ML19288A331

Final Accident Sequence Precursor Analysis - Browns Ferry Nuclear Plant, Unit 3 Automatic Reactor Scram Due to Turbine Load Reject- Precursor - (LER-296-2019-001-01)

ML19288A331
Person / Time
Site:	Browns Ferry
Issue date:	10/23/2019
From:	Felix Gonzalez NRC/RES/DRA/PRB
To:
C. Hunter
References
LER-296-2019-001-01
Download: ML19288A331 (7)

Text

Final ASP Program Analysis - Precursor Accident Sequence Precursor Program - Office of Nuclear Regulatory Research Browns Ferry Automatic Reactor Scram Due to Turbine Load Reject Nuclear Plant, Unit 3 LER: 296-2019-001-01 Event Date: 3/9/2019 CCDP = 3x10-6 IR: TBD General Electric Type 4 Boiling-Water Reactor (BWR) with a Mark I Plant Type:

Containment Plant Operating Mode Mode 1 (100% Reactor Power)

(Reactor Power Level):

Analyst: Reviewer: Contributors: Approval Date:

Christopher Hunter Felix Gonzalez N/A 7/25/2019 EXECUTIVE

SUMMARY

On March 9, 2019, the Unit 3 reactor automatically scrammed due to a turbine load reject. The automatic scram was caused when a licensed reactor operator lowered incoming reactive power at the request the grid authority. The operator incorrectly manipulated a hand switch by changing the automatic voltage regulator from automatic to manual. In this mode of operation, the dynamic limiter is removed, which allows operators to adjust mega-volt amps reactive beyond the under-excitation limiter protection setting. As a result, the main generator circuit breaker tripped causing a turbine load reject and subsequent automatic scram. In addition, the 500-kilovolt (kV) offsite power source was lost.

All safety systems actuated as designed. Specifically, all four Unit 3 emergency diesel generators (EDGs) started and loaded onto their respective 4-kV shutdown boards (per design).

In addition, high-pressure coolant injection (HPCI) and reactor core isolation cooling (RCIC) initiated on low reactor water level and successfully provided inventory makeup to the reactor.

The licensee declared a notice of unusual event (NOUE) due to loss of the 500-kV offsite power source.

This accident sequence precursor (ASP) analysis reveals that the most likely core damage scenario is a loss of offsite power (LOOP) initiating event and the successful operation of the EDGs providing safety-related alternating current (AC) power with subsequent (postulated) stuck-open safety relief valves (SRVs) resulting in a loss-of-coolant accident (LOCA) and the (postulated) failure of low pressure injection resulting in core damage. This accident sequence accounts for approximately 37 percent of the total conditional core damage probability (CCDP) for this event.

Although the CCDP of this event exceeds the ASP threshold, the risk was mitigated by the plant having four EDGs and the availability of an electric-driven high-pressure makeup-up pump the licensee installed as part their effort to meet the requirements of National Fire Protection Association (NFPA) 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants.

1

LER 296-2019-001-01 EVENT DETAILS Event Description. On March 9, 2019, the Unit 3 automatically scrammed due to a turbine load reject. The automatic scram was caused when a licensed reactor operator lowered incoming reactive power at the request of grid operators. The operator incorrectly manipulated a hand switch by changing the automatic voltage regulator from automatic to manual. In this mode of operation, the dynamic limiter is removed, which allows operators to adjust mega volt amps reactive beyond the under-excitation limiter protection setting. As a result, the main generator circuit breaker tripped causing a turbine load reject and subsequent automatic scram.

All safety systems actuated as designed. Specifically, all four Unit 3 EDGs started and loaded onto their respective 4-kV shutdown boards (per design). In addition, HPCI and RCIC initiated on low reactor water level and successfully provided inventory makeup to the reactor. The licensee declared an NOUE due to loss of the 500-kV offsite power source. Additional information is provided in licensee event report (LER) 296-2019-001-01 (Ref. 1).

Cause. This event was directly caused by a reactor operator incorrectly manipulating a hand switch by changing the voltage regulator from automatic to manual. The licensee determined that root cause of this event was the operations department allowing continued negative human performance behaviors by inconsistently providing reinforcement on the use of appropriate human performance barriers.

