ML20212L069

Forwards,For Review & Comment,Copy of Preliminary ASP Analysis of Operational Condition Discovered at Unit 1 on 981014,as Reported in LER 346/98-011

ML20212L069
Person / Time
Site:	Davis Besse
Issue date:	09/30/1999
From:	Stewart Bailey NRC (Affiliation Not Assigned)
To:	Campbell G CENTERIOR ENERGY
References
NUDOCS 9910070146
Download: ML20212L069 (25)

Text

c lii p

UNITED STATES

?

NUCLEAR REGULATORY COMMISSION g

WASHINGTON, D.C. 30806 4001 September 30, 1999 Mr. Guy G. Campbell, Vice Frasident - Nuclear FirstEnergy Nuclear Operating Company 5501 North State Route 2 Oak Harbor, OH 43449-9760.

SUBJECT:

REVIEW OF PRELIMINARY ACCIDENT SEQUENCE PRECURSOR ANALYSIS i

OF OPERATIONAL CONDITION AT DAVIS-BESSE NUCLEAR POWER J

STATION, UNIT 1

Dear Mr. Campbell:

. Enclosed for your review and comment is a copy of the preliminary Accident Sequence Precursor (ASP) analysis of an operational condition which was discovered at Davis-Besse Nuclear Power Station, Unit 1 on October 14,1998 (Enclosure 1), and was reported in Licensee Event Report (LER) No. 346/98-011. This analysis was prepared by our contractor at the Oak Ridge National Laboratory (ORNL). The results of this preliminary analysis indicate that this condition may be a precursor for 1998. In assessing operational events, an effort was made to make the ASP models as realistic as possible regarding the specific features and response of a given plant to various accident sequence initiators. We realize that licensees may have -

additional systems and emergency procedures, or other features at their plants that might affect the analysis. Therefore, we are providing you an opportunity to review and comment on the technical adequacy of the preliminary ASP analysis, including the depiction of plant equipment j

and equipment capabilities. Upon receipt and evaluation of your comments, we will revise the conditional core damage probability calculations where necessary to consider the specific Information you have provided. The object of the review process is to provide as realistic an analysis of the significance of the event as possible.

j

. In order for us to incorporate your comments, perform any required reanalysis, and prepare the final report of our analysis of this event in a timely manner, you are requested to complete your i

review and to provide any comments within 30 days of receipt of this letter. We have streamlined the ASP Program with the objective of significantly improving the time after an event in which the final precursor analysis of the event is made publicly available. As soon as our final analysis of the event has been completed, we will provide for your information the final precursor analysis of the event and the resolution of your comments.

l i

- We have also enclosed several items to facilitate your review. Enclosure 2 contains specific guidance for performing the requested review, identifies the criteria which we will apply to 9@)

determine whether any credit should be given in the analysis for the use of licensee-identified

. additional equipment or specific actions in recovering from the event, and describes the specific information that you should provide to support such a claim. Enclosure 3 is a copy of LER No.

346/011, which documented the event.

t t ph e r 9910070146 990930 PDR ADOCK 05000348 S

PM L

o e

1 1

Mr. Guy G. Campbell Please contact me at (301) 415-1321 if you have any questions regarding this request. This request is covered by the existing OMB clearance number (3150-0104) for NRC staff followup review of events documented in LERs. Your response to this request is voluntary and does not constitute a licensing requirement.

Sincerely, Original Signed By Stewart N. Bailey, Project Manager, Section 2 Project Directorate til Division of Licensing Project Management Office of Nuclear Reactor Regulation Docket No. 50-346

Enclosures:

As stated cc w/encls: See next page Distribution w/encis:

Docket File TKing, RES PUBLIC PO'Reilly, RES j

PD32 r/f SMays, RES

^

ACRS GGrant, Rlll JZwolinski/SBlack DOCUMENT NAME: G:\\PDlli-2\\DAVISBES\\DBASP9811 P.wpd To receive a copy of this document, Indicate In the box: "C" = Copy without onci ' ires *E" = Copy with enclosures "N" = No copy

/

OFFICE " PM:PD32 E

LA:PD31 E

SC:Pgd3;l NAME SBaileyMs -

EBarnhill &

ANifndfoia DATE 1 /% /99 9 /W 99

/ /99

/ /99 O M 99 OFFICIAL RECORD COPY

)

i

F

.t Mr. Guy G. Campbell Davis-Besse Nuclear Power Station, Unit 1 FirstEnergy Nuclear Operating Company cc:

Mary E. O'Reilly Robert E. Owen, Chief FirstEnergy Bureau of Radiological Her.lth 76 South Main Street Service Akron, OH 44308 Ohio Department of Health P.O. Box 118 James L Freels Columbus, OH 43266-0118 Manager-Regulatory Affairs FirstEnergy Nuclear Operating Company James R. Williams, Executive Director Davis-Besse Nuclear Power Station Ohio Emergency Management Agency 5501 North State - Route 2 2855 West Dublin Granville Road Oak Hart >or, OH 43449-9760 Columbus, OH 43235-2206 Jay E. Silberg, Esq.

Director Shaw, Pittman, Potts Ohio Department of Commerce and Trowbridge Division of industrial Compliance 2300 N Street, NW.

Bureau of Operations & Maintenance Washington, DC 20037 6606 Tussing Read P.O. Box 4009 Regional Administrator Reynoldsburg, OH 43068-9009 l

U.S. Nuclear Regulatory Commission i

801 Warrenville Road Ohio Environmental Protection Agency Lisle, IL 60523-4351 DERR-Compliance Unit ATTN: Zack A. Clayton Michael A. Schoppman P.O. Box 1049 i

Framatome Technologies incorporated Columbus, OH 43266-0149 1700 Rockville Pike, Suite 525 Rockville, MD 20852 State of Ohio l

Public Utilities Commission i

Resident inspector 180 East Broad Street i

U.S. Nuclear Regulatory Commission Columbus, OH 43266-0573 5503 North State Route 2 Oak Harbor, OH 43449-9760 Attomey General Department of Attomey James H. Lash, Plant Manager 30 East Broad Street FirstEnergy Nuclear Operating Company Columbus, OH 43216 Davis-Besse Nuclear Power Station 5501 North State Route 2 President, Board of County i

Oak Harbor, OH 43449-9760 Commissioners of Ottawa County Port Clinton, OH 43252

c 3s y.

LER No. 346/98-011

' lek No. 346/98-011 Event

Description:

Manual Reactor Trip due to Coir,ycc.ci.t Coolirig System I.mak due to De energizing Safety-Related Bus D1 and Non-Safety-Related Bus D2 Date ofEvent: October 14,1998

+

Plant: Davis-Besse Event Summary The Davis-Besse plant was in Mode 1 at 100 percent power at 1356 on October 14,1998, when an electrical bus Dl, bus D2, and station blackout diesel generator lockout occurred (Ref.1). : The bus lockout occurred when an electrician rolled circuit breaker AACD1 back into its cubicle 'aAer performing preventive maintenance. As the breaker was rolled back, the metal breaker frame contacted a terminal screw of a time-over current relay mounted on the cubicle door, which provides backup ground protection for buses D1 and D2. Loss of bus D2 caused the loss ofcondensate pump 12 and, as a result, the operators initiated a plant power reduction.' Prior to the lockout of buses D1 and D2, component cooling water pump (CCWP) 1-2 was in operation and supplying non essential loads. When, bus D1 was lost, CCWP 1-2 tripped. Tripping of CCWP l-2 caused CCWP l 1 to start automatically, ne isolation valve which isolates the non essential c

CCW supply from CCWP-1 opened after a 30 second time delay During that time delay, there was no CCW flow through the RCS letdown coolers and the hot RCS coolant heated up the CCW inside the coolers. When

' the isolation valve from CCWP-1 to the non essential CCW header opened, introduction of sub-cooled CCW

' into the RCS letdown coolers caused the steam bubbles to collapse and created a pressure spike. His short duration pressure spike damaged one of the two rupture disks in letdown cooler 1-1. At 1512, essential buses D1 and F1 were recovered. CCWP l-2 was restarted at 1523. When CCWP l-2 was restarted, the CCW surge tank level dropped rapidly due to rapid loss ofwater from the CCW system. This prompted the operators to trip the reactor at 1523. At 1712, CCW was restored and the plant was stabilized. The conditional core damage probability (CCDP) estimated for this event is 1.5 x 10'5 Event Description At 1356 hours0.0157 days <br />0.377 hours <br />0.00224 weeks <br />5.15958e-4 months <br />, on October 14,1998, Davis-Besse was operating at 100 percent power, when an electrical bus DI, bus D2, and station blackout diesel generator lockout occurred. At this time, bus tie transformer AC, which is also capable of providing backup power to bus Dl, was de energized Figure I shows the arrangement ofbuses D 1 and D2 and the associated breakers. AAer performing routine preventive maintemnee 1on circuit breaker AACDI,'an electrician rolled the breaker back into its cubicle. A misalignment between the floor rail and circuit breaker resulted in the breaker frame contactmg a terminal screw. As a result, non-essenual bus D2 and essential bus D1 de energized. The station blackout diesel generator output breaker (AD213) was also locked out. Emergency diesel generator (EDG) 1-2 started on low voltage. However, EDG output breaker AD101 could not close, since it was locked out. EDG l-2 was shut down at 1401, since no 1

t*

t

• LER No. 346/98-011 component cooling water (CCW) was available for the DG Due to the lockout of D1 and D2, CCWP l-2 and condensate pump 1-2 were lost. In addition, all normal station lighting supplied by bus D2 was lost.

Operators initiated a plant power reduction due to the loss of condensate pump 1-2, with the intent of stabilizing reactor power at a level within the capacity of the two available condensate pumps. The power reduction was stopped at approximately 87 percent power at 1430 hours0.0166 days <br />0.397 hours <br />0.00236 weeks <br />5.44115e-4 months <br />. Auxiliary feedwater (AFW) pump AFP l-1 was out of service for testing prior to the lockout event. However, it was declared operable at 1415 hours0.0164 days <br />0.393 hours <br />0.00234 weeks <br />5.384075e-4 months <br /> (19 minutes after the bus lockout). AFP l-2 was made inoperable as a result of the lockout.

When the Dl/D2 bus lockout occurred, CCWP l-2 was operating and supplying non-essential CCW loads inside containment (See Figure 2). Troubleshooting was in progress on the CCWP l-1 discharge flow indicating switch FIS1422D. When the bus lockout occurred and CCWP l-2 tripped, CCWP l 1 automatically started and CCW Ioop 1 non-essential valves began to open after a thiny-second time delay.

When CCWP l 2 tripped, even though CCW Loop 2 non essential isolation valves received signals to close, they could not do so because of the Dl/D2 bus lockout. During the 30 secono time delay for the CCW loop 1 non-essentialisolation valves to begin stroking open, no flow was provided to the RCS letdown coolers.

