05000346/LER-2016-009, Regarding Reactor Trip Due to Rainwater Intrusion and Auxiliary Feedwater Actuation on High Steam Generator Level

Regarding Reactor Trip Due to Rainwater Intrusion and Auxiliary Feedwater Actuation on High Steam Generator Level

ML16319A097
Person / Time
Site:	Davis Besse
Issue date:	11/09/2016
From:	Boles B FirstEnergy Nuclear Operating Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
L-16-287 LER 16-009-00
Download: ML16319A097 (7)

LER-2016-009, Regarding Reactor Trip Due to Rainwater Intrusion and Auxiliary Feedwater Actuation on High Steam Generator Level

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(i)
3462016009R00 - NRC Website

text

FE NOC' RrstEnergy Nuclear Operating Company 5501 North State Route 2 Oak Harbor, Ohio 43449 Brian D. Boles Vice President, Nuclear November 9, 2016 L-16-287 ATTN: Document Control Desk United States Nuclear Regulatory Commission Washington, D.C. 20555-0001

Subject:

Davis-Besse Nuclear Power Station, Unit 1 Docket Number 50-346, License Number NPF-3 Licensee Event Report 2016-009 10 CFR 50-.73 419-321-7676 Fax: 419-321-7582 Enclosed is Licensee Event Report (LER) 2016-009-00, "Reactor Trip due to Rainwater Intrusion and Auxiliary Feedwater Actuation on High Steam Generator Level." This event is being reported pursuant to 10 CFR 50. 73(a)(2)(iv)(A).

There are no regulatory commitments contained in this letter or its enclosure. The actions described represent intended or planned actions and are described for information only. If there are any questions or if additional information is required, please contact Mr. Patrick J. McCloskey, Manager - Site Regulatory Compliance, at (419) 321-7274.

Sincerely, Brian D. Boles GMW Enclosure: LER 2016-009 cc: NRG Region Ill Administrator NRG Resident Inspector NRR Project Manager Utility Radiological Safety Board

NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 10/31/2018 (06-2016)

, the NRG may not conduct or sponsor, and a person is not required to respond to, the information collection.

1. FACILITY NAME i;

2-DOCKET NUMBER 3_ PAGE Davis-Besse Nuclear Power Station, Unit 1 05000 346 1 OF 6

4. TITLE:

Reactor Trip due to Rainwater Intrusion and Auxiliary Feedwater Actuation on High Steam Generator Level

5. EVENT DATE

6. LER NUMBER

7. REPORT DATE

8. OTHER FACILITIES INVOLVED I

SEQUENTIAL I REV FACILITY NAME DOCKET NUMBER MONTH DAY YEAR YEAR NUMBER NO.

MONTH DAY YEAR 05000 FACILITY NAME DOCKET NUMBER 09 10 2016 2016 -

009 -

00 11 09 2016 05000

9. OPERATING MODE

11. THIS REPORTIS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR §: (Check all that apply)

D 20.2201 (b)

D 20.2203(a)(3)(i)

D 50.73(a)(2)(ii)(A)

D 50.73(a)(2)(viii)(A) 1 D 20.2201 (d)

D 20.2203(a)(3)(ii)

D 50.73(a)(2)(ii)(B)

D 50.73(a)(2)(viii)(B)

D 20.2203(a)(1)

D 20.2203(a)(4l D 50.73(a)(2)(iiil D 50.73(a)(2)(ix)(A)

D 20.2203(a)(2)(i)

D 50.36(c)(1)(i)(A)

[81 50.73(a)(2)(iv)(A)

D 50.73(a)(2)(x)

10. POWER LEVEL D 20.2203(a)(2)(ii)

D 50.36(c)(1)(ii)(A)

D 50.73(a)(2)(v)(A)

D 73.71(a)(4)

D 20.2203(a)(2)(iii)

D 5o.3a(c)(2)

D 50.73(a)(2)(v)(B)

D 73.71(a)(5)

D 20.2203{a)(2)(iv)

D 50.46(a)(3)(iil D 50.73(a)(2)(v)(C)

D 73.77(aHp 100 D 20.2203(a)(2)(v).

D 50.73(a)(2)(i)(A) 0,50.73(a)(2)(v)(D)

D 73.77(a)(2)(il D 2Q.2203(a)(2)(vi)

D 50.73(a)(2)(i)(B)

D 50.73(a)(2)(vii)

D 73.77(a)(2)(ii)

D 50.73(a)(2)(i)(C)

D OTHER Specify in Abstract below or in

==DESCRIPTION OF EVENT==At some point during the night, a heavy rain storm passed through the area. Rain fell through the four open roof vents and onto the Main Turbine operating deck. At 0336 hours0.00389 days <br />0.0933 hours <br />5.555556e-4 weeks <br />1.27848e-4 months <br /> on September 10, 2016, an electrical ground alarm was received on Direct Current (DC) Bus 2 [EJ-BU], but no other plant impact immediately occurred. On the Northwest side of the Turbine deck, the water pooled on the floor beneath an open roof vent and spread across the floor. The water then ran down a vibration joint between the Turbine-Generator pedestal and the Turbine deck floor, falling onto the top of the Main Generator AVR cabinet. The rain water then migrated inside the AVR cabinet through conduit connections on the top of the cabinet. At 0343 hours0.00397 days <br />0.0953 hours <br />5.671296e-4 weeks <br />1.305115e-4 months <br />, with the unit at approximately 100 percent power, a lockout of the Main Generator occurred due to a loss of field. The generator lockout tripped the Main Turbine, which satisfied the Anticipatory Reactor Trip System logic, resulting in a trip of the Reactor Protection System (RPS). Initial unit response to the Reactor trip was as designed, and all control rods fully inserted.

