Text

Transmittal of Final Clinton Power Station Accident Sequence Precursor Report (Licensee Event Report 461 2017 010)
	ML19092A159
Person / Time
Site:	Clinton
Issue date:	04/03/2019
From:	Joel Wiebe; Plant Licensing Branch III
To:	Stoner T; Exelon Generation Co
	Wiebe J 415-6606
References
	Download: ML19092A159 (4)
	v • d • e

Mr. Theodore R. Stoner UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON , D.C. 20555-0001 April 3, 2019 Site Vice President , Clinton Power Station Exelon Generation Company, LLC 8401 Power Rd. Clinton, IL 61727

SUBJECT:

TRANSMITTAL OF FINAL CLINTON POWER STATION ACCIDENT SEQUENCE PRECURSOR REPORT (LICENSEE EVENT REPORT 461-2017-010)

Dear Mr. Stoner:

By letter dated February 5, 2018 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML18040A463), Clinton Power Station submitted licensee event report (LER) 461-2017-010, "Division 1 Transformer Failure Leads to Instrument Air Isolation to Containment Requiring a Manual Reactor Scram," to the U.S. Nuclear Regulatory Commission (NRC) staff pursuant to Title 10 of the Code of Federal Regulations Section 50. 73. By letters dated August 3, 2018 (ADAMS Accession No. ML18219A731), and January 17, 2019 (ADAMS Accession No. ML19022A264), Clinton Power Station submitted revision 1 and revision 2 to the LER, respectively.

As part of the Accident Sequence Precursor (ASP) Program, the NRC staff reviewed the event to identify potential precursors and to determine the probability of the event leading to a core damage state. The results of the analysis are provided in the enclosure to this letter. The NRC does not request a formal analysis review in accordance with Regulatory Issue Summary 2006-24 , "Revised Review and Transmittal Process for Accident Sequence Precursor Analyses" (ADAMS Accession No. ML060900007), because the analysis resulted in a conditional core damage probability (CCDP) of less than 1 x1Q-4. Final ASP Analysis Summary. A brief summary of the final ASP analysis, including the results, is provided below. Division 1 Transformer Failure Leads to Instrument Air Isolation to Containment Requiring a Manual Reactor Scram. This event is documented in LER 461-2017-010-02.

Executive Summary. On December 9, 2017 , multiple alarms were received in the Clinton Power Station control room due to the unexpected opening of the 4.16 kilovolt (kV) alternating current (AC) bus '1 A1' breaker (1AP07EJ), which feeds the division 1 480-volt (V) AC buses. The loss of division 1 480 V AC power caused the outboard instrument air containment isolation valve to close and resulted in a subsequent loss of containment instrument air. In addition, the loss of the division 1 480 V AC buses resulted in the unavailability of the low-pressure core spray pump, residual heat removal pump 'A', the division 1 emergency diesel generator (EOG) 'A', and normal battery charging to the division 1 batteries.

Approximately 4 minutes after the breaker 1AP07EJ opened, the control room operators inserted a manual scram in accordance with procedures for low scram pilot air header pressure and control rod drift annunciator alarms.

T. Stoner Operators performed a reactor cooldown of the reactor by directing steam to the main

condenser using the main steam bypass valves and auxiliary steam equipment.

Due to the loss of containment instrument air, the main steam isolation valves (MSIVs) began to close. In response to the expected closure of the MSIVs, operators aligned the main steam line drains to maintain pressure control. These drains were used in conjunction with the reactor core isolation cooling turbine to continue to cooldown to Mode 4. According to the risk analysis modeling assumptions used in this ASP analysis, the most likely core damage sequence is reactor transient with a consequential loss of offsite power and postulated failures of the division 2 EOG 'B' result in a subsequent station blackout.

Although high-pressure core spray is initially successful, operators fail to recover offsite power within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months resulting in the inability to vent containment, which results in the loss of all injection.

This accident sequence accounts for approximately 17 percent of the CCDP for the event. Two Green (i.e., very low safety significance) findings were identified for this event. The first finding was associated with the licensee failure to perform corrective action to preclude repetition for a similar transformer failure that occurred in December 2013. The second finding was associated with the licensee failed to follow procedure that would classify three nonsafety-related 4.16 kV and 480 V transformers as operationally critical components.

Summary of Analysis Results. This operational event resulted in a best estimate CCDP of 8x1Q-6. The detailed ASP analysis can be found in the enclosure.

If you have any questions, please contact me at 301-415-6606 or Joel.Wiebe@nrc.gov. Docket No. 50-461

Enclosure:

As stated cc: Listserv Sincerely, Joel S. Wiebe, Senior Project Manager Plant Licensing Branch Ill Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation ENCLOSURE Final Accident Sequence Precursor Analysis -Clinton Power Station, Division 1 Transformer Failure Leads to Instrument Air Isolation to Containment Requiring a Manual Reactor Scram (LER 461-2017-010)

-Precursor Final ASP Pro Precursor Clinton Power Station Division 1 Transformer Failure Leads to Instrument Air Isolation to Containment Requiring a Manual Reactor Scram LER: 461-2017-010-02 Event Date: 12/9/2017 CCDP= IR: 05000461/2017012 Plant Type: General Electric Type 6 Boiling-Water Reactor (BWR) with a Mark Ill Containment Plant Operating Mode (Reactor Power Level): Mode 1 (97% Reactor Power) Analyst: Reviewer:

Contributors:

Christopher Hunter Dale Yeilding N/A EXECUTIVE

SUMMARY

Approval Date: 3/21/2019 On December 9, 2017, multiple alarms were received in the Clinton Power Station control room due to the unexpected opening of the 4.16 kilovolt (kV) alternating current (AC) bus '1 A 1' breaker (1AP07EJ), which feeds the division 1 480-volt (V) AC buses. The loss of division 1 480 V AC power caused the outboard instrument air containment isolation valve to close and resulted in a subsequent loss of containment instrument air. In addition, the loss of the division 1 480 V AC buses resulted in the unavailability of the low-pressure core spray (LPCS) pump, residual heat removal (RHR) pump 'A', the division 1 emergency diesel generator (EOG) 'A', normal battery charging to the division 1 batteries.