As a result of the hot reactor coolant flowing through the letdown ecclers, the CCW in the coolers generated steam. When the Loop 1 isolation valves opened and re-initiated flow to the letdown coolers, the sub-cooled CCW caused the steam pockets to collapse. The resultant pressure spike damaged one of the two rupture disks on letdown cooler 1-1. Alarms received regarding operation of the containment normal sump pump and low level in the CCW surge tank indicated that a leak of an estimated 2 to 5 gpm from the CCW system had started in containment.

By 1512 (76 minutes after the bus lockout), the operators had fixed the problem in bus cubicle AACDI.

Restoration of electrical buses began at that time. When 480 volt essential bus F1 was re-energized at 1512, power was restored to the CCW Loop 2 non-essential isolation valves. As a result of an "open" signal from FIS 1422D and a "close" signal from the breaker interlocks, CCW Loop 2 non-essential isolation valves started to cycle open and closed. De valves continued to cycle until CCWP l-2 was staned. At 1517 hours0.0176 days <br />0.421 hours <br />0.00251 weeks <br />5.772185e-4 months <br />, sersice water pump (SWP) 1-2 was restarted, followed by the restart of CCWP l 2 at 1523 hours0.0176 days <br />0.423 hours <br />0.00252 weeks <br />5.795015e-4 months <br />. When CCWP l-2 was started, the CCW surge tank level decreased rapidly. At the level of 35 inches and decreasing, the reactor and the reactor coolant pumps were tripped. When the reactor and the reactor coolant pumps were tripped, the AFW system actuated. Natural circulation conditions were fully developed approximately four minutes after the RCPs were tripped.

Following the reactor trip, the following events occurred: (a) the operators' attempt to stan makeup pump 1-2 failed, (b) steam generator (SG) outlet pressure increased due to the closing of the main turbine stop valves, (c) the turbine bypass valves (TBVs) and the atmospheric vent valves (AVVs) opened and the main steam safhy valves (MSSVs) lifted in response to the increasing secondary system pressure, (d) the MSSVs and the AVVs closed as SG outlet pressure decreased, and (c) the TBVs throttled closed as they attempted to control SG outlet pressure at the post-trip setpoint of approximately 995 psig. Following the reactor trip, MSSV SPl7B7 was identined to be not fully closed. Hewever, main steam pressure was manually reduced to 920 psig, and MSSV SPl7B7 rescated. While actions were underway to investigate and recover from the loss of -

CCW to the containment, and to recover electrical loads that were lost, the operators also had to initiate actions to reduce secondary system steam loads to terminate the overcooling of the reactor coolant system (RCS).

1 2

[""

9 c

LER No. 346/98-011 Plant operators made preparations to restore CCW to the containment while leaving CCW to the letdown coolers isolated. At 1712, CCW was restored to the containment header to provide cooling for the control rod drives and reactor coolant pumps (RCPs). Shortly thereafter, RCPs 2 2 and 1-2 were started, restoring forced RCS coolant flow.

Additional Event-Related Infonnation Essential bus D1 and non-essential bus D2 supply power to components that are needed for normal and emergency plant operation. Herefore, loss of these buses and the resulting changes to the RCS power level increased the likelihood of a reactor trip. The power redaction started at 1356 from 100% power, and was ternunated at 87% at 1430.

The damage to the RCS letdown heat exchanger worsened when CCWP l-2 was started after recovery of power. The CCW surge tank level dropped rapidly as a result. CCW containment isolation valves CC 1411 A and 1411B functioned as designed to isolate letdown cooler 1-1 within 10 seconds on low surge tank level.

Successful isolation maintained CCW system inventory and prevented net positive suction head problems for the CCW pumps. As Figure 2 shows, successful isolation of these valves not only affects the RCS letdown cooler, it also affects the CCW supply to all of the RCPs and control rod drives. That is, when either CCl411 A or CCl41IB closes, CCW cooling of the RCP seals will be lost. However, there are valves that can be remotely closed to allow isolation of the letdown heat exchangers while providing RCP cooling.

As shown in Figure 3, Davis Besse is equipped with two turbine-driven auxiliary feedwater pumps (AFP l-1 and AFP l-2). If bus D1 is available, either of these pumps can be used to feed either of the steam generators.

However, bus D1 was de energized, which de energized essential bus Fl. Bus FI powers motor operated valve AFW 3871, which is normally closed. Therefore, when bus D1 was lost, the capability to inject steam generator SG l 1 from AFP l-2 was lost. Even though there is a motor-driven feed pump at Dasis-Besse, it was not available, since it is powered from bus D2. As a result, if AFP l-1 had failed, there would have been no capability to feed SG l 1. Without feedwater, the steam supply from SG l-1 would fail.

If power is available to all buses, either of the steam generators can provide steam to either of the turbine-driven AFPs. During the scenario where AFP l-1 is failed, there will be no steam available from SG l-1. As a result, if bus F1 is failed and AFP l-1 fails, only SG l-2 has the capability to supply steam to AFP l-2.

However, as Figure 4 shows, when bus D1 is failed, MOV 107 (normally closed) cannot be opened. That is, SG l-2 cannot provide steam to the turbine of AFP l-2.

In summary, if AFP l-1 fails when bus D 1 is de-energized, SG l-1 stops generating steam due to lack of feed-water injection, and SG l-2 cannot provide steam to AFP l-2. Therefore, failure of AFP l-1 with bus D1 de-energized leads to the failure of AFP l 2.

According to Reference 2, when both trams ofmakeup pumps are available to perform feed-and-bleed cooling, opening of both cressurizer safety valves is adequate to perform the bleed function. The pressurizer pilot -

operated relief valve (PORV) is not essential. However, when buses D1 and D2 were lost, makeup pump 1-2 was not available. Under that condition, the PORV is essential to perform feed-and-bleed cooling. ~ The 3

L t g.3 F

LER No. 346/98-011 pressurizer PORV is powered from Division 2 DC powerI When buses D1 and D2 are lost, Division 2 DC power relies upon the Division 2 battery. When the battery's charge has been depleted, the PORV will fail and, as a result, food and bleed cooling will fail. Therefore, if bus D1 is not recovered, the battery that powers the pressurizer PORV will deplete.

~ Modeling Assumptions In modeling this event, three likely scenarios were m=i=1 Scenario I The first scenario considered was a reactor trip followed by unavailability of main feedwater, auxiliary j

feedwater and high pressure injection (HPI) cooling (also known as feed-and-bleed cooling). As described in j

. the previous section, if buses D1 and D2,are lost, failure of AFW pump Train I can fail AFP l-2, since there is no capability to provide steam from steam generator SG l 1 to AFP l-2. The modeling assumptions related to this sequence are discussed below.

Scenario 2 The second scenario consists ofloss of all CCW due to a rupture in the RCS letdown heat exchanger, failure to isolate the rupture (automatically or via operator action) followed by the operator failing to trip the RCPs after loss of CCW, thus leading to a seal LOCA.

Scenario 3 The third scenario consists ofloss of all CCW as in the second sequence in this sequence, the operator successfully trips the RCPs. Houver, fail'are to recover CCW and restore RCP seal cooling prior to seal damage leads to a RCP seal LOCA.

Probability of Reactor Trio When buses D 1 and D2 were lost, the reactor did not trip. However, several systems or system trams that rely on buses D1 or D2 (condensate pump 1-2, cooling water pump 2, station air compressor, emergency air compiessor, and heater drain pump 2) were lost. As a result, the operators had to reduce the power level from 100% to 87% over a 34-minute time frame (from 1356 to 1430). The operators tripped the plant at 1523. De loss of a single train ofessential and non essential busses and changing the power level increased the likelihood of a reactor trip. Based on Reference 3 (page 8-12), there were 10 reactor trips during 148 controlled plant shutdowns, herefore, the probability of a reactor trip during the event can be approxunated by a value of i

0.068(10/148). In order to accommodate this increased likelihood of a reactor trip, the basic event IE-TRNS in the SAPHIRE-based model for Davis-Besse was changed from its current value to 0.068.

4 I

i 1

',a e

LER No. 346/98-011 l

l r Availability of Main Feedwater Reference I notes the loss of bus D2 resulted in the loss of condensate pump 1-2. In addition to this, the station air compressor Cl40 is also powered from bus D2. Moreover, the emergency air compressor that is powered from bus F7 would also not be available. One train of the turbine plant cooling system would also

' have been lost due to loss of bus D2. In consideration of all these dep adaacies, it was pessimistically assumed that the reactor trip was caused by the loss of or a !wient of the main foodwater systera and that the main feedwater system would not be available to remove may heat aAer tripping the reactor with buses

. D1 and D2 de energized.

Availmhility of Motor-Driven Startuo Feed Pumo f

i in addition to the two turbine driven Al@ pumps and one motor-driven feed pump powered from bus D2, Davis-Besse has another motor driven pump (stanup feed pump) that can back up the AFW system. This was the original " motor driven feed pump," but once the new motor driven feed pump had been installed, it was essentially abandoned in place. Since that time, however, the pump has been put back into the plant procedures, and it should be available ifneeded. It is powered from bus'C2. Its breaker must be racked in, and there are manual isolation valves that must be opened locally. For these reasons, the availability of this pump is lower than that for the new motor-driven feed pump (which can be started from the control room and acts just like an AFW pump). If buses D1/D2 had remained unavailable, main feedwater had been lost, and the AFW pumps were unavailable, the startup feed pump could still have been used.

Feed-and-Bleed Coolinn Failure 3

If steam generator cooling using the AFW and MFW fails, decay heat can be removed by feed-and-bleed cooling. Accordmg to the Davis Besse IPE (Ref. 2), when only one makeup pump train is available (makeup i

pump 1-2 did not stan since bus D1 was unavailable), the pressurizer PORV is essential for feed-and-bleed cooling. ' This PORY requires power from Division 2. With bus D1 unavailable, the charger is unavailable and the battery will deplete. If the DC electrical loads are not tripped, a typical banery at a nuclear power plant can be expected to last for approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. During the event at Davis-Besse, the buses were lost for 76 minutes. Assuming a mean repair time (time to recover the lost essential bus) of 75 minutes and an i

exponential distribution, the probability of non-recovery of DC power in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> was estimated to be 0.2. The basic event D2N RECHARGE was added to the SAPHIRE-based model for Davis-Besse to model this failure.

