05000346/LER-2017-001

LER-2017-001, Emergency Diesel Generator Fuel Oil Storage Tank Vents Not Adequately Protected from Tornado-Generated Missiles

Davis-Besse Nuclear Power Station, Unit 1
Event date:	07-20-2017
Report date:	09-18-2017
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition
Initial Reporting
ENS 52865	10 CFR 50.72(b)(3)(v)(A), Loss of Safety Function - Shutdown the Reactor, 10 CFR 50.72(b)(3)(ii)(B), Unanalyzed Condition
3462017001R00 - NRC Website

LER 17-001-00 for Davis-Besse, Unit 1, Regarding Emergency Diesel Generator Fuel Oil Storage Tank Vents Not Adequately Protected from Tornado-Generated Missiles

ML17268A138
Person / Time
Site:	Davis Besse
Issue date:	09/18/2017
From:	Bezilla M B FirstEnergy Nuclear Operating Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
L-17-252 LER 17-001-00
Download: ML17268A138 (5)

comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

- 001 05000 - 346 YEAR 2017 - 00 Energy Industry Identification System (EIIS) codes are identified in the text as [XX].

System Description:

The Davis-Besse Nuclear Power Station (DBNPS) Class 1 E AC Electrical Power Distribution System AC sources consist of the offsite power sources (preferred power sources, normal and alternate) and the onsite standby Emergency Diesel Generators (EDGs). An EDG [EK-DG] starts automatically on a Safety Features Actuation System (SFAS) [JE] actuation or on an essential bus degraded voltage or loss of voltage signal.

After an EDG has started, it will automatically tie to its respective bus after offsite power is tripped.

Each EDG is provided with storage tanks [DC-TK] having a fuel oil capacity sufficient to operate that diesel for a period of seven (7) days while the EDG is supplying maximum post loss of coolant accident load demand.

Fuel oil is transferred from the above grade elevation storage tank to the day tank by a submersed transfer pump [DC-P] inside each storage tank. Without relying on the storage tanks for additional fuel, each day tank contains fuel for over twenty hours of full-power operation for its respective EDG.

Technical Specifications:

Technical Specification (TS) Limiting Condition for Operation (LCO) 3.8.1.b requires two EDGs be Operable in Modes 1 through 4. TS LCO 3.8.2.b requires one EDG be Operable in Modes 5 and 6, during movement of irradiated fuel assemblies. TS LCO 3.8.3 requires the stored diesel fuel oil, lube oil, and starting air subsystem be within limits for each required EDG when the associated EDG is required to be Operable. With one or more EDGs with diesel fuel oil, lube oil, or starting air subsystem not within limits otherwise specified, LCO 3.8.3 Condition F requires the associated EDG be declared inoperable immediately.

DESCRIPTION OF EVENT:

In order to address the concerns outlined in NRC Regulatory Issue Summary (RIS) 2015-06 "Tornado Missile Protection," evaluations of tornado missile vulnerabilities and their potential impact on Technical Specification (TS) plant equipment were conducted.

On July 20, 2017, with the DBNPS operating in Mode 1 at approximately 100 percent power, it was identified that the EDG fuel oil storage tank vents were not adequately protected from potential tornado-generated missiles. In the event a tornado missile were to strike the storage tank vents, the missile could completely crimp the vent and isolate the vent path. While the transfer pumps would remain able to transfer fuel oil to the associated EDG day tank, the removal of liquid from the tank would create a vacuum in the tank, which could affect pump performance and challenge the structural integrity of the tank. Both EDGs were declared inoperable and NRC Enforcement Guidance Memorandum (EGM) 15-002, "Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance," was applied.

CAUSE OF EVENT:

The primary cause of the inadequate missile protection on the EDG fuel oil storage tank vents was that the original system design did not recognize the need to provide missile protection for the tanks vents, which are required to support proper tank performance. The original plant design provided a single Diesel Oil Storage Tank [DE-TK] to provide fuel to the two individual EDG day tanks. This single, non-redundant tank comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

CAUSE OF EVENT: (continued) was not missile protected or seismically qualified. The need for separate, redundant, seismic, and missile- protected fuel oil storage tanks to provide a seven-day fuel supply for each EDG was identified after initial plant construction had begun, but before the operating license had been issued. Design documents from original system design and construction state that,missile protection for the fuel oil storage tanks is provided by a mound of structural backfill covering both tanks. Although design drawings show the fuel oil storage tank vents penetrate the structural backfill, none of the documents reviewed consider the vents as potential missile targets or the effect of damaged vents on the operation of the tanks and EDGs.

