ML18075A076: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
(StriderTol Bot change)
 
(2 intermediate revisions by the same user not shown)
Line 16: Line 16:


=Text=
=Text=
{{#Wiki_filter:UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 March 22, 2018 Site Vice President Entergy Operations, Inc. Waterford Steam Electric Station, Unit 3 17265 River Road Killona, LA 70057-3093  
{{#Wiki_filter:UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 March 22, 2018 Site Vice President Entergy Operations, Inc.
Waterford Steam Electric Station, Unit 3 17265 River Road Killona, LA 70057-3093


==SUBJECT:==
==SUBJECT:==
TRANSMITTAL OF FINAL WATERFORD STEAM ELECTRIC STATION, UNIT 3, ACCIDENT SEQUENCE PRECURSOR REPORT (LICENSEE EVENT REPORT 382-2017-002)  
TRANSMITTAL OF FINAL WATERFORD STEAM ELECTRIC STATION, UNIT 3, ACCIDENT SEQUENCE PRECURSOR REPORT (LICENSEE EVENT REPORT 382-2017-002)


==Dear Sir or Madam:==
==Dear Sir or Madam:==
By letter dated September 18, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17261B215), Entergy Operations, Inc. (the licensee) submitted Licensee Event Report (LER) 382-2017-002, "Automatic Reactor Scram due to the Failure of Fast Bus Transfer Relays to Automatically Transfer Station Loads to Offsite Power on a Main Generator Trip," to the U.S. Nuclear Regulatory Commission (NRC) staff for Waterford Steam Electric Station, Unit 3 (Waterford 3), pursuant to Title 10 of the Code of Federal Regulations Section 50. 73. As part of the Accident Sequence Precursor (ASP) Program, the NRC staff reviewed the event to identify potential precursors and to determine the probability of the event leading to a core damage state. The results of the analysis are provided in the enclosure to this letter. The NRC does not request a formal analysis review, in accordance with Regulatory Issue Summary 2006-24, "Revised Review and Transmittal Process for Accident Sequence Precursor Analyses," dated December 6, 2006 (ADAMS Accession No. ML060900007), because the analysis resulted in a conditional core damage probability (CCDP) of less than 1x10-4. Final ASP Analysis Summary. A brief summary of the final ASP analysis, including the results, is provided below. Automatic Reactor Scram due to the Failure of Fast Bus Transfer Relays to Automatically Transfer Station Loads to Offsite Power on a Main Generator Trip. This event is documented in LER 382-2017-002 and in Inspection Report 05000382/2017011 (ADAMS Accession No. ML17354A690).
 
Executive Summary. On July 17, 2017, with the Waterford 3 reactor operating at 100 percent power, control room operators received indications of an electrical grid spike during a severe thunderstorm.
By letter dated September 18, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17261B215), Entergy Operations, Inc. (the licensee) submitted Licensee Event Report (LER) 382-2017-002, "Automatic Reactor Scram due to the Failure of Fast Bus Transfer Relays to Automatically Transfer Station Loads to Offsite Power on a Main Generator Trip," to the U.S. Nuclear Regulatory Commission (NRC) staff for Waterford Steam Electric Station, Unit 3 (Waterford 3), pursuant to Title 10 of the Code of Federal Regulations Section 50. 73. As part of the Accident Sequence Precursor (ASP) Program, the NRC staff reviewed the event to identify potential precursors and to determine the probability of the event leading to a core damage state. The results of the analysis are provided in the enclosure to this letter.
The isophase bus duct to main transformer  
The NRC does not request a formal analysis review, in accordance with Regulatory Issue Summary 2006-24, "Revised Review and Transmittal Process for Accident Sequence Precursor Analyses," dated December 6, 2006 (ADAMS Accession No. ML060900007), because the analysis resulted in a conditional core damage probability (CCDP) of less than 1x10-4 .
'B' was glowing orange and arcing, causing control room operators to manually trip the main turbine to de-energize main transformer  
Final ASP Analysis Summary. A brief summary of the final ASP analysis, including the results, is provided below.
'B.' Unexpectedly, the transfer of the electrical buses from the unit auxiliary transformer to the startup transformer did not occur, resulting in a loss of offsite power (LOOP) to the safety and nonsafety electrical buses. Both emergency diesel generators (EDGs) started   and loaded their respective safety buses. Emergency feedwater (EFW) automatically actuated to feed the steam generators and was manually controlled by the operators.
Automatic Reactor Scram due to the Failure of Fast Bus Transfer Relays to Automatically Transfer Station Loads to Offsite Power on a Main Generator Trip. This event is documented in LER 382-2017-002 and in Inspection Report 05000382/2017011 (ADAMS Accession No. ML17354A690).
This event was modeled as a plant-centered LOOP initiating event. Given the modeling assumptions used in this analysis, the CCDP was calculated to be 2x 1 o-5* The risk of this event is dominated by station blackout scenarios as the result of postulated failures of the EDGs and EFW, with the subsequent failure of operators to recover offsite power. In addition, the risk of the event is significantly affected by the lack of feed-and-bleed cooling capability at Waterford
Executive Summary. On July 17, 2017, with the Waterford 3 reactor operating at 100 percent power, control room operators received indications of an electrical grid spike during a severe thunderstorm. The isophase bus duct to main transformer 'B' was glowing orange and arcing, causing control room operators to manually trip the main turbine to de-energize main transformer 'B.' Unexpectedly, the transfer of the electrical buses from the unit auxiliary transformer to the startup transformer did not occur, resulting in a loss of offsite power (LOOP) to the safety and nonsafety electrical buses. Both emergency diesel generators (EDGs) started
: 3. Sensitivity cases were performed to quantify the risk impacts from modeling uncertainties associated with key assumptions made in this ASP analysis (e.g., recovery of auxiliary feedwater, credit for FLEX generators).
 
In all cases, the resulting CCDP remained above the ASP precursor threshold.
and loaded their respective safety buses. Emergency feedwater (EFW) automatically actuated to feed the steam generators and was manually controlled by the operators.
The licensee performed a past operability analysis and determined that the Struthers Dunn relays would not have fulfilled their safety function of transferring safety-related loads to the offsite transmission network from June 2, 2017, until the automatic trip on July 17, 2017. A licensee performance deficiency was identified for an inadequate design change that rendered the fast bus transfer system inoperable.
This event was modeled as a plant-centered LOOP initiating event. Given the modeling assumptions used in this analysis, the CCDP was calculated to be 2x 1o-5
A detailed risk analysis for this condition was performed to support the Significance Determination Process, resulting in a delta core damage frequency
* The risk of this event is dominated by station blackout scenarios as the result of postulated failures of the EDGs and EFW, with the subsequent failure of operators to recover offsite power. In addition, the risk of the event is significantly affected by the lack of feed-and-bleed cooling capability at Waterford 3.
(~CDF) of 4.5x 10-7 per year, which is a Green finding (i.e., very low safety significance).
Sensitivity cases were performed to quantify the risk impacts from modeling uncertainties associated with key assumptions made in this ASP analysis (e.g., recovery of auxiliary feedwater, credit for FLEX generators). In all cases, the resulting CCDP remained above the ASP precursor threshold.
Summary of Analysis Results. This operational event resulted in a best estimate CCDP of 2x1Q*5* The detailed ASP analysis can be found in the enclosure.
The licensee performed a past operability analysis and determined that the Struthers Dunn relays would not have fulfilled their safety function of transferring safety-related loads to the offsite transmission network from June 2, 2017, until the automatic trip on July 17, 2017. A licensee performance deficiency was identified for an inadequate design change that rendered the fast bus transfer system inoperable. A detailed risk analysis for this condition was performed to support the Significance Determination Process, resulting in a delta core damage frequency (~CDF) of 4.5x 10-7 per year, which is a Green finding (i.e., very low safety significance).
Summary of Analysis Results. This operational event resulted in a best estimate CCDP of 2x1Q*5
* The detailed ASP analysis can be found in the enclosure.
If you have any questions, please contact me at 301-415-1390 or via e-mail at April. Pulvirenti@nrc.gov.
If you have any questions, please contact me at 301-415-1390 or via e-mail at April. Pulvirenti@nrc.gov.
Docket No. 50-382  
Sincerely, April L. Pulvirenti, Project Manager Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-382


==Enclosure:==
==Enclosure:==


Final Accident Sequence Precursor Analysis cc: Listserv Sincerely, April L. Pulvirenti, Project Manager Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation ENCLOSURE FINAL ACCIDENT SEQUENCE PRECURSOR ANALYSIS WATERFORD STEAM ELECTRIC STATION, UNIT 3 AUTOMATIC REACTOR SCRAM DUE TO THE FAILURE OF FAST BUS TRANSFER RELAYS TO AUTOMATICALLY TRANSFER STATION LOADS TO OFFSITE POWER ON A MAIN GENERATOR TRIP (LER 382-2017-002)  
Final Accident Sequence Precursor Analysis cc: Listserv
-PRECURSOR Final ASP Pro sis -Precursor Waterford Steam Electric Station -Unit 3 Event Date: 07/17/2017 Automatic Reactor Scram due to the Failure of Fast Bus Transfer Relays to Automatically Transfer Station Loads to Offsite Power on a Main Generator Trip LER: 382-2017-002 IR: 05000382/2017011 CCDP= 2x10-5 Plant Type: Pressurized Water Reactor (PWR); Combustion Engineering Two-Loop with a Lar e, D Containment Plant Operating Mode (Reactor Power Level): Mode 1 (100% reactor power) Analyst: Reviewer:
 
Ian Gifford Christopher Hunter EXECUTIVE  
ENCLOSURE FINAL ACCIDENT SEQUENCE PRECURSOR ANALYSIS WATERFORD STEAM ELECTRIC STATION, UNIT 3 AUTOMATIC REACTOR SCRAM DUE TO THE FAILURE OF FAST BUS TRANSFER RELAYS TO AUTOMATICALLY TRANSFER STATION LOADS TO OFFSITE POWER ON A MAIN GENERATOR TRIP (LER 382-2017-002) - PRECURSOR
 
Final ASP Pro                                                   sis - Precursor Waterford Steam                 Automatic Reactor Scram due to the Failure of Fast Bus Electric Station -              Transfer Relays to Automatically Transfer Station Loads to Unit 3                          Offsite Power on a Main Generator Trip LER: 382-2017-002 Event Date: 07/17/2017                                                          CCDP= 2x10-5 IR: 05000382/2017011 Plant Type: Pressurized Water Reactor (PWR); Combustion Engineering Two-Loop with a Lar e, D Containment Plant Operating Mode (Reactor Power Level): Mode 1 (100% reactor power)
Approval Date:
Analyst:                   Reviewer:                  Contributors:
03/1/18 Ian Gifford               Christopher Hunter         N/A EXECUTIVE  


==SUMMARY==
==SUMMARY==
Contributors:
 