MODELING SDP Results/Basis for ASP Analysis. The ASP Program performs independent analyses for initiating events. ASP analyses of initiating events account for all failures/degraded conditions and unavailabilities (e.g., equipment out for test/maintenance) that occurred during the event, regardless of licensee performance. 1 Additional LERs were reviewed to determine if concurrent unavailabilities existed during the March 9th event. No windowed events or concurrent degraded operating conditions were identified. Discussions with Region 2 staff indicate that a preliminary licensee performance deficiency associated with this event has been identified; however, the evaluation has not completed and the LER remains open.

Analysis Type. An initiating event analysis was performed using the Revision 8.62 standardized plant analysis risk (SPAR) model for Browns Ferry Nuclear Plant (Unit 3) created in June 2019. This event was modeled as a switchyard-centered LOOP initiating event.

Key Modeling Assumptions. The following modeling assumptions were determined to be significant to the modeling of this initiating event assessment:

• The probability of IE-LOOPSC (loss of offsite power (switchyard-centered)) was set to 1.0 due to the loss of offsite power caused by the turbine load reject. All other initiating event probabilities were set to zero.

• The probability of basic event FLX-XHE-XM-ELAP was set to a screening value of 0.1 to activate the credit for FLEX mitigation strategies for postulated station blackout (SBO) 1 ASP analyses also account for any degraded condition(s) identified after the initiating event occurred, if the failure/degradation exposure period(s) overlapped the initiating event date.

2

LER 296-2019-001-01 scenarios for which an extended loss of AC power (ELAP) is declared. 2 Sensitivity analyses show that any further refinement of these human error probabilities (HEPs) has a negligible impact on the results of this analysis.

• Offsite Power Recovery. Offsite power was restored from 500-kV offsite power source to the 4-kV shutdown boards approximately 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> after the LOOP initiated. However, the alternate 161-kV offsite power source remained available throughout the event.

Although this alternate offsite power source was supplying Unit 2 during an outage, it is estimated that operators could have aligned this source to at least one of the Unit 3 4-kV shutdown boards within an hour.

- Basic event OEP-XHE-XL-NR30MSC (operators fail to recover offsite power in 30 minutes) was set to TRUE given the uncertainties associated with operators being able to align the 161-kV offsite power source to a Unit 3 4-kV shutdown board within 30 minutes. Although this assumption is potential conservative, sensitivity analyses show this assumption has a negligible effect on the analysis results.

- Basic events OEP-XHE-XL-NR01HSC (operators fail to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />), OEP-XHE-XL-NR02HSC (operators fail to recover offsite power in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />),

OEP-XHE-XL-NR04HSC (operators fail to recover offsite power in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />),

OEP-XHE-XL-NR10HSC (operators fail to recover offsite power in 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />), and OEP-XHE-XL-NR12HSC (operators fail to recover offsite power in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />) were evaluated using the SPAR-H Human Reliability Analysis Method (Ref. 2 and Ref 3).

The HEPs were calculated to be 4x10-2 for OEP-XHE-XL-NR01HSC and 10-3 for OEP-XHE-XL-NR02HSC, OEP-XHE-XL-NR04HSC, OEP-XHE-XL-NR10HSC, and OEP-XHE-XL-NR12HSC. See Appendix B for additional information on this evaluation.

ANALYSIS RESULTS CCDP. The conditional CCDP for this analysis is calculated to be 3.2x10-6. The ASP Program acceptance threshold is a CCDP of 1x10-6 or the CCDP equivalent of an uncomplicated reactor trip with a non-recoverable loss of feed water or the condenser heat sink), whichever is greater.

This CCDP equivalent for Browns Ferry Nuclear Plant (Unit 3) is 2.7x10-6. 3 Therefore, this event is a precursor.