A contributing cause to this event was that earlier compensatory measures proceduralized in procedure RA-EP-02810, Tornados or High Winds, were not properly vetted to ensure the EDGs would remain capable of performing their design function following a tornado. The potential for a fuel oil storage tank vent to be damaged during a tornado and challenge the EDG function was first identified in 2009. Compensatory actions were established to be performed after a tornado to ensure both fuel oil storage tanks had an adequate .vent path even if the normal vents were damaged. Those compensatory actions were later incorporated in procedure RA-EP-02810 to direct operators to inspect vulnerable missile targets following a tornado strike and establish an alternate vent path if the normal vent is damaged. However, to prevent physical damage to the tanks and transfer pumps that could result from operation without adequate venting, one of the procedure steps used to establish an alternate vent requires locking out the associated transfer pump and declaring the affected EDG train inoperable. This action is not aligned with the Technical Specifications, which requires the fuel transfer system to operate as designed. Moreover, the procedure does not include steps to restore the system to service for operability. While these procedure steps would prevent additional damage to the fuel oil storage tank, they do not ensure the fuel oil storage and transfer system remains fully functional during and after a tornado.

ANALYSIS OF EVENT:

The fuel oil and transfer system has level switches in the EDG Day Tanks that initiate automatic transfer of fuel oil from the fuel oil storage tanks to the Day Tanks. If the storage tank vent path were compromised with a complete crimp by a tornado-generated missile and automatic fuel transfer was initiated, the transfer pump would start to draw a vacuum in the tank. Reduced pressure in the tank could degrade or disable the ability of the transfer pump to deliver fuel to the Day Tank and the integrity of the storage tank could be challenged, which would impact the seven-day fuel supply for the affected train(s) of EDG. When full, each EDG Day Tank contains enough fuel to supply a fully-loaded EDG for about one and one-half hours before the transfer pumps would auto start to refill the Day Tank.

While tornadoes are rather common in Ohio, the probability of a tornado striking the station is very low. As discussed in EGM 15-002, the probability of a tornado missile striking a non-conforming component is very small. For a tornado missile to disable a fuel oil storage tank, the tornado would have to generate missiles that would strike the unprotected vent piping and crimp it in a way to completely isolate the vent path. If the vent piping were sheared off completely, the tank would remain vented. If the tank vent were completely crimped, time is available for the operators to restore the vent path before the transfer pump would automatically start. Therefore, as concluded in EGM 15-002, this issue is of low risk significance.

comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

- 001 05000 - 346 YEAR 2017 - 00 Reportability Discussion:

This issue resulted in both EDGs being declared inoperable in accordance with TS LCO 3.8.1. Therefore, this issue represented an unanalyzed condition that significantly degraded plant safety in accordance with 10 CFR 50.72(b)(3)(ii)(B), and an event or condition that could have prevented fulfillment of a safety function in accordance with 10 CFR 50.72(b)(3)(v). This issue was reported to the NRC Operations Center on July 20, 2017, at 1330 hours0.0154 days <br />0.369 hours <br />0.0022 weeks <br />5.06065e-4 months <br /> (Event Number 52865).

This issue is being reported in accordance with 10 CFR 50.73(a)(2)(ii)(B) as an unanalyzed condition that significantly degraded plant safety, and in accordance with 10 CFR 50.73(a)(2)(v) as a condition that could have prevented the fulfillment of the safety function of a system needed to: (A) shutdown the reactor and maintain it in a safe shutdown condition; (B) remove residual heat; (C) control the release of radioactive material; and (D) mitigate the consequences of an accident. This issue is also being reported in accordance with 10 CFR 50.73(a)(2)(vii) as an event where a single cause or condition caused two independent trains to become inoperable in a single system, and in accordance with 10 CFR 50.73(a)(2)(i)(B) as a condition prohibited by Technical Specifications.

CORRECTIVE ACTIONS:

Completed Actions:

A standing order was issued as an immediate compensatory measure to satisfy the requirements of EGM 15-002. This compensatory measure directs the operators to existing plant procedures to secure the site if a tornado watch or warning is predicted or issued and to mitigate and recover from the effects of a tornado by establishing an alternate vent path for the fuel oil storage tanks.

Scheduled Actions:

A modification will be developed and implemented to ensure vents for each EDG fuel oil storage tank are adequately protected from tornado missiles.

Procedure RA-EP-02810, Tornados or High Winds, will be revised to ensure the EDGs can perform their design function following a tornado missile strike.

PREVIOUS SIMILAR EVENTS:

There have been no Licensee Event Reports (LERs) at the DBNPS in the past three years related to actual or postulated tornado missiles. A previous issue with postulated tornado missiles was reported via LER 2002-006, but did not include any issues with the EDG fuel oil storage tanks or vents. The tornado that struck the DBNPS on June 24, 1998, was classified by the National Weather Service as an F2 (Fujita Scale) with winds ranging from 113 to 157 miles per hour. While the 1998 tornado resulted in a complete loss of offsite power, the EDGs were started prior to the loss of offsite power and supplied their respective essential loads until offsite power was restored (refer to DBNPS LER 98-006 for further information).