N/A Approval Date: 03/1/18 On July 17, 2017, with the Waterford 3 reactor operating at 100 percent power, control room operators received indications of an electrical grid spike during a severe thunderstorm.
On July 17, 2017, with the Waterford 3 reactor operating at 100 percent power, control room operators received indications of an electrical grid spike during a severe thunderstorm. The isophase bus duct to main transformer 'B' was glowing orange and arcing, causing control room operators to manually trip the main turbine to de-energize main transformer 'B'. Unexpectedly, the transfer of the electrical buses from the unit auxiliary transformer (UAT) to the startup transformer (SUT) did not occur, resulting in a loss of offsite power (LOOP) to the safety and nonsafety electrical buses. Both emergency diesel generators (EDGs) started and loaded their respective safety buses. Emergency feedwater (EFW) automatically actuated to feed the steam generators and was manually controlled by the operators.
The isophase bus duct to main transformer  
This event was modeled as a plant-centered LOOP initiating event. Given the modeling assumptions used in this analysis, the conditional core damage probability (CCDP) was calculated to be 2x10-5
'B' was glowing orange and arcing, causing control room operators to manually trip the main turbine to de-energize main transformer  
* The risk of this event is dominated by station blackout (SBO) scenarios as the result of postulated failures of the EDGs and EFW, with the subsequent failure of operators to recover offsite power. In addition, the risk of the event is significantly affected by the lack of feed-and-bleed cooling capability at Waterford. Sensitivity cases were performed to quantify the risk impacts from modeling uncertainties associated with key assumptions made in this ASP analysis (e.g., recovery of auxiliary feedwater, credit for FLEX generators). In all cases, the resulting CCDP remained above the ASP precursor threshold.
'B'. Unexpectedly, the transfer of the electrical buses from the unit auxiliary transformer (UAT) to the startup transformer (SUT) did not occur, resulting in a loss of offsite power (LOOP) to the safety and nonsafety electrical buses. Both emergency diesel generators (EDGs) started and loaded their respective safety buses. Emergency feedwater (EFW) automatically actuated to feed the steam generators and was manually controlled by the operators.
The licensee performed a past operability analysis and determined that the Struthers Dunn relays would not have fulfilled their safety function of transferring safety-related loads to the offsite transmission network from June 2nd until the automatic trip on July 171h. A licensee performance deficiency was identified for an inadequate design change that rendered the fast bus transfer system inoperable. A detailed risk analysis for this condition was performed to support the Significance Determination Process (SOP), resulting in a delta core damage frequency (.6.CDF) of 4.5x10-7 per year, which is a Green finding (i.e., very low safety significance).
This event was modeled as a plant-centered LOOP initiating event. Given the modeling assumptions used in this analysis, the conditional core damage probability (CCDP) was calculated to be 2x10-5* The risk of this event is dominated by station blackout (SBO) scenarios as the result of postulated failures of the EDGs and EFW, with the subsequent failure of operators to recover offsite power. In addition, the risk of the event is significantly affected by the lack of feed-and-bleed cooling capability at Waterford.
EVENT DETAILS 1
Sensitivity cases were performed to quantify the risk impacts from modeling uncertainties associated with key assumptions made in this ASP analysis (e.g., recovery of auxiliary feedwater, credit for FLEX generators).
 
In all cases, the resulting CCDP remained above the ASP precursor threshold.
LER 382-2017-002 Event Description. On July 17, 2017, at 3:55 p.m., with the Waterford 3 reactor operating at 100 percent power, control room operators received indications of an electrical grid spike during a severe thunderstorm. Operators were dispatched to investigate electrical components in the transformer yard where they reported that the isophase bus duct to main transformer 'B' was glowing orange and arcing. At 4:06 p.m., control room operators manually tripped the main turbine to de-energize main transformer 'B'. In response to the main turbine trip, the main generator automatically tripped and reactor power cutback was initiated. Unexpectedly, the transfer of the electrical buses from the UAT to the SUT did not occur, resulting in a LOOP to the safety and nonsafety electrical buses. All four reactor coolant pumps (RCPs) were de-energized and the reactor automatically tripped due to loss of forced circulation. Both EDGs started and loaded their respective safety buses. EFW automatically actuated to provide inventory makeup to the steam generators. Control room operators took manual control of EFW due to overcooling concerns. Offsite power was restored to the train 'A' and train 'B' safety buses at 6:44 p.m. and 8:01 p.m., respectively. On July 18th at 1:16 a.m., control room operators started the auxiliary feedwater (AFW) pump to feed the steam generators and secured EFW.
The licensee performed a past operability analysis and determined that the Struthers Dunn relays would not have fulfilled their safety function of transferring safety-related loads to the offsite transmission network from June 2nd until the automatic trip on July 17 1 h. A licensee performance deficiency was identified for an inadequate design change that rendered the fast bus transfer system inoperable.
The licensee performed a past operability analysis and determined that the Struthers Dunn relays would not have fulfilled their safety function of transferring safety-related loads to the offsite transmission network from June 2nd until the automatic trip on July 17th.
A detailed risk analysis for this condition was performed to support the Significance Determination Process (SOP), resulting in a delta core damage frequency
Additional information regarding this event can be found in licensee event report (LER) 382-2017-002 (Ref. 1) and inspection report (IR) 05000382/2017011 (Ref. 2).
(.6.CDF) of 4.5x10-7 per year, which is a Green finding (i.e., very low safety significance).
Cause. Overheating of the isophase bus duct was caused by the failure of a shunt assembly connection to the phase 'B' bus duct. The failure of the shunt assembly was likely due to a combination of the dynamic response to the grid spike and degraded connections between the shunt assemblies and the bus duct. Failure of the fast bus transfer was caused by an instantaneous time out of the Struthers Dunn 237 series direct current (DC) time delay dropout relays after being exposed to DC coil inductive kick. Additionally, post-modification testing to the Struthers Dunn relay did not exercise the fast bus transfer timing circuitry and, therefore, prevented early detection of the relay failure.
EVENT DETAILS 1 LER 382-2017-002 Event Description.
MODELING Basis for ASP Analysis/SOP Results. The ASP Program performs independent analyses for initiating events. ASP analyses of initiating events account for all failures/degraded conditions and unavailabilities (e.g., equipment out for test/maintenance) that occurred during the event, regardless of licensee performance. 1 A licensee performance deficiency was identified for an inadequate design change that rendered the fast bus transfer system inoperable. Modifications to the fast bus transfer circuitry in May 2017 did not properly account for the increased susceptibility to DC coil inductive kick of electronic devices, and resulted in the licensee's inability to maintain offsite power to the 6.9 kilo-volt (kV) and 4.16 kV electrical buses following a trip of the main generator. A detailed risk analysis was performed under the SOP that modeled the failure of the fast bus transfer for the 45-day exposure period. The analysis utilized a condition-specific 2-hour nonrecovery value for offsite power of 7.0x1Q-3 , given that offsite power was always available in the switchyard.
On July 17, 2017, at 3:55 p.m., with the Waterford 3 reactor operating at 100 percent power, control room operators received indications of an electrical grid spike during a severe thunderstorm.
ASP analyses also account for any degraded condition(s) identified after the initiating event occurred, if the failure/degradation exposure period(s) overlaps the initiating event date.
Operators were dispatched to investigate electrical components in the transformer yard where they reported that the isophase bus duct to main transformer  
2
'B' was glowing orange and arcing. At 4:06 p.m., control room operators manually tripped the main turbine to de-energize main transformer  
 
'B'. In response to the main turbine trip, the main generator automatically tripped and reactor power cutback was initiated.
LER 382-2017-002 The ~CDP over this exposure period was calculated to be 1.97x 1o-6 , with dominant core damage sequences involving a transient initiating event, failure of fast transfer, failure of the EDGs, and failure of the turbine-driven EFW pump upon battery depletion. The SOP analysis determined that credit should be given for the ability of the FLEX diesel generator to provide power to a vital battery that allows extended operation of the turbine-driven EFW pump. A failure probability of 0.1 was determined using the SPAR-H Human Reliability Analysis Method (Ref. 3 and 4) for the operator actions required to shed DC loads during a SBO; set up, start, and align the FLEX diesel generator; and establish vital battery charging form via the FLEX diesel generator. The final ~CDF was calculated to be 4.5x 10-7 per year, which is a Green finding (i.e., very low safety significance). Additional information regarding this SOP analysis can be found in IR 05000382/2017011.
Unexpectedly, the transfer of the electrical buses from the UAT to the SUT did not occur, resulting in a LOOP to the safety and nonsafety electrical buses. All four reactor coolant pumps (RCPs) were de-energized and the reactor automatically tripped due to loss of forced circulation.
Analysis Type. An initiating event analysis was performed using the Waterford 3 standardized plant analysis risk (SPAR) model, Revision 8.54, created on December 15, 2017.
Both EDGs started and loaded their respective safety buses. EFW automatically actuated to provide inventory makeup to the steam generators.
SPAR Model Modifications. The following modifications were required for this initiating event analysis:
Control room operators took manual control of EFW due to overcooling concerns.
* Typically, the AFW system is assumed to be unavailable during a LOOP because the nonsafety buses are de-energized. However, because offsite power remained available at the switchyard throughout the event, it was determined that operators had sufficient time to recover offsite power and align the AFW pump. 2 Therefore, the EFW (emergency feedwater system) fault tree was modified by inserting the AFW (auxiliary feedwater system) fault tree as a transfer under the existing top gate of the EFW (emergency feedwater system) fault tree. In addition, this top gate was changed to AND gate. A new OR gate EFW-1 (failure of EFW) was inserted under the EFW fault tree top gate with all EFW system logic being moved under gate EFW-1. The modified EFW fault tree is shown in Figure A-1.
Offsite power was restored to the train 'A' and train 'B' safety buses at 6:44 p.m. and 8:01 p.m., respectively.
* To model power recovery to the AFW system, the ACP-NSTRNB (nonessential train B AC power) fault tree was modified to include a new AND gate ACP-NSTRNB-LOOP (loss of div. B offsite power with no recovery) inserted under the existing OR gate ACP-NSTRNB (nonessential train B AC power). House event HE-LOOP-B (loss of div.
On July 18th at 1:16 a.m., control room operators started the auxiliary feedwater (AFW) pump to feed the steam generators and secured EFW. The licensee performed a past operability analysis and determined that the Struthers Dunn relays would not have fulfilled their safety function of transferring safety-related loads to the off site transmission network from June 2nd until the automatic trip on July 17th. Additional information regarding this event can be found in licensee event report (LER) 382-2017-002 (Ref. 1) and inspection report (IR) 05000382/2017011 (Ref. 2). Cause. Overheating of the isophase bus duct was caused by the failure of a shunt assembly connection to the phase 'B' bus duct. The failure of the shunt assembly was likely due to a combination of the dynamic response to the grid spike and degraded connections between the shunt assemblies and the bus duct. Failure of the fast bus transfer was caused by an instantaneous time out of the Struthers Dunn 237 series direct current (DC) time delay dropout relays after being exposed to DC coil inductive kick. Additionally, post-modification testing to the Struthers Dunn relay did not exercise the fast bus transfer timing circuitry and, therefore, prevented early detection of the relay failure. MODELING Basis for ASP Analysis/SOP Results. The ASP Program performs independent analyses for initiating events. ASP analyses of initiating events account for all failures/degraded conditions and unavailabilities (e.g., equipment out for test/maintenance) that occurred during the event, regardless of licensee performance.
B offsite power flag) and basic event OEP-XHE-XL-NR01 HPC (operator fails to recover offsite power in 1 hour (plant-centered)) were added under AND gate ACP-NSTRNB-LOOP. The modified ACP-NSTRNB fault tree is shown in Figure A-2.
1 A licensee performance deficiency was identified for an inadequate design change that rendered the fast bus transfer system inoperable.
* In ASP analyses, recovery credit for EOG failures is limited to cases where event information supports credit for EOG recovery. Therefore, the DGR-02H (diesel generator recovery in 2 hours) top event (including applicable event tree branching) was eliminated from the SBO event tree. The modified SBO event tree is shown in Figure B-1.
Modifications to the fast bus transfer circuitry in May 2017 did not properly account for the increased susceptibility to DC coil inductive kick of electronic devices, and resulted in the licensee's inability to maintain offsite power to the 6.9 kilo-volt (kV) and 4.16 kV electrical buses following a trip of the main generator.
Key Modeling Assumptions. The following modeling assumptions were determined to be significant to the modeling of this event analysis:
A detailed risk analysis was performed under the SOP that modeled the failure of the fast bus transfer for the 45-day exposure period. The analysis utilized a condition-specific 2-hour nonrecovery value for offsite power of 7.0x1Q-3 , given that offsite power was always available in the switchyard.
2   The AFW pump is designed to deliver sufficient flow to the steam generators at maximum steam generator pressure, provided that power is available to the pump. Procedural guidance for restoring steam generator inventory with the AFW system is provided in OP-902-006, "Loss of Main Feedwater Recovery"; OP-902-008, "Functional Recovery Procedure"; and OP-902-009 Appendix 32, "Establishing Main Feedwater."
ASP analyses also account for any degraded condition(s) identified after the initiating event occurred, if the failure/degradation exposure period(s) overlaps the initiating event date. 2 LER 382-2017-002 The ~CDP over this exposure period was calculated to be 1.97x 1 o-6 , with dominant core damage sequences involving a transient initiating event, failure of fast transfer, failure of the EDGs, and failure of the turbine-driven EFW pump upon battery depletion.
3
The SOP analysis determined that credit should be given for the ability of the FLEX diesel generator to provide power to a vital battery that allows extended operation of the turbine-driven EFW pump. A failure probability of 0.1 was determined using the SPAR-H Human Reliability Analysis Method (Ref. 3 and 4) for the operator actions required to shed DC loads during a SBO; set up, start, and align the FLEX diesel generator; and establish vital battery charging form via the FLEX diesel generator.
 