Parantial of t mine All CCW A second scenario considered for modeling in this analysis was the potential loss of all CCW due to the rupture in the RCS letdown cooler. The design of the CCW is such that, when the runmng CCW stops and the standby CCW starts, steam will form inside the RCS letdown heat exchanger during the 30 seconds it takes to open the isolation valve from the standby CCW train to its non essential supply. As a result, during this event, the stan ofthe standby pump caused the steam to collapse and cause damage to a mpture disk (isolable leakage of 2-5 gpm). in the letdown heat exchanger. Subsequently, aAer electric power was recovered, when the second CCW pump was re-staned, the CCW surge tank level decreased rapidly (the leak got bigger). It was only I

1

l 2

l l

1 LER No. 346/98-011 when pump 1-2 (which had been operating prior to the loss of buses D1 and D2) was restarted that the draw dows of the surge tank level due to the leak through the letdown cooler rupture disk was experienced. Only if I

I the operators had failed to isolate the non-essential loads and had aligned pump lel to supply them from the second side of the surge tank (Davis Besse's CCW surge tank has two sides with a dividing wall), would the surge tank have been depleted fully.

l CCW pump 1-3 was the spare pump at the time of the event. This pump can be aligned electrically to either Division 1 (bus Cl) or Division 2 (bus DI). Thus, it could have been aligned as a backup to pump 1-1, ifit had failed to stan, or to pump 1 2 (after power was restored to bus DI). This would have required manually racking in the pump breaker at the 4kV switchgear, and opening two manual isolation valves. These actions are covered clearly in the plant procedures, and the IPE gives reasonable credit to their success.

There is an abnormal procedure for loss of CCW that specifies recovery actions using the spare pump. If there were no CCW, it is assumed that the makeup pump (s) would fail due to lack of cooling within about 10 minutes. The operators would then have about another 15 minutes to restore CCW to the RCP sealsif the pumps were not tripped. After that, a seal LOCA would result, and HPI would be actuated. The HPI pumps are expected to operate for at least an hour without CCW. Thus, the operators would have on the order of one hour and 25 minutes to restore CCW.

The RCS can be cooled down quite rapidly by AFW. If the RCPs are tripped (as called for by the procedure),

however, the ability to cool down is dmunished. With no CCW, there would be no makeup to compensate for RCS shrinkage, Thus, there would be a tendency to draw a bubble in the RCS due to the cooldown, which would interrupt natural circulation through the steam generators. This should not be permanent (i.e.,

circulation, and hence cooling, should be restored as the RCS heats back up), but it would certainly impede the cooldown efforts. Ofcourse, this is largely a moot point if tripping the RCPs is assumed to preclude a seal failure.

Based on the above information, two core damage sequences appear credible. In the first sequence, automatic signals fail to isolate the break in the RCS letdown heat exchanger, the operator fails to back up the automatic l

capability and manually isolate the break in a timely manner, and the operator fails to trip the RCPs. In the second sequence, the automatic signals fail to isolate the break, the operator fails to provide manual backmp, and the operator successfully trips the RCPs. However, CCW is not recovered prior to seal failure.

i There are two valves (CC 1411 A and 141IB) that would receive automatic signals to isolate the non-essential CCW header on low surge tank level. Ifrupture occurred in the RCS letdown cooler, and if both valves failed to isolate the rupture, then CCW would continue to drain down. Note that CC 1411 A and B are two redundant isolation valves that receive isolation signals from redundant sources. Further, the surge tank low level al' arm will also let the operator know of the need to isolate (as it did during this event).

Considering the two redundant auto signals and the operator's capability to recognize and intervene in response to low surge tank level and the containment normal sump pump alarms, the common cause mechanical failure of the two

{

isolation valves to close will dominate. The SAPHIPI-based model for Davis Besse uses a probability of i

2.6 x 10d for the common cause failuce of two MOvs to fail to close.

6

y l"*

l

l..,*

i LER No. 346/98-011 I

l

(

If CCW fails, the operator is instructed to trip the RCPs.' There are alarms that will indicate to the operator

- if the RCP seal temperature is high. Based on Swain and Guttman (Ref. 4), under this transient condition, a 4

probability of 1.0 x 10 represents an upper bound for the probability of the operator failing to stop the RCPs 4

d by the operator.- Therefore, the probability of a RCP seal LOCA is less than 2.6 x 10 (= 2.6 x 10 x 4

1.0 x 10 ). Failure to trip the RCPs willlead to an RCP seal LOCA. The RCP seal LOCA can be mitigated if CCW is be recovered before core uncovery. Therefore, the core damage probability for this sequence will be well below 1.0 x 104 The core damage probability for the second sequence will be the product of the probability of failing to isolate the heat exchanger (2.6 x 10d), the probability of fadmg to recover component cooling water prior to seal failure, and the probability of failure of high pressure injection, given a seal LOCA occurs.

Potential for RCP Seal LOCA riven loss of CCW Without CCW, RCP seal cooling is unavailable. Unavailability ofRCP seal cooling may result in an RCP seal -

failure and a small-break LOCA. In this analysis, the probability of an RCP seal LOCA was assumed to be zero up to 60 minutes aAer a loss of seal cooling. Between 60 minutes and 90 minutes, the probability of an 4

RCP seal LOCA was assumed to increase linearly to 0.083 at 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (i.e.,2.8 x 10 / minute), aAer which no additional seal failures were assumed to occur. This type of seal failure model is similar to that used in the ASP Program for modeling station blackout sequences (see ORN1/LTR-89/11, RevisedLOOP Recovery and i

RCPSealLOCA models, August 1989).

HPI Pumo Bearina Lube Oil Cooline failure At Davis-Besse, the HPI pump beanng oil is cooled t>y CCW. However, in the event of a loss of CCW event, the HPI pumps will not fail immediately. That is, if CCW can be recovered within a reasonable time, failure ofHPI and core uncovery can be averted. First, if CCW is lost and not recovered prior to seal failure, a finite time can elapse prior to core uncovery. For Davis Besse, using information provided in Table 3-11 of the IPE (basic event UHAMUISE), it was assumed that a period of I hour is available to mitigate the accident before core uncovery occurs. If the operators choose to start the HPI pumps without CCW (since runnmg the HPI pumps without lube oil cooling is preferred over uncovering the core), the pumps can run for a fmite time period prior to failure due to lack oflube oil cooling. Considering the uncertainties related to operator actions and timmg (e.g., whether the operators would' secure the HPI pumps when they auto start without CCW, whether 1 pump will be allowed to run while the other is secured), this analysis assumed I bour would be available to run the HPI pun!ps prior to failure due to tube oil cooling. The combined effeet of the time to core uncovery and the time that the HPI pumps can run without tube oil cooling failing leads to the assumption that there are 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> available followmg an RCP seal LOCA with CCW unavailable in which to recover CCW in order to avoid core damage.

Therefore, the probability ofthis accident sequence, which invoh es (a) the loss of CCW as a result of failing to isolate the heat exchanger (2.6 x 10'), (b) failing to recover component cooling water prior to RCP seal failure, and (c) failing to recover HPI (or makeup) pumps prior to core uncovery, can be calculated as follows:

= 2.6 x 10" x J fst(t) x P,,,,,(t+2) dt 7

i

g

$,, o f'

l LER No. 346/98-011 where, fn(t) is the failure raae for RCP seals at time 't' and PWt) is the probability of non-recovery of CCW at time 't'. Time 't' is measured from the time oflosing CCW. In the model used here, fn(t) is zero between l

0 and 60 minutes. Itis 2.8 x 10-8/ minute between 60 minuteand 90 minutes. It is zero when t is greater than 90 minutes.

P.,,,,,(t) can be modeled using an exponential model (i.e., P,,(t) = e%here lis the failure rate). Recovery of CCW would require manual isolation of the CCW non essential containment header, refdhng the CCW piping and surge tank, venting the system, and potentially realigning the CCW system to allow use of the spare l

pump. A review of Table 3-12 in the 1993 IPE submittal identified several recovery actions in the 1-4 hour and greater than 4 hout time frames that appear to be similar to what is required in this case. For these actions, the IPE estimates failure probabilities on the 0.03 - 0.05 range. Assuming a non recovery probability of 0.03 at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> will result in A being equal to.59 per hour or 0.015 per minute. Therefore, the sequence probability I

will be,

= 2.6x 10" xaf" 2.8 x 10 x e "'*** dt 8

l 4

=1.3x10 l

Analysis Results Three different scenarios were considered. The CCDP associated with scenario #1 (reactor trip followed by loss of steam generator cooling), estimated using the S APHIRE-based model for Dasis-Besse is 1.4 x 10 8. The CCDP associated with scenario #2 (loss of CCW followed by the operators failing to trip RCPs leading to a 4

RCP seal LOCA was screened out since it is well below the precursor threshold value of 1.0 x 10. Sequence

1. 3 (loss of CCW, RCPs tripped, non-recovery of CCW leading to RCP seal LOCA, and non-recovery ofCCW j

leading to HPI failure) has a CCDP of 1.3 x 10. Therefore, the total CCDP is estimated to be 1.5 x 108. The i

4 dominant sequence for this event involves a reactor trip while power is unavailable to buses D1 and D2, in j

which main feedwater is unavailable, turbine-driven auxiliary feedwater pump TDAFP l-1 fails, the startup feed pump is unable to provide steam generator cooling, and food-and-bleed cooling fails due to depletion of j

the Division 2 battery prior to recovery of Division 2 essential bus D1. The dommant sequence, Sequence 20, is highlighted on the event tree in Figure 5. It involves:

j e

a reactor trip while changmg power level, i

e unavailability of main foodwater, e

failure of turbine-driven AFP 1 1 (which f.uls AFP l-2 as well),

e failure of the motor driven startup food pump, e

failure to recover bus D1 before the Division 2 battery is depleted.

l Defmitions and probabilities for selected basic events are shown in Table 1. The conditional probabilities associated with the highest probability sequences are shown in Table 2. Table 3 lists the sequence logic i

assamt~i with the sequences listed in Table 2. Table 4 describes the system names associated with the dommant sequences.' Mimmal cut sets associated with the dommant sequences are shown in Table 5.

Acronyms l

8 i

L.

. a. -

LER No. 346/98-011 AFW

auxiliary feedwater AVV atmospheric vent valve CCDP conditional core damage probability CDP.

core damage probability -

-CCW w,ycesst cooling water EDG cmergency Rselgenerator IPE

-individual plant examination MSSV main steam safety valve PORY power operated reliefvalw RCP reactor coolant pumps RCS reactor coolant system SPAR standardized plant analysis risk TBV turbine bypass valve-1 References 1.

LER 346/98-011, " Manual Reactor Trip Due to Component Cooling Water System I.4ak." October 13,1998.

2.

David Besse Unit 1, Individual Plant Exammation.

3.

J.D. Andracbek, et. al., "Probabilistic Risk Analysis of the RPS and ESFAS Test Tunes and Compledon Tunes," WCAP-14334 NP-A, Rev.1, May 1995.

4.

A.D. Swain and H.E. Guttmann, " Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Application,"NUREG/CR-1278, August 1983.

l l

9

?'

l_

I 1

l LER No. 346/98-011 1

i l

9 l

t I

s!

l

'l l

1 _t k

i i t

.i i

I o.

g g.i 2

J S --

.b _[

I J ai I

,'J it s l

ji, g feig A i

3 y -[

3 J

o ir.nie m e

1 De* '

o

. I i

l

) J i

3,__. W I

I 3--

)

g 3.__.

l }\\

.z=-

l *g O

1 x.__.