Approximately 4 minutes after the breaker 1AP07EJ opened, the control room operators inserted a manual scram in accordance with procedures for low scram pilot air header pressure and control rod drift annunciator alarms. Operators performed a reactor cooldown of the reactor by directing steam to the main condenser using the main steam bypass valves and auxiliary steam equipment.

Due to the loss of containment instrument air, the main steam isolation valves (MSIVs) began to close. In response to the expected closure of the MSIVs, operators aligned the main steam line (MSL) drains to maintain pressure control. These drains were used in conjunction with the reactor core isolation cooling (RCIC) turbine to continue to cooldown to Mode 4. According to the risk analysis modeling assumptions used in this accident sequence precursor (ASP) analysis, the mostlikely core damage sequence is reactor transient with a consequential loss of offsite power (LOOP) and postulated failures of the division 2 EOG 'B' result in a subsequent station blackout (SBO). Although high-pressure core spray (HPCS) is initially successful, operators fail to recover offsite power within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months resulting in the inability to vent containment, which results in the loss of all injection.

This accident sequence accounts for approximately 17 percent of the conditional core damage probability (CCDP) for the event. Two Green (i.e., very low safety significance) findings were identified for this event. The first finding was associated with the licensee failure to perform corrective action to preclude repetition for a similar transformer failure that occurred in December 2013. The second finding 1 LER 461-2017-010-02 was associated with the licensee failure to follow procedure that would classify three nonsafety-related 4.16 kV and 480 V transformers as operationally critical components.

EVENT DETAILS Event Description.

On December 9, 2017, multiple alarms were received in the Clinton Power Station control room due to the unexpected opening of the 4.16 kV AC bus '1 A 1' breaker (1AP07EJ), which feeds 480-volt (V) AC unit substation

'1A' and 480 V AC unit substation

'1A.' The loss of 480 V AC power caused the outboard instrument air containment isolation valve to close and resulted in a subsequent loss of containment instrument air. Approximately 4 minutes after the breaker 1AP07EJ opened, the control room received a low scram pilot air header pressure alarm. Soon after, the control rod drift annunciator alarmed as expected and the control room operators inserted a manual scram in accordance with procedures.

Operators began cooling down the reactor by directing steam to the main condenser using the main steam bypass valves and auxiliary steam equipment.

Due to loss of containment instrument air, the inboard MSIVs began to close slowly. Operators lined up the MSL drains to maintain pressure control and continue the cooldown in anticipation of MSIV closure as containment air pressure lowered. The last inboard MSIV indicated full closed about 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the instrument air containment isolation valve closed; however, the MSL drain valves remained available to the operators throughout the event. These drains were used in conjunction with the RCIC turbine to continue to cooldown to Mode 4. This loss of division 1 480 V AC buses resulted in the unavailability of LPCS, RHR pump 'A', and the division 1 EOG to fulfil their safety function for the complete mission time (i.e., 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ).1 Normal charging capability to the division 1 batteries was also lost. Additional information is provided in licensee event report (LER) 461-2017-010-02 (Ref. 1) and inspection report (IR) 05000461/2017012 (Ref. 2). Cause. The unexpected opening of breaker 1 AP07EJ was due to a phase-to-ground fault on 480 V transformer 1 A. Subsequent vendor testing determined that the ground fault was caused by excessive layer-to-layer design stress within the 4.16 kV transformer winding. This preexisting design defect resulted in the issuance of a 10 CFR Part 21 notification to the NRC. Additional Event Information.

The following event details are provided as additional information about the event. This additional information was not factored in the modeling of this analysis due to the negligible risk impact.

The RCIC system was declared inoperable because the 480 V AC power was lost to water leg pump and, therefore, operators could not ensure the system was free of voids. NRC inspectors determined that although the RCIC system was appropriately declared inoperable, the system was available (if necessary) for pressure/inventory control and decay heat removal.

The isolation of instrument air to containment affected some components in the reactor water cleanup (RWCU) and control rod drive (CRD) systems. The safety-related The division 1 EOG was rendered unable to fulfil its safety function for the complete mission time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months due to loss 480V AC power to its associated fuel oil transfer pump. The fuel oil transfer pump starts as soon as the level in its associated day tank starts decreasing.

Withoutthe fuel oil transfer pump, the day tank only has enough fuel to run the EOG for approximately 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . In addition, the circulating oil and turbo soakback pumps were also unavailable due to the loss of division 1 480 V AC power. However, the loss of these two pumps is not expected to result in a loss of safety function of the EOG. 2 LER 461-2017-010-02 aspects of the RWCU system are typically limited to the containment isolation requirements.

