48
 
Clinton Power Station Regulatory Conference Conclusion Ted Stoner Site Vice President
 
Conclusion
* We had the knowledge, time, and resources to restore AC power
* NRC policy and guidance dictate risk evaluations to be realistic and based on the best available information
* Best available information includes:
  - Reflecting a realistic response to the event
  - Recognizing extensive operator training and experience
  - Appropriately crediting FLEX
* Using the best available information as presented today and applying the Commissions guiding policies and principles on risk results in:
Green significance 50}}

Latest revision as of 11:02, 20 October 2019

Regulatory Enforcement Conference Slides for Clinton Power Station on November 30, 2018
ML18333A333
Person / Time
Site: Clinton Constellation icon.png
Issue date: 11/30/2018
From:
Exelon Generation Co
To:
NRC/RGN-III
References
Download: ML18333A333 (51)


Text

Clinton Power Station Regulatory Conference Division 2 Diesel Generator Air Start Isolation Event November 30, 2018

Agenda

  • Introduction . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . Brad Fewell
  • Finding Cause and Corrective Actions. . . . . . . . . . . . . . . Brad Kapellas
  • Key Differences. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Gene Kelly/Johnny Weissinger
  • Initial Conditions for Postulated Event, Recovery and Mitigation Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . Johnny Weissinger/Gene Kelly
  • Risk Significance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Gene Kelly
  • Conclusion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ted Stoner 1

Clinton Power Station Regulatory Conference Introduction Brad Fewell Senior Vice President, Regulatory Affairs and General Counsel

Introduction

  • We agree with the Finding and violation
  • We recognize our failure to maintain the configuration of an important safety system
  • We have taken timely, comprehensive, and broad responsive actions
  • We disagree with the Findings preliminary significance of White

- Commission Policy and NRC guidance drive risk evaluations to be realistic and based on best available information

- NRC risk evaluation does not reflect the as-built, as-operated plant response

  • NRCs risk evaluation assumptions do not reflect how CPS would respond to DG recovery, SBO, FLEX, and ELAP by not appropriately crediting:

- Operators extensive knowledge, training, and experience

- Available time to take recovery actions

- Procedures that control the event and drive successful resolution PRA evaluations should be realistic and based on best available information 3

Introduction (cont.)

  • We will show that using realistic and best-available information:

- Division 2 DG would have been restored and injection available within one hour

- Expansive time was available to recover AC power and prevent core uncovery

- Procedurally directed alternative power recovery actions would have been pursued in parallel

- Objective data to support different performance shaping factor (PSF) multipliers

  • We will provide information that the NRC did not previously review and new information that we have recently developed
  • We had the knowledge, time, and resources to restore AC power and injection Finding should be characterized as Green 4

Clinton Power Station Regulatory Conference Finding Cause and Corrective Actions Brad Kapellas Plant Manager

Station Event Response

  • Root Cause

- Contrary to Exelon fleet governance for plant status control, operator logs were utilized as the sole means to track plant configuration

  • Corrective Action to Prevent Reoccurrence

- Identify and eliminate legacy site-specific administrative procedures/guidance that allow operator logs as a sole method for plant status control

  • Continuous Procedure Use

- Cause of the event was not an operating procedure execution issue

- Procedure directed operator component manipulation error rate is very low (estimated less than two per million manipulations)

  • Corrective Actions

- Implemented I know because I looked initiative station wide to improve administrative procedure knowledge and compliance

- Reinforced accountability for equipment status control throughout operations

- Revision to safety related operator rounds points

- Three day station wide campaign for change Event taken seriously and being used as burning platform to move culture to sustained levels of high Operational Excellence 6

Clinton Power Station Regulatory Conference Key Differences Gene Kelly Sr. Manager, Risk Management Johnny Weissinger Director, Operations

Exelon and NRC Risk Results - Differences Exelon change in CDF NRC change in CDF 1E-8/year 3.8E-6/year

