ML17313B159

Final Accident Sequence Precursor Analysis - Palo Verde Nuclear Generating Station (Unit 3), Emergency Diesel Generator Failure Resulting in a Condition Prohibited by Technical Specifications (LER 530-2016-002-01) - Precursor

ML17313B159
Person / Time
Site:	Palo Verde
Issue date:	01/08/2018
From:	Keith Tetter NRC/RES/DRA/PRB
To:
References
LER 530-2016-002-01 IR 2017008
Download: ML17313B159 (9)

Text

Final ASP Program Analysis - Precursor Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Palo Verde Nuclear Emergency Diesel Generator Failure Resulting in a Condition Generating Station, Prohibited by Technical Specifications Unit 3 LER: 530-2016-002-01 Event Date: 12/15/2016 CDP= 2x10-5 IR: 05000530/2017008 Plant Type: Combustion Engineering Pressurized-Water Reactor (PWR) with a Large Dry, Ambient Pressure Containment Plant Operating Mode (Reactor Power Level): Mode 1 (100% Reactor Power)

Analyst: Reviewer: Contributors: BC Approved Date:

Keith Tetter Chris Hunter 11/15/2017 EXECUTIVE

SUMMARY

On December 15, 2016, the 3B emergency diesel generator (EDG) experienced a significant mechanical failure during the performance of a regularly scheduled monthly surveillance test.

The Unit 3 control room staff immediately declared the 3B EDG inoperable. The plant continued to operate at 100% power and there were no automatic or manual safety system responses initiated as a result of the failure. No other systems were impacted. Additional information is provided in licensee event report (LER) 530-2016-002-01 (Ref. 1) and inspection report (IR) 05000530/2017008 (Ref. 2).

The licensee initiated an investigation to determine the cause and subsequent corrective actions required for the failure. As part of the investigation, a damage assessment identified that multiple internal components within the engine had evidence of mechanical overload, plastic deformation, or impact marks. The licensee initiated a comprehensive disassembly, repair, and reassembly process to restore the EDG to the manufacturer specifications. Due to the extensive nature of the repair effort, the licensee submitted two emergency license amendment requests (LARs) for additional time to allow for completion of the repairs and testing. The NRC staff approved the two LARs that granted one-time extensions of the 10-day required action completion time to a 62-day required action completion time.1 Repairs and post-maintenance testing were completed and the 3B EDG was declared operable on February 10, 2017.

Based on modeling assumptions used in this ASP analysis, the most likely core damage scenario is a grid-related loss of offsite power (LOOP) initiating event and subsequent station blackout (SBO) due to the failure of all the EDGs. Under this scenario there is initial success of the turbine-driven auxiliary feedwater (AFW) pump; the safety relief valves (SRVs) fail to open; the operators successfully isolate the reactor coolant pump (RCP) and control bleed-off; RCP seals remain intact; the operators fail to restore offsite power within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />; and lastly the 1

Additional information can be found in Palo Verde Nuclear Generating Station (PVNGS), Unit 3 - Emergency License Amendment Request for a One-Time Extension of the Diesel Generator Completion Time, (Ref. 3),

Palo Verde Nuclear Generating Station (PVNGS), Unit 3 - Emergency License Amendment Request to Extend Diesel Generator 3B Completion Time, (Ref. 4), and Palo Verde Nuclear Generating Station, Unit 3 - Issuance of Amendments Re: Revision to Technical Specification 3.8.1, AC [Alternating Current] Sources - Operating (Emergency Circumstances) (CAC NO. MF9019), (Ref. 5).

LER 530-2016-002-01 operators fail to manually control the turbine-driven AFW pump without direct-current (DC) power. This accident sequence accounts for approximately 23 percent of the increase in core damage probability (CDP) for this event. The point estimate CDP for this event is 1.8x10-5, which is considered a precursor in the ASP Program.

EVENT DETAILS Event Description. On December 15, 2016, with the plant at 100 percent power, the 3B EDG was undergoing monthly surveillance testing. At 3:56 a.m., with the 3B EDG operating at approximately 2700 kilowatts (kW), a low lube oil pressure trip occurred. Operators responded to alarms and identified physical damage to the 3B EDG based on oil and metal debris on the room floor. The control room staff immediately declared the 3B EDG inoperable.