The standardized plant analysis risk (SPAR) models typically have limited modeling of the RWCU system and containment isolation; however, their inclusion would not affect the analysis for this initiating event. Therefore, no modeling of RWCU system and its components was needed for this analysis. The CRD system component unavailabilities were limited to the scram pilot air header and did not affect the CRD pumps as a potential source of RCS inventory makeup. The SPAR model only credits CRD makeup from 1 of 2 pumps if RCIC is initially successful.

The model does not credit enhanced two-pump flow, which may require instrument air inside containment.

Therefore, no model changes for the CRD system were needed for this analysis.

MODELING SDP Results/Basis for ASP Analysis.

The ASP Program performs independent analyses for initiating events. ASP analyses of initiating events account for all failures/degraded conditions and unavailabilities (e.g., equipment out for test/maintenance) that occurred during the event, regardless of licensee performance.

2 Additional LERs were reviewed to determine if concurrent unavailabilities existed during the December 9th event. No windowed events or concurrent degraded operating conditions were identified.

In response to this event, the NRC performed a special inspection per Management Directive 8.3, "NRC Incident Investigation Program." The special inspection (as documented in IR 05000461/2017012) revealed two Green (i.e., very low safety significance) findings.

The first finding was associated with the licensee failure to perform corrective action to preclude repetition for a similar transformer failure that occurred in December 2013. The second finding was associated with the licensee failing to follow procedure that would classify three nonsafety-related 4.16 kV and 480 V transformers as operationally critical components.

Both findings were screened out (i.e., no detailed risk evaluation was performed) using Inspection Manual Chapter 0609, Attachment 4, "Initial Characterization of Findings at Power," and Appendix A, "The Significance Determination Process for Findings at Power." The LER remains open. Analysis Type. An initiating event analysis was performed using the Clinton Power Station SPAR model, Revision 8.54, modified on December 20, 2017. This event was modeled as a general plant transient with a loss of instrument air to the containment and loss of division 1 480 V AC power. SPAR Model Modifications.

The following modifications were required for this initiating event assessment:

2

The base SPAR models provide credit for EDG repair for SBO scenarios; however, the analyst must determine whether credit should be applied given the specific circumstances surrounding the event being analyzed.

The probabilities of successful repair of an EDG in the base SPAR models are calculated using the data from the unplanned unavailability mitigating system performance index (MSPI). There are questions on the applicability of this data. First, this repair data is not collected under SBO conditions (e.g., reduced lighting). Second, during postulated SBO scenarios, multiple EDG failures have occurred, thus further complicating troubleshooting activities, ASP analyses also account for any degraded condition(s) identified after the initiating event occurred, if the failure/degradation exposure period(s) overlapped the initiating event date. 3 3 4 tER 461-2017-010-02 which would likely increase the time to repair. Given these uncertainties, repair credit for EDG failures is limited to cases where event information supports this credit. Repair credit for postulated failures of the EDGs is not provided in this analysis.

3 The issue of crediting EDG repair is noted as a key modeling uncertainty for this analysis and will be discussed with internal stakeholders to det~rmine if consensus approach can be developed.

The CVS ( containment venting) fault tree was modified to eliminate duplicative operator actions to initiate containment venting. Specifically, basic events CVS-XHE-XM-VENT1 (operator fails to vent containment through CGP), CVS-XHE-XM-VENT2 (operator fails to vent containment through FC to SFP), and CVS-XHE-XM-VENT3 (operator fails to vent containment through RHR A to FP) were deleted. The operator action to vent containment is already accounted for in the model via basic event CVS-XHE-XM-VENT (operator fails to vent containment).

The modified CVS fault tree is shown in Figure B-1 of Appendix B.

The base model does not explicitly include modeling of the 480 V AC portion of the electrical distribution system. During the event, the 4.16 kV bus '1 A 1' breaker 1 AP07EJ, which feeds both division 1 480 V buses (1AP11 E and OAP05E), opened due to a fault on 480 V transformer

'1A.' This caused the unavailability of the LPCS pump, RHR pump 'A', and the division 1 EDG. To account for the dependency of these pumps on 480 V AC power, a new basic event ACP-BAC-LP-480V-DIV1 ( 480V division 1 buses are unavailable) was inserted in the LPCS fault tree (under the LCS-MDP-SS subtree), RHR pump A fault tree (under the RHR-MDPA-SS subtree), and DGA-SS fault tree (under gate DGA-SS8).4 These modified faults trees are shown in Figure B-2 , Figure B-3, and Figure B-4 of Appendix B.

The loss of division 1 480 V buses also resulted in the loss of normal battery charging for the division 1 batteries.

During the event, operators successfully aligned the class 1 E swing charger to supply the division 1 batteries. To account for the loss of normal battery charging on the division 1 batteries and the potential for aligning the swing charger, fault tree DCP-125V-1A-LT (Clinton division 1125 VDC power is unavailable) was modified.

Specifically, a new 'AND' gate was added under the top gate with the new basic events ACP-BAC-LP-480V-DIV1 and a DCP-XHE-SWINGCHARGER ( operators fail to align the swing charger) inserted under this new gate. Basic event DCP-XHE-SWINGCHARGER was set to IGNORE in the base model. This modified fault tree is shown in Figure B-5 of Appendix B.

