ML21022A415

8/10/2020 MD 8.3 Evaluation - Duane Arnold Energy Center - Loss of Offsite Power Event

ML21022A415
Person / Time
Site:	Duane Arnold
Issue date:	01/22/2021
From:	NRC/RGN-III
To:
Shared Package
ML21022A414	List: ML21022A415 ML21022A418
References
Download: ML21022A415 (14)

Text

MD 8.3 Evaluation Decision Documentation for Reactive Inspection (Deterministic and Risk Criteria Analyzed)

PLANT: Duane Arnold EVENT DATE: 8/10/2020 DETERMINISTIC CRITERIA Energy Center EVALUATION DATE: 8/11/2020 On August 10th, 2020, at approximately 12:45 p.m. (all times in CDT), severe thunderstorms and high winds (upwards of 100+ mph gusts) near the Duane Arnold Energy Center area caused a grid perturbation, which led to an automatic start of both Emergency Diesel Generators (EDGs). The EDGs ran unloaded for approximately 5 minutes.

At 12:49 p.m., due to additional damage caused to offsite power lines and the switchyard by the severe thunderstorm and high winds, a loss of offsite power occurred. The main generator tripped, subsequently tripping the reactor. The EDGs were already running and picked up essential loads. The licensee declared a Notice of Unusual Event per SU 1.1 (loss of offsite power).

Shortly after the EDGs started up, the B ESW strainer was taken to bypass due to high differential pressure caused by river debris. This configuration caused the B EDG to be declared inoperable but available and the licensee continued to run the B EDG as a source of 4KV power to essential loads. While in this configuration, the B EDG was at a higher risk of silting/particulate fouling of its cooling system, though the licensee monitored EDG parameters and performed hourly walkdowns with no adverse trends noted. The potential for additional/time-delayed river fouling due to the storm was discussed as a potential common cause failure mechanism for the ESW system, although no indications of further fouling have occurred since. The initial influx of storm-borne river debris (e.g., leaves and sticks) appeared to be a one-time occurrence due to the traveling water screens being in automatic at the time (i.e., not at full speed), which allowed some material bypass. The licensee subsequently set the traveling water screens to full speed, which precluded any additional bypass fouling downstream into the ESW system.

This event did highlight the potential for a single external event, in this case a derecho, to have an adverse effect (potential common cause failure mechanism of river debris fouling) on both trains of ESW and EDGs. RIII has provided this information to NRR/IOEB for their consideration for action as appropriate.

Reactor parameters were maintained with High Pressure Coolant Injection/Reactor Core Isolation Cooling and the Safety Relief Valves. The plant remained stable and the Senior Resident Inspector (SRI) responded to the site. Based on the SRIs initial assessment, the operators and plant systems responded appropriately to this complicated event to ensure plant safety.

Prior to the onset of the storms, the licensee was loading fuel into a spent fuel canister. These fuel moves were stopped by the Shift Manager prior to the storms striking the site and the fuel and canister were in a safe condition in the spent fuel pool. During the transient, the B train of fuel pool cooling, which was in service at the time, tripped. The A train was immediately started successfully, and with a spent fuel pool time--to--boil of greater than 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br />, there was no loss of the fuel pool cooling safety function. The cause of the B pump trip was

discovered to be due to a blown fuse in the control power circuit.

All other safety functions (RHR, secondary containment, etc.) remained functional throughout the event. Additionally, there were no safety system functional failures reported by the licensee per 10 CFR 50.72/NUREG-1022, nor identified by inspectors at this time.

Security posture was maintained as required. Minor security-related equipment issues were experienced due to the storm but were appropriately addressed by the licensee.

No injuries occurred on-site. The licensee provided minimum staffing to its Technical Support Center (TSC) with personnel who were already on-site. The TSC diesel provided power to the TSC.

Severe damage occurred to the cooling towers (non-safety related). The loss of the cooling towers did not preclude the ability to shut/cool down the plant.

Superficial damage to the Reactor and Turbine Building metal sheeting occurred (i.e., some panels were torn off). There was water intrusion into some areas of the buildings which the licensee has identified, cleaned up, and compensated for as needed.