  • Large difference in our results, a factor of almost 400
  • The difference is not in PRA methods both use similar approaches from a PRA standpoint
  • Key differences:

- Actual site response in SBO conditions

- Available time to recover power and injection

- Operator experience and training applied to recovery actions

- Complexity associated with power recovery actions Risk analysis should reflect manner in which plant is operated 8

Key Choice Letter Disagreements NRC Position Exelon Position Assumption 12

  • 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> available to recover AC power to Division
  • Air start valves found isolated within 29 minutes; 2 by recovering DG; ELAP declared at 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and ELAP not declared FLEX power to Division 2 would commence
  • DG recovery complicated by SBO load shedding
  • Load shed recovery proceduralized and does not that removes all DC control power from DG complicate DG recovery
  • FLEX electrical lineup impacts DG components
  • ELAP not declared/FLEX staging only Assumption 13
  • Experience/training considered Low for DG
  • DG air start valve position easily identified in recovery diagnosis knowledge-based or procedure-based mode
  • Operators have not trained on, experienced, or
  • Operators extensively trained on DG malfunctions been exposed to failed DG 9

Key Choice Letter Disagreements (cont.)

NRC Position Exelon Position Assumption 2

  • Time to TAF does not appear to credit shutdown
  • Operators will close one shutdown cooling valve cooling isolation per procedure to extend time to TAF from 10.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to about 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Assumptions 14, 23, 24
  • FLEX implementation success credited as Low
  • NRC inspections confirm that FLEX strategy meets regulatory requirements
  • FLEX lineup experience/training considered Low
  • FLEX trained in accordance with Systematic Approach to Training
  • FLEX ergonomics considered Poor
  • FLEX tasks similar to normal EO tasks &

performed in non-adverse conditions Assumption 15

  • Div 3 to Div 2 AC power cross-tie is Complex
  • Procedure is straightforward and not complex
  • Time required to complete cross-tie is 5-6 hours
  • Time-validated at 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 10

Clinton Power Station Regulatory Conference Initial Conditions for Postulated Event, Recovery and Mitigation Actions Johnny Weissinger Director, Operations Gene Kelly Sr. Manager, Risk Management

Success Criteria Injection Established Before RPV Water Level Reaches the Top of Active Fuel

  • Division 2 DG is completely recoverable (no equipment malfunction) and operations response would not complicate recovery

- NRC did not model or credit Division 2 DG after one hour

  • One action to close a shutdown cooling valve (1E12-F008), as directed by procedure, extends the time to TAF to about 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />

- Does not appear to be modeled in NRCs analysis

  • DC batteries provide ability to control RPV pressure using SRVs permitting use of low or high pressure injection sources

- Does not appear to be modeled in NRCs analysis 12

Exelon Perspective

  • RPV injection will be restored prior to reactor water level lowering below TAF through multiple, independent, and diverse means

- Rule-based procedural guidance to restore the DG

- Knowledge-based identification of the DG air start valves

- Cross-tie of the Division 3 DG to the Division 2 bus

- Use of FLEX

  • Identifying the closed air start valves, reopening them, and restarting the DG per procedure terminates the postulated event

- Significant time available before deterioration of plant conditions

- Operators are extremely knowledgeable and experienced with DG operation

- All actions to identify the valves and restart DG are proceduralized

- Air start valves are readily identifiable and accessible

- Reopening a manual ball valve is a simple task

- Emergency battery lighting and portable flashlights available

- Significant resources onsite to support 13

Bus Alignment During Div 1 & 2 DG Unavailability 345 kV Switchyard Plant is in Mode 4 - Cold Shutdown RAT-B XFMR RPV Water Level 235 to 250 above TAF Time To Boil ~4 hours Division 1 4160V Division 2 4160V Division 3 4160V Unplanned out-of-Div 1 DG service Div 3 DG Div 2 DG System Outage Window Division 1 Division 2 Division 3 138 kV Switchyard AC Distribution X AC Distribution O AC Distribution O Diesel Generator X Diesel Generator X Diesel Generator O ERAT XFMR RHR-A / SDC X RHR-B / SDC O HPCS X LPCS X RHR-C O DC Batteries O DC Batteries O DC Batteries O 14