The only modeling of instrument air system in the current SPAR model is via house event HE-LOIAS (loss of instrument air system initiating event has occurred), which is used alone or within the IAS ( Clinton instrument air) fault tree. Dependency on the instrument air system is limited in the current SPAR model (e.g., power conversion The applicable EOG recovery basic events: EPS-XHE-XL-NR30M (operator fails to recover emergency diesel in 30 minutes), EPS-XHE-XL-NR02H (operator fails to recover emergency diesel in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ), EPS-XHE-XL-NR04H ( operator fails to recover emergency diesel in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ), and EPS-XHE-XL-NR 12H ( operator fails to recover emergency diesel in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ) were set to TRUE in the base SPAR model. The ZT-BAC-LP (AC bus fails to operate) default template was used for this basic event. 4 LER 461-2017-010-02 system, condenser, containment venting, RCIC}.5* 6 During the event, the loss instrument air was limited to components/systems inside containment and, therefore, only containment venting and power conversion system were affected.7 The PCS fault tree assumes that PCS is rendered unavailable given a complete loss of instrument air, which would fail MFW because of lack of makeup to condenser hotwell and render the condenser heat sink unavailable due to the closure of MS IVs. Since instrument air was only lost in containment, feedwater and the condenser heat sink remained available throughout the event and operators were able to align the MSL drains to the condenser, two changes were made to the PCS fault tree. First, the IAS transfer tree and a new basic event PCS-XHE-XM-MSLDRAINS (operators fail to align the MSL drains to the condenser) were added under a new 'AND' gate. Basic event PCS-XHE-XM-MSLDRAINS was set to IGNORE in the base model. The modified PCS fault tree is shown in Figure B-6 of Appendix B. Second, the IAS transfer tree was deleted from the CDS-HW ( Clinton condensate hotwe/1 makeup is unavailable) fault tree. The modified CD-HW fault trees are shown in Figure B-7 of Appendix B.

Errors associated with late injection modeling were identified in two event trees, 1 SORV ( Clinton transfer -one stuck open SRV) and LOOP-1 ( Clinton transfer -one stuck open SRV). Specifically, transient (TRANS) sequences 65-33 and 67-38-19 incorrectly assumed a failure of late injection.

The transfers for these two sequences were changed from LI02 (Clinton late injection fault tree) to LIOO (Clinton late injection fault tree). Key Modeling Assumptions.

The following modeling assumptions were determined to be significant to the modeling of this initiating event assessment:

5 6 7

The operators manually scrammed the reactor due to low scram header air pressure; therefore, the probability of IE-TRANS (general plant transient initiating event) was set to 1.0. All other i nitiating event probabilities were set to zero.

Basic event ACP-BAC-LP-480V-DIV1 was set to TRUE due to the loss of the division 1 480 V AC buses caused by the opening of the 4.16 kV bus 1 A 1 breaker 1 APO?EJ as result of the transformer fault.

Basic event HE-LOIAS was set to TRUE to account for the loss of instrument air inside containment.

Recovery potential for instrument air to the containment was not credited in this analysis since that portion of the air system was not recovered for over 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months after initiation of the event.

The human failure event (HFE) DCP-XHE-SWINGCHARGER was evaluated using SPAR-H (Ref. 3 and Ref. 4); see Appendix C for additional information.

The human error probability (HEP) for DCP-XHE-SWINGCHARGER was calculated to be 1 x10-2. The CND (main condenser heat sink) fault tree also has an instrument air system dependency; however, this fault tree is only used in the loss of feedwater event tree. Modeling associated with the condenser is included in the PCS (power conversion system) fault tree for the TRANS (general transient) event tree. The use of house event HE-LOIAS in the RCIC pump modeling in the RCI-SS-L T (RCIC support systems) subtree corresponds to different support system requirements needed for different initiating events and was not intended to model a RCIC system dependency for instrument air. Therefore, this modeling does not need to be modified for this event analysis. In addition to the condensate and feedwater systems, the power conversion system includes modeling of the MSIVs. 5 LER 461-2017-010-02

The HFE PCS-XHE-XM-MSLDRAINS was evaluated using SPAR-H; see Appendix C for additional information.

The HEP for PCS-XHE-XM-MSLDRAINS was calculated to be 1 X 10-3. ANALYSIS RESULTS CCDP. The conditional CCDP for this analysis is calculated to be 8.3x10~. The ASP Program acceptance threshold is a CCDP of 1 x 1 o~ or the CCDP equivalent of an uncomplicated reactor trip with a non-recoverable loss of feed water or the condenser heat sink), whichever is greater. This CCDP equivalent for Clinton Power Station is 2.3x10~.8 Therefore, this event is a precursor.

Dominant Sequence.