Damage was sustained in the switchyard where some of the offsite power lines became entangled and one of the towers that supports an offsite line fell over. The licensee and ITC (local transmission company) worked to clean up the debris and fully restore offsite power.

At 1200 on August 11, 2020, the Vinton offsite line (161 KV) was energized. At 1217, the startup transformer was energized through the East bus. At 1335, offsite power was restored to the essential buses and the EDGs were unloaded and placed in standby. At 1600, Duane Arnold Energy Center exited the Unusual Event.

Y/N DETERMINISTIC CRITERIA N a. Involved operations that exceeded, or were not included in the design bases of the facility Remarks: As of the date of this evaluation, operation of the plant following the reactor trip and LOOP did not exceed design basis limitations.

N b. Involved a major deficiency in design, construction, or operation having potential generic safety implications Remarks: Based on the information reviewed by the inspectors following this event, no major deficiency in design, construction, or operation having potential generic safety implications were identified.

N c. Led to a significant loss of integrity of the fuel, primary coolant pressure boundary, or primary containment boundary of a nuclear reactor Remarks: There was no loss of integrity to the fuel, primary coolant pressure boundary, or containment.

2

N d. Led to the loss of a safety function or multiple failures in systems used to mitigate an actual event Remarks:

This weather event caused a loss of all offsite power sources. Both EDGs started up and supplied power to the 4 KV safety buses as designed.

With respect to the Emergency Alternating Current (EAC) safety function, the Emergency Diesel Generators provided the required 4KV EAC to the safety buses, as designed.

It is fully acknowledged that offsite power is important to risk in that it is the normal, primary power supply to the plant. When it was lost, it resulted in a complicated transient, which is the initiator (LOOP) that dominates the risk profile at DAEC.

Although this event did cause multiple failures to offsite power availability (all six offsite power sources were lost to the site) with damage to area power lines and the onsite switchyard, offsite power is not assumed to be available in any design basis analyses and is non-safety related. The EDGs, the system designed to mitigate the consequences of this actual event, functioned satisfactorily thereby maintaining this safety function until offsite power was restored approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> later.

N e. Involved possible adverse generic implications Remarks: At the time of completion of this evaluation, no generic implications were identified.

N f. Involved significant unexpected system interactions Remarks: Did not involve significant unexpected system interactions.

N g. Involved repetitive failures or events involving safety-related equipment or deficiencies in operations Remarks: No repetitive failures occurred N h. Involved questions or concerns pertaining to licensee operational performance Remarks: No questions or concerns pertaining to licensee operational performance 3

CONDITIONAL RISK ASSESSMENT RISK ANALYSIS BY: J. Hanna RISK ANALYSIS DATE: 8/12/2020 Brief Description of the Basis for the Assessment (may include assumptions, calculations, references, peer review, or comparison with licensees results):

Though a detailed risk analysis was not required, a regional Senior Reactor Analyst (SRA) performed one because the risk from LOOP events was known to be high at Duane Arnold.

Additionally, knowing that inspectors were responding to the site, the region wanted to generate risk insights and to provide suggested items for inspectors to review in the first few hours following the event.

The Duane Arnold SPAR model was used for this analysis and the following adjustments were made:

• The initiating event frequency was set to 1.0 (because an actual event occurred).

• The Mitigating Strategies equipment (commonly known as FLEX) was used with the nominal values established in all SPAR models.

• Test and maintenance values were set equal to zero. (The SRA validated through discussions with the inspectors that all risk significant equipment was functional and available when the event occurred.)

• The offsite recovery probabilities for offsite power were not adjusted and were left at their nominal values. Offsite power was recovered by the licensee approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the event.

• Significant debris was generated by the derecho and this debris affected the Cedar River which is the ultimate heat sink for DAEC. The B Essential Service Water strainer reached 15 psid during the event and per operating procedures was bypassed.

The B EDG was declared inoperable but was considered functional and remained running during the event. The A strainer reached 11 psid and remained in service.