The final ~CDF was calculated to be 4.5x 10-7 per year, which is a Green finding (i.e., very low safety significance).
LER 382-2017-002
Additional information regarding this SOP analysis can be found in IR 05000382/2017011.
* This analysis models the July 17, 2017, reactor trip at the Waterford Steam Electric Station as a plant-centered LOOP that resulted from failure of the fast transfer system, leaving the safety and nonsafety electrical buses without an offsite power source.
Analysis Type. An initiating event analysis was performed using the Waterford 3 standardized plant analysis risk (SPAR) model, Revision 8.54, created on December 15, 2017. SPAR Model Modifications.
Therefore, the probability for IE-LOOPPC (loss of offsite power initiator (plant-centered))
The following modifications were required for this initiating event analysis:
* Typically, the AFW system is assumed to be unavailable during a LOOP because the nonsafety buses are de-energized.
However, because offsite power remained available at the switchyard throughout the event, it was determined that operators had sufficient time to recover offsite power and align the AFW pump.2 Therefore, the EFW (emergency feedwater system) fault tree was modified by inserting the AFW (auxiliary feedwater system) fault tree as a transfer under the existing top gate of the EFW (emergency feedwater system) fault tree. In addition, this top gate was changed to AND gate. A new OR gate EFW-1 (failure of EFW) was inserted under the EFW fault tree top gate with all EFW system logic being moved under gate EFW-1. The modified EFW fault tree is shown in Figure A-1.
* To model power recovery to the AFW system, the ACP-NSTRNB (nonessential train B AC power) fault tree was modified to include a new AND gate ACP-NSTRNB-LOOP (loss of div. B offsite power with no recovery) inserted under the existing OR gate ACP-NSTRNB (nonessential train B AC power). House event HE-LOOP-B (loss of div. B offsite power flag) and basic event OEP-XHE-XL-NR01 HPC (operator fails to recover offsite power in 1 hour (plant-centered))
were added under AND gate ACP-NSTRNB-LOOP.
The modified ACP-NSTRNB fault tree is shown in Figure A-2.
* In ASP analyses, recovery credit for EOG failures is limited to cases where event information supports credit for EOG recovery.
Therefore, the DGR-02H (diesel generator recovery in [[estimated NRC review hours::2 hours]]) top event (including applicable event tree branching) was eliminated from the SBO event tree. The modified SBO event tree is shown in Figure B-1. Key Modeling Assumptions.
The following modeling assumptions were determined to be significant to the modeling of this event analysis:
2 The AFW pump is designed to deliver sufficient flow to the steam generators at maximum steam generator pressure, provided that power is available to the pump. Procedural guidance for restoring steam generator inventory with the AFW system is provided in OP-902-006, "Loss of Main Feedwater Recovery";
OP-902-008, "Functional Recovery Procedure";
and OP-902-009 Appendix 32, "Establishing Main Feedwater." 3 LER 382-2017-002
* This analysis models the July 17, 2017, reactor trip at the Waterford Steam Electric Station as a plant-centered LOOP that resulted from failure of the fast transfer system, leaving the safety and nonsafety electrical buses without an offsite power source. Therefore, the probability for IE-LOOPPC (loss of offsite power initiator (plant-centered))
was set to 1.0; all other initiating event probabilities were set to zero.
was set to 1.0; all other initiating event probabilities were set to zero.
* The time required to restore offsite power to plant equipment is a significant factor in modeling the risk of core damage given a LOOP. Given that offsite power remained available at the switchyard during this event, the analyst determined that condition-specific 1-and 2-hour nonrecovery probabilities for offsite power are warranted in this case. The SPAR-H Human Reliability Analysis Method was used to estimate nonrecovery probabilities, with key qualitative information for these recovery human failure events (HFEs) and the performance shaping factor (PSF) adjustments required for the quantification of these recovery events provided in Tables 1 and 2. Table 1. Key Qualitative In ormation of HFEs or site f f Off p ower Recovery The definition for these recovery HFEs is the operators failing to restore Definition offsite power to the electrical safety buses within 1 and [[estimated NRC review hours::2 hours]] (depending on the sequence) given a LOOP and postulated SBO. Description and Depending on postulated failures of the RCP seals (due to unavailability of Event Context seal injection/cooling), operators would have between 1 to [[estimated NRC review hours::2 hours]] to restore power to the safety electrical buses. Operator Action For successful recovery, operators would have to locally reset lockout relays Success Criteria prior to core uncovery.
* The time required to restore offsite power to plant equipment is a significant factor in modeling the risk of core damage given a LOOP. Given that offsite power remained available at the switchyard during this event, the analyst determined that condition-specific 1- and 2-hour nonrecovery probabilities for offsite power are warranted in this case. The SPAR-H Human Reliability Analysis Method was used to estimate nonrecovery probabilities, with key qualitative information for these recovery human failure events (HFEs) and the performance shaping factor (PSF) adjustments required for the quantification of these recovery events provided in Tables 1 and 2.
Table 1. Key Qualitative Information of HFEs f or Offsite power Recovery The definition for these recovery HFEs is the operators failing to restore Definition         offsite power to the electrical safety buses within 1 and 2 hours (depending on the sequence) given a LOOP and postulated SBO.
Depending on postulated failures of the RCP seals (due to unavailability of Description and seal injection/cooling), operators would have between 1 to 2 hours to restore Event Context power to the safety electrical buses.
Operator Action         For successful recovery, operators would have to locally reset lockout relays Success Criteria         prior to core uncovery.
* Transformer alarms
* Transformer alarms
* Breaker alarms
* Breaker alarms
Line 99: Line 97:
* Tripped breaker indications on the 6.9 kV and 4.16 kV buses
* Tripped breaker indications on the 6.9 kV and 4.16 kV buses
* Extensive loss of component power available indications
* Extensive loss of component power available indications
* OP-902-003, "Loss of Offsite Power/Loss of Forced Circulation Procedural Recovery Procedure" Guidance
* OP-902-003, "Loss of Offsite Power/Loss of Forced Circulation Procedural                 Recovery Procedure" Guidance
* OP-902-005, "Station Blackout Recovery Procedure"
* OP-902-005, "Station Blackout Recovery Procedure"
* OP-902-009 Appendix 12, "Electrical Restoration" Diagnosis/Action These recovery HFEs contain diagnosis and action components. a e -va ua 10n o T bl 2 SPAR H E I f s or s1e f PSF f Off "t P ower R ecovery PSF Multiplier Notes Diagnosis/Action Time Available 1 or 0.01 / 1 The operators would need less than five minutes to perform the action component (i.e., reset the lockout relays). Therefore, the minimum time for diagnosis is approximately 55 minutes. It would take operators approximately 30 minutes to get through the procedures and verify offsite power is fully available.
* OP-902-009 Appendix 12, "Electrical Restoration" Diagnosis/Action         These recovery HFEs contain diagnosis and action components.
Given these assumptions, the available time for the diagnosis 4
T a bl e 2 SPAR H Eva Iuaf 10n of PSFs f or Offs1e  "t Power Recovery Multiplier PSF                                                               Notes Diagnosis/Action Time Available           1 or 0.01 / 1     The operators would need less than five minutes to perform the action component (i.e., reset the lockout relays). Therefore, the minimum time for diagnosis is approximately 55 minutes. It would take operators approximately 30 minutes to get through the procedures and verify offsite power is fully available. Given these assumptions, the available time for the diagnosis 4
LER 382-2017-002 PSF Multiplier Notes Diagnosis/Action component for 1-hour recovery is assigned as Nominal Time (i.e., x1 ). Available time for the diagnosis component for 2-hour recovery is assigned as Expansive Time (i.e., xQ.01; time available is >2 times nominal and >30 minutes).
 