The dominant accident sequence is transient sequence 67-40-06 (CCDP = 1.4x 10~). which contributes approximately 17 percent of the total internal events CCDP. The dominant sequences that contribute at least 1.0 percent to the total internal events CCDP are provided in the following table. The dominant sequence is shown graphically in Figure A-1 , Figure A-2, and Figure A-3 and Appendix A. 8 Sequence CCDP Percentage Description TRANS 67-40-06 1.44x1Q~ 17.40% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; HPCS succeeds; operators fail to recover offsite power in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; containment venting fails resulting in a loss of all injection TRANS 67-40-24 1.39x10~ 16.80% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; HPCS fails, but RCIC succeeds; operators successfully shed DC loads; I operators fail to recovery offsite power in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months TRANS 67-40-30 7.83x10*7 9.50% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; RCIC and HPCS fail; operators fail to recovery offsite power in 30 minutes TRANS 67-35 5.15x10*7 6.20% Successful reactor trip; consequential LOOP occurs; EDGs successfully provide power to safety-related buses; RCIC and HPCS fail; reactor depressurization succeeds; low-pressure injection succeeds; suppression pool cooling and containment spray fails; containment venting fails resulting in a loss of all injection TRANS 67-40-31-13 5.06x10*7 6.10% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; recirculation pump seals fail resulting in a small loss-of-coolant accident (SLOCA); RCIC and HPCS fail TRANS 67-40-32-13 4.85x10*7 5.90% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; a stuck-open relief valve results in a SLOCA; RCIC and HPCS fail For BWRs, a loss of condenser heat sink initiating event typically assumes that the condensate system is available to provide a source of low-pressure injection to the reactor. 6 LER 461-2017-010-02 Sequence CCDP Percentage Description TRANS 65-07 4.80x10-7 5.80% Successful reactor trip; a stuck-open relief valve results in a SLOCA; feedwater succeeds; suppression pool cooling and containment spray fails; containment venting fails resulting in a loss of all injection TRANS 67-13 3.15x1Q-7 3.80% Successful reactor trip; consequential LOOP occurs; EDGs successfully provide power to safety-related buses; HPCS fails, but RCIC succeeds; suppression pool cooling fails; reactor depressurization succeeds; low-pressure injection succeeds; containment spray fails; containment venting fails resulting in a loss of all injection TRANS 67-07 2.87x10-7 3.50% Successful reactor trip; consequential LOOP occurs; EDGs successfully provide power to safety-related buses; RCIC and HPCS succeed; suppression pool cooling and containment spray fails; containment venting fails resulting in a loss of all injection TRANS 63 2.52x10-7 3.10% Successful reactor trip; power conversion system fails; feedwater fails; RCIC and HPCS fail; reactor depressurization succeeds; low-pressure injection fails TRANS 67-40-31-06 1.60x1Q-7 1.90% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; recirculation pump seals fail resulting in a SLOCA; HPCS succeeds; operators fail to recover offsite power in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; containment venting fails resulting in a loss of all injection TRANS 67-40-31-09 1.54X1 O-l 1.90% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; recirculation pump seals' fail resulting in a SLOCA; HPCS fails but RCIC succeeds; operators successfully shed DC loads; operators fail to recovery offsite power in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months TRANS 67-40-32-06 1.53x1Q-7 1.90% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; a stuck-open relief valve results in a SLOCA; HPCS succeeds; operators fail to recover offsite power in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; containment venting fails resulting in a loss of all injection TRANS 67-40-32-09 1.48x1Q-7 1.80% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; a stuck-open relief valve results in a SLOCA; HPCS fails but RCIC succeeds; operators successfully shed DC loads; operators fail to recovery offsite power in 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months TRANS 67-28 1.45X1 O-? 1.80% Successful reactor trip; consequential LOOP occurs; EDGs successfully provide power to safety-related buses; RCIC fails, but HPCS succeeds; suppression pool cooling and containment spray fails; operators fail to recover the power conversion system; containment venting fails resulting in a loss of all injection TRANS 67-37 1.03x1Q-7 1.30% Successful reactor trip; consequential LOOP occurs; EDGs successfully provide power to safety-related buses; RCIC and HPCS fail; operators fail to depressurize the reactors 7 LER 461-2017-010-02 Sequence CCDP Percentage Description TRANS 67-40-28-31 9.81 x1Q-8 1.20% Successful reactor trip; consequential LOOP occurs; EDGs fail resulting in a SBO; RCIC and HPCS fail; operators successfully recovery offsite power in 30 minutes; reactor depressurization succeeds; low-pressure injection fails TRANS 67-38-14 9.42x10-8 1.10% Successful reactor trip; consequential LOOP occurs; EDGs successfully provide power to safety-related buses; a stuck-open relief valve results in a SLOCA; HPCS fails, but RCIC succeeds; low-pressure injection succeeds; suppression pool cooling and containment spray fails; operators fail to align the MSL drains; containment venting fails resulting in a loss of all injection Key Modeling Uncertainties.

The base SPAR models provide credit for EDG repair and recovery; however, it is up to the analyst to determine whether credit should be applied given the specific circumstances surrounding the event being analyzed. This ASP analysis does not credit repair of postulated EDG failures.

A sensitivity analysis was performed crediting EDG repair of postulated failures of the division 1 EDG using the unplanned unavailability MSPI data. With this credit applied, the llCDP for the second exposure period decreases from 8.3x1Q-6 to 6.9x 10-6 (a decrease of approximately 17 percent).

Successful equipment operation is treated probabilistically in ASP analyses (i.e., success is not assumed), while observed failures are modeled as such.9 However, barring any postulated failures, the division 1 EDG would run until the fuel supply in its associated day tank was depleted (approximately 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ). To show the effects of this modeling uncertainty, a sensitivity analysis was performed allowing an additional 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for operators to recover offsite power during postulated LOOP scenarios.

With this credit applied, the llCDP for the second exposure period decreases from 8.3x 10-6 to 6.2x 10-6 (a decrease of approximately 25 percent).