Following the reactor trip, the control room operators observed Steam Generator 1 level rising due to a failure of the ICS to properly respond to the Reactor trip. Feedwater Loop 2 responded correctly to the reactor trip and controlled level in Steam Generator 2 at approximately 40 inches. The operators took manual control of the Main Feedwater Control valves and attempted to reduce Main Feedwater flow. However, the SFRCS actuated on high Steam Generator 1 level as level reached the 220 inch setpoint approximately one minute after the reactor trip. All SFRCS components responded as designed, with both AFW Pump Turbines starting, both MS IVs closing, and isolation of t~e Main Feedwater System.

CAUSE OF EVENT

The direct cause of the generator lockout and subsequent reactor trip was rain falling through an open roof vent onto the Turbine deck, which migrated into the AVR through one or more of the cabinet's conduit connections.

The root causes of the generator lockout and reactor trip were (1) Operations Shift Managers did not advocate adequate and timely compensatory actions to eliminate the risk to generation posed by rain falling onto energized equipment through a stuck open Turbine Building roof vent, and (2) station management 00 failed to recognize the roof vent rain issue as a potential imminent risk to generation. There are fourteen 4-foot by 8-foot smoke and heat vents in the Turbine Building roof, which are designed to automatically open at 165 degrees F due to a fusible link. Manual pull release handles also allow each vent to be opened without disturbing the fusible link. The roof vents had been routinely opened during warm weather to compensate for deficiencies in,the Turbine Building ventilation in order to reduce Turbine Building ambient temperatures. On August 14, 2016, it was identified that four of the roof vents could not be closed, including roof vent number 8 above the AVR. On the evening of August 17, 2016, operators noted water running from the Turbine deck (623 foot elevation) to the floor below (603 foot elevation) following a heavy rain storm due to roof vent 8.

being open. Maintenance personnel inspected the roof vents the following day to identify the necessary repairs, but no accelerated actions were taken beyond the normal work management process to repair the vents. Catch basins were installed below roof vent 8 on August 27, 2016, in attempt to collect the rain water to prevent it from affecting the equipment below.

==CAUSE OF EVENT==YEAR 2016

3. LER NUMBER SEQUENTIAL NUMBER 009 REV NO.

00 The direct cause of the high Steam Generator 1 level and resultant SFRCS actuation was a faulty output of ICS Module 5-6-6 which did not position the Main and Startup Feedwater Control Valves to the target positions as required, resulting in overfeeding of Steam Generator 1. The most probable cause of the module faulty output was degradation of an operational amplifier on the module.

The root cause of the high Steam Generator 1 level was that corrective actions taken to address the vulnerabilities in the ICS were not adequate to prevent future events. Contributing causes identified were 1) that the ICS including the RFR circuit are not safety related and in general are not fault tolerant, so a single failure can prevent the system from functioning as desired, and 2) that modifications to upgrade the ICS to make the system fault tolerant and corrective actions to develop RFR circuit testing were not performed.

Actions had been taken to mitigate the potential for ICS/RFR problems by creating/implementing preventive maintenance (PM) activities to periodically calibrate and refurbish ICS modules associated with RFR in accordance with industry standard practices. These actions did not eliminate the system vulnerabilities, however, they served to reduce the likelihood or frequency of occurrences.

ANALYSIS OF EVENT

All control rods inserted fully as designed. Following the Reactor trip, the SFRCS actuated due to high SG 1 level. All SFRCS components responded as designed, with both AFW Pump Turbines starting, both MSIVs closing, and isolating the MFW System.

To determine the risk significance of the initiating event (Reactor trip due to rain water intrusion), the currently

• effective Probabilistic Risk Assessment (PRA) Model was used with an initiating event of a Reactor/Turbine trip always occurring along with a loss of Main Feedwater as experienced and described below. Based on this, an Incremental Conditional Core Damage Probability of 4.14E-7 and an Incremental Conditional Large Early Release Probability of 9.59E-9 were calculated for the initiating event. Normalizing these values results in an estimated delta Core Damage Frequency of 4.14E-7 per year, and a delta Large Early Release Frequency of 9.59E-9 per year for the Reactor trip due to rain water intrusion, which are both considered to be of very low safety significance.

