ML20212D350
| ML20212D350 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 09/21/1999 |
| From: | Stewart Bailey NRC (Affiliation Not Assigned) |
| To: | Campbell G CENTERIOR ENERGY |
| References | |
| NUDOCS 9909230095 | |
| Download: ML20212D350 (23) | |
Text
V _.
3
' September. 21, 1999' o
Mr. Guy G. Campbell, Vice President - Nuclear.
FirstEnergy Nuclear Operating Company.
5501 North State Route 2
.' Oak Harbor, OH' 43449-9760 e
1
SUBJECT:
FINAL ACCIDENT SEQUENCE PRECURSOR ANALYSIS OF EVENT AT DAVIS-BESSE NUCLEAR POWER STATION, UNIT 1 Dear Mr. Campbelli
' Ericlosed for your information is a copy of the final Accident Sequence Precursor analysis of the operational event at Davis-Besse Nuclear Power Station, Unit 1 (Davis-Besse) reported in Licensee Event Report (LER) No. 346/98-006. We prepared this final analysis (Enclosure 1)
! based on review and evaluation of your comments on the preliminary analysis and comments received from the NRC staff. Enclosure 2 contains our responses to your specific comments.
Our review of your comments employed the criteria contained in the material which accompanied the preliminary analysis. The results of the final analysis indicate that this event is a precursor for 1998.
~ Please contact me at (301) 415-1321 if you have any questions regarding the enclosures. We scognize and appreciate the effort expended by you and your staff in reviewing and providing comments on the preliminary analysis.
Sincerely, Original Signed By Stewart N. Bailey, Project Manager, Section 2 Project Directorate ill Division of Licensing Project Management Office of Nuclear Reactor Regulation
__ Docket No. 50-346 ~
Distribution w/encis:
Docket File TKing, RES
Enclosures:
. As stated PUBLIC
- PBaranowski, RES LPDill r/f SMays, RES ACRS GGrant, Rlli
. cc w/encis: See next page JZwolinski/SBlack
(
DOCUMENT NAME: 'G:\\PDill-20AVISBESOBASP9806.wpd To receive a copy of this document,Indicale in the box: "C" = Copy wthout enclosures "E" = Copy wtth enclosures "N" = No
/, O\\
l OFFICE PM:LPD3 -
E LA:LPD3 E SC:[PD3
\\
, NAME, SBaileyeif$
EBamhill fjY A$dfiola1 l
p lDATE 09/t!l /99 09/[6 /99 0@lM99 9909230095 990921
_ ici l
1 PDR ADOCK 05000346 S
PM 4
F Mr. Guy G. Campbell Davis-Besse Nuclear Power Station, Unit 1 FirstEnergy Nuclear Operating Company 1
cc:
Mary E. O'Reilly Robert E. Owen, Chief FirstEnergy Bureau of Radiological Health 76 South Main Street Service Akron, OH 44308 Ohio Department of Health P.O. Box 118 l
James L. Freels Columbus, OH 43266-0118 l
Manager - Regulatory Affairs FirstEnergy Nuclear Operating Company James R. Williams, Executive Director Davis-Besse Nuclear Power Station Ohio Emergency Management Agency 5501 North State - Route 2 2855 West Dublin Granville Road Oak Harbor, OH 43449-9760 Columbus, OH 43235-2206 l
' Jay E. Silberg, Esq.
Director Shaw, Pittman, Potts Ohio Department of Commerce and Trowbridge Division of Industrial Compliance 2300 N Street, NW.
Bureau of Operations & Maintenance l
Washington, DC 20037 6606 Tussing Road i
P.O. Box 4009 l
Regional Administrator Reynoldsburg, OH 43068-9009 i
U.S. Nuclear Regulatory Commission 801 Warrenville Road Ohio Environmental Protection Agency Lisle, IL 60523-4351 DERR-Compliance Unit ATTN: Zack A. Clayton Michael A. Schoppman P.O. Box 1049 i
Framatome Technologies incorporated Columbus, OH 43266-0149 1700 Rockville Pike, Suite 525 Rockville, MD 20852 State of Ohio Public Utilities Commission Resident inspector 180 East Broad Street U.S. Nuclear Regulatory Commission Columbus, OH 43266-0573 i
5503 North State Route 2 l
Oak Harbor. OH _43449-9760 Attomey General Department of Attomey James H. Lash, Plant Manager 30 East Broad Street l
FirstEnergy Nuclear Operating Company Columbus,OH 43216 Davis-Besse Nuclear Power Station 5501 North State Route 2 President, Board of County l
Oak Harbor, OH 43449 9760 Commissioners of Ottawa County Port Clinton, OH 43252 l
7, ~
LER No. 346/98-006 i
l LER No. 346/98-006 i
Event
Description:
A Tornado Touchdown Causes a Complete Loss of Ossite Power j
Date of Event: June 24,1998 Plant: Davis Besse Event Summary The Davis-Besse plant was in Mode 1 at 99 percent power at approximately 2040 on June 24,1998, when a severe thunderstorm cell moved into the area. Several minutes later, a tornado touched down either near or in the switchyard, causing damage to switchyard equipment and a complete loss ofossite power (LOOP). Prior to the touchdown of the tomado, the control room operators staned hth emergency diesel generators (EDGs).
He LOOP caused the turbine control valves to close in response to a load rejection by the main generator.
De reactor protection system (RPS) initiated a reactor trip on high reactor coolant system (RCS) pressure.
At 2118 on June 24, the licensee declared an Alert as prescribed by the plant's emergency procedures. On June 25,1998 at approximately 2330, following the restoration of the Ohio Edison ossite line, the EDGs were shut down. De Alert was subsequently downgraded to an Unusual Event at 0200 on June 26,1998, since one ossite power source had been restored. The Unusual Event was terminated at 1405 on June 26, when a second o# site power source was restored. He conditional core damage probability (CCDP) for this event is 5 6 x 10d Event Description i
At 1946 on June 24,1998, with the Davis Besse plant operating at approximately 99 percent power, a severe thunderstorm warning was issued for Ottawa County, Ohio by the National Weather Sersice. A few mirsutes later, this was upgraded to a tomado warning when a tornado was spotted approxiraately 1I miles northwest
. of Pon Clinton, Ohio. At 2040, a lightning strike caused a switchyard air circuit breaker (ACB) 34561 to open.