Since sufficient time was available for the action component of the recovery, the available time for the action component for all recovery times is evaluated as Nominal (i.e., x1 ). See Reference 4 for guidance on apportioning time between the diagnosis and action components of an HFE. Stress 2 I 1 The PSF for diagnosis stress is assigned a value of High Stress (i.e., x2) due to the postulated SBO. The PSF for action stress was not determined to be a performance driver for these HFEs; and therefore, was assigned a value of Nominal (i.e., x1 ). Complexity 2 I 1 The PSF for diagnosis complexity is assigned a value of Moderately Complex (i.e., x2) because operators would have to deal with multiple equipment unavailabilities and the concurrent actions/multiple procedures during a postulated SBO. The PSF for action complexity was not determined to be a performance driver for these HFEs; and therefore, was assigned a value of Nominal (i.e., x1 ). Procedures, 1 / 1 No event information is available to warrant a change in Experience/Training, these PSFs (for diagnosis and action) from Nominal for Ergonomic/HS I, these HFEs. Fitness-for-Duty, Work Process An HEP evaluated using SPAR-His calculated using the following formula: Calculated HEP= (Product of Diagnosis PSFsx0.01)  
LER 382-2017-002 Multiplier PSF                                                             Notes Diagnosis/Action component for 1-hour recovery is assigned as Nominal Time (i.e., x1 ).
+ (Product of Action PSFsx0.001)
Available time for the diagnosis component for 2-hour recovery is assigned as Expansive Time (i.e., xQ.01; time available is >2 times nominal and >30 minutes).
Therefore, the failure probability for OEP-XHE-NR01 HPC (operator fails to recover offsite power in 1 hour (plant-centered))
Since sufficient time was available for the action component of the recovery, the available time for the action component for all recovery times is evaluated as Nominal (i.e., x1 ). See Reference 4 for guidance on apportioning time between the diagnosis and action components of an HFE.
was set to 4x 10-2 and the failure probability for OEP-XHE-NR02HPC (operator fails to recover offsite power in [[estimated NRC review hours::2 hours]] {plant-centered))
Stress                 2I 1         The PSF for diagnosis stress is assigned a value of High Stress (i.e., x2) due to the postulated SBO.
was set to 1 x 1 o-3. ANALYSIS RESULTS CCDP. The point estimate CCDP for this event is 1.8x1Q-5. The ASP Program acceptance threshold is a CCDP of 1x10-5 or the CCDP equivalent of an uncomplicated reactor trip with a non-recoverable loss of feedwater or the condenser heat sink, whichever is greater. This CCDP equivalent for Waterford is 2.4x 1 o-6. Therefore, this event is a precursor.
The PSF for action stress was not determined to be a performance driver for these HFEs; and therefore, was assigned a value of Nominal (i.e., x1 ).
5 LER 382-2017-002 Dominant Sequence.
Complexity               2I 1         The PSF for diagnosis complexity is assigned a value of Moderately Complex (i.e., x2) because operators would have to deal with multiple equipment unavailabilities and the concurrent actions/multiple procedures during a postulated SBO.
The dominant accident sequence is LOOPPC sequence 15-20 (CCDP = 7.67x1Q-6), which contributes approximately 43 percent of the total internal events CCDP. This sequence is shown graphically in Figures B-1 and B-2 in Appendix B. The dominant sequences that contribute at least 1 .0 percent to the total internal events CCDP are provided in the following table: Sequence CCDP Percentage Description Plant-centered LOOP initiating event; successful reactor trip; failure of emergency power results in LOOPPC 15-20 7.67x1Q-6 42.8% SBO; failure of EFW; and operators fail to recover offsite power within 1 hour, which results in core damage Plant-centered LOOP initiating event; successful LOOPPC 14 5.80x10-6 32.3% reactor trip; success of emergency power; and failure of EFW, which results in core damage Plant-centered LOOP initiating event; successful reactor trip; failure of emergency power results in LOOPPC 15-14-10 4.08x10-6 22.8% SBO; success of EFW; RCP seal integrity is maintained; and operators fail to recover offsite power within [[estimated NRC review hours::2 hours]], which results in core damage Key Modeling Uncertainties.
The PSF for action complexity was not determined to be a performance driver for these HFEs; and therefore, was assigned a value of Nominal (i.e., x1 ).
The following were identified as key modeling uncertainties associated with this analysis:
Procedures,               1/ 1         No event information is available to warrant a change in Experience/Training,                         these PSFs (for diagnosis and action) from Nominal for Ergonomic/HS I,                           these HFEs.
Fitness-for-Duty, Work Process An HEP evaluated using SPAR-His calculated using the following formula:
Calculated HEP= (Product of Diagnosis PSFsx0.01) + (Product of Action PSFsx0.001)
Therefore, the failure probability for OEP-XHE-NR01 HPC (operator fails to recover offsite power in 1 hour (plant-centered)) was set to 4x 10-2 and the failure probability for OEP-XHE-NR02HPC (operator fails to recover offsite power in 2 hours {plant-centered))
was set to 1x 1o-3 .
ANALYSIS RESULTS CCDP. The point estimate CCDP for this event is 1.8x1Q-5 . The ASP Program acceptance threshold is a CCDP of 1x10-5 or the CCDP equivalent of an uncomplicated reactor trip with a non-recoverable loss of feedwater or the condenser heat sink, whichever is greater. This CCDP equivalent for Waterford is 2.4x 1o-6 . Therefore, this event is a precursor.
5
 
LER 382-2017-002 Dominant Sequence. The dominant accident sequence is LOOPPC sequence 15-20 (CCDP =
7.67x1Q-6), which contributes approximately 43 percent of the total internal events CCDP. This sequence is shown graphically in Figures B-1 and B-2 in Appendix B. The dominant sequences that contribute at least 1.0 percent to the total internal events CCDP are provided in the following table:
Sequence           CCDP       Percentage                           Description Plant-centered LOOP initiating event; successful reactor trip; failure of emergency power results in LOOPPC 15-20         7.67x1Q-6       42.8%     SBO; failure of EFW; and operators fail to recover offsite power within 1 hour, which results in core damage Plant-centered LOOP initiating event; successful LOOPPC 14         5.80x10-6       32.3%     reactor trip; success of emergency power; and failure of EFW, which results in core damage Plant-centered LOOP initiating event; successful reactor trip; failure of emergency power results in LOOPPC 15-14-10       4.08x10-6     22.8%     SBO; success of EFW; RCP seal integrity is maintained; and operators fail to recover offsite power within 2 hours, which results in core damage Key Modeling Uncertainties. The following were identified as key modeling uncertainties associated with this analysis:
* Credit for recovery of the AFW system given a LOOP has occurred and (postulated) failure of the EFW system;
* Credit for recovery of the AFW system given a LOOP has occurred and (postulated) failure of the EFW system;
* Credit for continued turbine-driven EFW flow after aligning a FLEX diesel generator to maintain safety-related DC power during a (postulated)
* Credit for continued turbine-driven EFW flow after aligning a FLEX diesel generator to maintain safety-related DC power during a (postulated) SBO; and
SBO; and
* Credit for EOG repair and recovery during a (postulated) SBO.
* Credit for EOG repair and recovery during a (postulated)
Sensitivity analyses were performed to show the effects of these modeling assumptions. The following table provides a brief description of each sensitivity case, including the results and observations:
SBO. Sensitivity analyses were performed to show the effects of these modeling assumptions.
Description                     CCDP                     Notes/Observations The estimated time to core damage following a LOOP and failure of EFW is 1. 7 hours for Combustion Engineering plants. The best Similar dominant sequences and cut sets estimate analysis for this event assumed that to the best estimate analysis. The CCDP sufficient time was available to restore offsite of LOOPPC sequence 14 is increased by a power and align the AFW system to feed the       7.8x1Q-5     factor of 11. The total CCDP is increased steam generators. However, any delay in by a factor of four, but still remains below recovery actions could result in core damage the significant precursor threshold of during a LOOP and (postulated) failure of the 1 x1Q-3 .
The following table provides a brief description of each sensitivity case, including the results and observations:
EFW system. A sensitivity analysis was performed to show the effects of eliminating this credit.
Description CCDP Notes/Observations The estimated time to core damage following a LOOP and failure of EFW is 1. [[estimated NRC review hours::7 hours]] for Combustion Engineering plants. The best Similar dominant sequences and cut sets estimate analysis for this event assumed that to the best estimate analysis.
6
The CCDP sufficient time was available to restore offsite of LOOPPC sequence 14 is increased by a power and align the AFW system to feed the 7.8x1Q-5 factor of 11. The total CCDP is increased steam generators.
 