Overview of Station Response to a SBO LOOP/Station Blackout Operations Response Power Recovery Time Extension Emergency Response Shutdown Cooling Declare ALERT Restore Offsite Isolation Power (extends time to TAF from 10.8 hrs to ~24 hrs) Activate ERO Align Div 2 DG to start DC Battery Load Shedding (extends battery Div 3 DG cross-tie life from 2.3 hrs to to Div 2 bus 24 hrs)

Control RPV FLEX Pressure for Low Pressure Injection 15

Loss of AC Power Procedure 4200.01

  • Definitions are in accordance with CPS licensing basis SBO is not a beyond design basis external event 16

LOOP Procedure Direction for ELAP Declaration HIGH ASSURANCE that power will be recovered within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> includes:

- Division 2 DG air start valves identified out of position

- No maintenance performed on Division 2 DG during outage

- No degraded conditions for the Division 2 DG existed Shift Manager has High Assurance ELAP does not exist 17

Entry into ELAP

  • Operators are exhaustively trained on the DGs and Loss of AC Power due to high risk significance

- Five simulator scenarios, 26 exam questions, biennial training in last two years

- Operator JPMs for DGs include resetting trips/lockouts and manually bypassing the air start system to manually start the engine with 100% pass rates administered a total of 50 times in the last two years

  • ERO is trained on LOOP/FLEX

- ERO drills include simulated loss of power and/or loss of DG

- TSC personnel experienced in plant restoration

- Restoration of power is high priority

  • Six CPS Shift Managers were surveyed for four potential ELAP scenarios

- All surveyed Shift Managers stated they would not declare an ELAP during scenarios where action was taken to recover power within the 4-hour SBO coping period

- All Shift Managers stated they would not enter ELAP/FLEX procedures once the DG air start valves are identified out of position

- All Shift Managers surveyed stated they would pre-stage FLEX equipment to improve plant risk

  • 28 SROs from other stations (including non-Exelon) were given CPS procedures and scenarios that recreated the postulated scenario

- All SROs stated that they remain in the LOOP procedure and NOT enter ELAP No ELAP entry conditions 18

Recovery Pathway #1: Division 2 DG Restoration

  • Time validation for a CPS EO to walkdown and identify the out of position air start valves using only system knowledge was 11 minutes
  • Time validation for a CPS EO to identify and correct the out of position air start valves per procedure was 29 minutes

- DG full lineup completed within 40 minutes and in service within 50 minutes

  • JPM performed by non-CPS EOs to identify out of position air start valves

- All six EOs identified closed air start valves using procedure within 32 minutes

- DG full lineup completed within 37 minutes

  • Multiple operators, engineers, and technicians would respond, improving DG recovery time Division 2 DG will be recovered in < 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 19

Rule-Based Operator Response to Division 2 DG Failure to Start Dedicated Safe Shutdown EO arrives EO requests DG EO commences EO resets DG and reports Failure to standby DG lineup and lockouts and LOOP/SBO Entered Start alarm and no procedure. restores valves Engine Start visible equipment damage Walks down DG. per procedure (bus energized)

Knowledge / Training-Based Response Procedure / Rule-Based Response DG is recovered.

EOs are trained to check the air start A supervisor and additional EOs arrive Air start valves are system after any DG start. The EO is also to support with the procedure in hand. restored by procedure.

cued by the alarm card.

The out of position air start valves are The Div 2 DG starts The out of position air start valves will be identified by procedure. and restores power.

identified during this walkdown.