2.___.

J i

J l

~

w.

rA.,

I s_.c.._vL i @ --

I 1

r i

.)

i i.

. H.b I. D ~.[--

I.

i

~

__J li F,

l.

i_: oj 1

l 1

3. u_..

s C j l

l) o.- k =

i s

jo! )

I I

s h

o Oh. 1 g

i's..

1/

1 i

o-..

g N51'

)

l lj) l c..=:r-

,g

~

j,-J l

3.___< s

.J i

.m, w

2 _.:__

I s

5i i

3.

h:-3

)

fo Eg

!. 1 --

f o'"sEEi:

)

a ea 91

-J l

1 3.__

L.2 e ---

! J e

g o

.I

=

10

LER No. 346/98-011 fi i

(!

(!'

(f (3

fiEs x'

i Pi t'. 4.

ti te 4

l I'

8 L

=

_l'a_,..;lll i

[T jl,,;

g f

as

'i

!=

1:

I si si.

8' s i s i 8'

di de i

~ ~ '-

4,6 4,9, a

x, x,

- {s

Ks y

J ew u

.P!

J a!i I,r!

l.,r.!

g p

.I 1

i II!

I I

Ill s

I i

i Vi a

a i

i 1

D N#

,1

.E, i

4

?

u I M

?:

?:

h x,

.t.

m

.i e

i i

I E

I E

. Y.

. Y.!

s s

li IB E

'8 3 85

l3 fli g

l I

l' a

j i

j z-1 l

_ -x, M ' :.:

E n

J I -y v

l iwi 11 l

L

4 LER No. 346/98-011 I t

!,l 19 i !.

1 I

[

ni{@i e,[s.

5$@![

T:.

'i 1.

i.

(t l

gi ;

n r.-

r.h,.

j 15 r

i...

• EP si

r. '

n

e' N,-

.I h. +r[,

p 1.y p l u6a.r g'

,i a

~ M; D--t.!

.) SS d : ft L.

!O s

ip u n

s r er 1

O--t 1

m 41:..

4.

s i:1ces u

g e

• et-i SI 7

I O

+

7, h,

re Yd.i !.;,'Md*N8.'h.

-Afh h V E

'-"I ~

y

.n; (y-mip;l p

L.

. ~.

a g** -

• o, ab) I i

llTT I

i I

at M g

• i J l'd. k h,p' l,&4 9.pi P{ ?

• ) fhe d i

e el e stf

$ 1' M y y'

Nx fr

'M

{

,g tg

(

D! * !! %

T

4.

I,. '

I 7j a l;

(

o t.

{

m

!. !rE lj,.F Oi1

!W Y

Ti ! E j

,5 N

5.Ti ' a

]

w-o e

m t g g y r r g. t l.- 9 llf m

~

3 a j

55 Lt E[

e fh n)

I'.

p

' Y! IS I,

i

,IF@-

pf,

g

,,,.,2 g

. ~..

l.

• h.,{!

• g '

• 1(

5Z g.- 0 * .i m s. g f. 1 %.N. ? {'g '@g a g; 7 6 j 9 (( jf i 7 8 t as 0 'r-- l_ pl hI !L) g L1, .' I 3,

)-

. it 1 gt sh s a F" I L i I fr % 8* . g ~. YI ,h i - ~",o,,g @!I h,c { { g ,"I "5508 ':I 2 F: te g lvpIC i 1a 1 = ~ st i e I" 8 M (h - 69 Si l 1 3 l't N m.-.?[. . l I -T e sn i is s '& l I c 'L elh*} 1,;I(d"(? ? g 'c) ;,_ ~h a, r o at igg i ' y,it. it - gi l9 !!D L =@ph' i y' y s v j d fE.I h.- r -4 a. 4m e,-.m m w.x m di 1 12

LER No. 346/98-011 I.l I hI di I odo e I cal l G L,. l ( 8: ) E ( 8: ) i, y

MI OI!Mj Oli E

l cpl og! 11,-e-l I 1 5 1I Es a 68 Gi 4 a aT a a gg, / 3 5 t U E D i_ v: I n i b# h k# c4,!! sll sid! i 8 , II I II I M'ki $i .E ?' ?'_ l j.1 I I E' N' N' E' i iii. ' _g a I I .j l,il. i

• )",I G' -

Z. o I T I= Z G-I I

)

OEI E-I. - M,i i = off s oI! D tie li: 111 iZ', !,d i$ll i 12/91 13 l

t LER No. 346/98-011 D Ii. Ol. ' C I.:j ' c .i u

erlE

'I1i

~1!' l

Tis, y

y _ - -f, +"i

i m l8}}

siti iM ' f !ps d' b, [fpf; i%*t) o.a i r I t.c !',y# % i 0 s-= ,J e. a+ g 'L i t$p 11 ,i i ti tT ($ i h/.: W3 I e e-f! Li I r; 4 W W./ oP..' f ei -!- b i t 3 lM.i' 3 'g .r ,;+ i r a .h. ' et,I n, R e e I s 9: e, na J.' J i,. :

=

l f-i $1 Ci,ij .i p1 v.

==l L-tat t! F. - ii i s b 8** IA) fl h o ..v.. g a y A 1$. mn;r .h f:: u g irs g;; .r tu f 11 1-i } gf}f $ f[ fi 2 b y.; .s e - -- - I e L .,fj'I ~!kA, E ?* 3 3 .M hf I g*I! l r i J @ i_ Nh (p l

3 P.4 5,

. J _! i i l i a l t e.: i i If; t i m ~ 6 g E ) l! ' 11 -lg l 5 I 2 9 _1: .,t [ n! 5 l 2.gf s' n-E- it 7"f l' if ~ j ^ 14

PMIJ Zo y$ a Yeww t ~ S OOMoCoCaooOoCoCCooCCT KK KDKD KKKKDKDDKKDDW E gTA gT A S o1 2 3 4 5 6 7 s9 0 1 1 2 345.7eet 9 1 1 1 1 e 1 i 1 2 2 S Qes Kc L nCe O e aE= O VC_ C eE eR S u P P t Wf s One it H g7 Il E eq D Dem M mua oi Snc Ctn L Aoo O oc O c C Y o fsr L D ei O l o O etw gi o C se cm o O t S e t n Mms O s L Uua O is SSct C ro t Moz e c Ps M ema 4u Nst IP sc teee N ep rs me SE ss P e o J wn VR n e om O p P D E R E mun Y WR te R P T rr O oc P PT is S N AEV t re E, E s etvna S T mut W S N aus F E E aoi A mr 4I es S BN P m V A A R un w DT ts sn saev a s s s s e env t e a er meTe t cu Ar a M ,n _e u _ r _s _ t. w - _rw ee T ns T.'d a g. Ol 8 [8.Ny p~ I1P ZO-Am@ { =- T t wtA

u t. LER NO. 346/98-011 Modified Evest Base Current for this mame Description probability probability Type event l IE-LOOP Initiating Evens-LOOP 1.6 E 005 0.0 E+000 No IE-SOTR Ininsting Evens-Sasam Generator Tube 1.6 E 006 0.0 E+000 No Rupene 16161'6tE SLOCA initianns Event-Small less of Coolant 23 E 006 0.0E 6 No Accident (SLOCA) IE-TRNS Initiating Event General Transient 2.TE 004 6.gE 002 Yes ACP-BAC LP-D1 Division B Ac Power 4160v Bus D1 9.0E 005 1.0E+000 TRUE Yes fails ACP-BAC LP-D2 Division B Ac Power 4160v Bus D2 9.0E 005 1.0E+000 11tUE Yes fails AFW-MDP-FC-SUFP Startup Feed Pump Fails to Start & Run 3.8E 003 3.8E 003 No AFW TDP CF-ALL Common Cause Failure ofAFW TDP 3 2E 003 3.2E 003 No Trains AFW TDP-FC P11 Turbine driven AFW Pump Train F11 3.5E 002 3.5E 002 No Failures AFW XHE XE SUFP Operator Fails to Start and Align Startup 1.0E-001 1.0E 001 NEW Yes { Feed pump CVC-MDP-FC-Mull Charging MDP Train 1 Failures 3.gE 003 3.gE 003 No CVC AOV OC DIS Charging Discharge Path Failurcs 3.lE 003 3.lE-003 No CVC MOV-FC-SUCll Charging Train Suction Valve MU 6405 3.0E 003 3.0E 003 No Fails D2N-RECHARGE Failure to Recover D2n Charger within 2.0E 001 2.0E-001 NEW Yes 2 hours DHR-MDP-FC-P11 DHR Pump Train P11 Failures 4.0E 003 4.0E 003 No DHR-MOV FC-DH64 Failure ofLPITrain 11 Discharge MOV 3.0E 003 3.0E 003 No DH64 HPI-XHE-XM-HPIC Operator Fails to Initiate HPI Cooling 1.0E 002 1.0E-002 No MFW-SYS-UNAVAIL Main Feedwater SystemUnavailable 2.0E 001 1.0E+000 11tUE Yes PPR-SRV CO TRAN PORV/SRVs Open During Transient 8.0E-002 8.0E 002 No PPR-SRV CC-PORV PORV Fails to Open on Demand 63E 003 63E 003 Nn TRANS-20-NREC Trans Sequence 20 Non-recovery 2 2E-001 2 2E 001 No Probabihty 16 l

i 1 LER No. 346/98-011 Table 2. Sequence Conditional Probabilities for LER No. 346/98-011 Conditional Event tree Sequence core damage Percent name number probability contribution (CCDP) TRNS 20 1.4E-005 100.0

f. '$' fi-$fh ph Total (all sequences) 1.4E-005 a..

o s.. Table 3. Sequence 14gic for Dominant Sequences for LER No. 346/98-011 Event tree name Sequence Iagic number TRNS 20 /RT, MFW-T, AFW, HPI-COOL m a 17

=, LER No. 346/98-011 Table 4. System Names for'LER No. 346/98-011 System same Logic AFW No orInsufficient AFW Flow HPI. COOL Failure to Provide HPI Cooling (feed and-bleed cooling) MFW.T Failure of the Main Feedwater System During Transient RT Reactor Fails to Trip During Transient 0 18 r-