However, any delay in by a factor of four, but still remains below recovery actions could result in core damage the significant precursor threshold of during a LOOP and (postulated) failure of the 1 x1Q-3. EFW system. A sensitivity analysis was performed to show the effects of eliminating this credit. 6 LER 382-2017-002 Description CCDP Notes/Observations Credit for continued operation of the turbine-driven EFW pump after battery depletion was not credited in this analysis because of the significant potential for Similar dominant sequences and cut sets over-or under-filling.
LER 382-2017-002 Description                   CCDP               Notes/Observations Credit for continued operation of the turbine-driven EFW pump after battery depletion was not credited in this analysis because of the significant potential for                 Similar dominant sequences and cut sets over- or under-filling. However, the lack of             to the best estimate analysis. Extended credit for this strategy is likely conservative.         operation of the EFW pump beyond the To show potential benefit of this action, a               2-hour battery depletion mitigates the risk sensitivity analysis was performed that         1.4x1Q-5 when offsite power is not recovered. The credited operation of the FLEX diesel                     CCDP of LOOPPC sequence 15-14-10 is generator to provide charging to the                     reduced by a factor of ten. The total safety-related batteries to allow for extended           CCDP is reduced by approximately 20 operation of the turbine-driven EFW pump to               percent, but still remains above the a safe/stable end state during a SBO. A                   precursor threshold.
However, the lack of to the best estimate analysis.
Extended credit for this strategy is likely conservative.
operation of the EFW pump beyond the To show potential benefit of this action, a 2-hour battery depletion mitigates the risk sensitivity analysis was performed that 1.4x1Q-5 when offsite power is not recovered.
The credited operation of the FLEX diesel CCDP of LOOPPC sequence 15-14-10 is generator to provide charging to the reduced by a factor of ten. The total safety-related batteries to allow for extended CCDP is reduced by approximately 20 operation of the turbine-driven EFW pump to percent, but still remains above the a safe/stable end state during a SBO. A precursor threshold.
screening failure probability of 0.1 was applied to operation of the FLEX diesel generator.
screening failure probability of 0.1 was applied to operation of the FLEX diesel generator.
Repair of failed equipment is not typically credited in PRAs. It is questionable that LOOP sequence 14 remains unchanged, mean time to repair data for EDGs is applicable to postulated SBO scenarios.
Repair of failed equipment is not typically credited in PRAs. It is questionable that LOOP sequence 14 remains unchanged, mean time to repair data for EDGs is as the results are still dominated by failure applicable to postulated SBO scenarios. To 1.6x1Q-5 of the EFW pumps. The total CCDP is show the effects of this credit, a sensitivity reduced by approximately 6 percent, but analysis was performed crediting EDG repair still remains above the precursor threshold.
To as the results are still dominated by failure show the effects of this credit, a sensitivity 1.6x1Q-5 of the EFW pumps. The total CCDP is analysis was performed crediting EDG repair reduced by approximately 6 percent, but for 1-hour (0.88) and 2-hour (0.82) still remains above the precursor threshold. (postulated)
for 1-hour (0.88) and 2-hour (0.82)
SBO scenarios.
(postulated) SBO scenarios.
REFERENCES
REFERENCES
: 1. Waterford Steam Electric Station, "LER 382/17-002 -Automatic Reactor Scram due to the Failure of Fast Bus Transfer Relays to Automatically Transfer Station Loads to Off-Site Power on a Main Generator Trip," dated September 18, 2017 (ADAMS Accession No. ML17261B215). 2. U.S. Nuclear Regulatory Commission, "Waterford Steam Electric Station, Unit 3 -NRC Special Inspection Report 05000382/2017011," dated December 20, 2017 (ADAMS Accession No. ML17354A690).
: 1. Waterford Steam Electric Station, "LER 382/17-002 -Automatic Reactor Scram due to the Failure of Fast Bus Transfer Relays to Automatically Transfer Station Loads to Off-Site Power on a Main Generator Trip," dated September 18, 2017 (ADAMS Accession No. ML17261B215).
: 2. U.S. Nuclear Regulatory Commission, "Waterford Steam Electric Station, Unit 3 - NRC Special Inspection Report 05000382/2017011," dated December 20, 2017 (ADAMS Accession No. ML17354A690).
: 3. Idaho National Laboratory, NUREG/CR-6883, "The SPAR-H Human Reliability Analysis Method," August 2005 (ADAMS Accession No. ML051950061).
: 3. Idaho National Laboratory, NUREG/CR-6883, "The SPAR-H Human Reliability Analysis Method," August 2005 (ADAMS Accession No. ML051950061).
: 4. Idaho National Laboratory, "INUEXT-10-18533, SPAR-H Step-by-Step Guidance," May 2011 (ADAMS Accession No. ML112060305).
: 4. Idaho National Laboratory, "INUEXT-10-18533, SPAR-H Step-by-Step Guidance," May 2011 (ADAMS Accession No. ML112060305).
7 FAILURE OF EFW SUCTION SOURCE EFW-SUCT H Appendix A: Fault Tree Modifications EMERGENCY FEEDWATER SYSTEM EFW y I FAILURE OF EFW EFW-1 CCF OF EFW PUMPS TO RUN EFW PUMP 'TRAIN FAIWRES ,, EFW-PMP-CF-FR I 1.69E-05 CCF OF EFW PUMPS TO START (PSA BASIC EVENT) EFW-PMP-CF-FS l5.33E-07 EFW-NOFLOW-F NO EFW FLOW TO STEAM GE~TQR2 NO EFW FLOW TO STEAM GENERA'TOR 1 EFW-Fl.()W-5(;1 Figure A-1: Waterford Modified EFW System Fault Tree A-1 LER 382-2017-002 I AUXILIARY FEEDWA~ SYSTEM AFW !Ext Ext Ext NON--ESSl:NT!ALTRAIN B AC POWER LOSS OF DIV B OFFSITE POWER WITH NO RECOVERY ACP-NSTRNB-LOOP ACP-NSTRNB LOSS OF DIV B OFFSITE POWER FLAG iif*~*. OPERATOR FAILS TO tir(ECOVER OFFSITE POWER IN 1 HOUR PLANT-CENTERED OEP-XHE-XL-NROlHPC 3.82E-01 HE-LOOP-B False FAILURE OF SWITCHGEAR ROOM B/AB COOUNG SWTCHGR-HYACBAB I Ext X LER 382-2017-002 CCF OF STARTUP TRANSFORMERS 3A/3B TO PROVIDE POWER :P-TFM-CF-SUT3AB
7
! 1.86E-06 FAILURE OF FAST BUS TRANSFER FOR TRAIN B ACP-ABT-FC-TRB 1.13E-03 FAILURE OF STARTUP NSFORMER FROM SWITCHYARD TO 4.16KV BUS 3B2 ACP.. TFM-FC-SUT3B j 6.07E-05 STARTUP TRANSFORMER FROM SWITCHYARD UNAVAIL DUETOT&M ACP-TFM-TM-SUT3B j 1.75E-03 > < Figure A-2: Waterford Modified Nonessential Train 'B' AC Power Fault Tree A-2 LER 382-2017-002 Appendix B: Key Event Trees EM1!RGENCY POWER ~~A'l'ER SAFETY R11UEF VALVl!S NOT CON!'RQJJ;E>~F WCTORcoow+T llCP SEAi. lN'liGRITY OFFS,ITE POWER RECOVER.)'
# End State S&#xa5;$l0t CHAU.i!NGED
~lfi!;I SUIIC()OIJNG,NAlNTAINEO MA!NTAlNIID IN2HRS (Phase-CD)
EPS **--rn EFW SRI/ Cl!O RSW w,.-, 0Pll.-ll2H
~o---[ 1 I OK I ~RCP301 0---1*1 .. 1 580-2 > ~~O---[ a*.** .1 580-l ) ~1**1 CD I c--[~o---11 5 I OK I o---, I 580-2 > ~o---1 .7 1 580-1 > R~ I . o&#xa3;:-a j CD I ~o---1 9 I OK I ,__~=03 o---1 10 1 580-2 > ~~o---1 11 580-1 > ~, 0---12 CD I OPR-01H r.* ::=;======~-
c--[~0---,1 13 OK I .....__ 0---14 580-2 > ~o---1 15 I 580-1 > RCP304 o---1 16.. CD I OPR-01H -. >-----o-----Co---1 11 580-1 > o2;;-I .. "' I EFW-B O o-----Co---1 19 580-1 > o---1 20 I CD I OPR-01H -. . SRV-B EFW-B SRV-B Figure B-1. Waterford Modified SBO Event Tree B-1 LER 382-2017-002 LOSS OJ'Ofln POWEi! REAcroR PRQ1EC1lON EME1tGOCf POWa illlllli1NC'fl'fflJWA'IIIR-SAfffiRUl'Ylill'l!SJ<<w RU~~ lllil!IIR!SIIJRfMffl)li Ol'PSlliPOWEl!Rl!l:OViRY RCSCOOIOOWNUSING SIIJTOOll1ICOCllllil HlrillfRESSURI!
C~alllilNa , EndState ltQc'lll!l(I\Alll'* S'ISIIJII QWllfi(I IN2lfl5 MNS ~' (Phase-CD) 11;-I.OOJ'IIC Rl'S EPS ISl!IH!f &#xa3;fW SRV ""' 11>1 OPR.olll SSC soc 1ft lRR'llll"""'
&#xa3;SR 0 0 0 0 0 0 o---1'1 OK I ~o O O O O O o---1.Z'l LOOP-I ) LOSU O O o---1 %; I OK I o----[o--ro--ej
: I : I Lo o---1 1 I CD I o---1 ' I OK I 0 o--ro--Co---1 a j CD j L \----o---[
' I CD I H'l-l SRV-L o---! 10 I OK I 0 0 ~~o---1111 CD I CSR-L 0 o---112 CD I --, 0 0 fffi ..... -L --o---113 CD I H'l-l 0---1 14 CD I --o O 01-----_ . 0 0 EfW-l 0 C 0 0 0 0 C --o O O o---f 15 soo ) 1-----0 0 0 o---1
* ATWS ) --o o---117 CD I o--Co 0 0 0 0 C 0 C Figure B-2. Waterford Plant-Centered LOOP Event Tree B-2 


==SUBJECT:==
LER 382-2017-002 Appendix A: Fault Tree Modifications EMERGENCY FEEDWATER SYSTEM EFW y
TRANSMITTAL OF FINAL WATERFORD STEAM ELECTRIC STATION, UNIT 3, ACCIDENT SEQUENCE PRECURSOR REPORT (LICENSEE EVENT REPORT 382-2017-002)
I                                                                  I FAILURE OF EFW                                              AUXILIARY FEEDWA~ SYSTEM EFW-1                                                              AFW                      !Ext
DATED MARCH 22, 2018 DISTRIBUTION:
                              ~~i FAILURE OF EFW SUCTION SOURCE      CCF OF EFW PUMPS TO RUN              EFW PUMP 'TRAIN FAIWRES EFW-SUCT                        EFW-PMP-CF-FR            I 1.69E-05  EFW-NOFLOW-F H                  CCF OF EFW PUMPS TO START (PSA BASIC EVENT)
PUBLIC PM File Copy RidsACRS_MailCTR Resource RidsNrrDorlLpl4 Resource RidsNrrLAPBlechman Resource RidsNrrPMWaterford Resource RidsRgn4MailCenter Resource Ian Gifford, RES ADAMS Accession Nos. Package ML18075A064; Letter ML18075A076; ASP R ML 18066 196 eport A OFFICE NRR/DORL/LPL4/PM NAME APulvirenti DATE 3/20/18 NRR/DORL/LPL4/LA NRR/DORL/LPL4/BC N RR/DORL/LPL4/PM PBlechman RPascarelli APulvirenti 3/19/18 3/22/18 3/22/18 OFFICIAL RECORD COPY}}
EFW-PMP-CF-FS            l5.33E-07        NO EFW FLOW TO STEAM GE~TQR2 Ext NO EFW FLOW TO STEAM GENERA'TOR 1 EFW-Fl.()W-5(;1            Ext Figure A-1: Waterford Modified EFW System Fault Tree A-1
 
LER 382-2017-002 NON--ESSl:NT!ALTRAIN B AC POWER ACP-NSTRNB LOSS OF DIV B OFFSITE                          FAILURE OF SWITCHGEAR              CCF OF STARTUP POWER WITH NO RECOVERY                            ROOM B/AB COOUNG            TRANSFORMERS 3A/3B TO PROVIDE POWER ACP-NSTRNB-LOOP                                SWTCHGR-HYACBAB X
IExt                            !
:P-TFM-CF-SUT3AB 1.86E-06 FAILURE OF FAST BUS TRANSFER FOR TRAIN B LOSS OF DIV B OFFSITE      iif*~*. OPERATOR FAILS TO                                      ACP-ABT-FC-TRB            1.13E-03 POWER FLAG            tir(ECOVER OFFSITE POWER IN                                          FAILURE OF STARTUP NSFORMER FROM SWITCHYARD 1 HOUR PLANT-CENTERED                                              TO 4.16KV BUS 3B2 HE-LOOP-B              False OEP-XHE-XL-NROlHPC 3.82E-01 ACP..TFM-FC-SUT3B j 6.07E-05 STARTUP TRANSFORMER FROM SWITCHYARD UNAVAIL DUETOT&M ACP-TFM-TM-SUT3B j 1.75E-03 Figure A-2: Waterford Modified Nonessential Train 'B' AC Power Fault Tree A-2
 