Multiple means to identify out of position air start valves Identification of closed air start valves and no visible damage provides Shift Manager High Assurance of Division 2 power recovery 20

Operator Response to Division 2 DG Failure to Start (Rule-Based) 21

Operator Alarm Response (Rule-Based)

Dedicated EO requests a copy of the DG procedures from the Control Room 22

Operator Alarm Response (Rule-Based)

Opening of the air start valves is procedurally governed On Page 6 of DG operating procedure Restoration of DC control power following load shed is procedurally governed and does not complicate DG recovery Load shed circuits are recovered per Loss of AC Power procedure DG recovered completely by procedures 23

Operator Response to Division 2 DG Failure to Start (Knowledge-Based)

Starting air receiver pressure is 225-250 psig and did not lower as expected following DG start signal 24

Operator Validates DG Starting Air Parameters Division 2 DG Local Air Start Pressure Division 2 DG Air Receiver Pressure Located on gauge board, as found during the event Tech Spec LCO 3.8.3 0 psig Required to log on operator rounds Normal pressure Not on operator rounds prior to event is 225-250 psig EO identifies closed air start valves based on alarms and local indications 25

Operator Response to Division 2 DG Failure to Start This flow path was most recently trained in 2017 Air start path can be easily traced back to the receivers EO JPM to start the DG by overriding the air start system solenoids/lineup; 100% pass rate across 27 Operators in 2017 26

Operator Validates Air Start System Did Not Actuate Through Equipment Checks If the DG received starting air, an oil spray/mist would be visible below the exhaust of the six air start motors 27

Operator Response to Division 2 DG Failure to Start Walking down the air start system is trained and performed with the monthly DG runs EOs trained to check air start system response after DG start 28

Operator Identifies Out Of Position Air Start Valves Division 2 DG air start valve in the Left over tie wraps from clearance order normal Locked Open position tags as found on 5/17/18 Tags Plus straps left on air start valves 29

Operator Response to Division 2 DG Failure to Start Video 30

DG Restoration Summary

  • Identification of the out of position air start valves will occur in either knowledge or rule-based space
  • Air start valves are time validated to be identified by knowledge in 11 minutes and procedure in 29 minutes
  • DG recovery is simple task (open air start valves) using regularly executed DG lineup procedure
  • Identification of closed air start valves and no visible damage provides Shift Manager High Assurance of Division 2 power recovery

- An ELAP will not be declared

  • OCC/ERO technical support and large number of resources We had knowledge, time, and resources to restore Division 2 DG 31

Impact of Actual Response: Div 2 DG Recovery Exelons DG HEP NRCs DG HEP 0.005 0.2 (99.5% success) (80% success)

  • Realistic modeling of Division 2 DG recovery, by itself, leads to GREEN significance

- NRCs sensitivity case #3 (using Exelons HEP) shows Green SPAR-H HEP Impact on PSF NRC Diagnosis Setting Exelon Position Reduction Finding Factor Expansive Available Time Nominal (required time <1 hr) 1 hr only need 2 hrs, but ~50 GREEN 24 hrs available Experience/Training Low Nominal ~10 GREEN Considerable available time, and operator experience and training assure high success 32

Minimum Shift Staffing Control Room Team Shift Manager (SRO) 2 Senior Reactor Operators 3 Reactor Operators Dedicated On Duty Security Force Members 6 Equipment Operators 1 IM/EM 2 RP Technicians Chemistry ERO Technician 33

Outage Response Staffing

  • 137 - Minimum craft staffing on any shift during the affected window of C1R18 Control Room Team Shift Manager (SRO) 16 Electricians 6 Senior Reactor Operators 5 Reactor Operators 27 Equipment Operators 4 Chemistry Technicians 30 Mechanics 11 Radiation Protection Technicians 44 Instrument Maintenance Technicians 34

Event Recovery Timeline Activities in Series Start 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> 12 hours Restore Div 2 DG to Service (50 min)

Complete DC Load Shed (1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />)

Commence FLEX Pre-Staging (1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />)