In addition, the lightning strike caused switchyard ACB 34562 to cycle three times. This ACB eventually stayed open. The senior reactor operator (SRO) instructed th operators to start the EDGs from the control room due to the severe weather conditions. Although EDG 2 started successfully, EDG 1 failed to start.
Therefore, the operators were instructed to attempt to start EDG 1 locally. EDG 1 started successfully.
Several minutes later, a tornado touched down in or near the switch yard, causing a complete loss of ofEite power. At the same time,' the plant computer system failed because of the loss of power to electrical distribution panel YAU.
Subsequent to the LOOP and the resulting reactor trip, all control rods inserted. The EDGs, which were already running, automatically connected to the respective emergency buses. Since the EDGs were running successfully, the station blackout dieselgenerator (SBODG) was not required. The two turbine-driven auxiliary I
I Enclowre 1
I LER No. 346/98 006 feedwater (TDAFW) pumps started successfully. Even though the TDAFW pumps operated successfully, the operators started the motor driven feed pump and used that pump to supply feedwater to the steam generators.
De LOOP had caused a loss ofpower to the reactor coolant pumps (RCPs). However, natural circulation was established and circolated the reactor coolant. The transient that followed the LOOP and the subsequent reactor trip caused the secondary system pressuie to rise. As a result, the main steam nfety valves (MSSVs) lifted to relieve pressure. De operators opened the atmospheric relief valves to control steam pressure. One of the MSSVs actuated below its setpoint and failed to fully rescat. However, as the head:r pressure decreased, that MSSV fully rescated. With all critical safety functions successful, at 2353, the operators commenced a plant cooldown.
With the offsite power sources still unavailable on June 25, the EDGs continued to supply power to the emergency buses. That day, the operator noted that the EDG room temperatures were increasing with time.
At 0817, the doors leading to the outside from both EDG rooms were opened in order to stop the temperature rise. The EDG room ventilating system is sized to maintain each " operating" EDG room at 120 deg. F assuning outside air at 95 deg. F. In spite of the opened door, the EDG 1 room temperature increased because the recirculation damper to the room had failed in the open position, which allowed hot outside air to enter the EDG room and eventually muse the room temperature to increase beyond its design value. In order to arrest the temperature rise in this EDG room, the operators mechanically disconnected and closed the recirculation damper. In addition, two portable fans were used to enhance air circulation. In spite of these compensatory actions, at 1313 the EDG 1 room temperature rose to 122*F. Finally, through the use of additional portable fans and blocking open the door between the EDG 1 room and the plant, the licensee successfully arrested the temperature rise, By 1640, the room temperature stabilized at il4*F. Although EDG 1 was declared inoperable per plant procedures because ofthe high EDG room temperature, it was in fact available to perform its safety function and provided essential electric power during the event. The recirculation damper in EDG 2.com had also failed in a slightly open position. He operator mechanically disconnected this damper. h was also put in the fully closed position. Unlike the situation with the EDG 1 room, this action, together with opening the EDG 2 room door to the outside, was sufficient to maintain the EDG 2 room temperature below ll3 *F.
In addition to the malfunctions experienced in controliing the EDG room temperatures, other complications were encountered in the process of transferring electrical power from the EDGs to the offsite power sources. At about 2100 on June 25, when attempts were made to transfer the power supply to buses C1/C2 from bus B (Bus B is powered from the offsite source.), circuit breaker ABDCI failed to close. The transfer was performed using a dead bus. While transferring power supply to buses Dl/D2 from the EDGs to the offsite source, EDG 2 fault and frequency alarms were received. The root cause of the malfunction that caused the alarms on EDG 2 was a failed open contact that affected the EDG's govemor.
Additional Event-Related Information In the event of a loss of offsite power, the EDGs provide power to the emergency buses. If both of the EDGs were to fail, then the plant's station blackout diesel generator (SBODG) will provide power to one of the emergency buses. When the SBODG successfully starts, it supplies its own auxiliaries. When the SBODG is in standby, the non-essential D2 bus supplies power to its auxiliaries. A 125V battery system is one of the SBODO auxiliaries. Dese batteries have sufficient capacity to maintain de control power and diesel-generator I
2
IJ LER No. 346/98-006 l
staning and loading ability. If bus D2 is not powered and the SBODG is not running, the SBODG batteries l
will deplete in 20 h. SBODG breaker AD 213 is normally closed and receives its control power from train 2 de distribution system. He SBODG fuel oil tank is separate from the EDGs' fuel oil tanks. It has enough caracity for an 8-h run at the rated load.
The SBODG and its auxiliaries (except the engine radiator) are located inside their own structure, which is located in a different part of the site from the EDGs. He structure was designed and built to meet the Ohio State Basic Building Code. Meeting this code assures protection for the SBODG from the most likely weather-related events that could cause a LOOP, such as rain, ice, or moderate to heavy straight winds (e.g., during I
a thunderstorm). However, it does not afford protection against damage from the effects of more severe weather conditions (e.g., tomado-caused missiles).- Although the SBODG engine radiator is located outside, it has been designed to withstand the same types ofweathe conditions as the SBODG enclosure (i.e., it is also i
vulnerable to tornado-generated missiles). He cabling associated with the SBODG is routed through a buried dect bank.