Dominant Sequence. The dominant accident sequence is switchyard-centered LOOP sequence 27-7 (CCDP = 1.17x10-6), which contributes approximately 37 percent of the total internal events CCDP. The dominant sequences that contribute at least 1.0 percent to the total internal events CCDP are provided in the following table. The dominant sequence is shown graphically in Figure A-1 of Appendix A.

Sequence CCDP Percentage Description

-6 LOOPSC 27-7 1.17x10 37.1% LOOP initiating event occurs; successful reactor trip; EDGs successfully provide power to 4-kV shutdown boards; stuck-open SRVs result in a LOCA; and low-pressure injection fails resulting in core damage 2 NUREG-1792, Good Practices for Implementing Human Reliability Analysis, provides that 0.1 is an appropriate screening (i.e., typically conservative) value for most post-initiator human failure events (HFEs).

3 For BWRs, a loss of condenser heat sink initiating event typically assumes that the condensate system is available to provide a source of low-pressure injection to the reactor.

3

LER 296-2019-001-01 Sequence CCDP Percentage Description

-7 LOOPSC 6 7.16x10 22.7% LOOP initiating event occurs; successful reactor trip; EDGs successfully provide power to at least one 4-kV shutdown board; at least one high-pressure injection sources is successful; suppression pool cooling fails; reactor depressurization succeeds; low-pressure injection is successful; shutdown cooling fails; and containment venting fails resulting in core damage LOOPSC 4 5.02x10-7 15.9% LOOP initiating event occurs; successful reactor trip; EDGs successfully provide power to at least one 4-kV shutdown board; at least one high-pressure injection sources is successful; suppression pool cooling fails; and reactor depressurization succeeds; low-pressure injection is successful; shutdown cooling fails; containment venting is successful; and late injection fails resulting in core damage LOOPSC 25 3.15x10-7 10.0% LOOP initiating event occurs; successful reactor trip; EDGs successfully provide power to at least one 4-kV shutdown board; all high-pressure injection sources fail; and reactor depressurization fails resulting in core damage LOOPSC 13 2.63x10-7 8.3% LOOP initiating event occurs; successful reactor trip; EDGs successfully provide power to at least one 4-kV shutdown board; at least one high-pressure injection sources is successful; suppression pool cooling fails; and reactor depressurization fails resulting in core damage LOOPSC 28-07-10 7.26x10-8 2.3% LOOP initiating event occurs; successful reactor trip; EDGs fail resulting in SBO; electric-driven makeup pump fails, but RCIC is successful; operators successfully recover offsite power to at least one 4-kV shutdown board; suppression pool cooling fails; reactor depressurization succeeds; and all sources of low-pressure injection fail resulting in core damage REFERENCES

1. Browns Ferry Nuclear Plant (Unit 3), "LER 296-2019-001 Automatic Reactor Scram Due to Turbine Load Reject, dated July 8, 2019 (ADAMS Accession No. ML19189A125).

2. Idaho National Laboratory, NUREG/CR-6883, The SPAR-H Human Reliability Analysis Method, August 2005 (ADAMS Accession No. ML051950061).

3. Idaho National Laboratory, INL/EXT-10-18533, SPAR-H Step-by-Step Guidance, May 2011 (ADAMS Accession No. ML112060305).

4

LER 296-2019-001-01 Appendix A: Key Event Tree LOSS OF OFFSITE POWER REACTOR SHUTDOWN EMERGENCY POWER SRV'S CLOSE HIGH PRESSURE INJECTION SUPPRESSION POOL MANUAL REACTOR LOW PRESSURE INJECTION ALTERNATE LOW PRESS LOSS OF RESIDUAL HEAT CONTAINMENT VENTING LATE INJECTION # End State INITIATOR (SWITCHYARD- (RCIC OR HPCI OR EHPM) COOLING DEPRESS (CS OR LPCI) INJECTION REMOVAL SYSTEM (Phase - CD)