LER 382-2017-002 Appendix B: Key Event Trees EM1!RGENCY POWER    ~~A'l'ER  SAFETY R11UEF VALVl!S NOT  CON!'RQJJ;E>~F    WCTORcoow+T              llCP SEAi. lN'liGRITY OFFS,ITE POWER RECOVER.)'  #            End State S&#xa5;$l0t        CHAU.i!NGED              ~lfi!;I    SUIIC()OIJNG,NAlNTAINEO        MA!NTAlNIID                IN2HRS                        (Phase-CD)
EPS            **--rn EFW        SRI/                      Cl!O            RSW                      w,.-,                    0Pll.-ll2H
                                                                                                                    ~o---[ I                                                        I 1              OK
                                                                                          ~RCP301                                            0---1*1 . 1                  580-2
                                                                                          ~~O---[                                                          a*.** .1      580-l  )
                                                                                                                  ~1**1                                                      CD      I
                                                                                                                    ~o---11 I o--- , I 5              OK
                                                                                                                                                                                    >I c--[                  R ~
                                                                                                                      ~o---1 1 o&#xa3;:-I
                                                                                                                                                            .7 a      j 580-2 580-1 CD
                                                                                                                                                                                    . I SRV-B
                                                                                                                      ~o---1 I                              9              OK      I EFW-B
                                                                              ,__~=                                      03 o---1 1      10              580-2  >
                                                                                          ~~o---1
                                                                                                                  ~~0---,1 0---
OPR-01H 11 12 r.* ::=;======~-
580-1 CD I
I 13              OK c--[~o---1              RCP304 0---
o---1 14 15 16..
I 580-2 580-1 CD I
OPR-01H      -                          .
                                                                                            >-----o-----Co---1                                            11              580-1
                        ~                      SRV-B o2;;-I ..                        "'      I EFW-B            O                                                                      o-----Co---1 o---1 19 20      I 580-1 CD
                                                                                                                                                                                    >I OPR-01H      -          .                .
Figure B-1. Waterford Modified SBO Event Tree B-1
 
LER 382-2017-002 LOSS OJ'Ofln POWEi!        REAcroR PRQ1EC1lON    EME1tGOCf POWa        illlllli1NC'fl'fflJWA'IIIR- SAfffiRUl'Ylill'l!SJ<<w  RU~~    lllil!IIR!SIIJRfMffl)li Ol'PSlliPOWEl!Rl!l:OViRY  RCSCOOIOOWNUSING    SIIJTOOll1ICOCllllil    HlrillfRESSURI!          C~alllilNa  ,    EndState ltQc'lll!l(I\Alll'*          ~                                                S'ISIIJII              QWllfi(I            ~                                      IN2lfl5                MNS                                    ~'                                      (Phase-CD)
          ~
11;-I.OOJ'IIC              Rl'S                  EPS            ISl!IH!f &#xa3;fW                          SRV
                                                                                                                              ""'      11>1                    OPR.olll                SSC                soc                    1ft          lRR'llll"""' &#xa3;SR 0                0                      0                      0                  0                        0                    o---1'1          OK    I
                                                                                                                ~o                                O                      O                      O                  O                        O                    o---1.Z'l      LOOP-I  )
LOSU                                                                                  O                      O                    o---1 I%;        OK    I o----[o--ro--ej :I                                                                :       I Lo                              o---1 I 1 CD      I o---1 ' I        OK    I SRV-L H'l-l                                        0                  o--ro--Co---1                                        a j      CD      j L \----o---[ ' I                                  CD      I o---! I 10        OK    I 0                      0                                            ~o---1111            CSR-L CD    I
                                                                                                                                                                                                                        ~                      0                    o---112          CD    I H'l-l 0                  0                        fffi -L
                                                                                                                                                                                                                                                  .....  --o---113                    CD    I 0EfW-l                0                                  0                      C- - o                                    O                        01----- 0---1_ 14                      CD    I.
0                            0                      0                0                                        C- - o                                    O                        O                    o---f  15 soo  )
o--Co                                              0                      0                0                0                      C1-----0                                  0                        0                    o---1
* ATWS  )
0                                                                                                              C- - o                                                                                  o---117          CD    I Figure B-2. Waterford Plant-Centered LOOP Event Tree B-2
 
Package ML18075A064; Letter ML18075A076; ASP Report ML18066A196 OFFICE NRR/DORL/LPL4/PM NRR/DORL/LPL4/LA NRR/DORL/LPL4/BC NRR/DORL/LPL4/PM NAME    APulvirenti          PBlechman       RPascarelli     APulvirenti DATE      3/20/18            3/19/18         3/22/18         3/22/18}}

Latest revision as of 15:28, 7 March 2020

Transmittal of Final Waterford Steam Electric Station, Unit 3, Accident Sequence Precursor Report (Licensee Event Report 382-2017-002)
ML18075A076
Person / Time
Site: Waterford Entergy icon.png
Issue date: 03/22/2018
From: April Pulvirenti
Plant Licensing Branch IV
To:
Entergy Operations
Pulvirenti A, NRR/DORL/LPLIV, 415-1390
References
LER 382-2017-002
Download: ML18075A076 (5)
v • d • e


Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 March 22, 2018 Site Vice President Entergy Operations, Inc.

Waterford Steam Electric Station, Unit 3 17265 River Road Killona, LA 70057-3093

SUBJECT:

TRANSMITTAL OF FINAL WATERFORD STEAM ELECTRIC STATION, UNIT 3, ACCIDENT SEQUENCE PRECURSOR REPORT (LICENSEE EVENT REPORT 382-2017-002)

Dear Sir or Madam:

By letter dated September 18, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17261B215), Entergy Operations, Inc. (the licensee) submitted Licensee Event Report (LER) 382-2017-002, "Automatic Reactor Scram due to the Failure of Fast Bus Transfer Relays to Automatically Transfer Station Loads to Offsite Power on a Main Generator Trip," to the U.S. Nuclear Regulatory Commission (NRC) staff for Waterford Steam Electric Station, Unit 3 (Waterford 3), pursuant to Title 10 of the Code of Federal Regulations Section 50. 73. As part of the Accident Sequence Precursor (ASP) Program, the NRC staff reviewed the event to identify potential precursors and to determine the probability of the event leading to a core damage state. The results of the analysis are provided in the enclosure to this letter.

The NRC does not request a formal analysis review, in accordance with Regulatory Issue Summary 2006-24, "Revised Review and Transmittal Process for Accident Sequence Precursor Analyses," dated December 6, 2006 (ADAMS Accession No. ML060900007), because the analysis resulted in a conditional core damage probability (CCDP) of less than 1x10-4 .

Final ASP Analysis Summary. A brief summary of the final ASP analysis, including the results, is provided below.

Automatic Reactor Scram due to the Failure of Fast Bus Transfer Relays to Automatically Transfer Station Loads to Offsite Power on a Main Generator Trip. This event is documented in LER 382-2017-002 and in Inspection Report 05000382/2017011 (ADAMS Accession No. ML17354A690).

Executive Summary. On July 17, 2017, with the Waterford 3 reactor operating at 100 percent power, control room operators received indications of an electrical grid spike during a severe thunderstorm. The isophase bus duct to main transformer 'B' was glowing orange and arcing, causing control room operators to manually trip the main turbine to de-energize main transformer 'B.' Unexpectedly, the transfer of the electrical buses from the unit auxiliary transformer to the startup transformer did not occur, resulting in a loss of offsite power (LOOP) to the safety and nonsafety electrical buses. Both emergency diesel generators (EDGs) started

and loaded their respective safety buses. Emergency feedwater (EFW) automatically actuated to feed the steam generators and was manually controlled by the operators.

This event was modeled as a plant-centered LOOP initiating event. Given the modeling assumptions used in this analysis, the CCDP was calculated to be 2x 1o-5

  • The risk of this event is dominated by station blackout scenarios as the result of postulated failures of the EDGs and EFW, with the subsequent failure of operators to recover offsite power. In addition, the risk of the event is significantly affected by the lack of feed-and-bleed cooling capability at Waterford 3.

Sensitivity cases were performed to quantify the risk impacts from modeling uncertainties associated with key assumptions made in this ASP analysis (e.g., recovery of auxiliary feedwater, credit for FLEX generators). In all cases, the resulting CCDP remained above the ASP precursor threshold.

The licensee performed a past operability analysis and determined that the Struthers Dunn relays would not have fulfilled their safety function of transferring safety-related loads to the offsite transmission network from June 2, 2017, until the automatic trip on July 17, 2017. A licensee performance deficiency was identified for an inadequate design change that rendered the fast bus transfer system inoperable. A detailed risk analysis for this condition was performed to support the Significance Determination Process, resulting in a delta core damage frequency (~CDF) of 4.5x 10-7 per year, which is a Green finding (i.e., very low safety significance).

Summary of Analysis Results. This operational event resulted in a best estimate CCDP of 2x1Q*5

  • The detailed ASP analysis can be found in the enclosure.

If you have any questions, please contact me at 301-415-1390 or via e-mail at April. Pulvirenti@nrc.gov.

Sincerely, April L. Pulvirenti, Project Manager Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-382

Enclosure:

Final Accident Sequence Precursor Analysis cc: Listserv

ENCLOSURE FINAL ACCIDENT SEQUENCE PRECURSOR ANALYSIS WATERFORD STEAM ELECTRIC STATION, UNIT 3 AUTOMATIC REACTOR SCRAM DUE TO THE FAILURE OF FAST BUS TRANSFER RELAYS TO AUTOMATICALLY TRANSFER STATION LOADS TO OFFSITE POWER ON A MAIN GENERATOR TRIP (LER 382-2017-002) - PRECURSOR

Final ASP Pro sis - Precursor Waterford Steam Automatic Reactor Scram due to the Failure of Fast Bus Electric Station - Transfer Relays to Automatically Transfer Station Loads to Unit 3 Offsite Power on a Main Generator Trip LER: 382-2017-002 Event Date: 07/17/2017 CCDP= 2x10-5 IR: 05000382/2017011 Plant Type: Pressurized Water Reactor (PWR); Combustion Engineering Two-Loop with a Lar e, D Containment Plant Operating Mode (Reactor Power Level): Mode 1 (100% reactor power)

Approval Date:

Analyst: Reviewer: Contributors:

03/1/18 Ian Gifford Christopher Hunter N/A EXECUTIVE

SUMMARY

On July 17, 2017, with the Waterford 3 reactor operating at 100 percent power, control room operators received indications of an electrical grid spike during a severe thunderstorm. The isophase bus duct to main transformer 'B' was glowing orange and arcing, causing control room operators to manually trip the main turbine to de-energize main transformer 'B'. Unexpectedly, the transfer of the electrical buses from the unit auxiliary transformer (UAT) to the startup transformer (SUT) did not occur, resulting in a loss of offsite power (LOOP) to the safety and nonsafety electrical buses. Both emergency diesel generators (EDGs) started and loaded their respective safety buses. Emergency feedwater (EFW) automatically actuated to feed the steam generators and was manually controlled by the operators.

This event was modeled as a plant-centered LOOP initiating event. Given the modeling assumptions used in this analysis, the conditional core damage probability (CCDP) was calculated to be 2x10-5

  • The risk of this event is dominated by station blackout (SBO) scenarios as the result of postulated failures of the EDGs and EFW, with the subsequent failure of operators to recover offsite power. In addition, the risk of the event is significantly affected by the lack of feed-and-bleed cooling capability at Waterford. Sensitivity cases were performed to quantify the risk impacts from modeling uncertainties associated with key assumptions made in this ASP analysis (e.g., recovery of auxiliary feedwater, credit for FLEX generators). In all cases, the resulting CCDP remained above the ASP precursor threshold.