REFERENCES

1. Clinton Power Station, "LER 461/17-010-02

-Division 1 Transformer Failure Leads to Instrument Air Isolation to Containment Requiring a Manual Reactor Scram," dated January 17, 2019 (ADAMS Accession No. ML19022A264). 2. U.S. Nuclear Regulatory Commission, "ERRATA-Clinton Power Station -NRC Special Inspection Report 05000461/2017012," dated January 29, 2018 (ADAMS Accession No. ML18029A863). 3. Idaho National Laboratory, NUREG/CR-6883, "The SPAR-H Human Reliability Analysis Method," August 2005 (ADAMS Accession No. ML051950061

). 4. Idaho National Laboratory, "INUEXT-10-18533, SPAR-H Step-by-Step Guidance," May 2011 (ADAMS Accession No. ML112060305). 9 This general modeling technique is called the "failure" memory approach. 8 0---

.-0---.------0--

Appendix A: Key Event Tree --.------0--

L---o----Figure A-1. Clinton General Transient Event Tree A-1 LER 461-2017-010-02 I I I -. -.,,

I I I I I I I I

I I ) ) ) )

LER 461-2017-010-02 o-e~-"'---o~,-0----o-e~-. o~*= I"'--o-e~,-* ..,.* V" Figure A-3. Modified Clinton SBO Event Tree A-3 Appendix B: Modified Fault Trees I lelTPA116AAEIJII.VQAIIE C\S-1 J COOAJlffN1"SPRAYl£AOO!

\BIT PAlli IS 1.111.IIIIIAllf COHTAIIHNT\8111Ni 1l<<ltGi ClMCONIIIU)USJIUG: (CCP) ~lJIIIBIPOOllelT PAlli(VIA FC)ISIJII.VQAIIE C\S-2 cvs-4 C\S-3 I I I RIRACOOAitffNTlelTl()

V 11 CUNTONINSTRlHNTAIRS"ISTIM I I IOJSEE\ffiT*LOSSOFOFfS!TE 11 CONTIN.Ol.5PLRGElelTVALII:

11 QJNTONllllSIONIACPOMR I JHIIUllelTVALll:FCO l 2BFAILS 27AFAILSTOOPEN FAIA.T'lm POYtB!IEHASQCCLRRII)

I-FAILS TO OPEN SYS191FAIA.T'IRII:

r TOOPEN CUNT0N Cl\!SJON I AC POYtB! SYSl9I FAIA.T'lm jACP-<<\fl.15-IAI

!&ti jRIR-M>V<C*F027A 1B.16f-041 I JAS leitj 11£,!.Q()f>

Ii Q IFa"'I AOV-CC*IIW68 7.55 E-04 ,ACJl;l\'lll6;1AI

!Ell ~C-FC012B

]4.59E-04 RIRA CONTAitffNTlelT l()V 28A FAILS TO OPEN CUNTONJl\4SlllNIACl'O'MR S1SIEM FAIA.TlRlf I RH!-M>V<C-f028A I 8.16E-04 I IAC:P-41Ml.&1AI Ii I~ -.W. lelTVALII:

F099 FAILS TO OPEN C'6-JMl.(C-F099 l4.59E-04 Mm.JAL lelT V ALi!: FC090 FAILS TO OPEN C\S-IMI-CC-FC090 l4.59E-04 -.W. \ffirVALII:

Fein FAILS TO OPEN C\S-IMI-CC*FCln l4.59E-04 0 CONTIN..Ol.6 PLRGE lelTVALII:

CUNTON llllSION D AC POYtB! l.ml6AFAILSTOOPEN SYS191FAIA.Tlm COHTlelT l1lV FC007 FAILS TO OPEN C\S-AOV-CC-VR06A l7.55E-04I IAC:P-41M1.&1BI

!ext! ~C'6-H:JY<C-FC007 IB.lif-04 0 Ii COHTIBITl1lV FC008 FAILS TO OPEN C'IS-l'OV-CC-FC008 JB.16f-04 0 Figure B-1. Modified Containment Venting Fault Tree B-1 LER 461-2017-010-02 I OPIRA'JtlR FAILS1011M" CONTUMNTGl\91 S85IIC E\tN1' I OPIRAlOR FAILS TO lelT COITTAitffNT IC6-H:¥ !extl IC6->>£-XH-lelT Ii 0 11.00E--OJ I I I LPCS PUMP ROOM COOLING IS UNAVAILABLE LCS-MDP-SS-1 LPCS LCS-MDP-SS CLINTON DMSION I AC POWER SYSTEM FAULTTREE ACP-4KV8US-1A1 IExt CLINTON DMSION I 125 VOC POWER IS UNAVAILABLE OCP-125V-1A-LT IExt Figure B-2. Modified LCS-MDP-55 Fault Tree B-2 LER 461-2017-010-02 I 480V DMSION 1 BUSES ARE UNAVAILABLE ACP-BAC-LP-480V-D1V1 2.29E-05 I FAILURE OF ROOM COOLING FOR RHR PUMP A RHR-MDPA-SS-1 CLINTON FAIWRE OF RHR MOP 1A RHR*MDPA-SS CLINTON DMSION I AC POWER SYSTEM FAULT TREE LER 461-2017-010-02 I 480V DIVISION 1 BUSES ARE UNAVAILABLE ACP-4KVBUS-1A1 Ext !ACP-BAC-LP-480V-DIV1