Based on the potential challenge to the ESW system and the supported equipment, the individual failure probability of the B Essential Service Water strainer was adjusted to various values in order to create sensitivity results. The values were adjusted from a lower end of 1E-2 up to 0.5. The common cause value for both strainers failing was not adjusted in the analysis though that approach could have been taken.

The dominant sequence was a weather-related LOOP where the reactor successfully trips, but on-site power from the EDGs fails and recovery of offsite and onsite power fails. The ICCDP results (mean values) when adjusting for B ESW strainer failure probabilities ranged from 2E-4 to 2E-3. In evaluating the stochastic uncertainty, the range of results varied more significantly with the lowest results (the 5 percent value) at 4E-5 and the highest results (the 95 percent value) at 5E-3.

The estimated conditional core damage probability (CCDP) is ranged from 2E-4 to 2E-3 and places the risk in the range of AIT-IIT inspection.

4

RESPONSE DECISION USING THE ABOVE INFORMATION AND OTHER KEY ELEMENTS OF CONSIDERATION AS APPROPRIATE, DOCUMENT THE RESPONSE DECISION TO THE EVENT OR CONDITION, AND THE BASIS FOR THAT DECISION DECISION AND DETAILS OF THE BASIS FOR THE DECISION:

Due to Resident Inspector office staffing issues (SRI affected by the weather event and having no resident assigned to the plant), the Division of Reactor Projects, Branch 2, with insights from the regional SRA, recommends sending one to two inspectors to Duane Arnold, to perform event response follow-up and inspection under the baseline inspection program. The inspector(s) will perform a verification of the licensees event response; including operator response in the control room, plant SSC response to the event, and licensee event response.

The operating experience group is aware of this event and will consider the specifics for further learnings and dissemination.

Based on the initial assessment of the responding inspectors there are presently no significant issues of concern identified. The inspectors observed what they could with respect to operator and SSC performance during, and in response to, this event. The inspectors performed independent walkdowns of storm damage and SSCs and reviewed licensee corrective action documents and testing procedures to validate these conclusions.

The Branch will re-evaluate this decision if additional information is available that changes the answer to any deterministic criterion or risk assessment inputs.

BRANCH CHIEF: /RA/ by April Nguyen, Acting Chief, DATE: 9/14/2020 Branch 2, Division of Reactor Projects SRA: /Non-Concur/ by John Hanna, Senior Reactor DATE: 1/22/2021 Analyst DIVISION DIRECTOR: /RA/ by Mohammed Shuaibi, DATE: 1/7/2021 Director, Division of Reactor Safety DIVISION DIRECTOR: /RA/ Julio Lara, Director, Division DATE: 1/22/2021 of Reactor Projects DEPUTY REGIONAL ADMINISTRATOR: /RA/ Kenneth DATE: 1/22/2021 OBrien, Deputy Regional Administrator ADAMS ACCESSION NUMBER: ML21022A415 EVENT NOTIFICATION REPORT NUMBER (as applicable): 54826 Note to preparer: If the decision was NOT to perform a reactive inspection, you must complete the rest of the form to fully document the basis for not performing a reactive inspection.

Internal Distribution List is at the end of this document.

5

Decision Documentation for Reactive Inspection (Deterministic-only Criteria Analyzed)

PLANT: Duane Arnold EVENT DATE: 8/10/2020 EVALUATION DATE: 8/11/2020 Energy Center REACTOR SAFETY Y/N IIT Deterministic Criteria N Led to a Site Area Emergency Remarks: None.

N Exceeded a safety limit of the licensee's technical specifications Remarks: None.

N Involved circumstances sufficiently complex, unique, or not well enough understood, or involved safeguards concerns, or involved characteristics the investigation of which would best serve the needs and interests of the Commission Remarks: None.

Y/N SI Deterministic Criteria N Significant failure to implement the emergency preparedness program during an actual event, including the failure to classify, notify, or augment onsite personnel Remarks: None.

N Involved significant deficiencies in operational performance which resulted in degrading, challenging, or disabling a safety system function or resulted in placing the plant in an unanalyzed condition for which available risk assessment methods do not provide an adequate or reasonable estimate of risk.