The licensee initiated an investigation to determine the cause and subsequent corrective actions required for the failure. As part of the investigation, a damage assessment identified that multiple internal components within the engine had evidence of mechanical overload, plastic deformation, or impact marks. The licensee initiated a comprehensive disassembly, repair, and reassembly process to restore the EDG to manufacturer specifications. Due to the extensive nature of the repair effort, the licensee submitted two emergency LARs to request additional time to allow for completion of the repairs and testing. The NRC staff approved the two LARs that granted one-time extensions of the 10-day required action completion time to a 62-day required action completion time. Repairs and post-maintenance testing were completed and the 3B EDG was declared operable on February 10, 2017.

Additional information is provided in LER 530-2016-002-01 (Ref. 1) and IR 05000530/2017008 (Ref. 2).

Cause. The direct cause of this event was high cycle fatigue of the #9 master rod ligament.

The root cause analysis determined the 3B EDG had a misaligned crankshaft bore that resulted from a previous failure of the 3B EDG that occurred in 1986. The misalignment of the crankshaft bore resulted in sufficient cyclic stresses at the #9 master rod ligament to initiate and propagate a fatigue crack. Evidence indicates the 3B EDG crankshaft bore misalignment was due to the previous 1986 connecting rod failure and subsequent repair, which did not include a check of the crankshaft main bore alignment. The licensee determined that the other five EDGs at Palo Verde Nuclear Generating Station have not had a connecting rod failure or any other mechanical event that could have introduced such misalignment.

MODELING Basis for ASP Analysis/SDP Results. The ASP Program uses SDP results for degraded conditions when available and applicable. The NRC conducted a special inspection (in accordance with Management Directive 8.3, NRC Incident Investigation Program,) due to this event meeting two deterministic criteria and a preliminary risk assessment resulting in an incremental core damage probability of 3.7x10-6 (which is within the band for a special inspection). NRC inspectors did not identify any finding or violation of more than minor significance; however, the LER remains open. An independent ASP analysis was performed given the lack of an identified performance deficiency and the potential risk significance of this event.

2

LER 530-2016-002-01 A review of the LERs for Palo Verde Nuclear Generating Station within 1 year of this event revealed no windowed degradations for Unit 3.2 Analysis Type. A condition assessment was performed using an interim Palo Verde standardized plant analysis risk (SPAR) model, created in September 2017.3,4 This model is set up for Unit 1; therefore, when using it to perform an analysis of the Unit 3 event, Unit 1 basic events are used as surrogates that represent applicable basic events on the other unit.

Exposure Periods. Based on the review of the past run time and the type of failure that occurred, the 3B EDG would likely have failed to run for its full 24-hour mission time beginning on August 18, 2016. Therefore, an exposure period of approximately 119 days (August 18th through December 15th) existed when the 3B EDG would have failed to fulfil its safety function.

In addition, the 3B EDG was unavailable for approximately 57 days (December 15th through February 10th) while the 3B EDG was being repaired. These two exposure periods are referred to as Exposure Periods 1 and 2, respectively.

Key Modeling Assumptions. The following assumptions were determined to be significant to the modeling of this event:

Exposure Period 1 (119 days)

• The failure of the 3B EDG is modeled by setting basic event EPS-DGN-FR-DG1B (diesel generator 1B fails to run) to TRUE because the 3B EDG would have failed to run for its complete 24-hour mission time.

Exposure Period 2 (57 days)

• The 57-day period that the 3B EDG was undergoing repairs is modeled by setting basic event EPS-DGN-TM-DG1B (diesel generator 1B unavailable due to test and maintenance) to TRUE.

• Due to technical specifications and as part of the approved LAR, maintenance activities were prevented on the risk important equipment while the 3B EDG was undergoing repair (see Ref. 5 for additional information). Therefore, basic events ACP-CTG-TM-G01 (gas turbine generator 1 unavailable due to maintenance),

ACP-CTG-TM-G02 (gas turbine generator 2 unavailable due to maintenance),

2 During the August 2016 through February 2017 time period when the 3B EDG was unable to fulfil its safety function for the complete PRA mission time (i.e., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />), the 3A EDG was taken out of service for maintenance on October 4th for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and, therefore, creating a condition where both trains may have been inoperable. However, the SPAR models already contain probabilities the 3A EDG was unavailable due to test and/or maintenance. This base model probability is 1.48x10-2, which equates to approximately 130 hours0.0015 days <br />0.0361 hours <br />2.149471e-4 weeks <br />4.9465e-5 months <br /> of unavailability time per year. Given that the unavailability time of the 3A EDG during the August 2016 through February 2017 is accounted for in the base model unavailability, the 3-hour time period is not modeled explicitly in this analysis.