ERO Is Staffed (Alert) (1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />)

Complete Div 3 to Div 2 X-Tie (1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />)

End of SBO. Commence FLEX (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />)

FLEX is ready for RPV injection (5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />s*)

RCS Boiling Begins (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />)

Shutdown Cooling Isolated within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Time to TAF (No Operator Actions) (10.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />)

Time to TAF (SDC isolated or RPV pressure controlled low with Batteries) (~24 hours) 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> is the worst case for FLEX RPV injection and 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> is the worst case FLEX heat removal and suppression pool makeup. RPV injection commences before TAF in all cases.

  • 1 hour subtracted from FLEX times because they overlap with the first hour of SBO actions.

Substantial time available for mitigation actions even if performed in series 35

Recovery Pathway #2:

Cross-Tie Div 3 DG to Div 2 Bus

- Bus cross-tie completion validated to complete in 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />

- Open one in-plant disconnect

- Open four relay test switches

- Remove one relay control power fuse

- Control Room performs breaker alignments

- Tools pre-staged in operations locked cages and all manipulations in general plant areas

- Switchgear breaker and disconnect training occurs every two years

- Four page procedure with pictures, locations, and diagrams simplify execution 36

Cross-Tie Div 3 DG to Div 2 Bus During SBO 345kV Switchyard RAT-B XFMR Division 1 4160V Division 2 4160V Division 3 4160V Unplanned Out of Div 1 DG service Div 3 DG Div 2 DG System Outage Window Division 1 Division 2 Division 3 138 kV Switchyard AC Distribution X AC Distribution O AC Distribution O Diesel Generator X Diesel Generator X Diesel Generator O ERAT XFMR RHR-A / SDC X RHR-B / SDC O HPCS X LPCS X RHR-C O DC Batteries O DC Batteries O DC Batteries O 37

Impact of Actual Response: Div 3 to Div 2 Cross-Tie Exelons Cross-Tie HEP NRCs Cross-Tie HEP 0.096 0.27 (90.4% success) (73% success)

SPAR-H HEP Impact on PSF NRC Action Setting Exelon Position Reduction Finding Factor Available Time Nominal Extra (required time ~1.5 hr) (13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />) (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />)

Experience/Training Low Nominal

~7 GREEN Ergonomics Poor Nominal Complexity High Moderate Realistic modeling of Division 3 cross-tie, coupled with higher likelihood of offsite power recovery within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, leads to Green 38

Recovery Pathway #3:

FLEX Implementation and Timeline FLEX equipment pre-staged in parallel until implementation required 39

FLEX Implementation and Timeline

  • By 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />s: Briefs complete, teams ready to dispatch
  • By 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />s: Pre-staging complete, hoses and cables run to location, FLEX generator running in standby; plant realignment occurs when directed by Control Room Supervisor
  • By 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />s: Battery charger in service powering Division 2 batteries, low pressure RPV makeup is available
  • By 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />s: Decay heat removal and suppression pool makeup available
  • Minimum Personnel: 6 Operators, 6 Security Force Members (for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />), 2 Radiation Protection Technicians, 1 Chemistry Technician
  • Outage Personnel: At least 15 Qualified Operators + Supervision, Electrical and Mechanical maintenance dispatched by the ERO to support as necessary 40

FLEX Training and Experience

  • Task specific procedures are located in field FLEX cabinets
  • Procedures are designed to be Grab and go and have prerequisite steps built into each section to ensure all required manipulations are completed
  • Most tasks are similar to normal EO tasks

- Racking breakers

- Starting FLEX generator (similar to TSC generator)

- Routing cable or hoses

  • Trained in accordance with the Systematic Approach to Training
  • From NRC Inspection Report TI-191: licensee has trained their staff to assure personnel proficiency in the mitigation of beyond DB events EOs trained and proficient with FLEX equipment and procedures 41