! 2.29E-05 ------~----

CLINTON DMSION I 12s voe ( ) POWER IS UNAVAILABLE OCP-125V-1A-LT Ext Figure B-3. Modified RHR-MDPA-55 Fault Tree B-3 l DIESEL GENERATOR 1A ELECTRICAL FAULTS DGA-SS-1 H I DIESEL-GENERATOlffA SUPPORT SYSTEM FALURES DGA-SS I SSW SYSTEM FAU..S TO DG1A FALURE OF DG1A HVAC DGN-SSWA Extemal DGA-883 D H Figure B-4. Modified DGA-SS Fault Tree B-4 I DG1AFUEL OU.. FAILURES DGA-SSS T FUEL OIL PUMP 1 A FAILS TO START FH~DP-FS-D01A 7.84E-04 FUEL OIL PUMP 1A FAILS TO RUN FHS-MDP-FR-001 A 3.87E-04 FOPUMPSA , B,C FAIL FROM COMMON CAUSE TO START FHS-MDP-CF

-FS 6.23E-06 FO PUMP A , B , C FAIL FROM COMMON CAUSE TO RUN FHS-MDP-CF-FR 2.90E-06 F0 PUMPS A , B FAIL FROM COMMON CAUSE TO START FHS-MDP-CF

-FSAB 1.99E-05 F0 PUMPS A,C FAIL FROM COMMON CAUSE TO START FHS-MDP-CF-FSAC 1.99E-05 480V DIVISION 1 BUSES ARE UNAVAILABLE ACP-BAC-LP-480V-DIV1 2.29E-05 u LER 461-2017-010-02 I LOSS OF DMSION 1 POWER RESULTS IN LOSS OF BATTERY CHARGING CAPBIUTY DCP-125V-1A-LT-2 u 480V DIVISION 1 BUSES ARE UNAVAILABLE

.. ACP-BAC-LP-480V-DIV1 I 2.29E-05 OPERATORS FAIL TO ALIGN SWING CHARGER DCP-XHE-XM-SWINGCHARGERI Iqnore --CUNTON DIVISION I 125 VDC POWER IS UNAVAILABLE DCP-125V-1A-LT CUNTON DMSION I AC POWER SYSTEM FAULTTREE ACP-4KVBUS-1Al Ext DC BA TT CHARGERS FAILURE FROM SEISMIC EVENT Ext Figure B-5. Modified OCP-125V-1A-LT Fault Tree B-5 LER 461-2017-010-02 I f.* FAILURE OF DIVISION I 125VDC BUS 1A 0CP-B0C-LP-1A I 5.21E-06 FAILURE OF DIVISION I 125VDC BATTERY CHARGER DCP-BCH-LP-1A I 6.17E-05 I BATTERY CHARGERS FAIL FROM COMMON CAUSE OCP-BCH-CF-CHRS I 2. lOE-07 FEEDWATER MFW Ext I STEAM SYSTEM FAILS PCS-2 STEAM LOOP VALVES FAIL TO OPEN/REMAIN OPEN IM<<-MSV-OC-STEAM 17.44E-06 TURBINE BYPASS VALVES FAIL TO nD~N OPEN MSS-TBV-CC-BYPAS 3.12E-03 PCS POWER CONVERSION SYSreM FAIWRE OF STEAM CONDENSING FUNCTION OF PCS PCS-1 MSIVS AND MSl DRAINS ARE ISOLATED PCS-3 I CLINmN INSTRUMENT AIR SYSTEM r OPERATORS FAIL TO ALIGN MSL FAULTTREE DRAINS IAS IExt PCS-XHE-XM-MSLDRAINS IIonore Figure B-6. Modified PCS Fault Tree 8-6 LER 461-2017-010-02 I I CUNTON MAIN CIRCULATING HOUSE EVENT -TOTAL LOSS OF WATER IS UNAVAILABLE CONDENSER HEAT SINK INITIATOR MCW lExt HE-LOCHS I False FAILURE TO MAINTAIN HOlWEU. INVENTORY CDS-HW-3 FAIWRE TO CONTROL CD/CB FLOW TOPREVENTEMPTYINGHOTWEU.

1rnc:-XHE*XM*HOTWELL I 1.00E-03 set to PSA value of O. 067 CDS-TNK*FC-CYMC l6.26E*06 FAILURE OF CIRCUIT BREAKER 501A TO OPEN (UAT) ACP-CRB-CC*501A I 2.49E*03 FAILURE OF CIRCUIT BREAKER 501BTO OPEN (UAT) ACP*CRB-CC*501B I 2.49E*03 SJAE MIN FLOW TO COND VALVE 1CD039 FAILS TO CLOSE CDS-AOV*CC-039 I 7.SSE-04 CLINTON CONDENSATE HOlWEU. MAKEUP IS UNAVAILABLE CDS-HW FAIWRE OF HOlWEU. INVENTORY CDS-HW-1 INITIATORS WITHOUT STEAM RETURN TO HOlWEU. CDS-HW-2 lWO OR MORE B'WR SRVS FAIL TO CLOSE --.V-00*2VLVS 2.00E-03 ONE BWR SRV FAILS TO CLOSE PPR*SRV*OO*lVLV 9.60E*02 HOUSE EVENT* SMALL LOSS*OF* COOLANT ACCIDENT INITIATOR HE-SLOCA I False INADVERTENT OPEN RELIEF VALVE (IORV) HAS OCCURRED HE*IORV I False HOUSE EVENT* TOTAL LOSS OF CONDENSER HEAT SINK INITTATOR HE-LOCHS I False " CONDENSATE STORAGE TANK FAIWRE FROM SEISMIC EVENT LER 461-2017-010-02 I CONDENSATE STORAGE TANK IS UNAVAILABLE 1cos-TNK-EQ x !Ext! 1cos-TNK*FC*CST l6.26E*061 HOlWEU. LEVEL CONTROL VALVE 2 FAILS COS-AOV*CC*MKUP2

11. 55E*04 C HOlWEU. LEVEL CONTROL VALVE 1 FAILS COS-AOV*CC*MKUPl f 7.55E*04f 0 Figure B-7. Modified CDS-HW Fault Tree 8-7 PSF Time Available Stress, Complexity, Procedures Experience/Training, Ergonomics/HM I, Fitness for Duty, Work Processes LER 461-2017-010-02 Appendix C: Evaluation of Key HFEs Operators swing charger to supply the division 1 batteries.