Modeling Assumptions This event was analyzed as a loss of offsite power due to extreme!y severe weather. The IRRAS-based models and analysis tools used by the ASP Program for precursor quantification automatically revised the probabilities for certain basic events and non-recovery probabilities to reflect the effect that extremely severe weather would have on the parameters used in the calculation of the likelihood of recovering offsite power, the probability of reactor coolant pump seal LOCA, and the likelihood of battery depletion. These included the probability that the EDGs and the SBODG will fail to start and run (increased from the nominal value of 3.6 x104 to 7.8= 104). De offsite power non recovery probabilities for the following basic events were all increased for this initiating event to 1.0 to reflect the anticipated longer times that would be required to recover offsite power: (1) OEP XHE-NOREC-ST (failure to recover offsite power in the short-term), (2) OEP.XHE-NOREC-2H (failure to recover offsite power within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />), (3) OEP-XHE NOREC-6H (failure to recover offsite power within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />), and (4) OEP XHE-NOREC-SL (failure to recover offsite power before RCP seal failure).
Duration of the LOOP event De LOOP event occurred at 2047 on June 24,1998. He first offsite power source, the Ohio Edison line was restored at 1926 on June 25,1998. In consideration of the abos e, this analysis used a 24-h duration for this LOOP event.
EDG 1 Failure to Start When the operators attempted to start the EDGs manually from t).e control room due to the severe weather warnings at 2044, EDG 1 failed to start. However, in the modeling of the event in the ASP analysis, the probability of random failure of EDG 1 (basic event EPS DGN-FC-DGA) was neither set to "TRUE" nor increased. The reasons for not changing the random failure probability are as follows:
i l
3 l
s
O LER No. 346/98-006
- 1. EDG 1 was started before the LOOP occurred. Although the operators originally had failed to start EDG I using the hand switch in the control roora, within two minutes,. operators had successfully started it i
manually.
- 2. Subsequent investigations concluded that the contact for the hand switch in the control room was defective, and that despite the bad contacts, if EDG I had received an automatic signal, it would have started l
successfully.
l Even though both EDGs were mnrung before the LOOP occurred, the EDG failure to start probability l
contribution was not removed from the overal! EDG failure probability. This was done in this analysis only because both EDGs were started only a few minutes before the LOOP. EDG 1 started approximately one minute before the LOOP, and EDG 2 started approximately three minutes before the LOOP. If the EDGs had been running for a significant amount of time before the LOOP occurred (e.g., for several hours), the EDG l
failure to start probability contribution would not have been considered in the analysis.
Switchvard ACB Failures l-During the storm, ACB 34561 opened. Subsequently, ACB 34562 cycled open three times and eventually l
stayed open. These two breakers imp;,ct the offsite power connections to the Davis-Besse site. These open breakers, together with damage to the switchyard, led to the loss ofoffsite power. Therefore, the impact of the condition of these breakers was implicitly captured in the CCDP assessment.
SBODG Vulnerability to Tornadoes Unlike the EDGs, the SBODG is not tomado missile-protected. Reasonable protection from high wind and tornado effects is provided to the SBODG as follows: First, the cabling associated with the SBODG is routed through a buried duct bank. Therefore, these cables are protected from tornado effects. Second, according to the FSAR, only the engine radiator of the SBODG is located outside. However, the radiator has been designed to withstand most types of outdoor conditions, except effects of the most severe weather (e.g., tornado-generated missiles). Finally, the SBODG is enclosed in a structure that meets the Ohio building code.
Although this structure provides protection against falling light debris, the building does not afford protection against tornado-generated rrissiles. Herefore, unlike the EDGs, the SBODG is vulnerable to missiles.
l References I and 2 document the damage incurred at the Davis-Besse site as a result of this tornado While l
there was damage to several onsite and offsite systems (e.g., offsite power, telephone system, meteorological tower instruments, turbine building roof), there was no evidence ofdamage caused by heavy missiles anywhere on the site, and no heavy missiles were observed during the storm. Most of the damage incurred by equipment i
and buildings as a result of the tornado was caused by high winds and accompanying heasy rain. That is, during this tornado (classified by the National Weather Service as "F2" due to wind speeds between 113 157 miles per hour), the relatively small target area of the station blackout diesel was not threatened by heasy missiles. De SBODG building is located at the southem edge of the site. It is not located near the turbine building or near the switchyard. Also,it is not on a straight line path between these two site structures. Most of the physical damage to structures due to the tornado which struck the site occurred at the switchyard and at the turbine building. Based on these considerations, this analysis assumed that the likelihood of failure of 4
l d
h
LER No. 346/98-006 the SBODG as a result of missiles, given that the tornado occurred, was negligible compared to the random SBODG failure probability of 0.078. A new basic event was added to the Davis-Besse model, ACP XHE-XE-ALT, to respresent the probability that the operator fails to align the SBODG.
Non-lE Power for SBODG Auxiliaries When the SBODG successfully starts, it supplies its own auxiliaries. However, if the SBODG is in standby, the non-essential bus D2 supplies power to the SBODG auxiliaries. If bus D2 were not powered, then some SBODG auxiliaries (e.g., SBODG battery) will degrade. Without recharging from either the SBODG or bus.
D2, the SBODG batteries will deplete in 2.0 h. Due to this and due to the need to power the motor-driven feed
. pump, the procedure gives high priority to powering bus D2 as soon as possible. During the event, the operators kept bus D2 powered.
Limited Capacity of SBODG Fuel Oil Tank The SBODG fuel oil tank is separate from the EDGs' fuel oi1 anks. It has enough capacity for an 8-h run at t
the rated load. Detailed procedures exist to refill the tank. Therefore, in comparison to the random failure of the SBODG (.078), the probability of failure to refill the SBODG fuel tank is low. Herefore, that failure probability is not explicitly modeled in this analysis.