3 The Palo Verde SPAR model used in this analysis is currently posted on the test/limited use portion of the SAPHIRE Web page. This updated SPAR model is expected to be finalized and posted for unrestricted use after the model documentation is revised.

4 The applicable EDG recovery basic events (e.g., EPS-XHE-XL-NR01H, EPS-XHE-XL-NR02H, EPS-XHE-XL-NR24H, and EPS-XHE-XL-NR24H2) were set to TRUE in the base SPAR model. In ASP analyses, these basic events are only used (in the change case) if the event information indicated that a failed EDG is recoverable and, therefore, recovery credit is warranted.

3

LER 530-2016-002-01 AFW-TDP-TM-AP01 (AFW TDPAFA-P01 unavailable due to test and maintenance),

EPS-DGN-TM-DG1A (DG 1A unavailable due to test and maintenance), and ECW-TRN-TM-EWASYS (train A essential cooling water unavailable due to maintenance (PSA)) were set to FALSE.

ANALYSIS RESULTS CDP. The point estimate CDP for this event is 1.8x10-5, which is the sum of both exposure periods. The ASP Program acceptance threshold is a CDP of 1x10-6 for degraded conditions.

The CDP for this event exceeds this threshold; therefore, this event is a precursor. The total CDP for this event is dominated by the risk from Exposure Period 1 (CDP of 1.5x10-5).

Whereas, the risk from Exposure Period 2 (CDP of 3.6x10-6) contributes approximately 20 percent to the total risk for this event. It is important to note that the risk from Exposure Period 2 is potentially conservative because additional compensatory actions (e.g., installation of portable diesel generators) associated with the LAR are not considered in this analysis.

Dominant Sequence. The dominant accident sequence is grid-related LOOP/SBO Sequence 09-09-10 (CDP = 4.2x10-6) that contributes 23 percent of the total internal events CDP.

Figures A-1 through A-3 in Appendix A illustrate this sequence. The dominant sequences that contribute at least 1 percent of the total internal events CCDP are provided in the following table:

Sequence CDP Percentage Description Grid-related LOOP initiating event; successful reactor trip; emergency power system failure results in SBO; AFW initially succeeds; operators successfully isolate LOOPGR 09-09-10 4.2x10-6 22.9% RCP controlled bleed-off; RCP seals remain intact; operators fail to restore offsite power within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />; operators fail to manually control AFW without DC power Weather-related LOOP initiating event; successful reactor trip; emergency power system failure results in SBO; AFW initially succeeds; operators successfully LOOPWR 09-09-10 3.9x10-6 21.5% isolate RCP controlled bleed-off; RCP seals remain intact; operators fail to restore offsite power within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />; operators fail to manually control AFW without DC power Switchyard-centered LOOP initiating event; successful reactor trip; emergency power system failure results in SBO; AFW initially succeeds; operators successfully LOOPSC 09-09-10 3.6x10-6 19.4% isolate RCP controlled bleed-off; RCP seals remain intact; operators fail to restore offsite power within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />; operators fail to manually control AFW without DC power Grid-related LOOP initiating event; successful reactor trip; emergency power system failure results in SBO; LOOPGR 09-30 1.5x10-6 8.2%

AFW fails; operators fail to restore offsite power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Switchyard-centered LOOP initiating event; successful reactor trip; emergency power system failure results in LOOPSC 09-30 1.3x10-6 7.3%

SBO; AFW fails; operators fail to restore offsite power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 4

LER 530-2016-002-01 Sequence CDP Percentage Description Weather-related LOOP initiating event; successful reactor trip; emergency power system failure results in LOOPWR 09-30 1.2x10-6 6.3%

SBO; AFW fails; operators fail to restore offsite power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Switchyard-centered LOOP initiating event; successful LOOPSC 08 7.6x10-7 4.1% reactor trip; emergency power system succeeds; AFW fails Grid-related LOOP initiating event; successful reactor LOOPGR 08 6.2x10-7 3.4%

trip; emergency power system succeeds; AFW fails Weather-related LOOP initiating event; successful LOOPWR 08 3.4x10-7 1.8% reactor trip; emergency power system succeeds; AFW fails Plant-centered LOOP initiating event; successful reactor trip; emergency power system failure results in SBO; AFW initially succeeds; operators successfully LOOPPC 09-09-10 3.1x10-7 1.7% isolate RCP controlled bleed-off; RCP seals remain intact; operators fail to restore offsite power within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />; operators fail to manually control AFW without DC power Modeling Uncertainty. The treatment of the 3B EDG failure is a potential modeling uncertainty in this ASP analysis. ASP analyses use the failure memory approach in which successful operation of equipment is not credited.5 However, the 3B EDG had successfully completed its surveillance testing for the previous months prior to December 2015. Therefore, depending on when it was demanded, it is likely that the 3B EDG would have run for some time prior to failing within the PRA mission time (i.e., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />).