Impacts of Actual Response: FLEX Alignment Exelons FLEX HEP NRCs FLEX HEP 0.002 0.25 (99.8% success) (75% success)

SPAR-H HEP Impact on PSF NRC Action Setting Exelon Position Reduction Finding Factor Available Time Nominal Extra (required time ~4 hr) (13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />) (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />)

Experience/Training Low Nominal

~12 GREEN Ergonomics Poor Nominal Complexity High Nominal Realistic modeling of FLEX deployment, coupled with higher likelihood of offsite power recovery within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, leads to Green 42

RPV Pressure Control

  • SRVs are available for pressure control for > 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />

- Division 1 and 2 DC batteries analyzed with > 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> capacity with outage loads

- ADS accumulators and backup air bottles fully charged

  • Procedure guidance to stabilize pressure in multiple procedures

- Station Blackout, Loss of Shutdown Cooling, EOP-1, FLEX

  • Time to boil is 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, SRV usage not needed until at least 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> RPV pressure controlled to allow use of low pressure injection systems 43

Injection

  • Multiple diverse injection systems available after Division 2 AC power restored using proceduralized actions

- Within 1 minute, start Standby Liquid Control pump B from Control Room

  • 43 gpm (4000 gallon tank), injects at any pressure, no field actions required

- Within 1 minute, start RHR-B/C water leg pump from Control Room

  • 50 gpm with RPV depressurized, no field actions required

- Manually start RHR-C for Low Pressure Coolant Injection (LPCI)

- Align RHR-B from shutdown cooling to LPCI mode

  • Additional injection systems using proceduralized actions

- FLEX pump direct injection from Ultimate Heat Sink

- Suppression Pool Transfer Pump using FLEX generator power

- Fire pump injection (direct to RPV or using hoses)

Any one path restores RPV level 44

Impact of Actual Response - Pressure/Inventory Control Exelon HEP NRC HEP SDC Isolation 0.022 Not modeled (98% success)

Maintain RPV Pressure (Using Division 1 or 2 Batteries) 0.001 Not modeled (99.9% success)

  • Both actions procedurally directed
  • Success of EITHER action extends time to TAF to about 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />

- Increases Available Time for Diagnosis and Action to restore onsite equipment

- Increases likelihood of offsite power recovery

  • Division 1 and 2 batteries available for RPV pressure control (SRVs) for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />
  • RPV pressure control enhances ability for low or high pressure injection sources Realistic modeling of loss of shutdown cooling actions and RPV pressure control, coupled with multiple sources of injection, leads to Green 45

Recovery and Mitigation Actions Summary

  • Identification of out of position air start valves will occur
  • DG recovery is simple task (open air start valves)
  • Shift Manager has High Assurance of Division 2 power recovery
  • Activities to restore power taken in parallel but controlled to minimize conflicts
  • Other defense-in-depth actions provide additional success paths within the available time AC power and injection recovered quickly and successfully 46

Clinton Power Station Regulatory Conference Risk Significance Gene Kelly Sr. Manager, Risk Management

Risk Assessment for Safety Significance For White significance, NRC must conclude the SBO condition would not be successfully mitigated because:

- Division 2 DG not recovered within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and

- ELAP declared at 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and

- Shutdown cooling valve not isolated and

- RPV pressure not controlled and

- Division 3 to Division 2 AC power cross-tie procedurally complex and

- FLEX strategy inadequate and not sufficiently trained White significance not based on realistic or best available information 48

Clinton Power Station Regulatory Conference Conclusion Ted Stoner Site Vice President

Conclusion

  • We had the knowledge, time, and resources to restore AC power
  • NRC policy and guidance dictate risk evaluations to be realistic and based on the best available information
  • Best available information includes:

- Reflecting a realistic response to the event

- Recognizing extensive operator training and experience

- Appropriately crediting FLEX

  • Using the best available information as presented today and applying the Commissions guiding policies and principles on risk results in:

Green significance 50