ICS Module 5-6-6, which was determined to be the cause of the improper control of Steam Generator 1 level following the Reactor trip, had been successfully calibrated during the previous refueling outage ending May 9, 2016. Utilizing a maximum exposure time of approximately 0.34 years in the PRA Model results in an estimated delta Core Damage Frequency of 2.0E-7/year and a delta Large Early Release Frequency of 6E-9/year, which are also both considered to be of very low safety significance. Because the delta Core Damage Frequency for this event was determined to be greater than 1 E-7 per year, the impact on external events was evaluated. Evaluation of the DBNPS Individual Plant Examination of External Events (IPEEE)

Fire PRA model yields a delta Core Damage Frequency of 6.60E-7 per year, which is considered to be of very low safety significance. This condition causes no increase in Seismic risk, so it also is considered to be of very low safety significance.

Reportability Discussion:

YEAR 2016

3. LER NUMBER SEQUENTIAL NUMBER 009 The automatic actuation of the RPS while the reactor is critical is reportable within four hours of occurrence per 10 CFR 50.72(b)(2)(iv)(B). The actuation of the Auxiliary Feedwater System by the Steam Feedwater Rupture Control System (SFRCS) on a valid high Steam Generator level is reportable within eight hours of the event in accordance with 10 CFR 50.72(b)(3)(iv)(A).. On September 10, 2016, at 0723 hours0.00837 days <br />0.201 hours <br />0.0012 weeks <br />2.751015e-4 months <br /> both of these events were reported to the NRG Operations Center (Event Number 52232).

REV NO.

00 These issues are being reported in accordance with 10 CFR 50.73(a)(2)(iv)(A), which requires reporting of any event or condition that resulted in manual or automatic actuation of the RPS, including a reactor scram or reactor trip, as well as automatic actuation of the Auxiliary Feedwater System. All safety systems performed as required to the event, and no loss of safety function occurred.

CORRECTIVE ACTIONS

Completed Actions:

The four failed Turbine Building roof vents were closed on September 10, 2016, via a temporary modification and tagged with instructions to not operate the roof vents without Senior Reactor Operator approval.

Additionally, an Operations Standing Order was issued on September 11, 2016, directing that the Operations Manager's permission was required to open any of the roof vents. The Standing Order will remain in place until configuration control steps are instituted in the Turbine Ventilation System Operating Procedure.

Five suspect modules in the ICS RFR Feedwater Loop 1 circuit were replaced with bench tested, refurbished modules on September 14, 2016, and field testing of the affected portion of the RFR circuit for Feedwater Loop 1 was performed and verified to function properly. The five modules removed were sent to a laboratory for failure analysis, which identified the most probable cause of the operational amplifier degradation on Module 5-6-6. Because of this degraded operational amplifier, all 14 spare signal lag modules in stock had the same operational amplifier replaced. Additionally, the work documents used by the laboratory to refurbish the ICS modules has been updated to require replacement of the operational amplifiers, transistors, and diodes as part of the refurbishment.

The conduit penetrations on the top of the AVR cabinet has been sealed to prevent future water intrusion events. While installed in the same location, the AVR cabinet that was installed in 2014 is physically different than the old cabinet, and is more vulnerable to water pooling on top of the cabinet, allowing it to eventually migrate inside the cabinet and affect the AVR circuitry.

Scheduled Actions:

A case study will be developed and presented to the Operations Senior Reactor Operators and to site Superintendents and Managers focusing on information turnover, use of the station operational challenge list, ensuring either compensatory or mitigating actions are addressed along with the ownership of directing these measures, recognition of elevated risk issues, and understanding of issues prior to management review board review of the issues.

The Turbine Building roof vent material deficiencies will be corrected.

==CORRECTIVE ACTIONS==YEAR 2016

3. LER NUMBER SEQUENTIAL NUMBER 009 REV NO.

00 The signal lag modules currently installed in the plant will be replaced with refurbished modules that have had the operational amplifiers replaced as described above.

A multi-functional team will be assembled to perform a review of the ICS to address system performance concerns. This review will include the following

1.

Recommend additional testing of the ICS RFR circuitry to verify system functions that are not checked during normal plant startups.

2.

Evaluate additional monitoring equipment to ensure RFR functions as required.

3.

Evaluate ICS module classifications to determine if single point vulnerabilities exist.

4.

Review industry operating experience for scram reduction recommendations, and verify lessons learned have been incorporated.

5.

Evaluate outstanding ICS modifications and recommendations for modifications to improve the reliability of the ICS Feedwater control.

PREVIOUS SIMILAR EVENTS

There have been no Licensee Event Reports (LERs) at the DBNPS in the past three years that were the result of rainwater intrusion.

LER 2016-001 documents a Reactor trip at the DBNPS on January 29, 2016, with an actuation of the SFRCS on high Steam Generator Level. In the January 2016 event, the RFR circuit did not actuate due to a miswired RFR defeat switch module that was installed in a previous outage. For the September 10, 2016 trip, the RFR circuit actuated, but only controlled level on one of the two Steam Generators, likely due to a degraded operational amplifier resulting in a module providing a faulty output. The corrective actions taken in response to the January 2016 event would not have prevented the September 10, 2016 event. Page 6 of 6