Depending on how long the 3B EDG runs prior to failing, operators would have additional time to recover offsite power. A sensitivity analysis was performed crediting the expected successful run time for the 3B EDG (based on the surveillance test data) by adjusting the offsite power recovery probabilities based on surveillance test run times for the applicable exposure periods from August 18th through December 15th. The following table provides a breakdown of the eight different exposure periods (within the best estimate case Exposure Period 1), the credited run time for the 3B EDG, and CDP for each period.

Exposure Credited Run Time Date Range Time CDP Period # for the 3B EDG 1a 11/18/16-12/15/16 649 hours0.00751 days <br />0.18 hours <br />0.00107 weeks <br />2.469445e-4 months <br /> ~1 hour 4.5x10-6 1b 10/16/16-11/18/16 782 hours0.00905 days <br />0.217 hours <br />0.00129 weeks <br />2.97551e-4 months <br /> ~6 hours 2.5x10-6 1c 10/10/16-10/16/16 140 hours0.00162 days <br />0.0389 hours <br />2.314815e-4 weeks <br />5.327e-5 months <br /> ~11 hours 3.0x10-7 1d 10/10/16 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> ~12 hours 1.0x10-8 1e 10/9/16-10/10/16 19 hours2.199074e-4 days <br />0.00528 hours <br />3.141534e-5 weeks <br />7.2295e-6 months <br /> ~13 hours 3.6x10-8 1f 10/9/16 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> ~14 hours 2.3x10-8 1g 9/14/16-10/9/16 588 hours0.00681 days <br />0.163 hours <br />9.722222e-4 weeks <br />2.23734e-4 months <br /> ~15 hours 1.0x10-6 1h 8/18/16-9/14/16 661 hours0.00765 days <br />0.184 hours <br />0.00109 weeks <br />2.515105e-4 months <br /> ~20 hours 9.2x10-7 5

Convolution factors are applied to the postulated failures-to-run of the other EDGs.

5

LER 530-2016-002-01 This sensitivity case results in a CDP = 9.3x10-6, which excludes the EDG repair time (i.e., Exposure Period 2). Therefore, this sensitivity case results in a CDP approximately 36 percent less than Exposure Period 1 (1.5x10-5) in the best estimate case. While not greatly affecting the result of this analysis, other cases in which the affected EDG runs longer just prior to failing would yield larger differences.

REFERENCES

1. Palo Verde Nuclear Generating Station, Emergency Diesel Generator Failure Resulting in a Condition Prohibited by Technical Specifications, LER 530-2016-002-01, dated June 27, 2017 (ADAMS Accession No. ML17178A383).

2. U.S. Nuclear Regulatory Commission, Palo Verde Nuclear Generating Station - NRC Special Inspection Report 05000530/2017008, dated April 10, 2017 (ADAMS Accession No. ML17100A130).

3. U.S. Nuclear Regulatory Commission, Palo Verde Nuclear Generating Station (PVNGS),

Unit 3 - Emergency License Amendment Request for a One-Time Extension of the Diesel Generator Completion Time, dated December 21, 2016 (ADAMS Accession No. ML16356A689).

4. U.S. Nuclear Regulatory Commission, Palo Verde Nuclear Generating Station (PVNGS),

Unit 3 - Emergency License Amendment Request to Extend Diesel Generator 3B Completion Time, dated December 30, 2016 (ADAMS Accession No. ML16365A240).

5. U.S. Nuclear Regulatory Commission, Palo Verde Nuclear Generating Station, Unit 3 -

Issuance of Amendments Re: Revision to Technical Specification 3.8.1, AC [Alternating Current] Sources - Operating (Emergency Circumstances) (CAC NO. MF9019), dated January 4, 2017 (ADAMS Accession No. ML17004A020).

6

LER 530-2016-002-01 Appendix A: Key Event Trees Figure A-1. Palo Verde LOOP Event Tree (Grid-Related)

A-1

LER 530-2016-002-01 Figure A-2. Palo Verde SBO Event Tree A-2

LER 530-2016-002-01 Figure A-3. Palo Verde SBO-2 Event Tree A-3