.e,, i 1 1 ) l LER No. 346/98-011 i Table 5. Conditional Cut Sets for Higber Probability Sequences for LER No. 346/98 011 l i Cut set Percent ' Conditional I number contdbution probability" - Cut sets i NiN@$$$MN%$$$$NMM2d5@}M$.f TRNS Sequence 20 1.4E-005 l 1 74.9 1.0E 005 AN TDP-FC-P11. D2N-RECHARGE, 1 APW-XHE-XE SUFP, MFW4YS-UNAVAIL, i I TRANS-20-NREC l i { 2 6.9 9.5E 007-AN TDP CF AL1, D2N-RECHARGE, AFW.XHE XE-SUFP, MN4YS-UNAVAIL TRANS-20-NREC 3 3.8 5.2E 007 AN TDP FC P11, AFW XHE XE-SUFP, HPI-XHE-XM-HPlC, MN-SYS-UNAVAIL TRANS 20-NREC i l 4 2.9 3.9E 007 AFW TDP-FC-Pil, D2N RECHARGE, i AFW-MDP-FC SUFP, MFW4YS-UNAVAIL { TRANS-20-NREC i 5 2.4 3.3E-007 A0N TDP FC P!1. PPR-SRV.CC-PORV, ANAMEJE-SUFP, MFW-SYS-UNAVAll, TRANS-20-NREC 6 1.5 2.1E 007 AN TDP-FC PI1. AFW XHE-XE SUFP, DHR MDP-FC-Pil, MN4YS-UNAVAIL, TRANS-20-NREC 7 1.4 2.0E-007 AN TDP-FC P!1 AFW XHE-XE-SUFP, CVC-MDP-FC-MUI1 MFW-SYS-UNAVAIL, TRANS 20-NREC 8 1.4 1.6E 007 AN TDP-FC-Pil, AFW-XHE-XE-SUFP, CVC AOV OC-DIS, MN SYS UNAVAIL, TRANS-20-NREC 9 1.1 i.6E-007 AN TDP-FC P11. AFW XHE XE-SUFP, CVC-MOV FC4UCI1, MFW4YS-UNAVAIL, TRANS-20-NREC 10 1.1 1.6E-007 AN TDP-FC P11, AFW-XHE XE-SUFP, DHR-MOV CC-DH64, MFW4YS-UNAVAIL,TRANS-20-NREC Total (all sequences) 1.4E 005 NEMSSNNE@M55$ $$$h$fSkjisM3 % condmanal probabibry for each cm am is doesnused by madeplyng Gu probabibey of tw humang swer by the W of tw banc ensus in dist miasmal om sat The probabanes for es humaamg swam and tw beme esames ase youn in Tabic 1. j 19 I

t. 1 GUIDANCE FOR LICENSEE REVIEW OF PRELIMINARY ASP ANALYSIS

===. Background=== The preliminary precursor analysis of an operational event that occurred at your plant has been provided for your review. This analysis was performed as a part of the NRC's Accident Sequence Precursor (ASP) Program. The ASP Program uses probabilistic risk assessment - j techniques to provide estimates of operating event significance in terms of the potential for core damage. The types of events evaluated include actual initiating events, such as a loss of 3 off site power (LOOP) or loss-of-coolant accident (LOCA), degradation of plant conditions, and safety equipment failures or unavailabilities that could increase the probability of core damage from postulated accident sequences. This preliminary analysis was conducted using the j information contained in the plant-specific final safety analysis report (FSAR), individual plant j examination (IPE), and the licensee event report (LER) for this event. l i Modeling Techniques The models used for the analysis of 1998 events were developed by the Idaho National Engineering Laboratory (INEL). The models were developed using the Systems Analysis Programs for Hands-on integrated Reliability Evaluations (SAPHIRE) software. The models i are based on linked fault trees. Four types of initiating events are considered: (1) transients, (2) loss-of-coolant accidents (LOCAs), (3) losses of offsite power (LOOPS), and (4) steam generator tube ruptures (PWR only). Fault trees were developed for each top event on the event trees to a supercomponent level of detail. The only support system currently modeled is the electric power system. The models may be modified to include additional detail for the systems / components of interest for a particular event. This may include additional equipment or mitigation strategies i as outlined in the FSAR or IPE. Probabilities are modined to reflect the particular circumstances of the event being analyzed. Guidance for Peer Review Comments regarding the analysis should address: e Does the " Event Description" section accurately describe the event as it occurred? Does the " Additional Event-Related Information" section provide accurate additional information concoming the configuration of the plant and the operation of and procedures associated with relevant systems? e Does the "Modeling Assumptions" section accurately describe the modeling done for the event? Is the modeling of the event appropriate for the events that occurred or that had the potential to occur under the' event conditions? This also includes assumptions regarding the likelihood of equipment recovery.

V-8, Appendix G of Reference 1 provides examples of comments and responses for previous ASP j

analyses, l

Criteria for Evaluating Comments J Modifications to the event analysis may be made based on the comments that you provide. Specific documentation will be required to consider modifications to the event analysis. References should be made to portions of the LER, AIT, or other event documentation concerning the sequence of events. System and component capabilities should be supported by references to the FSAR, IPE, plant procedures, or analyses. Comments related to operator response times and capabilities should referetice plant procedures, the FSAR, the IPE, or i applicable operator response models. Assumptions used in determining failure probabilities should be clearly stated. Criteria for Evaluating Additional Recovery Measures Additional systems, equipment, or specific recovery actions may be considered for incorporation into the analysis. However, to assess the viability and effectiveness of the equipment and methods, the appropriate documentation must be included in your resporise. This includes: normal or emergency operating procedures.* piping and instrumentation diagrams (P&lDs),* electrical one-line diagrams,* results of thermal-hydraulic analyses, and l operator training (both procedures and simulator),* etc. l Systems, equipment, or specific recovery actions that were not in place at the time of the event i will not be considered. Also, the documentation should address the impact (both positive and l negative) of the use of the specific recovery measure on: the sequence of events, the timing of events, l the probability of operator error in using the system or equipment, and other systems / processes already modeled in the analysis (including operator actions). For example, Plant A (a PWR) experiences a reactor trip, and during the subsequent recovery, it is discovered that one train of the auxiliary feedwater (AFW) system is unavailable. Absent any furtherinformation regrading this event, the ASP Program would analyze it as a reactor trip with one train of AFW unavailable. The AFW modeling would be pattemed after information gathered either from the plant FSAR or the IPE. However, if information is received about the use of an additional system (such as a standby steam generator feedwater system) in recovering from this event, the transient would be modeled as a reactor trip with one train of AFW unavailable, but this unavailability would be mitigated by the use of the standby feodwater system. The Revision or practices at the time the event occurred. 1

l\\~ + mitigation effect for the standby feedwater system would be credited in the analysis provided that the following material was available: standby feedwater system characteristics are documented in the FSAR or accounted for in the IPE, procedures for using the system during recovery existed at the time of the

event, the plant operators had been trained in the use of the system prior to the event, a clear diagram of the system is available (either in the FSAR, IPE, or supplied by the licensee),

previous analyses have indicated that there would be sufficient time available to implement the procedure successfully under the circumstances of the event under analysis, the effects of using the standby feedwater system on the operation and recovery of systems or procedures that are already included in the event modeling. In this case, use of the standby feedwater system may reduce the likelihood of recovering failed AFW equipment or initiating feed-and-bleed due to time and personnel constraints. Materials Provided for Review The following materials have been provided in the package to ft cilitate your review of the preliminary analysis of the operational event. The specific LER, augmented inspection team (AIT) report, or other pertinent reports. e A summary of the calculation results. An event tree with the dominant sequence (s) e highlighted. Four tables in the analysis indicate: (1) a summary of the relevant basic events, including modifications to the probabilities to reflect the circumstances of the event, (2) the dominant core damage sequences, (3) the system names for the systems cited in the dominant core damage sequences, and (4) cut sets for the dominant core damage sequences. Schedule Please refer to the transmittal letter for schedules and procedures for submitting your comments. References 1. R. J. Belles et al., " Precursors to Potential Severe Core Damage Accidents: 1997, A Status Report," USNRC Report NUREG/CR-4674 (ORNL/NOAC-232) Volume 26, Lockheed Martin Energy Research Corp., Oak Ridge National Laboratory, and Science Applications intemational Corp., Oak Ridge, Tennessee, November 1998. l 1 ~-

I '_ e g ] / g? 00n8 ksSt NUCbt8r Power StatsOn $501 Nom Start Route 2 ^ Oak hatDor, onto 4344p.9760 l 8 NP-33 98-01100 Docket No. 50-346 License No. NPF-3 f November 13, 1998 United States Nuclear Regulatory Commission Document Control Desk Washington. D.C. 20555 Ladies and Gentlemen: l LER 1998-011 I Davis-Besse Nuclear Power Station, Unit No.1 Date of Occurrence - October 14.1998 .j Enclosed please find Licensee Event Report 1998-011, which is being submitted to provide 30 days written notification of the subject occurrence. This LER is being submitted in accordance with 10CFR50.73(a)(2)(i)(B) and 10CFR50.73(a)(2)(iv). Very truly yours,

J ll H. Lash hj Plant Manager l

Davis-Besse Nuclear Power Station ) j DLM/dic Enclosure l cc: .Mr.J. L Caldwell Acting Regional Administrator USNRC RegionIII [ Mr. Stepben J. Campbell DB-1 NRC Senior Resident inspector l Utility Radiological Safety Board ( y ii h_v, #l l Ikhh m. u o in i

l i i t 1 NRC FORM 346 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB NO. 31604104 EXPIRES 06W2001

• '""3 Esumand tween

,- so e,r see respeu to conwy saim rus maaosiory neormsten sweae a .o. e.,. -. oo,. e, pronssa ano ted t ca to moustry Formere somer LICENSEE EVENT REPORT (LER) ~ A.com. -- a~ c.rmn u s.us fugtrorg twooi esir.m to a i.,v c- ...,y.. oc mism -. in. - w- , matew Once er idens9.meru anc Swaym Washngian DC 20603 m an eWo i (See reverse for required number of a==== com am o, e e-.rw y me oue can

• a,me=r. e. Nac==r as degr!s/ characters for each block) g,""*"""888""*""'***""8""8*'*"*'*"

eaca/rv siaast (s) oocartNuusen6:3 paos (si Davis BesSe Unit Number 1 05000346 1 OF 10 TITka te) Manual Reactor Trip Due to Component Cooling Water System Leak EVENT DATE (5) LER NUMBER (6) REPORT NUMBER OTHER FACIUTIES INVOLVED (8) LEQUDMAL REV:ss0*e FAcduTV **AadE D0c'TiNUMSLA WOWN DAY YEAR YEAA WONTH DAY YEAR ,,m R NUWBER 05()O0 10 14 1998 1998 - 011 - 00 11 13 1998 05000 @PEAATING THis REr'ORTIS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR 5: (Check one or rnore) (11) MODE (9) 1 20.2201(b) 20.2203(aX2)(v) X 50.73(a)(2)0) 50.73(ax2Mvlii) POWER TO 2203(a)(1) 20 2203(aW3)/I) 50 73(a)(2)/il) 50 73(a)(2Vx) LEYEL (10) 87 20.2203(aH2)C) 20.2203(aH3)0i) 50.73(a)(2)0ii) 73.71 20 2203/eM2)(ii) 20 2203(aW4) X 50 73(a)(2)(iv) OTHER 20.2203(a)(2)0ii) 50.36(c)(1) 50.73(aK2)(v) speady e Atstreet be6ow 20.2203(aH2)0v) 50 36(c)(2) 50.73(aK2)(vii) or m NRC Form 366A UCENSEE CONTACT FOR THIS LER (12)