Common Cause Failure Considerations between the SBODG and the EDGs The SBODG provides diversity against common cause failure (CCF) of the DGs. De CCF coupling mechanisms between the SBODG and the EDGs are rare. For example, the two EDGs and the SBODG are ofdifferent design. While the EDGs are cooled by service water, the SBODG is air-cooled. Unlike the EDGs, which are located in adjacent structures, the SBODG has its own structure. He SBODG does not share auxiliaries, such as fuel tanks, with the EDGs. The test and maintenance practices on the EDGs are different from those for the SBODG. For this reason, the IRRAS-based model for Davis Besse was modified to capture the distinction between the CCF considerations for the EDGs and those involving the SBODG Re failure probability for the basic event, EPS DGN-CF ALL, which represents the CCF probability for therwo EDGs and the SBODG, was reduced to 3.6= 10 to reflect the weak coupling among the three DGs. A new basic 4
event, EPS-DGN-CF AB,' was added to account for the common cause failure of the two EDGs. The probability for this basic event was estimated using Reference 5 to determine the alpha factor for 2/2 diesel failures. His resulted in an EDG CCF probability of 3.0= 10. He NRC's CCF database $ was resiewed 4
to identify events that could fail two EDGs as well as the SBODGs. Four such events were identified. During two of these events, the cold weather cornmon to the site caused the failures. During the other two events, biofouling of the diesel fuel oil caused the failures. Based on these four failures, the alpha factor used in the l
CCF calculations for 3/3 diesel failures was estimated to be 4.6 x 10d Eauipment Malfunctions De following equipment abnormalities were assumed to have no impact on the core damage probability (CDP):
5
LER No. 346/98-006 e Loss of power to the 120 V ac electrical distribution canel YAU.
During cleanup activities, it was discovered that the loss of offsite power, in combination with the loss of electrical distribution panel YAU, resulted in the condenstate polisher's isolation valves and the condensate recirculation valve failing open. This failure caused the release of condensate system resin to the hotwell, which in tum elevated the sulfate level in the secondary side water. Other consequences ofthis failure were speculated to be a loss ofinput to the safety parameter display system (SPDS). Even though the loss of j
the SPDS results in a loss of critical information on RCS parameters in a graphical display format, the j
operators have access to this information via other means. Derefoie, loss ofthis bus was assumed to have
]
no impact on CDP.
e Epilure of a MSSV to reseat.
When the reactor tripped as a result of the LOOP, this caused a pressure transient on the secondary side.
One main steam safety valve (MSSV) lifted below its set point, and did not fully rescat. However, when 1
the steam pressure dropped, this MSSV fully rescated. De impact of this degradation (desiation of the actual lift pressure from the setpoint) was assumed to be negligible, since the valve would reclose at a slightly lower pressure.
o Failure of the EDG 2 electronic novernor
)
After offsite power recovery, while power to busses Dl/D2 was being transferred from EDG 2 to offsite power, the EDG 2 electronic govemor failed. His failure was attributed to a contact pair failing to open.
This condition could have impacted the CDP if the EDG had to be stopped and re-started during the LOOP. De licensee's procedures do not specify the stopping and the restarting of the EDG during a LOOP. Further, the failure was easily recoverable. Derefore, this failure was assumed to have no impact on the CDP.
e Failure of the EDG 1 room ventilation recirculation damper.
As a result of the continued EDG 1 room heatup, the operators determined that the ventilation recirculation damper had failed open. His analysis did not increase the EDG " failure to run" probability in spite of this degradation, and assumed that the impact on CDP was negligible based on the following justification:
As illustrated by the actions pursued during this event, the operators had the capability to detect and o
take compensatory measurcs (opening doors, installing fans) to arrest the temperature rise.
o De maximum temperature reached was 125'F. Per plant procedures, this resulted in EDG 1 being declared inoperable, since it exceeded the 120 deg. F design parameter for the EDG ventilation system. Subsequent analysis performed by the licensee determined that the most limiting components temperature-wise in the rooms were the EDG differential relays, and that the limiting temperature for these relays was 131*F.
6 l
l I
p-l l
l
[
LER No. 346/98-006 l
l o
Although EDG 1 was declared inoperable per plant procedures, it was in fact available to perform its t
safety function and continued to provide essential electric power during the event.
e Dearaded EDG 2 ventilation recirculation damner.
The operators determined that the recirculation damper in the EDG 2 ventilation system had failed slightly open. However, the impact on the CDP attributed to this condition was assumed to be negligible due to l
the following:
l l
o As illustrated by actions taken during this event, the operators had the capability to detect and take compensatory measures (opening doors, installing fans) to arrest the temperature rise.
l o De maximum temperature reached was ll3*F.
e Failure of Circuit Breaker ABDCI.
After the initial recovery of offsite power, while the supply for bus Cl/C2 was being transferred from EDG 1 to offsite power, the breaker ABDCI failed to close. De transfer had to be accomplished sia a dead bus shortly thereafter. De condition that caused the breaker failure affected the recovery of offsite power.
However, it did not impact the capability to establish power from EDG 1 to the emergency bus. Further, it did not affect the capability of the EDG to continue to run. As illustrated, the breaker failure was easily compensated by providing offsite power to the emergency bus via an alternate path. Since this failure had no l
adverse impact on the this failure was not explicitly modeled in the CCDP calculations.
t ne automatic swanover of the CREVS train I from water-cooled mode to air-cooled.md e
De air cooled mode operated properly until the system was reset to the water-cooled mode. Herefore, there was no impact on the CDP.
l e Loss of power to ENS couloment and loss of all wind speed and direction i
ne loss of power to some equipment, such as sirens, and wind damage to the wind speed and direction sensors in the meteorological tower had some impact on emergency management and risk to the public.
However, there was no impact on the CDP.
l e Water intrusion into the turbine buildina cable trays and MCC E5.
l Rainfall that entered the turbine building through the storm-induced hole.in the roofcaused water intrusion in the cable trays. He impact of this on the CDP was assumed to be negligible since the cables that got wet were not safety-related, and water impinging on the cable jackets did not impact their functionality.
He water intrusion in MCC E5 caused damage (ground fault of circuit breaker). However, MCC E5 supplies non-essential lighting only. Derefore, this failure had no impact on the CDP.