6

Remarks: The B ESW strainer was taken to bypass due to high differential pressure. This configuration caused the B EDG to be declared inoperable but available and the licensee continued to run the B EDG as the source of 4KV power to essential loads with the A ESW strainer and A EDG in standby. While in this configuration, the B EDG was at a higher risk of silting/particulate fouling of its cooling system, though the licensee monitored EDG parameters and operations performed hourly walkdowns with no adverse trends noted. With EDG A operable and in standby, the plant remained in a fully analyzed condition. The potential for additional/time-delayed river silting/fouling due to the storm on 8/10 was discussed as a potential common cause failure mechanism for the ESW system, though no indications of further fouling have occurred since. The initial influx of storm-borne river debris (e.g., leaves and sticks) appeared to be a one-time occurrence due to the traveling water screens being in auto at the time (i.e., not at full speed), which allowed some material bypass. The licensee subsequently set the traveling water screens to full speed, which precluded any additional bypass fouling downstream into the ESW system.

This event did highlight the potential for a single external event, in this case Derecho, to have an adverse effect on both trains of ESW and or EDGs, the operating experience group is aware of this event and will consider the specifics for further learnings and dissemination.

RADIATION SAFETY Y/N IIT Deterministic Criteria N Led to a significant radiological release (levels of radiation or concentrations of radioactive material in excess of 10 times any applicable limit in the license or 10 times the concentrations specified in 10 CFR Part 20, Appendix B, Table 2, when averaged over a year) of byproduct, source, or special nuclear material to unrestricted areas Remarks: None.

N Led to a significant occupational exposure or significant exposure to a member of the public. In both cases, significant is defined as five times the applicable regulatory limit (except for shallow-dose equivalent to the skin or extremities from discrete radioactive particles)

Remarks: None.

N Involved the deliberate misuse of byproduct, source, or special nuclear material from its intended or authorized use, which resulted in the exposure of a significant number of individuals Remarks: None.

N Involved byproduct, source, or special nuclear material, which may have resulted in a fatality Remarks: None.

7

N Involved circumstances sufficiently complex, unique, or not well enough understood, or involved safeguards concerns, or involved characteristics the investigation of which would best serve the needs and interests of the Commission Remarks: None.

Y/N AIT Deterministic Criteria N Led to a radiological release of byproduct, source, or special nuclear material to unrestricted areas that resulted in occupational exposure or exposure to a member of the public in excess of the applicable regulatory limit (except for shallow-dose equivalent to the skin or extremities from discrete radioactive particles)

Remarks: None.

N Involved the deliberate misuse of byproduct, source, or special nuclear material from its intended or authorized use and had the potential to cause an exposure of greater than 5 rem to an individual or 500 mrem to an embryo or fetus Remarks: None.

N Involved the failure of radioactive material packaging that resulted in external radiation levels exceeding 10 rads/hr or contamination of the packaging exceeding 1000 times the applicable limits specified in 10 CFR 71.87 Remarks: None.

N Involved the failure of the dam for mill tailings with substantial release of tailings material and solution off site Remarks: None.

Y/N SI Deterministic Criteria N May have led to an exposure in excess of the applicable regulatory limits, other than via the radiological release of byproduct, source, or special nuclear material to the unrestricted area; specifically

• occupational exposure in excess of the regulatory limits in 10 CFR 20.1201

• exposure to an embryo/fetus in excess of the regulatory limits in 10 CFR 20.1208

• exposure to a member of the public in excess of the regulatory limits in 10 CFR 20.1301 Remarks: None.

N May have led to an unplanned occupational exposure in excess of 40 percent of the applicable regulatory limit (excluding shallow-dose equivalent to the skin or extremities from discrete radioactive particles)

Remarks: None.

8

N Led to unplanned changes in restricted area dose rates in excess of 20 rem per hour in an area where personnel were present or which is accessible to personnel Remarks: None.

N Led to unplanned changes in restricted area airborne radioactivity levels in excess of 500 DAC in an area where personnel were present or which is accessible to personnel and where the airborne radioactivity level was not promptly recognized and/or appropriate actions were not taken in a timely manner Remarks: None.