• • Ama in.tPMoNE NUteEA (wungen Area coes)

Dale L. Miller, Senior Engineer. Licensing (419) 321 7264 COMPLETE ONE UNE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT (13) CAUSE SYSTEM ConPONEWI MANUFACTURER Ep CAUSE SYSTEW Cot #0 NEWT MANUFACTURER EP B CC RPD B295 Y I X CC 6 W120 Y SUPPLEMENTAL REPORT EXPECTED (141 EXPECTED WONN DAY 4AR SUBMISSION X NO DATE(15) t yes comp 6ere EXPECTED SUBMISSION DATE). ABS' TRACT (Umrt to 1400 spaces, i.e., approximateiy 15 sangle-spaced typewrmen lines) (15) On October 14, 1998, at 1523 hours, with the Davis-Besse Nuclear Power Station operating in Mode 1, at 87 percent rated thermal power, the plant was manually tripped. Previously on October 14, at 1356 hours, the plant was operating at 100 percent power, when electrical busses D1 and D2 experienced a lockout. As a result of the loss of a condensate pump and several other plant loads powered by these busses, thermal power was reduced to 87 percent. When the lockout occurred, Component Cooling Water (CCW) Pump 1-2 stopped. When CCW Pump 1-1 automatically started, a CCW system leak developed that was determined to be located inside the containment. When CCW pump 1-2 was restarted, the CCW Surge Tank level decreased rapidly. At a surge tank level of 35 inches and decreasing, plant operators tripped the Reactor, and the Reactor Coolant Pumps in accordance with plant procedures. During the trip recovery, a makeup pump failed to start on demand, and a plant overcooling occurred. The cause of the CCW 1eak was failure of one letdcwn cooler rupture disk. All of the letdown cooler rupture disks were replaced prior to plant restart. This event was reported to the Nuclear Regulatory Commission (NRC) within four hours via the Emergency Notification System at 1750 hours on October 14, 1998 as an event that resulted in manual actuation of the Reactor Protection System (RPS) in accordance with 10CFR50.72 (b) (2) (ii). This report is being submitted in accordance with 10CFR50.73 (a) (2) (i) (B) and 10CFR50.73 (a) (2) (iv). NRC FORM 306 (61808) 1

( t..... w C FORM M4A U.S. NUCLEAR REGULATORY COMMISSION N-. u> v.- LICENSEE EVENT REPORT (LER) TEXT CONTINUATION F ACILfTY NAME (1) DOCKET NUMBER (2) LER HUMSER (5) P AGE (3) SEQUEMnAL REVtSION Davis-Besse Unit Number 1 , 05000346 NUMBER NUWBER 2 OF 10 l 1998 - 011 - 00 Tui (It more space as reawed, use eso00nalcopies of NRC Form 3664) (17) Description of occurrence: On October 14, 1998, at 1523 hours, with the Davis-Besse Nuclear Power Station (DBNPS) operating in Mode 1, at 87 percent rated thermal power, the plant was manually tripped in accordance with abnormal operating procedure, DB-OP-02523,

• Component Cooling Water System Halfunctions." Previously on October 14, at 1356 hours, the plant was operating at 100 percent power, when an electrical bus D1,

[ Energy Industry Identification System-Function Code: EB-BU) bus D2, [EA-BU) and Station Blackout Diesel Generator (SBODG) [EK-DG) lockout occurred. At the time of this event, Bus Tie Transformer AC, [EA-XFMR) which is also capable of providing a backup power supply to 4160 volt essential bus D1 via circuit breaker AACD1, [EB-BKR) was de-energized for fire protection system deluge [KP-SRNK) testing. Routine preventive maintenance had also been performed on circuit breaker AACD1, and the circuit breaker was ready to be rolled back into its cubicle. At 1355 hours; on October 14, 1998, an electrician attempted to install the Westinghouse type DHP circuit breaker into cubicle AACD1. After the breaker had been rolled partially into the cubicle, the electrician noted that the circuit breaker was not completely aligned with the floor rail. The electrician repositioned the breaker, then resumed rolling the breaker into the cubicle. As it was being rolled into the cubicle, the metal breaker frame contacted a teminal screw of a time-over-current relay, [EB-SIGS) mounted on the cubicle door, which provides backup ground over-current protection for busses D1 and D2. Accidental contact between the terminal and the breaker, which was grounded via the floor rail, provided a path for current to flow from the DC control power bus to ground via the operating coil of an auxiliary trip relay (EB-511X). This high speed trip relay, which operates in 8 milli-seconds or less, includes a seal-in circuit that ensures the relay stays in the trip state even if the initiating signal is only momentary. The lockout caused non-essential bus D2 supply breaker ABDD2 [EA-BKR) and D1/D2 bus tie breaker AD110 to open, which de-energized bus D2 and er.sential bus D1 [EB-BKR). The SBODG output breaker (AD213) [EA-BKR) was also locked cut. Emergency Diesel Generator (EDG) 1-2 [EK-DG) started on low voltage when the D1/D2 bus lockout occurred at 1356 hours. The EDG output breaker AD101 [EB-BKR) could not close because it was also locked out. At approximately 1401 hours, the EDG was shutdown per procedure because no component Cooling Water was available to cool the engine. Due to the lockout, Service Water Pump (SWP) 1-2[BI-P) and Component Cooling Water Pump (CCWP) 1-2 [CC-P) stopped. Secondary system loads were also lost, including Condensate Pump 1-2 [SD-P). All normal station lighting, which was supplied by bus D2, was lost. A plant pcwer reduction was initiated by Plant Operations personnel due to the loss of Condensate Pump 1-2, with the intent of stabilizing reactor power at a level within the capacity of the two available condensate pumps. The power reduction was stopped at approximately 87 percent power at 1430 hours. Auxiliary Feedwater Pump (AFP) 1-1 was out of service for testing prior to the lockout event. Testing was completed and AFP 1-1 was declared operable at 1415 hours on October 14,1998. From 1356 hours until 1415 hours, both auxiliary feedwater trains were inoperable. The AFP 1-2 was made inoperable as a result of the lockout, which resulted in the plant being in Technical Specification (TS) 3.0.3 for this time period. At the onset of the event, efforts were initiated to restore AFP 1-1 to an operable status, which was accomplished at 1415 hours. Although a plant power reduction was made, the power reduction was not initiated as a result of entry into TS 3.0.3. NRC FORW 386A (61998)

F I 1* NRC FORM 346A U.S. NUCLEAR REuuLATORY COMMISSION tMess) LICENSEE EVENT REPORT (LER) TEXT CONTINUATION F ACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) P AGE (3) I stoutwrx Revision Davis Besse Unit Number 1 - 05000346 NUMBER NtheER 3 OF 10 1998 - 011 -- 00 TEXT (Itmore space os tenwed, use adot00nal cop,es of NRC Form 366A) (17) Description of Occurrence: (Continued) Loss of power to busses D1 and F.1 placed the plant into the Actions for the TS listed below: l TS 3.1.2.4 Reactivity Control Systems - Makeup Pumps TS 3.3.2.2 Steam and Feedwater Rupture Control System Instrumentation TS 3.7.1.2 Auxiliary Feedwater System TS 3. 7.1 '. 7 Motor Driven Feec' water Pump System TS 3.8.1.1 Electrical Power Systems - A.C. Sources TS 3.8.2.1 Onsite Power Distribution Systems - A.C. Distribution TS 3.8.2.3 Electrical Power Systems - D.C. Distribution As a result of the loss of the 4160 volt D1 electrical bus at 1356 hours on October 14, 1998, several TSs, listed below, were entered because both the normal and emergency power sources for the affected equipment were inoperable. As a result, the unit was required to satisfy the Limiting Condition for Ope. ration of TS 3.0.5. TS 3.3.3.1 Radiation Monitoring Instrumentation TS 3.4.6.1 Reactor Coolant System Leakage Detection System TS 3.5.2 Emergency Core Cooling System Subsystems TS 3.6.2.1 Containment spray Systems TS 3.6.2.2 containment Cooling Systems TS 3.6.3.1 Containment Isolation Valves TS 3.6.4.1 Combustible Gas Control Hydrogen Analyzers TS 3.6.4.3 Containment Hydrogen Dilution System i TS 3.6.4.4 Containment Hydrogen Purge System TS 3.6.5.1 shield Building Emergency Ventilation System TS 3.7.3.1 Component Cooling Water System TS 3.7.4.1 Service Water System TS 3.7.6.1 Control Room Emergency Ventilation System TS 3.9.12 Storage Pool Ventilation At 1512 hours on October 14, 1998, electrical busses D1 and F1 were re-energized, which returned the normal power supply affecting the TS systems or components listed above, and these TSs were exited. The action requirements of TS 3.0.5 were satisfied. Prior to the bus D1/D2 lockout, CCWP 1-2 was operating and supplying non-essential CCW loads inside Containment. Troubleshooting was in progress on the CCWP 1-1 discharge flow indicating switch FIS1422D (CC-FIS), which was isolated and drained. Both Reactor Coolant System (RCS) letdown coolers [AB-HK) were in-service. When the bus D1/D2 lockout occurred, CCWP 1-2 tripped. When low pump discharge flow was sensed for CCWP 1-2, a start signal was provided for. CCWP 1-1 and open signals were provided to the Loop 1 non-essential isolation valves (CC-ISV). After CCWP 1-2 tripped and CCWP 1-1 started, the Loop 1 non-essential valves began to open after a thirty second time delay. When CCWP 1-2 tripped, close signals were sent to the Loop 2 non-essential isolation valves. However, the Loop 2 non-essential valves could not close due to the D1/D2 bus lockout. During the 30 second time delay for the Loop 1 non-essential isolation valves to begin stroking open, no CCW flow was provided to the RCS letdown coolers. Hot reactor coolant flowing through the letdown coolers heated the CCW in the coolers to saturation conditions which caused steam to form in the coolers. When CCWP 1-1 started and re-initiated flow to the letdown coolers, introduction of sub-cooled CCW caused the steam pockets to collapse. The resultant short duration pressure spike NRC F0W 386A (61988)

r x, QFORM 364A U.S. NUCLEAP REcuLATORY COMMISSION !6 LICENSEE EVENT REPORT (LER) { TEXT CONTINUATION F ACERY NAWE (1) DoCKri NUWsER (2) LER NUMBER (6) P AGE (3) SEQUENTA REVWON Davis Besse Unit Number 1 05000346 NUMBER NUMBER 4 OF 10 1998 - 011 - 00 TEXT (Itmore space os reqwred, use audiDonalcopes of NRC Form 36M) (17) Description of Occurrence: (Continued) damaged one of the two rupture disks [CC-RPD) on Letdown Cooler 1-1 (PSE 3761). Alarw.s received for operation of the Containment Normal Sump Pump [NH-P) and low level in the CCW Surge Tank [CC-TK) were correlated, which indicated that'a leak of an estimated 2 to 5 gpm had started in Containment from the CCW system. The breaker being installed into D1 bus cubicle AACD1 was removed from the cubicle. Af ter assessment of the lockout and the status of the electrical distribution system by Plant Maintenance, Operations and Engineering personnel, the lockout was reset, and restoration of electrical busses was commenced. When 480 volt essential bus F1 i was re-energized at 1512 hours, power was restored to the CCW Loop 2 non-essential isolation valves. The loop 2 non-essential isolation valves started to cycle open and closed because of an open signal from FIS1422D and a close signal from the breaker interlocks. The valves continued to cycle until CCWP 1-2 was started.