If normal battery charging capability is lost via the 480 V division 1 AC buses, operators can align the swing charger to prevent a loss of division 1 direct current (DC) power. Operators successfully align the swing charger to supply the division 1 batteries prior to batter depletion (2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ). Low DC bus voltage CPS 3503.01 C006, "Class 1 E Swing Battery Charger 1 DC11 E Feed to Safety-Related DC Bus Checklist" This HFE only contains both diagnosis and action activities.

Multiplier Diagnosis/Action 1 / 1 1 / 1 Notes The nominal battery depletion time of the safety-related batteries is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months without shedding of DC loads. With successful load shedding, the battery life can be extended to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . In addition, During the event, a loss of division 1 AC loads (as occurred during the event) reduces the depletion rate. The time estimated to align the swing charger is approximately 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This would leave a maximum of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months available for diagnosis under the most restrictive scenario (i.e. nominal depletion rate and, low bus voltage threshold quickly reached). However, there could be less time. Given this uncertainty, the diagnosis PSF for available time is set to Nominal. Sufficient time exists to perform the action component of the offsite power recovery; therefore, the action PSF for available time is set to Nominal. See Reference 4 for guidance on apportioning time between the diagnosis and action components of an HFE. No event information is available to warrant a change in these PSFs (diagnosis or action) from Nominal for this HFE. The HEP is calculated using the following SPAR-H formula: HEP = (Product of Diagnosis PSFs x Nominal Diagnosis HEP) + (Product of Action PSFs x Nominal Action HEP) : (1 X 0.01) + (1 X 0.001): 1x10-2 Therefore, the human error probability for DCP-XHE-SWINGCHARGER was set to 1 x10-2. C-1 LER 461-2017-010-02 Evaluation of PCS-XHE-XM-MSLDRAINS o erators fail to a/i n the MSL drains to the condense 'll;il 1111\IVI I Description and Event Context Operator Action Success Criteria Key Cue(s) Procedural Guidance Diagnosis/Action PSF Time Available Stress, Complexity, Procedures Experience/Training, Ergonomics/HM I, Fitness for Duty, Work Processes Operators use MSL drains for reactor pressure control. If the condenser is available , but the MSIVs are closed (or expected to close) operators can align the MSL drains to for reactor pressure control. Operators align MSL drains to the main condenser to maintain steam path prior to closure of all MSIVs. MSIV{s) closing or expected closure of MSIVs EOP-1, "RPV Control" and CPS 4411.09, "RPV Pressure Control Sources" This HFE only contains both diagnos i s and action activities.

Multiplier Diagnosis/Action 0.01 I 1 1 / 1 Notes During the event, the last inboard MSIV did not close until approximately 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after instrument air to containment was isolated. The time estimated to align the MSL drain is conservatively estimated to be 30 minutes. This would leave at least 3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months available for diagnosis.

The nominal time for diagnosis is estimated to take 5 minutes. Since the 3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months available for diagnosis is greater than 2x nominal time and greater than 30 minutes, the diagnosis PSF for available time is set to Expansive.

Sufficient time exists to perform the action component of the offsite power recovery; therefore, the action PSF for available time is set to Nominal. See Reference 4 for guidance on apportioning time between the diagnosis and action components of an HFE. No event information is available to warrant a change in these PSFs (diagnosis or action) from Nominal for this HFE. The HEP is calculated using the following SPAR-H formula: HEP = (Product of Diagnosis PSFs x Nominal Diagnosis HEP) + (Product of Action PSFs x Nominal Action HEP) : (.01 X 0.01) + (1 X 0.001) : 1x10-3 Therefore, the human error probability for PCS-XHE-XM-MSLDRAINS was set to 1x10-3_ C-2 T. Stoner

SUBJECT:

TRANSMITTAL OF FINAL CLINTON POWER STATION ACCIDENT SEQUENCE PRECURSOR REPORT (LICENSEE EVENT REPORT 461-2017-010)

DATED APRIL 3, 2019 DISTRIBUTION:

PUBLIC MailCTR Resource RidsNrrDorlLpl3 Resource RidsNrrLASRohrer Resource RidsNrrPMClinton Resource RidsRgn3MailCenter Resource CHunter, RES/ORA ADAMS Accession Nos.: Package ML19092A162; Letter ML19092A159; ASP R rt ML19050A510 epo OFFICE NRR/D0RL/LPL3/PM N RR/D0RL/LPL3/LA NRR/D0RL/LPL3/PM NAME JWiebe SRohrer JWiebe DATE 04/03/19 04/02/19 04/03/19 OFFICIAL RECORD COPY

ML19092A159

Contents

Text

SUBJECT:

Dear Mr. Stoner:

Enclosure:

SUMMARY

SUBJECT:

Navigation menu

ML19092A159

Text

SUBJECT:

Dear Mr. Stoner:

Enclosure:

SUMMARY

SUBJECT:

Navigation menu

Search