ML20220A292

Risk Informed Process for Evaluations Example - Kirk Key - July 15, 2020

ML20220A292
Person / Time
Issue date:	08/06/2020
From:	Audrey Klett, Tim Reed, Antonios Zoulis NRC/NRR/DORL/LPL4
To:
Klett A
Shared Package
ML20220A290	List: ML20220A291 ML20220A292
References
Download: ML20220A292 (8)

Text

RIPE Example Kirk Key LAR LICENSEE:

Licensee A (LSA)

SITE:

Example Site A (ESA)

DOCKET NUMBER(S):

N/A LICENSE NUMBER(S):

N/A REGULATORY REQUEST:

LSA is requesting an amendment to the facility operating licensee in accordance with 10 CFR 50.90, Application for Amendment of License, Construction Permit, or Early Site Permit, to remove the mechanical kirk key interlock on the feeder breakers for screenwash raw water (SRW) motor control centers (MCCs) 1A-A, 1B-B, 2A-A, and 2B-B and revise the ESA Updated Final Safety Analysis Report (UFSAR) to reflect removal of the interlock. The kirk key interlock will be replaced with administrative procedural controls to ensure only one feeder breaker is closed onto an SRW MCC.

DETAILED DESCRIPTION OF THE REGULATORY ISSUE:

ESA UFSAR Section 9.2 states that there is a mechanical kirk key interlock on the feeder breakers for SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B. The mechanical kirk key interlock physically prevents paralleling of the normal and alternate power supply on each MCC. The affected feeder breakers are obsolete and need to be replaced. The replacement breakers have different physical dimensions which do not allow for installation of the kirk key interlock.

The ESA onsite Class 1E AC power distribution system has two redundant and independent power trains, A and B, each with its own emergency power supplied by two dedicated emergency diesel generator (EDGs). The two Class 1E power trains are split into four shutdown boards, one for each EDG. Shutdown boards 1A and 2A are part of the A power train, and shutdown boards 1B and 2B are part of the B power trains. SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B are each normally supplied power from their respective shutdown board.

However, each SRW MCC can also be supplied power from the other shutdown board in their respective power train. For example, SRW MCC 1A-A can be supplied power from either shutdown board 1A or 2A. In order to prevent powering these MCCs from both power trains, mechanical kirk key interlocks were installed on the feeder breakers so that only one feeder breaker for each individual MCC could be closed at a time. The mechanical kirk key interlock will be replaced by administrative controls.

If a human performance error were to occur and an operator mistakenly closed both of the feeder breakers to one of the affected MCCs, this action could potentially parallel two standby power sources, potentially resulting in damage to the MCC and unavailability of all of the equipment powered by the MCC. If this were to occur with the plant powered from offsite power, there would be no immediate impact because the offsite power feeds for both divisions of AC power (power trains A and B) are in phase. However, if this were to occur with either power train powered from its EDG, the power could be out of phase, which could result in catastrophic damage to the affected MCC. Therefore, a human performance error when transferring the power supply for an MCC could remain unnoticed until the power supply for a shutdown board transfers to its EDG. Administrative controls will be included in the procedure for transferring the power supply for each MCC to ensure that only one feeder breaker is closed onto an individual MCC. In addition, operator rounds will be updated to include a daily check to ensure that each affected MCC is only being powered by one power supply. SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B each have indicating lights that identify which power supply is connected.

SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B each provide power for traveling screens, screenwash pumps, strainers, and associated indications at the raw water intake facility. The SRW system consists of two trains (A and B), each with two subsystems. Each subsystem is capable of supplying all of the equipment needed to maintain the SRW system for both units.

REFERENCES:

1. ESA UFSAR Section 9.2

2. IEEE Std. 308-1971, "Criteria for Class 1E Power Systems for Nuclear Power Generating Stations"

3. Regulatory Guide (RG) 1.6, Rev 0, Independence between Redundant Standby (Onsite) Power Sources and Between Their Distribution Systems, ML003739924

4. RG 1.81, Rev 1, Shared Emergency and Shutdown Electric Systems for Multi-Unit Nuclear Power Plants, ML003740343

5. 10 CFR 50 Appendix A, General Design Criteria for Nuclear Power Plants, Criteria 5 and 17

6. TSG XXX, Guidelines for Characterizing the Safety Impact of Issues SUPPORTING INFORMATION FOR CONCLUSIONS REGARDING SAFETY IMPACT:

If a generic assessment was performed, provide the generic preliminary screening question results, including explanations for responses: N/A

1. Does the issue result in any impact on the frequency of occurrence of a risk significant accident initiator or result in a new risk significant accident initiator?

Explanation:

2. Does the issue result in any impact on the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a risk significant transient, accident, or natural hazard?

Explanation:

3. Does the issue result in any impact on the consequences of a risk significant accident sequence?

Explanation:

4. Does the issue result in any impact on the capability of a fission product barrier?

Explanation:

5. Does the issue result in any impact on defense-in-depth capability or impact in safety margin?

Explanation:

Site-specific screening question results, including explanations for responses:

Step 1 - Screening for no impact:

1. Does the issue result in an adverse impact on the frequency of occurrence of a risk significant accident initiator or result in a new risk significant accident initiator?