N Led to an uncontrolled, unplanned, or abnormal release of radioactive material to the unrestricted area

• for which the extent of the offsite contamination is unknown; or,

• that may have resulted in a dose to a member of the public from loss of radioactive material control in excess of 25 mrem (10 CFR 20.1301(e)); or,

• that may have resulted in an exposure to a member of the public from effluents in excess of the ALARA guidelines contained in Appendix I to 10 CFR Part 50 Remarks: None.

N Led to a large (typically greater than 100,000 gallons), unplanned release of radioactive liquid inside the restricted area that has the potential for ground-water, or offsite, contamination Remarks: None.

N Involved the failure of radioactive material packaging that resulted in external radiation levels exceeding 5 times the accessible area dose rate limits specified in 10 CFR Part 71, or 50 times the contamination limits specified in 49 CFR Part 173 Remarks: None.

N Involved an emergency or non-emergency event or situation, related to the health and safety of the public or on-site personnel or protection of the environment, for which a 10 CFR 50.72 report has been submitted that is expected to cause significant, heightened public or government concern Remarks: None.

SAFEGUARDS/SECURITY Y/N IIT Deterministic Criteria N Involved circumstances sufficiently complex, unique, or not well enough understood, or involved safeguards concerns, or involved characteristics the investigation of which would best serve the needs and interests of the Commission Remarks: None.

9

N Failure of licensee significant safety equipment or adverse impact on licensee operations as a result of a safeguards initiated event (e.g., tampering).

Remarks: None.

N Actual intrusion into the protected area.

Remarks: None.

Y/N AIT Deterministic Criteria N Involved a significant infraction or repeated instances of safeguards infractions that demonstrate the ineffectiveness of facility security provisions Remarks: None.

N Involved repeated instances of inadequate nuclear material control and accounting provisions to protect against theft or diversions of nuclear material Remarks: None.

N Confirmed tampering event involving significant safety or security equipment Remarks: None.

N Substantial failure in the licensees intrusion detection or package/personnel search procedures which results in a significant vulnerability or compromise of plant safety or security Remarks: None.

Y/N SI Deterministic Criteria N Involved inadequate nuclear material control and accounting provisions to protect against theft or diversion, as evidenced by inability to locate an item containing special nuclear material (such as an irradiated rod, rod piece, pellet, or instrument)

Remarks: None.

N Involved a significant safeguards infraction that demonstrates the ineffectiveness of facility security provisions Remarks: None.

N Confirmation of lost or stolen weapon Remarks: None.

N Unauthorized, actual non-accidental discharge of a weapon within the protected area Remarks: None.

Substantial failure of the intrusion detection system (not weather related) 10

N Remarks: None.

N Failure to the licensees package/personnel search procedures which results in contraband or an unauthorized individual being introduced into the protected area Remarks: None.

N Potential tampering of vandalism event involving significant safety or security equipment where questions remain regarding licensee performance/response or a need exists to independently assess the licensees conclusion that tampering or vandalism was not a factor in the condition(s) identified Remarks: None.

11

RESPONSE DECISION USING THE ABOVE INFORMATION AND OTHER KEY ELEMENTS OF CONSIDERATION AS APPROPRIATE, DOCUMENT THE RESPONSE DECISION TO THE EVENT OR CONDITION, AND THE BASIS FOR THAT DECISION.

12

DECISION AND DETAILS OF THE BASIS FOR THE DECISION:

It was noted that the deterministic questions were all answered "No". Of most interest, was the answer to the question of whether the event Led to the loss of a safety function..."

Specifically, the Branch concluded that because after the loss of offsite power sources, the EDGs provided the required 4KV EAC to the safety buses, as designed, therefore there was not a loss of safety function.

There were alternative perspectives that suggest that the question on loss of function should have been answered Yes. "Loss of safety function" is not defined within the MD 8.3 and IMC 0309 documents, and there are various definitions (e.g., PRA function, FSAR function, NUREG 1022). It was also noted that Criterion 17 in the General Design Criteria describes the onsite electric power system and the offsite electrical power system as separate discrete systems and states the safety function for each system shall be to provide sufficient capacity and capability. Based on this logic, an alternative view was shared that when offsite power is lost, that a safety function is lost.