The licensee performed a past operability analysis and determined that the Struthers Dunn relays would not have fulfilled their safety function of transferring safety-related loads to the offsite transmission network from June 2nd until the automatic trip on July 171h. A licensee performance deficiency was identified for an inadequate design change that rendered the fast bus transfer system inoperable. A detailed risk analysis for this condition was performed to support the Significance Determination Process (SOP), resulting in a delta core damage frequency (.6.CDF) of 4.5x10-7 per year, which is a Green finding (i.e., very low safety significance).

EVENT DETAILS 1

LER 382-2017-002 Event Description. On July 17, 2017, at 3:55 p.m., with the Waterford 3 reactor operating at 100 percent power, control room operators received indications of an electrical grid spike during a severe thunderstorm. Operators were dispatched to investigate electrical components in the transformer yard where they reported that the isophase bus duct to main transformer 'B' was glowing orange and arcing. At 4:06 p.m., control room operators manually tripped the main turbine to de-energize main transformer 'B'. In response to the main turbine trip, the main generator automatically tripped and reactor power cutback was initiated. Unexpectedly, the transfer of the electrical buses from the UAT to the SUT did not occur, resulting in a LOOP to the safety and nonsafety electrical buses. All four reactor coolant pumps (RCPs) were de-energized and the reactor automatically tripped due to loss of forced circulation. Both EDGs started and loaded their respective safety buses. EFW automatically actuated to provide inventory makeup to the steam generators. Control room operators took manual control of EFW due to overcooling concerns. Offsite power was restored to the train 'A' and train 'B' safety buses at 6:44 p.m. and 8:01 p.m., respectively. On July 18th at 1:16 a.m., control room operators started the auxiliary feedwater (AFW) pump to feed the steam generators and secured EFW.

The licensee performed a past operability analysis and determined that the Struthers Dunn relays would not have fulfilled their safety function of transferring safety-related loads to the offsite transmission network from June 2nd until the automatic trip on July 17th.

Additional information regarding this event can be found in licensee event report (LER) 382-2017-002 (Ref. 1) and inspection report (IR) 05000382/2017011 (Ref. 2).

Cause. Overheating of the isophase bus duct was caused by the failure of a shunt assembly connection to the phase 'B' bus duct. The failure of the shunt assembly was likely due to a combination of the dynamic response to the grid spike and degraded connections between the shunt assemblies and the bus duct. Failure of the fast bus transfer was caused by an instantaneous time out of the Struthers Dunn 237 series direct current (DC) time delay dropout relays after being exposed to DC coil inductive kick. Additionally, post-modification testing to the Struthers Dunn relay did not exercise the fast bus transfer timing circuitry and, therefore, prevented early detection of the relay failure.

MODELING Basis for ASP Analysis/SOP Results. The ASP Program performs independent analyses for initiating events. ASP analyses of initiating events account for all failures/degraded conditions and unavailabilities (e.g., equipment out for test/maintenance) that occurred during the event, regardless of licensee performance. 1 A licensee performance deficiency was identified for an inadequate design change that rendered the fast bus transfer system inoperable. Modifications to the fast bus transfer circuitry in May 2017 did not properly account for the increased susceptibility to DC coil inductive kick of electronic devices, and resulted in the licensee's inability to maintain offsite power to the 6.9 kilo-volt (kV) and 4.16 kV electrical buses following a trip of the main generator. A detailed risk analysis was performed under the SOP that modeled the failure of the fast bus transfer for the 45-day exposure period. The analysis utilized a condition-specific 2-hour nonrecovery value for offsite power of 7.0x1Q-3 , given that offsite power was always available in the switchyard.

ASP analyses also account for any degraded condition(s) identified after the initiating event occurred, if the failure/degradation exposure period(s) overlaps the initiating event date.

2

LER 382-2017-002 The ~CDP over this exposure period was calculated to be 1.97x 1o-6 , with dominant core damage sequences involving a transient initiating event, failure of fast transfer, failure of the EDGs, and failure of the turbine-driven EFW pump upon battery depletion. The SOP analysis determined that credit should be given for the ability of the FLEX diesel generator to provide power to a vital battery that allows extended operation of the turbine-driven EFW pump. A failure probability of 0.1 was determined using the SPAR-H Human Reliability Analysis Method (Ref. 3 and 4) for the operator actions required to shed DC loads during a SBO; set up, start, and align the FLEX diesel generator; and establish vital battery charging form via the FLEX diesel generator. The final ~CDF was calculated to be 4.5x 10-7 per year, which is a Green finding (i.e., very low safety significance). Additional information regarding this SOP analysis can be found in IR 05000382/2017011.

Analysis Type. An initiating event analysis was performed using the Waterford 3 standardized plant analysis risk (SPAR) model, Revision 8.54, created on December 15, 2017.

SPAR Model Modifications. The following modifications were required for this initiating event analysis:

  • Typically, the AFW system is assumed to be unavailable during a LOOP because the nonsafety buses are de-energized. However, because offsite power remained available at the switchyard throughout the event, it was determined that operators had sufficient time to recover offsite power and align the AFW pump. 2 Therefore, the EFW (emergency feedwater system) fault tree was modified by inserting the AFW (auxiliary feedwater system) fault tree as a transfer under the existing top gate of the EFW (emergency feedwater system) fault tree. In addition, this top gate was changed to AND gate. A new OR gate EFW-1 (failure of EFW) was inserted under the EFW fault tree top gate with all EFW system logic being moved under gate EFW-1. The modified EFW fault tree is shown in Figure A-1.
  • To model power recovery to the AFW system, the ACP-NSTRNB (nonessential train B AC power) fault tree was modified to include a new AND gate ACP-NSTRNB-LOOP (loss of div. B offsite power with no recovery) inserted under the existing OR gate ACP-NSTRNB (nonessential train B AC power). House event HE-LOOP-B (loss of div.

B offsite power flag) and basic event OEP-XHE-XL-NR01 HPC (operator fails to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (plant-centered)) were added under AND gate ACP-NSTRNB-LOOP. The modified ACP-NSTRNB fault tree is shown in Figure A-2.

  • In ASP analyses, recovery credit for EOG failures is limited to cases where event information supports credit for EOG recovery. Therefore, the DGR-02H (diesel generator recovery in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) top event (including applicable event tree branching) was eliminated from the SBO event tree. The modified SBO event tree is shown in Figure B-1.

Key Modeling Assumptions. The following modeling assumptions were determined to be significant to the modeling of this event analysis:

2 The AFW pump is designed to deliver sufficient flow to the steam generators at maximum steam generator pressure, provided that power is available to the pump. Procedural guidance for restoring steam generator inventory with the AFW system is provided in OP-902-006, "Loss of Main Feedwater Recovery"; OP-902-008, "Functional Recovery Procedure"; and OP-902-009 Appendix 32, "Establishing Main Feedwater."

3

LER 382-2017-002

  • This analysis models the July 17, 2017, reactor trip at the Waterford Steam Electric Station as a plant-centered LOOP that resulted from failure of the fast transfer system, leaving the safety and nonsafety electrical buses without an offsite power source.

Therefore, the probability for IE-LOOPPC (loss of offsite power initiator (plant-centered))

was set to 1.0; all other initiating event probabilities were set to zero.

  • The time required to restore offsite power to plant equipment is a significant factor in modeling the risk of core damage given a LOOP. Given that offsite power remained available at the switchyard during this event, the analyst determined that condition-specific 1- and 2-hour nonrecovery probabilities for offsite power are warranted in this case. The SPAR-H Human Reliability Analysis Method was used to estimate nonrecovery probabilities, with key qualitative information for these recovery human failure events (HFEs) and the performance shaping factor (PSF) adjustments required for the quantification of these recovery events provided in Tables 1 and 2.

Table 1. Key Qualitative Information of HFEs f or Offsite power Recovery The definition for these recovery HFEs is the operators failing to restore Definition offsite power to the electrical safety buses within 1 and 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> (depending on the sequence) given a LOOP and postulated SBO.

Depending on postulated failures of the RCP seals (due to unavailability of Description and seal injection/cooling), operators would have between 1 to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to restore Event Context power to the safety electrical buses.

Operator Action For successful recovery, operators would have to locally reset lockout relays Success Criteria prior to core uncovery.

  • Transformer alarms
  • Breaker alarms
  • EDGs automatically starting
  • RCP trouble alarms
  • Condenser vacuum alarms Nominal Cues
  • Loss of control room lighting
  • Extensive loss of various indications
  • Equipment "loss of power" alarms
  • Tripped breaker indications on the 6.9 kV and 4.16 kV buses
  • Extensive loss of component power available indications
  • OP-902-003, "Loss of Offsite Power/Loss of Forced Circulation Procedural Recovery Procedure" Guidance
  • OP-902-005, "Station Blackout Recovery Procedure"
  • OP-902-009 Appendix 12, "Electrical Restoration" Diagnosis/Action These recovery HFEs contain diagnosis and action components.

T a bl e 2 SPAR H Eva Iuaf 10n of PSFs f or Offs1e "t Power Recovery Multiplier PSF Notes Diagnosis/Action Time Available 1 or 0.01 / 1 The operators would need less than five minutes to perform the action component (i.e., reset the lockout relays). Therefore, the minimum time for diagnosis is approximately 55 minutes. It would take operators approximately 30 minutes to get through the procedures and verify offsite power is fully available. Given these assumptions, the available time for the diagnosis 4

LER 382-2017-002 Multiplier PSF Notes Diagnosis/Action component for 1-hour recovery is assigned as Nominal Time (i.e., x1 ).

Available time for the diagnosis component for 2-hour recovery is assigned as Expansive Time (i.e., xQ.01; time available is >2 times nominal and >30 minutes).

Since sufficient time was available for the action component of the recovery, the available time for the action component for all recovery times is evaluated as Nominal (i.e., x1 ). See Reference 4 for guidance on apportioning time between the diagnosis and action components of an HFE.

Stress 2I 1 The PSF for diagnosis stress is assigned a value of High Stress (i.e., x2) due to the postulated SBO.

The PSF for action stress was not determined to be a performance driver for these HFEs; and therefore, was assigned a value of Nominal (i.e., x1 ).

Complexity 2I 1 The PSF for diagnosis complexity is assigned a value of Moderately Complex (i.e., x2) because operators would have to deal with multiple equipment unavailabilities and the concurrent actions/multiple procedures during a postulated SBO.

The PSF for action complexity was not determined to be a performance driver for these HFEs; and therefore, was assigned a value of Nominal (i.e., x1 ).

Procedures, 1/ 1 No event information is available to warrant a change in Experience/Training, these PSFs (for diagnosis and action) from Nominal for Ergonomic/HS I, these HFEs.

