05000458/LER-2017-002

LER-2017-002, Loss of Safety Function of Onsite Electrical Distribution Due to Malfunction of Control Building HVAC System

River Bend Station - Unit 1
Event date:	02-18-2017
Report date:	04-18-2017
Reporting criterion:	10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor
4582017002R00 - NRC Website

LER 17-002-00 for River Bend Station, Unit 1, Regarding Loss of Safety Function of Onsite Electrical Distribution Due to Malfunction of Control Building HVAC System

ML17116A297
Person / Time
Site:	River Bend
Issue date:	04/18/2017
From:	Maguire W F Entergy Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
RBG-47749 LER 17-002-00
Download: ML17116A297 (6)

comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

05000-458 2017 002 00

REPORTED CONDITION

On February 18, 2017, at 3:37 p.m. CST, while a refueling outage was in progress, the operators were shifting subsystems of the main control building ventilation system [VI]. The Division 2 "B" chiller (**CHU**) had been in service, and it was intended to start the Division 1 "C" chiller to facilitate the outage work schedule. After the swap, operators noted that the air flow was abnormally low, and within approximately four minutes, the "C" chiller tripped. The operators attempted to restore the Division 2 subsystem to service, but they were unsuccessful, and the abnormal operating procedures for the loss of control building ventilation were then implemented. The electrical distribution subsystems [ED] in the control building were declared inoperable due to the loss of the ventilation system. This condition is being reported in accordancewith 10 CFR 50.73(a)(2)(v).

As described in the causal analysis below, a circuit breaker (**BKR**) manufacturing defect that violated the single failure requirements of 10 CFR 50 Appendix A, General Design Criteria, was discovered. This is being reported in accordance with 10 CFR 50.73(a)(2)(ii)(B) as an unanalyzed condition.

BACKGROUND

Two 100-percent capacity chillers provide cooling to each ventilation system sub-loop, each of which provides cooling, heating, ventilation, pressurization, and smoke removal for several areas within the building. The ventilation system comprises two independent, redundant trains of components and subsystems either of which supports the safety function of providing a controlled environment in the main control room (MCR) and the environmental requirements of the safety-related electrical equipment in the building. Each control building ventilation subsystem is supported by the respective safety-related emergency diesel generator.

The control building chilled water system (HVK) provides chilled water to the cooling coils in three separate air handlers within each division. The air handling system (HVC) removes the heat generated within the MCR and electrical equipment rooms. Air handlers serve the MCR, standby switchgear rooms, battery charger rooms, inverter rooms, and chiller rooms. Each air handler serves both trains of their assigned areas (i.e., both the Division 1 and 2 standby switchgear rooms cooling may be fully served by the air handler in either train). In the event of a total ventilation system failure, the current Technical Specification action to restore the ventilation system is bounded by the 2-hour completion times for DC sources

IMMEDIATE ACTIONS

In troubleshooting the abnormally low air flow with the Division 1 subsystem in service, it was discovered that air flow control dampers in the system had not operated correctly, which diverted air flow from the operating air handler.

Operators implemented abnormal operating procedures to provide alternate means of cooling to the affected areas and monitored the areas for temperature rise.

comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects,Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

05000-458 2017 002 00 Under temporary configuration controls, operators closed the air dampers by removing their control power fuses, and restored the normal air flow path. The Division 1 "C" HVK chiller was successfully started at 5:37 p.m. CST. At the onset of the event, MCR temperatures were approximately 73F. The highest temperature recorded before the restoration of the cooling system was approximately 81F.

CAUSAL ANALYSIS

The failure of the air handler dampers to close correctly was traced to an internal failure in the 480-volt circuit breaker for the Division 2 switchgear room air handling unit. It was found that a mechanism operated cell (MOC) switch positioner linkage screw had fallen out, causing the logic circuit for the damper controls to fail to actuate. The screw in the MOC linkage failed because it was shorter than required by the circuit breaker design (i.e., one-quarter inch in length versus three-eighths inch).

"Single failure" is defined by 10 CFR 50 Appendix A, General Design Criteria for Nuclear Power Plants. A single failure means an occurrence which results in the loss of capability of a component to perform its intended safety functions.

Multiple failures resulting from a single occurrence are considered to be a single failure. The control building ventilation system is required to be designed against an assumed single failure. Failure of the screw caused the failure of both the Division 1 and Division 2 ventilation subsystems.

It is possible that the MOC screw may have been loose since the last time the breaker was successfully closed on January 31. However, its actual failure can be pinpointed only to the opening of the breaker the on date of the event.

CORRECTIVE ACTIONS TO PREVENT RECURRENCE

All safety-related, electrically operated Masterpact NT breakers were categorized with regard to the design of their MOC logic circuit switches. Those breakers with the potential to cause the mis-operation of other components by the same failure mechanism of the February 18 event were inspected to verify that correct screws and lock washers were installed.

The remaining population of Masterpact NT breakers will be inspected.

Design changes were implemented to alter the damper logic circuits for the main control room and electrical equipment area air handlers to eliminate the cause of this event as a potential failure mode for damper actuation.

Technical and quality requirements for receipt inspections of Masterpact circuit breakers will be revised to specifically examine the MOC hardware. Similar breakers already in the warehouse will be inspected. These actions are being tracked in the corrective action program.

EVALUATION OF PRIOR OCCURRENCES

No events reported in the last three years by RBS have occurred as a result of the breaker failure mode discovered in this evaluation.

comments regarding burden estimate to the Information Services Branch (T-2 F43), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to

• respond to, the information collection.

05000-458 2017 002 00

SAFETY SIGNIFICANCE

The normal operating upper temperature limit for the main control room and electrical equipment rooms served by the HVC system is 104F. During the restoration of the ventilation system, main control room temperature increased from approximately 73F to 81F as recorded in the operator's logs. The electrical distribution equipment rooms are served by remote temperature monitors, and none of those associated alarms actuated in the MCR during the time that the ventilation system was out of service. Thus, this event was of minimal significance to the health and safety of the public.

(NOTE: Energy Industry Identification System component function identifier and system name of each component or system referred to in the LER are annotated as (**XX**) and [XX], respectively.)