• At 1517 hours, SWP 1-2 was restarted followed by the restart of CCWP 1-2 at 1523 hours. When the CCWP 1-2 was started, the CCW Surge Tank level decreased rapidly.

At the level of 35 inches and decreasing, the Control Room Senior Reactor Operator instructed the Reactor Operators to trip the Reactor, and to trip the Reactor Coolant Pumps (RCPs) [AB-P) in accordance with DB-OP-02523, " Component Cooling Water System Malfunctions." Plant operators entered the plant emergency procedure DB-OP-02000. The Control Rod Drive Trip Breakers [AA-BKR] opened and all control rods inserted on the reactor trip, as designed. Tripping the RCPs resulted in an actuation of Auxiliary Feedwater (AFW) [BA) from the Steam Feedwater Rupture Control System (SFRCS) [JB) and the establishment of natural circulation core cooling. Natural circulation conditions were fully developed approximately four minutes after the RCPs were tripped. Following the Reactor trip, operators attempted to start Makeup Pump 1-2 [CB-P) in accordance with procedure. However, the pump did not start. The steam generator (SG) outlet pressu:tes increased due to the closing of the main turbine stop valves. The turbine bypass valves (TBVs) and the atmospheric vent valves (AVVs) opened and the main steam safety valves (MSSVs) lifted in response to the increasing secondary system pressure. The MSSVs,.and the AVVs closed as SG outlet pressure decreased. The TBVs throttled closed as they attempted to control SG outlet pressure at the post-trip setpoint of approximately 995 psig. Following the reactor trip, MSSV SP17B7 [SB-RV) was identified to be not fully closed. Main steam pressure was manually reduced to 920 PSIG, per procedure DB-OP-02000, to reseat MSSV SPl?B7. The MSSV reseated and SG pressures stabilized. The plant operators determined that this minor overcooling event had been terminated based on the initial SG pressure response. The magnitude and the rate of this overcooling was within the TS limits for cooldown of the RCS. Although SG pressure initially recovered within a few minutes, SG pressures and RCS temperature started to decline. The plant operators were aware of the potential for overcooling due to steam production being less thar. the steam loads for the equipment in service. The RCS cooldown rate was initially determined to be less than 50 degrees Fahrenheit per hour. Since the safety Parameter Lisplay System was not available, the RCS cooldown rate was determined by manual calculation. MC F0FW 306A (61000)

S* 3 t NRC FORM 366A m ent U.S. NUCLEAR REGULATORY COMMISSION J-LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) SEQUEVTIAL REVISION Davis Besse Unit Number 1 05000346 NUMBER NWBER 5 OF 10 1998 - 011 - 00 iEXT (It more apace os reqwec, use ad@ DOC.'.optes of NRC Form 366A) (17) Description of occurrence: (Continued) Actions proceeded to investigate and recover frein the loss of CCW to containment, and recover electrical loads that were lost. Plant operators initiated actions to reduce secondary system steam loads to terminate the overcooling. Prior to the event, the Auxiliary Boiler was out of service for maintenance and code safety valve testing. Plant operators discussed the status of the Auxiliary Boiler with the Plant Engineer who was supervising the code safety valve testing on the Auxiliary Boiler. When it was apparent to the Shift Supervisor that the efforts to reduce secondary system steam loads would not occur soon enough, the Auxiliary Boiler would not be available, and that the cooldown rate had increased to a rate of 65 degrees Fahrenheit per hour, he directed re-entry into the Overcooling Section of DB-OP-02000 and the manual initiation of SFRCS. As plant operators were being directed to manually initiate and isolate the SFRCS, an automatic Low SG Generator Pressure Trip on SG 2, SPRCS Actuation Channel 2, was received at 620 psig. This automatic action occurred approximately 50 minutes af ter the MSSV was reseated. Plant operators then manually actuated and isolated the SFRCS. Steam generator pressures increased. Based on the Shift Supervisors direction, auxiliary feedwater was re-aligned to receive steam from, and to supply auxiliary feedwater, to its respective Steam Generator. Plant conditions were then stabilized in Mode 3. Plant operators made preparations to restore CCW to the Containment while leaving CCW to the letdown coolers isolated. At 1712 hours, CCW was restored to the Containment header to provide cooling for the Control Rod Drives, and RCPs. Shortly thereafter, RCPs 2-2 and 1-2 were started, restoring forced RCS cooling flow. Both AFPs inoperable is reportable to the Nuclear Regulatory Comission (NRC) in accordance with 10CFR50.73 (a) (2) (i) (B) as a condition prohibited by the plant TSs. When CCW was lost for the Reactor Coolant Pumps, the Reactor was manually tripped per plant procedures. This is reportable to the NRC in accordance with 15 M50.72 (b) (2) (ii) within four hours, and the NRC was notified of this event via the Emergency Notification System (ENS) at 1750 hours on October 14, 1998, as an event that resulted in manual actuation of the Reactor Protection System (RPS). This report is being submitted in accordance with 10CFR50.73 (a) (2) (iv) as an event that resulted in manual actuation of the RPS and 10CFR50.73 (a) (2) (i) (B). An evaluation of the CCW surge tank level decrease, coupled with cycling of the non-essential CCW isolation valves produced a conclusion that a common mode failure mechanism existed. This was reported to the NRC via the ENS at 2048 hours on October 14, 1998, in accordance with 10CFR50.72 (b) (2) (iii) (A) as a condition ^that alone could have prevented the fulfillment of a safety function of a system needed to shutdown the reactor and maintain it in a safe shutdown condition. Further analysis of event data demonstrated that the CCW cor)tainment isolation valves (CC1411A and CC1411B) functioned as designed to isolate Letdown Cooler 1-1 within 10 seconds, on low CCW surge tank level, to terminate the leak, maintain CCW system inventory and maintain the required nat pesitive suction head to the CCW pumps. Non-essential, valve cycling was determined to not affect the safety function of the CCW system. As a result, on October 17, 1998, the NRC was notified via the ENS that the notification made on October 14, 1998, at 2048 hours was being withdrawn.

e*, ~ I NRC FORM 366A f8'IM8) U.S. NUCLEAR REGULATORY COMMISSION LICFNSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME (1) DOCKET NUMBER (2) LER NUM BER (6) PAGE (3) SEQUENTA REYlSON Davis.Besse Unit Number 1

• A 05000346 M BER NUMBER 6 OF 10 1998

- 011 - 00 TEXT pf more space os required, use acciconalcopres of NRC Form 366A) (17) Apparent Cause of Occurrence: The precursor event to the CCW Letdown Cooler rupture disk failure was a lockout of the D1 and D2 electrical busse 3. As a 4160 volt breaker was being installed into D1 bus cubicle AACD1, plant personnel noticed that the breaker was not properly aligned with the cubicle floor rails. After plant personnel repositioned the breaker and then rolled the breaker into the cubicle, the metal breaker frame contacted a terminal screw of a ground overcurrent relay, which caused current to flow from the DC control power bus to ground. The apparent cause for this occurrence is an inadequate design layout of the relays mounted on the cubicle door which created a human interface inadequacy. The configuration of the relays mounted on the switchgear deor provides insufficient clearance between the circuit breakers and the exposed relay terminals. Some bus cubicles, including cubicle AACD1, have two vertical columns of protective relays mounted on their door. For this configuration, when the door is held in its maximum open position, the clearance between the breaker frame and the closest relay terminal is estimated to be only one inch. Contributing to the cause of occurrence was a failure of plant personnel to evaluate the conditions noted during the activity and allowing the breaker frame to contact the relay terminal. The Dl/D2 bus lockout caused a loss of the operating CCW pump which was followed by failure of letdown cooler rupture disk PSE3761. The primary cause of this event was a design configuration that allowed the formation and subsequent collapse of steam voids within a heat exchanger designed with rupture disks for overpressure protection. Letdown flow through the coolers wus approximately 25 gpm per cooler at a temperature of approximately 558 degrees Fahrenheit. Normal CCW flow is approximately 390 gpm per cooler at 80 psig and 85 degrees Fahrenheit. Following a loss of the operating CCW pump, CCW pressure drops to approximately 20 psig and total CCW pump flow drops to 1000 gpm before the standby pump starts. Thirty seconds after the standby pump starts, the associated non-essential isolation valves will begin to open to re-establish flow to the Letdown Coolers. This design would result in a total loss of CCW flow to the Letdown Coolers for approximately 30 seconds. During this time, letdown flow at 25 gpm and 558 degrees continued to both coolers, causing the CCW within the coolers to boil and form steam voids within the coolers. Saturation temperature for water at 20 psig is approxima V y 258 degrees Fahrenheit. The bulk CCW temperatures noted downstream of the Letdow Coolers following flow recovery were 240 degrees Fahrenheit. The computer points monitoring these temperatures have a thirty second scan time and actual peak temperatures within the cooler would exceed bulk temperatures downstream due to mixing action, supporting the conclusion that saturation temperatures were reached within the coolers. When CCW flow was recovered, colder water was forced into the coolers causing the steain voids to collapse, resulting in a water hammer type event. The pressure pulse caused by the steam void collapse was sufficient to damage the inlet rupture disc on Letdown Cooler 1-1 resulting in the initial 2-5 gpm leak. In 1993, a plant modification installed the current rupture disks with a 250 PSI setpoint. The analysis and modification didn't recognize the potential for higher pressure pulses due to steam voiding during the transfer from an operating CCW pump to the standby pump. NRC PORM 3BSA (6. tees)