Fitness-for-Duty, Work Process An HEP evaluated using SPAR-His calculated using the following formula:

Calculated HEP= (Product of Diagnosis PSFsx0.01) + (Product of Action PSFsx0.001)

Therefore, the failure probability for OEP-XHE-NR01 HPC (operator fails to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (plant-centered)) was set to 4x 10-2 and the failure probability for OEP-XHE-NR02HPC (operator fails to recover offsite power in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> {plant-centered))

was set to 1x 1o-3 .

ANALYSIS RESULTS CCDP. The point estimate CCDP for this event is 1.8x1Q-5 . The ASP Program acceptance threshold is a CCDP of 1x10-5 or the CCDP equivalent of an uncomplicated reactor trip with a non-recoverable loss of feedwater or the condenser heat sink, whichever is greater. This CCDP equivalent for Waterford is 2.4x 1o-6 . Therefore, this event is a precursor.

5

LER 382-2017-002 Dominant Sequence. The dominant accident sequence is LOOPPC sequence 15-20 (CCDP =

7.67x1Q-6), which contributes approximately 43 percent of the total internal events CCDP. This sequence is shown graphically in Figures B-1 and B-2 in Appendix B. The dominant sequences that contribute at least 1.0 percent to the total internal events CCDP are provided in the following table:

Sequence CCDP Percentage Description Plant-centered LOOP initiating event; successful reactor trip; failure of emergency power results in LOOPPC 15-20 7.67x1Q-6 42.8% SBO; failure of EFW; and operators fail to recover offsite power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, which results in core damage Plant-centered LOOP initiating event; successful LOOPPC 14 5.80x10-6 32.3% reactor trip; success of emergency power; and failure of EFW, which results in core damage Plant-centered LOOP initiating event; successful reactor trip; failure of emergency power results in LOOPPC 15-14-10 4.08x10-6 22.8% SBO; success of EFW; RCP seal integrity is maintained; and operators fail to recover offsite power within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, which results in core damage Key Modeling Uncertainties. The following were identified as key modeling uncertainties associated with this analysis:

  • Credit for recovery of the AFW system given a LOOP has occurred and (postulated) failure of the EFW system;
  • Credit for continued turbine-driven EFW flow after aligning a FLEX diesel generator to maintain safety-related DC power during a (postulated) SBO; and
  • Credit for EOG repair and recovery during a (postulated) SBO.

Sensitivity analyses were performed to show the effects of these modeling assumptions. The following table provides a brief description of each sensitivity case, including the results and observations:

Description CCDP Notes/Observations The estimated time to core damage following a LOOP and failure of EFW is 1. 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> for Combustion Engineering plants. The best Similar dominant sequences and cut sets estimate analysis for this event assumed that to the best estimate analysis. The CCDP sufficient time was available to restore offsite of LOOPPC sequence 14 is increased by a power and align the AFW system to feed the 7.8x1Q-5 factor of 11. The total CCDP is increased steam generators. However, any delay in by a factor of four, but still remains below recovery actions could result in core damage the significant precursor threshold of during a LOOP and (postulated) failure of the 1 x1Q-3 .

EFW system. A sensitivity analysis was performed to show the effects of eliminating this credit.

6

LER 382-2017-002 Description CCDP Notes/Observations Credit for continued operation of the turbine-driven EFW pump after battery depletion was not credited in this analysis because of the significant potential for Similar dominant sequences and cut sets over- or under-filling. However, the lack of to the best estimate analysis. Extended credit for this strategy is likely conservative. operation of the EFW pump beyond the To show potential benefit of this action, a 2-hour battery depletion mitigates the risk sensitivity analysis was performed that 1.4x1Q-5 when offsite power is not recovered. The credited operation of the FLEX diesel CCDP of LOOPPC sequence 15-14-10 is generator to provide charging to the reduced by a factor of ten. The total safety-related batteries to allow for extended CCDP is reduced by approximately 20 operation of the turbine-driven EFW pump to percent, but still remains above the a safe/stable end state during a SBO. A precursor threshold.

screening failure probability of 0.1 was applied to operation of the FLEX diesel generator.

Repair of failed equipment is not typically credited in PRAs. It is questionable that LOOP sequence 14 remains unchanged, mean time to repair data for EDGs is as the results are still dominated by failure applicable to postulated SBO scenarios. To 1.6x1Q-5 of the EFW pumps. The total CCDP is show the effects of this credit, a sensitivity reduced by approximately 6 percent, but analysis was performed crediting EDG repair still remains above the precursor threshold.

for 1-hour (0.88) and 2-hour (0.82)

(postulated) SBO scenarios.

REFERENCES

1. Waterford Steam Electric Station, "LER 382/17-002 -Automatic Reactor Scram due to the Failure of Fast Bus Transfer Relays to Automatically Transfer Station Loads to Off-Site Power on a Main Generator Trip," dated September 18, 2017 (ADAMS Accession No. ML17261B215).
2. U.S. Nuclear Regulatory Commission, "Waterford Steam Electric Station, Unit 3 - NRC Special Inspection Report 05000382/2017011," dated December 20, 2017 (ADAMS Accession No. ML17354A690).
3. Idaho National Laboratory, NUREG/CR-6883, "The SPAR-H Human Reliability Analysis Method," August 2005 (ADAMS Accession No. ML051950061).
4. Idaho National Laboratory, "INUEXT-10-18533, SPAR-H Step-by-Step Guidance," May 2011 (ADAMS Accession No. ML112060305).

7

LER 382-2017-002 Appendix A: Fault Tree Modifications EMERGENCY FEEDWATER SYSTEM EFW y

I I FAILURE OF EFW AUXILIARY FEEDWA~ SYSTEM EFW-1 AFW !Ext

~~i FAILURE OF EFW SUCTION SOURCE CCF OF EFW PUMPS TO RUN EFW PUMP 'TRAIN FAIWRES EFW-SUCT EFW-PMP-CF-FR I 1.69E-05 EFW-NOFLOW-F H CCF OF EFW PUMPS TO START (PSA BASIC EVENT)

EFW-PMP-CF-FS l5.33E-07 NO EFW FLOW TO STEAM GE~TQR2 Ext NO EFW FLOW TO STEAM GENERA'TOR 1 EFW-Fl.()W-5(;1 Ext Figure A-1: Waterford Modified EFW System Fault Tree A-1

LER 382-2017-002 NON--ESSl:NT!ALTRAIN B AC POWER ACP-NSTRNB LOSS OF DIV B OFFSITE FAILURE OF SWITCHGEAR CCF OF STARTUP POWER WITH NO RECOVERY ROOM B/AB COOUNG TRANSFORMERS 3A/3B TO PROVIDE POWER ACP-NSTRNB-LOOP SWTCHGR-HYACBAB X

IExt  !

P-TFM-CF-SUT3AB 1.86E-06 FAILURE OF FAST BUS TRANSFER FOR TRAIN B LOSS OF DIV B OFFSITE iif*~*. OPERATOR FAILS TO ACP-ABT-FC-TRB 1.13E-03 POWER FLAG tir(ECOVER OFFSITE POWER IN FAILURE OF STARTUP NSFORMER FROM SWITCHYARD 1 HOUR PLANT-CENTERED TO 4.16KV BUS 3B2 HE-LOOP-B False OEP-XHE-XL-NROlHPC 3.82E-01 ACP..TFM-FC-SUT3B j 6.07E-05 STARTUP TRANSFORMER FROM SWITCHYARD UNAVAIL DUETOT&M ACP-TFM-TM-SUT3B j 1.75E-03 Figure A-2: Waterford Modified Nonessential Train 'B' AC Power Fault Tree A-2

LER 382-2017-002 Appendix B: Key Event Trees EM1!RGENCY POWER ~~A'l'ER SAFETY R11UEF VALVl!S NOT CON!'RQJJ;E>~F WCTORcoow+T llCP SEAi. lN'liGRITY OFFS,ITE POWER RECOVER.)' # End State S¥$l0t CHAU.i!NGED ~lfi!;I SUIIC()OIJNG,NAlNTAINEO MA!NTAlNIID IN2HRS (Phase-CD)

EPS **--rn EFW SRI/ Cl!O RSW w,.-, 0Pll.-ll2H

~o---[ I I 1 OK

~RCP301 0---1*1 . 1 580-2

~~O---[ a*.** .1 580-l )

~1**1 CD I

~o---11 I o--- , I 5 OK

>I c--[ R ~

~o---1 1 o£:-I

.7 a j 580-2 580-1 CD

. I SRV-B

~o---1 I 9 OK I EFW-B

,__~= 03 o---1 1 10 580-2 >

~~o---1

~~0---,1 0---

OPR-01H 11 12 r.* ::=;======~-

580-1 CD I

I 13 OK c--[~o---1 RCP304 0---

o---1 14 15 16..

I 580-2 580-1 CD I

OPR-01H - .

>-----o-----Co---1 11 580-1

~ SRV-B o2;;-I .. "' I EFW-B O o-----Co---1 o---1 19 20 I 580-1 CD

>I OPR-01H - . .

Figure B-1. Waterford Modified SBO Event Tree B-1

LER 382-2017-002 LOSS OJ'Ofln POWEi! REAcroR PRQ1EC1lON EME1tGOCf POWa illlllli1NC'fl'fflJWA'IIIR- SAfffiRUl'Ylill'l!SJ<<w RU~~ lllil!IIR!SIIJRfMffl)li Ol'PSlliPOWEl!Rl!l:OViRY RCSCOOIOOWNUSING SIIJTOOll1ICOCllllil HlrillfRESSURI! C~alllilNa , EndState ltQc'lll!l(I\Alll'* ~ S'ISIIJII QWllfi(I ~ IN2lfl5 MNS ~' (Phase-CD)

~

11;-I.OOJ'IIC Rl'S EPS ISl!IH!f £fW SRV

""' 11>1 OPR.olll SSC soc 1ft lRR'llll"""' £SR 0 0 0 0 0 0 o---1'1 OK I

~o O O O O O o---1.Z'l LOOP-I )

LOSU O O o---1 I%; OK I o----[o--ro--ej :I  : I Lo o---1 I 1 CD I o---1 ' I OK I SRV-L H'l-l 0 o--ro--Co---1 a j CD j L \----o---[ ' I CD I o---! I 10 OK I 0 0 ~o---1111 CSR-L CD I

~ 0 o---112 CD I H'l-l 0 0 fffi -L

..... --o---113 CD I 0EfW-l 0 0 C- - o O 01----- 0---1_ 14 CD I.

0 0 0 0 C- - o O O o---f 15 soo )

o--Co 0 0 0 0 C1-----0 0 0 o---1

0 C- - o o---117 CD I Figure B-2. Waterford Plant-Centered LOOP Event Tree B-2

Package ML18075A064; Letter ML18075A076; ASP Report ML18066A196 OFFICE NRR/DORL/LPL4/PM NRR/DORL/LPL4/LA NRR/DORL/LPL4/BC NRR/DORL/LPL4/PM NAME APulvirenti PBlechman RPascarelli APulvirenti DATE 3/20/18 3/19/18 3/22/18 3/22/18

Retrieved from "https://kanterella.com/w/index.php?title=ML18075A076&oldid=2533860"