The question on "loss of safety function" could also have been answered as "Yes", consistent with the underlying principles and objectives of MD 8.3. The lack of a specific definition provides flexibility to inspectors in answering the deterministic questions, just as there is flexibility in the final MD 8.3 decision. The exercise of flexibility and risk-informed judgment also addresses the conclusions contained in the D. Dorman memo to M. Doane, Implementing Commission Direction on Applying Risk Informed Principles in Regulatory Decision Making, dated, November 18, 2019. Lastly, this is also consistent with the risk-informed Objectives contained in the agency's Strategic Plan (2018-2022), and agency goal of becoming a "modern, risk-informed" regulator. "

Despite the different perspectives (which was not resolved), for this 8.3 evaluation, answering with a Yes would have resulted in nothing different. A risk assessment would have been called for, and one was conducted. The results of the risk assessment would have been considered in the decision making for the type of response, and such due consideration was given. Therefore, for this specific evaluation, an answer of Yes would have resulted in no real impact to the conclusion.

Based on the initial assessment of the responding inspectors there are presently no significant issues of concern with respect to operator or SSC performance during/in response to this event. The recommendation is being made to send additional inspectors due to resident office staffing issues for targeted baseline support to DAEC to perform a verification of licensee event response & plant system performance (i.e., EDG and its support systems performance, HPCI response curves, SRV performance, etc.) under the baseline procedures. The operating experience group is aware of this event and will consider the specifics for further learnings and dissemination.

Based on the above, a decision was reached to conduct follow-up inspection utilizing the baseline inspection procedures. The senior resident inspectors inspection effort, and as supported by other inspectors, will ensure that the agency understands the LOOP event, equipment performance, and risk insights. This is important given the relatively high estimated conditional core damage probability (CCDP) for this event. (Note that the resulting CCDP is a function of the relatively higher baseline risk of this plant and its design, as the 13

event that occurred (LOOP) is known to be the dominant contributor to risk for Duane Arnold and the systems for which the sensitivity study was conducted are key to mitigation of the LOOP.

DRP will re-evaluate this decision if additional information is available that changes the answer to any deterministic criterion or risk assessment inputs.

BRANCH CHIEF: /RA/ by April Nguyen Acting Chief, DATE: 9/14/2020 Branch 2, Division of Reactor Projects SRA: /Non-Concur/ by John Hanna, Senior Reactor DATE: 1/22/2021 Analyst DIVISION DIRECTOR: /RA/ by Mohammad Shuaibi, DATE: 1/7/2021 Director, Division of Reactor Safety DIVISION DIRECTOR: /RA/ Julio Lara, Director, Division DATE: 1/22/2021 of Reactor Projects DEPUTY REGIONAL ADMINISTRATOR: /RA/ Kenneth DATE: 1/22/2021 OBrien, Deputy Regional Administrator ADAMS ACCESSION NUMBER: ML21022A415 EVENT NOTIFICATION REPORT NUMBER (as applicable): 54826 Distribution: Richard.Skokowski@nrc.gov; Dan.Dorman@nrc.gov; Jason.Carneal@nrc.gov; Jack.Giessner@nrc.gov; Kenneth.O'Brien@nrc.gov; Daniel.Collins@nrc.gov; Bo.Pham@nrc.gov; Paul.Krohn@nrc.gov; Mark.Miller@nrc.gov; Tara.Inverso@nrc.gov; Mark.Franke@nrc.gov; Andrew.Pretzello@nrc.gov; Julio.Lara@nrc.gov; Jamie.Heisserer@nrc.gov ; Mohammed.Shuaibi@nrc.gov; David.Curtis@nrc.gov; Tony.Vegel@nrc.gov: Michael.Hay@nrc.gov; Ryan.Lantz@nrc.gov; Geoffrey.Miller@nrc.gov; Aaron.McCraw@nrc.gov; Doris.Chyu@nrc.gov; Laura.Kozak@nrc.gov; John.Hanna@nrc.gov; Dariusz.Szwarc@nrc.gov; NRR_Reactive_Inspection.Resource@nrc.gov 14