CENTERED) FS = FTF-SBO IE-LOOPSC RPS EPS SRV HPI3 SPC DEP LPI VA RHR CVS LI 1 OK 2 OK 3 OK 4 CD LI01 5 OK 6 CD 7 OK 8 OK 9 CD LI02 10 OK RH1 11 CD 12 CD 13 CD 14 OK 15 OK 16 CD LI01 17 OK 18 CD 19 OK 20 OK 21 CD LI02 22 OK RH1 23 CD 24 CD 25 CD 26 LOOP-1 P1 27 LOOP-2 P2 28 SBO 29 ATWS 30 CD Figure A-1. Browns Ferry Unit 3 Switchyard-Centered LOOP Event Tree A-1

LER 296-2019-001-01 Appendix B: Evaluation of Key HFEs Evaluation of OEP-XHE-XL-NR01HSC, OEP-XHE-XL-NR02HSC, OEP-XHE-XL-NR04HSC, OEP-XHE-XL-NR10HSC, and OEP-XHE-XL-NR12HSC Operators failing to restore the 161-kV offsite power source to at least one Unit 3 Definition 4-kV shutdown board within 1-12 hours (depending on the applicable accident sequence) given a LOOP and/or postulated SBO.

Depending on availabilities of key safety-related equipment (e.g., RCIC, HPCS),

whether the EDGs successfully supply emergency AC power, and the time until Description and the safety-related batteries are depleted, operators would have between 1-12 Event Context hours (depending on the applicable accident sequence) to restore AC power prior to core damage.

Operators would have to align the 161-kV offsite power source to at least one Operator Action Unit 3 4-kV shutdown board prior to core damage. The time available for Success Criteria operators to perform this action would be a minimum of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for these evaluated HFEs.

• Momentary loss of all AC power (for all scenarios)

• EDGs successfully start and load onto respective 4-kV shutdown boards Key Cue(s)

(LOOP with no SBO scenarios)

• EDG failure annunciators (SBO scenarios only)

Procedural AOI-57-1B, Loss of 500 kV Guidance Diagnosis/Action This HFE only contains both diagnosis and action activities.

Multiplier PSF Notes Diagnosis/Action The operators would need approximately 15 minutes to perform the action component of restoring 161-kV offsite power to a 4-kV shutdown board. Therefore, the minimum time for diagnosis is approximately 45 minutes for the most limiting HFE. There is uncertainty associated with how much time it will take operators to get through procedures and determine the limitations of the 161-kV offsite power source given it was supplying Unit 2 during its outage.

Therefore, available time for the diagnosis component for the 1-hour recovery is assigned as Nominal Time (i.e., x1).

Time Available 1 or 0.01 / 1 Available time for the diagnosis component for recoveries with at least 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> is assigned as Expansive Time (i.e.,

x0.01; time available is >2 times nominal and >30 minutes).

Sufficient time exists to perform the action component of the offsite power recovery; therefore, the action PSF for available time is set to Nominal (i.e., x1). See Ref 3 for guidance on apportioning time between the diagnosis and action components of an HFE.

The PSF for diagnosis and action stress was set to High (i.e., x2) because the most severe scenario involves a Stress 2/2 postulated SBO where recovery of offsite power is required to prevent core damage.

B-1

LER 296-2019-001-01 Multiplier PSF Notes Diagnosis/Action The PSF for diagnosis complexity was assigned a value of Moderately Complex (i.e., x2) because operators would have to contend with multiple equipment unavailabilities Complexity 2/1 and concurrent actions/multiple procedures during all postulated scenarios. The PSF for action complexity was not determined to be a performance driver for these HFEs and, therefore, was set to Nominal (i.e., x1).

Procedures, Experience/Training, No event information is available to warrant a change in Ergonomics/HMI, 1/1 these PSFs (diagnosis or action) from Nominal (i.e., x1).

Fitness for Duty, Work Processes The HEP is calculated using the following SPAR-H formula:

HEP = (Product of Diagnosis PSFs x Nominal Diagnosis HEP) + (Product of Action PSFs x Nominal Action HEP)

Therefore, the HEP for OEP-XHE-XL-NR01HSC was calculated as 4x10-2. The HEPs for OEP-XHE-XL-NR02HSC, OEP-XHE-XL-NR04HSC, OEP-XHE-XL-NR10HSC, and OEP-XHE-XL-NR12HSC were calculated as 10-3.

B-2