7
(
LER No. 346/98-006 Analysis Results De CCDP estimated for this event is 4.1 10. All of the dominant sequences for this event involve station d
blackout sequences in which either the batteries are depleted or the RCP seals fail as result of the failure to recover offsite power in a timely manner. De dominant sequence, highlighted on the event trees in Figures 1 and 2, involves a station blackout sequence, LOOP Sequence 18-02 :
e a LOOP, e a successful reactor trip, a failure of emergency ac power,
e e a successful initiation of auxiliary feedwater, no challenge to the PORVs or the safety valves, e
sufficient cooling so that the RCP seals do not fail, and e
a failure to recover offsite power before the batteries are depleted, which leads to core damage.
e The next most dominant sequences, LOOP Sequences 18-09 and 18-11 in Fig. I and Fig. 2, contribute approximately 15% and 13%, respectisely, to the CCDP. LOOP Sequence 18-09 involves an SBO, failure to recover offsite power in the short term, and failure to recover offsite power before a seal LOCA occurs, leading to core damage. LOOP Sequence 18-11 involves an SBO, the PORVs open and reclose successfully, the RCP seals do not fail, and failure to recover offsite power before battery depletion, resulting in core damage.
All dominant cut sets include the failure of the EDGs and the SBODG, De duration of the LOOP event is a significant contribution.
Defmitions and probabilities for selected basic events are shown in Table 1. The conditional probabilities associated with the highest probability sequences are shown in Table 2. Table 3 lists the sequence logic associated with the sequences listed in Table 2. Table 4 describes the system names associated with the dominant sequences. Minimal cut sets associated with the dominant sequences are shown in Table 5.
Acronyms AFW auxiliary feedwater system CCDP conditional core damage probability CDP core damage probability EDG emergency diesel generator HPI high-pressure injection IPE integrated plant examination IRRAS Integrated Reliability and Risk Analysis System LOOP loss of offsite power MOV motor-operated valve PORV power-operated relief valve 8
\\
v-LER No. 346/98-006 r
l l
i PRA probabilistic risk assessment RCP reactor coolant pump SBO station blackout l
SGTR stcam generator tube rupture l
l SLOCA smallloss-of-coolant accident I
~ TRANS transient event References
- 1. LER 346/98-006, " Tornado Damage to Switchyard Causing Loss of Offsite Power." August 21,1998.
- 2. NRC Team Inspection Report 50-346/98012 (DRP), August 14,1998.
3.
Davis Besse Unit 1, Final Safety palysis Report.
4; Davis Besse Unit 1,IndwidualPlant Examination, February 26,1993.
- 5. Marshall, Rasmuson, and Mosleh, Common-Cause Failure Parameter Estimations, NUREG/CR-5497, October 1998.
l I
9 i
1 LER No. 346/98 006
$l 36668586885585588E8
~~----..
-a,,,,,,,
I lll1 1
_b l
an I;
lilll ill
, Ii i
i e
f I
l i
i Elll f'
I I
lll'i I
i,j a
fI f Ig ri iin lI lll-i,.
Bill Fig.1 Dominant core damage sequence for LER 346/98-006, 10
Fl-*
1 I
LER No. 346/98-006 gg 5855858885855858885858 l
--.....s::cosescasana i
ll l
.a up
'll i iii l ll l
~
lT l
l l
I
'l llll 1 l
185ll i
1 ll lIll i L
g ll 1 ll
.n n l
l Ill I all a t
Fig. 2 Dominant core damage sequence for LER 346/98-006.
I1 1
LER No. 346/98-006 i
Table 1. Definitions and Probabilities for Selected Basic Events for
{
LER No. 346/98-006 Modified Base Current for This Event Name.
Description Probability Probability Type Event IE-LOOP Initiating 1.6 E 005 1.0 Extremely severe Yes Event-LOOP weather LOOP IE-SGTR Initiating 1.6 E 006 0.0 Yes Event-Steam Generator Tube Rupture IE-SLOCA Initiating 2.3 E-006 00 Yes Esent-Small Loss-
)
of Coolant Accident (SLOCA) j ACP-XHE-BUS D2 Operator Fails to 10 E 002 1.0 E-002 NEW No Power Non.
Essential Bus D2 ACP-XHE XE-ALT Operator Fails to 1.0 E-002 1.0 E-002 NEW No Abgn SBODG EPS DGN-CF AB Common {suse 3 0 E 003 3 0 E-003 hTW No Failure of EDGs EPS DON-CF-ALL Common-Cause 3+ E-005 3 6 E-005 NEW No Failure ofEDGs and SBODG EPS DGN FC DGA EDG 1 Fails to Start 3 6 E 002 7 8 E 002 Extremely sesere Yes and Run weather LOOP EPS-DGN FC DGB EDG 2 Fails to Start 3.6 E-002 7.8 E 002 Extremely sesere Yes and Run weather LOOP EPS-DGN-FC SBO SBODG Fails to 3.6 E 002 7.8 E-002 Extreme!) Sesere Yes Start and Run weather LOOP LOOP 1842 NREC LOOP Sequence 18-8 0 E 001 8.0 E 001 No 02 Nonrecovery Probability - Failure to Recover Electric Power (EP)
LOOP-1849-NREC LOOP Sequence 18-8.0 E 001 8 0 E-001 No 09 Nonrecovery Probabihty - Failure to Recoser EP 12
LER No. 346/98-006 Table 1. Definitions and Probabilities for Selected Basic Events for
{
LER No. 346/98-006 (Continued)
Modified Base Current for This Event Name Description Probability Probability Type Event LOOP 18-11 NREC LOOP Sequence 18-I1 80E401 8 0 E 001 No Nontecovery Probabihty
- Failure to Recover EP LOOP-1818-NREC LOOP Sequence 18-18 8.0 E-001 8.0 E401 No Nonrecovery Probabihty
- Failure to Recover EP OEP XIE-NOREC-2H Operator Fails to 6 4 E402 1.0 Extremely severe Yes Recoser OfTsite Power weather LOOP Within 2 h OEP-XIE-NOREC-6H Operator Fails to 3.7 E.002 1.0 Extremely severe Yes Recover OfTsite Power weather LOOP Within 6 h OEP XIE NOREC-BD Operator Fails to 4.2 E-002 7.1 E-001 Extremely severe Yes Recover OfTsite Power weather LOOP Before Battery Depletion OEP XIE-NOREC ST Operator Fails to 2.4 E-001 1.0 Extremely severe Yes Recover Electric Power weather LOOP in Short Term OEP-XIE-NOREC SL Operator Fails to 6 8 E 001 1.0 TRUE Yes Recover OfTsite Power Before RCP Seals Fail PPR-SRV CO-SBO PORV'SRVs Open 3.7 E-001 3.7 E401 No During Station Blackout RCS-MDP-LK SEALS RCP Seals Fail Without 7.9 E403 8.3 E-002 Extremely severe Yes Cooling and Injection weather LOOP l
13 i
LER No. 346/98-006 i
Table 2. Sequence Conditional Probabilities for LER No. 346/98-006 l
Conditional l
Event tree Sequence core damage Percent i
name number probability contribution (CCliP)
'I8-02 3.0E-004 53.6 LOOP 18 11 1.8E-004 32.1 l
i LOOP 18-09 3.9E-005 7.0 i
LOOP 18 18 2.3E-005 4.1 LOOP 18-20 8.2E-006 1.5 h.)$5'J:Q)f(.