Explanation: No. SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B provide power for traveling screens, screenwash pumps, strainers, and associated indications at the raw water intake facility. This equipment circulates raw water at the intake facility. This equipment is not an accident initiator. Complete failure of all four SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B could require a downpower if it occurred during a time of heavy debris in the raw water supply, but it would not initiate an accident.

2. Does the issue result in an adverse impact on the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a risk significant transient, accident, or natural hazard?

Explanation: No. The equipment powered by SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B are used to respond to transients, accidents, and natural hazards for which the main condenser remains available to remove decay heat from the reactor after a trip. The equipment is not used to respond to events for which the circulating water system is not used. Operation of the SRW system is not required to support use of any other pumps supplied by the raw water intake facility because of the lower flowrate of the other pumps. As such, the SRW system is not credited to respond to any risk significant transients, accidents, or natural hazards.

3. Does the issue result in an adverse impact on the consequences of a risk significant accident sequence?

Explanation: No. The equipment powered by SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B are used to respond to transients, accidents, and natural hazards for which the main condenser remains available to remove decay heat from the reactor after a trip. The equipment is not used to respond to events for which the circulating water system is not used. Operation of the SRW system is not required to support use of any other pumps supplied by the raw water intake facility because of the lower flowrate of the other pumps. As such, the SRW system is not credited to mitigate the consequences of any risk-significant accident sequences.

4. Does the issue result in an adverse impact on the capability of a fission product barrier?

Explanation: No. SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B provide power for traveling screens, screenwash pumps, strainers, and associated indications at the raw water intake facility. This equipment circulates raw water. None of this equipment provides a fission product barrier.

5. Does the issue result in an adverse impact on defense-in-depth capability or impact in safety margin?

Explanation: Yes. If the administrative controls were to fail, one subsystem of SRW could become unavailable. However, the other subsystem would be available to perform all the necessary functions needed for the train. In addition, both subsystems in the alternate train would remain available.

If ALL the responses are NO, the issue screens to NO IMPACT. Continue to Step 3 If ANY response is YES, continue to Step 2.

Step 2 - Screening for minimal safety impact:

1. Does the issue result in more than a minimal increase in frequency of occurrence of a risk significant accident initiator or result in a new risk significant accident initiator?

Explanation: No. SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B provide power for traveling screens, screenwash pumps, strainers, and associated indications at the raw water intake facility. This equipment circulates raw water at the intake facility. This equipment is not an accident initiator. Complete failure of all four SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B could require a downpower if it occurred during a time of heavy debris in the raw water supply, but it would not initiate an accident.

2. Does the issue result in more than a minimal decrease in the availability, reliability, or capability of SSCs or personnel relied upon to mitigate a risk significant transient, accident, or natural hazard?

Explanation: No. The equipment powered by SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B are used to respond to transients, accidents, and natural hazards for which the main condenser remains available to remove decay heat from the reactor after a trip. The equipment is not used to respond to events for which the circulating water system is not used. Operation of the SRW system is not required to support use of any other pumps supplied by the raw water intake facility because of the lower flowrate of the other pumps. As such, the SRW system is not credited to respond to any risk significant transients, accidents, or natural hazards.

3. Does the issue result in more than a minimal increase in the consequences of a risk significant accident sequence?

Explanation: No. The equipment powered by SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B are used to respond to transients, accidents, and natural hazards for which the main condenser remains available to remove decay heat from the reactor after a trip. The equipment is not used to respond to events for which the circulating water system is not used. Operation of the SRW system is not required to support use of any other pumps supplied by the raw water intake facility because of the lower flowrate of the other pumps. As such, the SRW system is not credited to mitigate the consequences of any risk-significant accident sequences.

4. Does the issue result in more than a minimal decrease in the capability of a fission product barrier?

Explanation: No. SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B provide power for traveling screens, screenwash pumps, strainers, and associated indications at the raw water intake facility. This equipment circulates raw water. None of this equipment provides a fission product barrier.

5. Does the issue result in more than a minimal decrease in defense-in-depth capability or safety margin?

Explanation: No. The equipment powered by SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B are used to respond to transients, accidents, and natural hazards for which the main condenser remains available to remove decay heat from the reactor after a trip. If the administrative controls were to fail, one subsystem of SRW could become unavailable, reducing defense-in-depth.

However, the other train and the other subsystem would be available to perform all the necessary functions needed. As shown in the PRA results for Step 3, the risk increase due to one failed subsystem is less than minimal.

If ALL the responses are NO, the issue screens to MINIMAL IMPACT.

Continue to Step 3 If ANY response is YES, stop. The issue has a more than minimal impact on safety.