NRC PORM 366A van) U.S. NUCLEAR RFGULATORY COMMISSION LICENSEE EVENT REPORT (LER) TEXT CONTINUATION F ACILfTY NAME (4 DOCKET NUMBER (2) LER NUMsER (6) PAGE (3) SEQUENTIAL REYl$oN Davis Besse Unit Nurnber 1 05000346 NUWBER NUh8ER 7 OF 10 r 1998 - 011 - 00 TEXT ptmore space as required, use ac$00nalcepes of NRC Form 366A) (17) Apparent Cause of Occurrence: (Continued) Contributing to the cause of this event was that the troubleshooting activities for FIS 1422D locked in an open signal to the Loop 2 non-essential isolation valves. When power was restored to the Loop 2 non-essential isolation valves, these valves started to cycle open and closed, and continued to cycle until CCWP 1-2 was started. This was a distraction and did not initially contribute to the event. However, when CCW Pump 92 was restarted, this cycling resulted in a hydraulic pressure pulse from the pump start being transmitted to the Letdown Cooler rupture dise previously damaged, which caused the size of the CCW leak to increase significantly. The effects of FIS 1442D troublesheoting activities on the system were discussed with Plant operations prior to beginning work. This work was commenced because open signals were being sent to valves already aligned open and that the troubleshooting activities would not effect the interlocks that would transfer CCW loads to the standby pump following a loss of the operating CCW Pump. The potential to cause the non-essential isolation valves on Loop 2 to cycle following a loss of the operating pump was not identified. Failure of MUP 1-2 to start is attributed to an inadequate gap between the armature buttons of the breakers' anti-pumping relay and the relay cover plate. Bench testing of the anti-pump relay removed from the breaker determined that the slightest pressure on the armature buttons caused a high resistance or open contact in series with the breaker spring release circuit coil. This high resistance or open contact would prevent the breaker from closing because the spring release circuit could not pick up. With the relay installed in the breaker, the relay cover plate was observed to be in contact with the relay's armature buttons. It was concluded that there was sufficient contact between the cover plate and armature buttons to prevent the spring release circuit from picking up. Overcooling of the RCS following the reactor trip was a result of the steam demands on the Main Steam system to supply the secondary systems being greater than the amount of decay heat available for steam production. The Auxiliary Boiler was not available to supply the steam loads in the secondary systems, due to code safety valve testing. The RCPs had been shutdown due tc a loss of CCW to containment which removed approximately 16 megawatts thermal heat input. The shutdown of the RCPs then resulted'in automatic initiation of the AFPs, adding additional steam loads. During the initial entry into the Overcooling Section of DB-OP-02000, *RPS, SFAS, SFRCS Trip or SG Tube Rupture,

• SG pressure was reduced to reseat MSSV SP17B7. The reduction in pressure did result in the MSSV reseating. An incorrect assumption was made br the plant operators that the overcooling event had been terminated based on the initial SG pressure response. As a result, the overcooling Section of the procedure was exited and Supplemental Actions were continued. Although pressure did initially recover, within a few minutes, SG pressures and RCS temperature started to decline.

If the overcooling Section of the procedure had been continued, operators would have been directed to initiate and isolate the SFRCS, which would have terminated the overcooling event. When the plant operators recognized t. hat the overcooling was still in progress, they delayed re-entering the overcooling Section of the procedure to focus on other plant conditions. The philosophy use document for DB-OP-02000 states that emergency procedure actions take priority over most abnormal procedure actions. Early actuation and isolation of the SFRCS would have terminated the overcooling allowing resources to be focused on dealing with the other plant problems. -s

e: s. NRC FORM 396A

feasse, U.S. NUCLEAR REGULATORY COMMISSION LICENSEE E'ENT SEPORT (LER)

) TEXT CONTINDATION FACILITY NAME (O DOCKET ?tuuSER (2) LER NUMBER (6) PAGE (3) $EQUENEAL REVISION Davis-Besse Unit Number 1 05000346 NWeER NWSER 8 OF 10 YEAR 1998 - 011 - 00 TEKT (Itmore space a reqwred, use addtDonalcopes of NRC Form 366A) (17) Analysis of Occurrence: This event had no safety significance to the health and safety of the public. Upon initiation of the manual Reactor trip, the Reactor Protection System and the Control Rod Drive Trip Breakers functioned properly and all Control Rods inserted as designed. After the RCPs were tripped and the Steam and Feedwater Rupture Control System was actuated, natural circulation flow was developed in the RCS as expected. The Turbine Bypass Valves, Atmospheric Vent Valves and Main Steam Safety Valves functioned to cool the RCS as required. Although the combination of events that occurred relative to the CCW system rupture disk failure caused the Reactor to be manually tripped, the CCW leak in the non-essential header was automatically isolated on low CCW Surge Tank level as designed. The safety function of the CCd system was preserved and the CCW system was available to provide its safety-related cooling functions as. designed. A review of heat exchangers serviced by the CCW system determined that there are no other heat exchangers designed with rupture disks for over-pressure protection. A review of other cooling water systems (Service Water, Turbine Plant Cooling Water, and Chilled Water) also identified no heat exchangers with rupture disks installed. There were also no other heat exchangers identified with a large heat gradient between the tube and shell sides as the letdown coolers, making these coolers the most susceptible to steam voiding on a loss of CCW flow. Failure of MUP l-2 to start was noteworthy because the required gap between the breaker anti-pump relay artr.ature buttons and ther protective cover was not previously identified as a possible cause of the breaker's failure to close. This was the first documented failure of a breaker to close because of this deficiency. Previously documented closure failures were traced to either the latch check switch or the motor cutoff switch. The complete population of 4160 volt breakers, which is 51 operational breakers and 3 spare breakers, was inspected. This inspection revealed three other breakers with no clearance between the armature buttons and the cover plate, which could have potentially affected their ability to close on demand. Two of these breakers, ADlli for High Pressure Injection Pump 1-2 and AD301 for the J SBODG, were in service. The third breaker, for CCWP l-3, was not in service. 1 The overcooling event had minimal safety significance. The maximum cooldown rate calculated from the plant post-trip data was approximately 90 degrees Fahrenheit per hour. The maximum allowable RCS cooldown rate limit provided in TS 3.4.9.1, Reactor Coolant System Pressure - Temperature Limits, is 100 degrees Fahrenheit per hour for RCS terqperatures greater than or equal to 270 degrees Fahrenheit. The RCS temperature was maintained greater than 270 degrees Fahrenheit during this event. Evaluation of tha procedures and systems used for mitigation of the overcooling 1 indicated they Are capable of performing their intended function. j i

e,. 4 . C. NRC FORM 306A U.S. NUCLEAR RE20LATORY COMMIS;ON LICENSEE EVENT REPORT (LER) TEXT CONTINUATION F ACLfTY NAME (1) DOCKET NUMBER (2) LER NUMBEA (6) PAGE (1) SEQUENTML REVIS40N N Davis-Besse Unit Number 1 - 05000346 NumER maalER 9 OF 10 1998 - 011 - 00 TEXT (It more space os reqwred, use a0@Donalcopres of NRC Form 366A) (17) Analysis of occurrence: (continued) Main Steam Safety Valve, SP17B7, opened as required during the event. However, the valve did not reseat until main steam pressure was reduced to 920 PSIG. A setpoint check using a hydroset conducted on October 18, 1998, showed the valve lifted within one percent of its 1050 PSIG setpoint, two times. No setpoint adjustments were required. A minor over-cooling of the RCS resulted from reducing the Steam Generator outlet steam pressure approximately 75 PSIG below the normal post-trip setpoint of 995 PSIG. The magnitude and rate of this ovprecoling was within the TS limit for cooldown of the RCS. Corrective Actions: Af ter the Dl/D2 bus lockout occurred, the breaker being installed into D1 bus cubicle AACD1 was removed from the cubicle. After assessment of the lockout and the status of the electrical distribution system by Plant Maintenance, Operations and Engineering personnel, the lockout was reset, and restoration of electrical busses was completed. After review of this occurrence within the DBNPS corrective action program, several corrective actions have been recommended relative to the inadequate human interface design inadequacy for the 4160 volt bus breakers. Final review of the recommended corrective actions will be completed by November 20, 1998. Following the failure of the letdown cooler rupture disks, all four letdown cooler rupture disks were replaced prior to plant startup. A. plant modification (98-0050) was initiated to replace the existing letdown cooler rupture disks with another means of overpressure protection. A Temporary Modification (98-0037)was implemented to reduce the time delay for opening the non-essential isolation valves from 30 seconds to 5 seconds to reduce the potential for steam void formation in the letdown coolers. A plant modification to make a permanent change to this time delay circuitry will be initiated by November 30,1998. Changes to the preventive maintenance procedures and the data packages for CCW flow switches to specify required actions to prevent cycling of valves, will be completed by January 29, 1999. When the cause of MUP 1-2 failure to start was determined to be inadequate clearance between the armature buttons and the cover plate, maintenance work activities were completed to inspect all 4160 volt breakers. Repairs were made to the three breakers containing anti-pump relays that did not demonstrate adequate clearance between the armature buttons and the cover plate. The maintenance procedure for 4160 volt breakers will be revised to include a check of the clearance between the armature buttons and the cover plate. This procedure revision will be completed by March 31, 1999. Actions to be completed relative to the overec,oling event are as follows: A training package will be developed and presented by December 18, 1998, to each Operating Crew to provide information about this event and Plant Operation's management expectations for any future events of this nature. An alteration will be completed to DB-OP-02000 and/or the Bases Document for DB-

• OP-02000 to incorporate lessons learned from this event. Simulator training will be conqpleted utilizing the draft procedure. These actions will be completed by June 30, 1999.

NRC PORW 306A (84005)

2 ] *.4 e NRC FORM 306A ). , **) U.S. NUCLEAR REauLATORY COMMISSION LICENSEE EVENT REPORT (LER) TEXT CONTINUATION F ACRJTY NAME (1) DOCKET NUMsEA(2) LER NUMBER (8) PAGE (3) secuswTw. m Davis-Besse Unit Number 1 '05000346 maeER maeER 10 OF 10

• A 1998

- 011 - 00 TEXT (if more space es requrred, use addisona/ copes of NRC Form.1664) (17) Failure Data Within the last 3 years there have been 4 reactor trips reported in accordance with 10CFR50.72 (b) (2) (ii) and 10CFR50.73 (a) (2) (iv). Two LERs involved a manual reactor trip. A resin breakthrough for Makeup and Purification Domineralizer 1-3 caused a loss of letdown capability which precipitated a manual reactor trip on high pressurizer level reported in LER 98-002. Inadvertent closure of a main feedwater regulating valve during testing caused a loss of main feedwater which lead to the manual reactor trip reported in LER 98-010. Two LERs involved automatic reactor trips. An automatic reactor trip occurred when an inadvertent actuation of the main transformer fire protection deluge system caused a main generator lockout as reported in LER 97-010. A tornado caused a loss of off-site power and a turbine-generator load rejection which lead to the reactor trip reported in LER 98-006. There have been no manual reactor trips in the last 3 years as a result of a loss of cbW to the RCPs. NP-33-98-011-0 PCAOR 98-1854 PCAQR 98-1855 PCAOR 98-1857 PCAOR 98-1858 PCAQR 98-1859 PCAQR 98-1860 PCAQR 98-1868 PCAOR 98-1884 MC P0fBd MBA (61988)

---

U}}