]
Total (all requences) 5.6E-004 l
l pqqp: :;;. +r Table 3. Sequence Logic for Dominant Sequences for LER No. 346/98-006 Event tree name Sequence Logic number LOOP 18-02
/RT L, EP, /AFW-L, /PORV-SBO,
/SEALLOCA, OP BD l
LOOP 18 11
/RT-L, EP, /AFW-L, PORV-SBO,
/PRVL RES, /SEALLOCA, OP BD I
LOOP 18-09
/RT-L, EP, /AFW-L, /PORV SBO, SEALLOCA, OP SL LOOP 18-18
/PRVL-RES, SEALLOCA, OP-SL LOOP 18-20
/RT-L, EP, /AFW L, PORV-SBO, PRVL-1ES, ACP ST 14
t LER No. 346/98-006 i
l l
Table 4. System Names for LER No. 346/98-006 l
System name Logic ACP-ST Offsite Power Recovery in Short-Term l
l AFW-L No or Insufficient EFW Flow During a LOOP i
EP Emergency Power Fails OP-BD Operator Fails to Recover Offsite Power Before Battery Depletion OP SL Operator Fails to Offsite Power Before a Seal LOCA l
Occurs PORV-SBO PORVs/ Safety Relief Valves Open During a Station l
Blackout l
PRVL RES PORVs and Block Valves and SRVs Fail to Rescat RT-L Reactor Fails to Trip During a LOOP l
SEALLOCA Reactor Coolant Pump Seals Fail During a LOOP 1
l l
t 15 l
l
LER No. 346/98-006 Table 5. Conditional Cut Sets for Higher Probability Sequences for LER No. 346/98-006 Cut set Percent Number Contribution CCDP' Cut sets LOOP Sequence 18-02 2.7E-004 T N N[ M id f 4
1 51.3 1.4 E-004 OEP-XIE-NOREC BD,/RCS MDP-LK SEALS,EPS-DGN FC-SBO, EPS-DGN-FC DGA, EPS-DGN-FC DGB, /PPR-SRV COL, LOOP 18-02 NREC 2
25 6.8 E-005 EPS-DGN-CF-AB,OEP-NOREC-BD,/RCS MDP-LK SEALS, EPS-DGN-FC-SBO,/PPR SRV CO L, LOOP.I8-02-NREC 3
6.6 1.8E-005 OEP-XHE NOREC-BD,/RCS MDP-LK-SEALS, ACP-XHE-XE-ALT, EPS-DGN FC-DGA, EPS-DGN-FC-DGB, /PPR-SRV CO-L, LOOP 18 02 NREC 4
6.6 1.8E-005 OEP XlE-NOREC BD, ACP XIE-BUS-D2, /RCS-MDP-LK SEALS, EPS'DGN FC DGA,EPS-DGN FC DGB, /PPR SRV-CO-L.
LOOP 18-02 NREC 5
3.9 1.1 E-005 EPS DGN-CF ALL,OEP XIE NOREC-BD, / RCS MDP-LK-SEALS OEP XIE-NOREC SL, PPR SRV-CO-L, LOOP.I8-02-NREC 6
3.2 8.8E-006 EPS-DGN CF-AB, OEP-XIE-NOREC-BD, /RCS-MDP-LK-SEALS, ACP-XHE-XE-ALT, /PPR-SRV-CO-L, LOOP-18-02-NREC 7
3.2 8.8E-006 EPS-DGN-CF-AB, OEP-XHE-NOREC BD, ACP-XHE-BUS-D2, IRCS-MDP-LK-SEALS, /PPR-SRV-CO-L, LOOP-18-02 NREC LOOP Sequence 18-09 6.0 E-005 g
9,, '5,
a W :t 1
51.3 3.1E-005 OEP-XHE-NOREC-SL, RCS-MDP-LK-SEALS, EPS-DGN-FC-SBO, EPS-DGN-FC DGA, EPS-DGN-FC-DGB, /PPR-SRV-CO-L.