STEP 3 - PRA RESULTS AND ASSOCIATED DISCUSSIONS, INCLUDING SENSITIVITY ANALYSES:

SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B are each modeled in the ESA PRA. The ESA PRA includes internal events, fire, and seismic risk. The change in core damage frequency (CDF) and change in large early release frequency (LERF) was modeled using the ESA PRA by assuming a complete failure of a single MCC. The results are included in the following table:

Internal Events CDF Fire CDF Seismic CDF Total CDF Total LERF SRW MCC 1A-A 3.3E-8 9.7E-9 8.3E-11 4.4E-8 6.2E-9 SRW MCC 1B-B 3.4E-8 9.7E-9 8.3E-11 4.5E-8 6.2E-9 SRW MCC 2A-A 3.3E-8 9.7E-9 8.3E-11 4.4E-8 6.2E-9 SRW MCC 2B-B 3.4E-8 9.7E-9 8.3E-11 4.5E-8 6.2E-9 The PRA results are conservative because the PRA results do not include any credit for the administrative controls that will be used to ensure that only one feeder breaker is supplying power to an individual MCC. In addition, failing the entire MCC assumes that catastrophic failure would result from closing both power supplies onto a single MCC. This would not occur unless power was being supplied by the EDGs. The evolution to swap power supplies from one shutdown board to another is only performed for maintenance activities and would not be performed while any shutdown board was being powered by its EDG.

STEP 4 - ASSESS NEED FOR RISK MANAGEMENT ACTIONS:

The proposed change has a minimal impact on safety, as shown by the results of Steps 2 and

3. Therefore, RMAs were considered. Administrative controls will be included in the procedure for transferring the power supply for each MCC to ensure that only one feeder breaker is closed onto an individual MCC. In addition, operator rounds will be updated to include a daily check to ensure that each affected MCC is only being powered by one power supply. These administrative controls will be included as permanent procedure changes and are RMAs to reduce the risk associated with removing the mechanical kirk key interlock.

CUMULATIVE RISK RESULTS:

ESAs baseline CDF is 5.6E-5/yr and baseline LERF is 7.2E-6/yr. Based on the PSA applications guide the allowable plant-specific permanent cumulative changes for CDF and LERF are 13% and 12% respectively. The maximum expected CDF for the proposed change is 4.5E-8/yr and the maximum expected LERF is 6.2E-9/yr. The risk increase due to the proposed change is less than 0.1% for both CDF and LERF and therefore the cumulative risk thresholds are acceptable (non-risk significant) for both CDF and LERF.

SAFETY IMPACT CHARACTERIZATION CONCLUSION:

The proposed change to remove the mechanical kirk key interlock on SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B has a minimal impact on safety. RMAs have been considered and administrative procedural controls will be implemented to ensure only one feeder breaker is closed onto a single MCC. The cumulative risk is acceptable. Therefore, this LAR qualifies for a streamlined NRC review. The ESA Plant Operations Review Committee has reviewed this proposed change and determined that operation of ESA with this change will not endanger the health and safety of the public.

SIGNIFICANT HAZARDS CONSIDERATIONS:

The proposed change removes the mechanical interlock from the feeder breakers SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B and revises the SRW System Description in Section 9.2 of the UFSAR to describe the normal and alternate power sources for the SRW system. LSA has

concluded that the proposed change does not involve a significant hazards consideration.

LSAs conclusion is based on its evaluation in accordance with Title 10 of the Code of Federal Regulations (10 CFR) 50.91(a)(1) of the three standards set forth in 10 CFR 50.92, Issuance of Amendment, as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequence of an accident previously evaluated?

Response: No. The proposed change does not alter the safety function of any structure, system, or component, does not modify the manner in which the plant is operated, and does not alter equipment out-of-service time. In addition, this request does not degrade the ability of the SRW system to perform its intended safety function. Therefore, the proposed change does not involve a significant increase in the probability or consequence of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No. The proposed change does not involve any physical changes to plant safety related structure, system or component or alter the modes of plant operation in a manner that is outside the bounds of the system design analyses. The proposed change to remove the mechanical interlock from the feeder breakers for SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B and to revise the SRW System Description in Section 9.2 of the UFSAR to describe the normal and alternate power sources for the SRW system does not create the possibility for an accident or malfunction of a different type than any evaluated previously in ESAs UFSAR. The proposal does not alter the way any safety related structure, system or component functions and does not modify the manner in which the plant is operated. Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No. The proposed change to remove the mechanical interlock from the feeder breakers for SRW MCCs 1A-A, 1B-B, 2A-A, and 2B-B and to revise the SRW System Description in Section 9.2 of the UFSAR to describe the normal and alternate power sources for the SRW system does not reduce the margin of safety because SRW will continue to perform its safety function. The design features provided by the mechanical interlock device are not described in the ESA UFSAR, are not credited in the ESA accident analysis, and do not provide any additional safety margin. The results of accident analyses remain unchanged by this request. Therefore, the proposed change does not involve a significant reduction in a margin of safety. Based on the above, LSA concludes that the proposed amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92 (c),

and accordingly, a finding of no significant hazards consideration is justified.

ENVIRONMENTAL CONSIDERATIONS:

A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined

in 10 CFR 20. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.