LOOP 1849-NREC 2
25 1.5E-005 EPS DGN-CF AB, OEP XHE NOREC SL, RCS-MDP LK SEALS, j
EPS-DGN-FC-SBO, /PPR SRV-CO-L, LOOP 18-09-NREC i
3 6.6 4.0E-006 OEP XHE-NOREC-SL, ACP-XHE-BUS-D2, RCS-MDP-LK-SEALS, EPS-DGN FC-DGA, EPS-DGN-FC-DGB, /PPR SRV-CO-L, i
LOOP 18-09-NREC J
4 6.6 4.0E-006 OEP XHE-NOREC SL,RCS-MDP-LK SEALS, ACP-XHE-XE-ALT, EPS-DGN-FC DGA, EPS DGN-FC-DGB, /PPR SRV-CO-L, LOOP-18-09 NREC 16 w.
p I
LER No. 346/98-006
\\
l l
Table 5, Conditional Cut Sets for Higher Probability Sequences for LER No. 346/98-006 (Continued)
Cut set Percent Number Contribution CCDP' Cut sets 1
5 3.9 2.3E-006 EPS-DGN-CF ALL,OEP XIE-NOREC-SL,RCS-MDP LK-SEALS, l
/PPR SRV CO L, LOOP 18 09-NREC 6
3.2 1.9E-006 EPS-DON CF-AB, OEP-XIE.NOREC-SL, RCS-MDP-LK SEALS, l
ACP-XHE-XE-ALT, /PPR SRV-CO L, LOOP-18-09-NREC l
7 3.2 1.9E-006 EPS-DGN CF AB, OEP-XHE NOREC-SL, ACP XHE BUS-D2, RCS-MDP-LK SEALS, /PPR SRV-CO-L, LOOP-18-09-NREC l
LOOP Sequence 18-11 5.2E-005 58$N$ CN[$NMMEIC.
l 1
51.3 2.7E-005 OEP-XHE-NOREC-BD, /RCS-MDP LK SEALS, EPS-DGN-FC-SBO, EPS-DGN-FC-DGA EPS-DGN-FC-DGB, PPR-SRV-CO-L, t
l LOOP-18 ll-NREC l
l 2
25.0 1.3E-005 EPS-DGN-CF AB, OEP-XHE-NOREC BD, /RCS-MDP LK-SEALS, EPS-DGN-FC SBO, PPR-SRV-CO-L, LOOP-18-11-NREC i
l 3
6.6 3.4E-006 OEP XIE-NOREC-BD,/RCS-MDP-LK-SEALS, ACP-XIE-XE-ALT, l
EPS DGN FC-DGA, EPS-DGN-FC DGB, PPR SRV-CO-L, LOOP-18-11-NREC 4
6.6 3.4E-006 OEP-XIE NOREC-BD, ACP-XIE BUS-D2,/RCS-MDP-LK-SEALS, EPS-DGN-FC-DGA, EPS-DGN FC-DGB, PPR SRV-CO-L, LOOP-18-il NREC 5
3.9 5.6E-006 EPS-DGN-CF-ALL, OEP-XIE-NOREC-BD, /RCS-MDP LK SEALS, PPR-SRV-CO-L, LOOP-18-11-NREC 6
3.2 1.7E-006 EPS-DGN-CF-AB, OEP-XHE NOREC BD, /RCS-MDP-LK-SEALS, ACP-XIE-XE ALT, PPR-FRV-CO L, LOOP 18-11 NREC 7
3.2 1.7E-006 EPS-DGN-CF-AB, OEP XIE-NOREC-BD, ACP X11E-BUS D2, j
/RCS MDP-LK SEALS, PPR SRV-CO-L, LOOP-18-11-NREC
~ w m e n n,.e,,W, SM;s@an..m;g.
m;m
!/$wgsv.'y&
l LOOP Sequence 1818 1.2E-005 I
51.3 5.9E-006 OEP-XIE NOREC-SL, RCS-MDP-LK SEALS.EPS-DGN FC-SBO, EPS-DGN-FC-DGA, EPS-DGN-FC-DGB, PPR-SRV CO L, LOOP 1818-NREC 2
25 2.9E-006 EPS-DGN-CF-AB, OEP-XIE-NOREC-SL, RCS-MDP-LK SEALS, EPS-DGN-FC-SBO, PPR SRV-CO-L, LOOP-18-18-NREC 3
6.6 7.5E-007 OEP XIE-NOREC-SL, ACP-XIE-BUS-D2, RCS-MDP-LK SEALS, EPS-DON-FC-DGA, EPS-DGN-FC-DGB, PPR SRV CO-L, l
LOOP 18-18-NREC 17 l
1o
r,'
LER No. 346/98 006 1
Table 5, Conditional Cut Sets for Higher Probability Sequences for LER No. 346/98-006 (Continued)
Cut set Percent Number Contribution CCDP' Cut sets 4
6.6 7.5E-007 OEP-XHE-NOREC-SL, RCS-MDP-LK-SEALS, ACP-XHE-XE-ALT, EPS-DGN-FC DGA, EPS-DGN-FC-DGB, PPR-SRV-CO-L, LOOP 18-18-NREC 5
3.9 4.5E-007 EPS-DGN CF-AI), OEP-XHE-NOREC-SL, RCS-MDP-LK-SEALS, PPR-SRV-CO L, LOOP 1818-NREC 4
6 3.2 3.7E-007 EPS-DGN-CF-AB, OEP-XHE NOREC-SL, RCS-MDP-LK-SEALS, ACP-XHE-XE-ALT, PPR-SRV-CO.L. LOOP-18-18-NREC 7
3.2 3.7E-007 EPS-DGN-CF-AB, OEP-XHE-NOREC-SL, ACP-XHE BUS-D2, RCS-MDP-LK-SEALS, PPR SRV-CO L, LOOP 18-18-NREC Total (all sequences) 4.1 E-004
" Y,5 * < ".
~ $$, $ M 7,
- The conditional probabihty for each cut set is determined by multiplying the probabihty of the initiating event by the probabihties of l
the basic events in that minimal cut set. The probabihties for the initiating events and the basic events are given in Table 1.
18
I i
i i
LER No. 346/98-006 1
I LER No. 346/98-006 Event
Description:
A Tornado Touchdown Causes a Complete Loss of Offsite Power Date of Event: June 24,1998 Plant: Davis-Besse Licensee Comments
Reference:
Letter from Guy G Campbell, Vice President - Nuclear, to U. S. Nuclear Regulatory Commission, " Comments on Preliminary Accident Sequence Precursor Analysis ofJune 24, 1
1998 Operational Event at Davis-Besse Nuclear Power Station, Unit Number 1," March 27, 1999.
l Comment 1:
Page 2 of the preliminary ASP analysis, Event Description, states that the emergency diesel generators (EDGs) are qualified to 120'F. This is not correct in that the only design l
characteristic that relates to this temperature value is the EDG Room ventilation system that is sized to maintain each " operating" EDG room at 120*F assuming 95'F outside air (Reference USAR 9.4.2.1.2.3). The elevated temperatures wii! only affect the 40-year life of the EDG in terms of days (based on continuous operatien during this period). Therefore, l
although the EDG was declared inoperable per plant procedures, it w as in fact available and j
continued to provide essential electric power during the event.
Response 1:
The discussion about the problems regarding control of the temperature in the EDG rooms contained in the first full paragraph on page 2 of the analysis report has been revised to state that the EDG room ventilation system is sized to maintain each operating EDG room at 120*F, as pointed out by the comment.
As noted in the discussions on 5 and 6 of the preliminary analysis report, the analysis assumed that the impact of the EDG room temperature on the core damage probability was negligible.
Hence, no changes in the analysis assumptions were necessary to address this comment.
Comment 2:
Page 6 of the preliminary ASP analysis, third bullet of Failure of EDG 1 room ventilation recirculation damner. states the maximum room temperature reached was 122*F. The 1
May 19,1999
[.
l, i
LER No. 346/98-006 maximum temperature recorded for the EDG 1 room, as cited in Potential Condition Adverse to Quality Report (PCAQR) 981294, was 125'F at i135 hours on June 25,1998.
Response 2:
The second bullet under Failure of the EDG 1 room ventilation recirculation damoer in the analysis report has been revised to provide the correct maximum temperature.
Comment 3:
Page 6 of the preliminary ASP analysis, third bullet of Failure of EDG 1 room ventilation recirculation damper, also reflects that a 120'F room temperature is an " operability limit,"
which is incorrect as it relates to qualification of the EDGs. Per comment I above, this is a procedural operability limit and a design parameter for the ventilation system.
Response 3:
The second bullet under Failure of the EDG 1 room ventilation recirculation damner in the analysis report has been revised to provide the correction and associated clarification identified in the comment.
Comment 4:
Page 6 of the preliminary ASP analysis, third bullet of Failure of EDG 1 room ventilation recirculation damper. states that the most limiting temperature ofcomponents in the room was 132'F. Evaluation of control cabinet components for PCAQR 98-1294 indicated that the EDG differential relays were the most limiting components, being certified for continuous operation at 55'C (131 *F).
Response 4:
The second bullet under Failure of the EDG I toom ventilation recirculation damper in the analysis report has been revised to provide the correction and associated clarification identified in the comment.
Comment 5:
ne Analysis Results on page 7 of the ASP analysis assumed that a reactor coolant pump (RCP) seal Loss of Coolant Accident (LOCA) could occur despite the loss of the RCPs due to failure of offsite power. This is not consistent with the seal failure model used in the DBNPS Probabilistic Safety Assessment (PSA). The seal failure model used by DBNPS is described in detail in the DBNPS IPE, Part 3, Section 4.4.3, submitted by Serial Number 2119, dated February 26,1993. It was concluded, based on testing and the design of the Byron Jackson RCP seal, that the seals will not experience gross leakage due to loss of support systems ss long as operators take appropriate actions to trip the RCP (Reference DB.
2 May 19,1999
f LER No. 346/98 006 OP-02523, Component Cooling Water System Malfunctions). He DBNPS PSA model incorporates this conclusion by tssuming a RCP seal LOCA only ifplant operators fail to trip i
the affected RCP. This approach is consistent with other plants using Byron Jackson pumps and the same model/ design seals. For the June 24,1998, event, the RCPs tripped upon loss of offsite power; therefore, a RCP seal LOCA should not be assumed anytime offsite power is not available.
Response 5:, ne RCP seal model used in the p climinary analysis was based on an earlier understanding of RCP seal failure mechanisms at Davis Besse. He model has been revised to reflect our current understanding of the potential for seal failure given a station blackout for Byron Jackson RCP seals, based on seal performance during historically observed losses of seal cooling of greater than I h (including the 8 h loss of seal cooling test involving a Byron-Jackson N-9000 seal referred to in the Davis-Besse PSA). He revised model results in a somewhat reduced probability of seal failure compared to the preliminary analysis. As a result, RCP seal LOCA-related sequences also have lower probabilities compared to the preliminary analysis. However, this decrease is offset by an additional change which was made to the model used in the preliminary analysis (see the discussion that follows). The final CCDP estimated for the event is 5.6 x 10d RCP seal LOCA sequences are a minor contributor [~11%] to this value.
When modifications were being made to the IRRAS-based model for Davis-Besse (SPAR model) used in the ASP analysis to address the comment regarding the RCP seal failure model, an error was discovered in the model logic. The specific model for Davis-Besse did not correctly model the probability that the pressurizer power-related relief valve would be challenged in the event of a station blackout. Instead, the model used in the preliminary analysis had used the PORV challenge probability for sequences invohing a loss ofoffsite power with successful emergency power system operation, which is 0.16. To correct this, the modeling logic was modified to use the appropriate challenge probability, which is 0.37. His value was obtained from a review of relevant operational experience data reported in LERs.
When this change was combined with the RCP seal failure model changes discussed above, the net effect was a slight increase (-36%) in the estimated CCDP compared with the preliminary analysis.
D 3
May 19,1999