05000282/LER-2005-001, Regarding Discovery of Single Failure Vulnerability of Unit 1 Safeguards Buses
| ML050960556 | |
| Person / Time | |
|---|---|
| Site: | Prairie Island  |
| Issue date: | 04/04/2005 |
| From: | Solymossy J Nuclear Management Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| L-PI-05-018 LER 05-001-00 | |
| Download: ML050960556 (6) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 2822005001R00 - NRC Website | |
text
APR 0 4 2009 L-PI-05-018 10 CFR 50.73 U S Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Prairie Island Nuclear Generating Plant Unit 1 Docket 50-282 License No. DPR-42 LER 1-05-01, Discovery of Single Failure Vulnerabilitv of Unit 1 Safeguards Buses The Licensee Event Report for this occurrence is attached. This event was reported via the Emergency Notification System in accordance with 10 CFR Part 50, Section 50.72, on February 5, 2005. Please contact us if you require additional information related to this event.
Summary of Commitments This letter contains no new commitment and no revisions to existing commitments.
Island Nuclear Generating Plant Enclosure cc:
Administrator, Region Ill, USNRC Project Manager, Prairie Island, USNRC Resident Inspector, Prairie Island, USNRC Glenn Wilson, State of Minnesota 171 7 Wakonade Drive East Welch, Minnesota 55089-9642 Telephone: 651.388.1 121
ENCLOSURE LICENSEE EVENT REPORT 1-05-01 4 pages follow
NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION (6-2004)
LICENSEE EVENT REPORT (LER)
(See reverse for required number of digitslcharacters for each block)
FACILITY NAME (1)
Prairie Island Nuclear Generating Plant Unit 1 APPROVED BY OMB NO. 3150-0104 EXPIRES 6-30-2007
, the NRC may not conduct or sponsor, and a person IS not requlred to respond to, the lnformatlon collectlon DOCKET NUMBER (2) 05000 282 TITLE (4)
Discovery of Single Failure Vulnerability of Unit 1 Safeguards Buses PAGE (3) 1 of 4
EVENT DATE (5)
MO 2
LER NUMBER (6)
DAY 5
YEAR SUPPLEMENTAL REPORT EXPECTED (14)
YEAR 05 REPORT DATE (7)
ABSTRACT On February 5, 2005, Prairie Island Nuclear Generating Plant (PINGP) Staff completed an evaluation of an event reported at Crystal River dealing with the single failure vulnerability of safeguards buses. The review determined that the Prairie Island Unit 1 safeguards buses did have a single failure vulnerability due to current transformer (CT) circuits for the source breakers for these buses from the CT11 (Cooling Tower 11 transformer) source that are tied together with a secondary CT on the common wires which feeds metering equipment. At approximately 8:45 pm Central Standard Time (CST), plant operators declared affected Unit 1 safeguards buses 15 and 16 inoperable and declared one path from the grid inoperable. At approximately 10:15 pm CST, operators restored buses 15 and 16 to operable status after they were transferred to an alternate source (1 RY transformer) and the CT11 breakers and relaying disconnects were opened. Since a single failure vulnerability of the Unit 1 safeguards buses (which are required to meet the single failure criterion) was identified, this event is reportable per 10 CFR 50.73(a)(2)(ii)(B).
Temporary modification of the CT11 relaying scheme was completed on February 8, 2005.
05
-- 01 --
0 SEQUENTIAL NUMBER MO 4
OTHER FACILITIES INVOLVED (8)
YEAR EXPECTED SUBMISSION DATE (15)
NO YES (If yes, complete EXPECTED SUBMISSION DATE).
REV NO FACILITY NAME FACILITY NAME X
DAY 6
DOCKET NUMBER DOCKET NUMBER MONTH YEAR 05 DAY U.S. NUCLEAR REGULATORY COMMISSION (1 -2001 )
LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION TEXT (If more space is required, use additional copies of NRC Form 366A) (17)
EVENT DESCRIPTION
On February 5, 2005, during review of operating experience from a Crystal River event (#41362),
Nuclear Management Company, LLC (NMC) engineering identified that the source side current transformer' (CT) circuits for the Unit I safeguards buses2 15 and 16 source breakers from the CT1 l3 source are tied together with a secondary CT on the common wires that feed metering equipment.
Failure in the common portion of this CT circuit could actuate an overcurrent relay in each bus locking out both safeguards buses. Overcurrent relays in these CT circuits actuate bus lockout relays for each bus.
At approximately 8:45 pm CST on February 5, 2005, operators entered Technical Specification (TS) 3.0.3 due to buses 15 & 16 being declared inoperable due to potential vulnerability to single failure.
With buses 15 and 16 inoperable, the Required Action for TS 3.8.9 (Distribution Systems -
Operating), Condition E (two trains with inoperable distribution subsystems that result in loss of safety function), is entry into TS 3.0.3. Additionally, operators entered TS 3.8.4 (DC Sources - Operating),
Condition A, due to cascade from TS 3.8.9, Condition A. Operators also entered TS 3.8.1 (AC Sources - Operating), Condition A, for one path from the grid being inoperable.
At approximately 10:15 pm CST on February 5, 2005, operators exited TS 3.0.3, TS 3.8.9, Conditions A and E, and TS 3.8.4, Condition A. Buses 15 & 16 were transferred to the 1 RY source, with CT11 Breakers in disconnect and the relaying disconnects for CT1 I source breakers open. Both safeguards diesels, both safeguards battery chargers and batteries were operable for TS 3.8.4. TS 3.8.1, Condition A, for one inoperable path from the grid still applied.
At approximately I
- 00 am CST on February 8, 2005, operators exited TS 3.8.1, Condition A, due to the return to service of CT 11 source breakers to safeguards buses 15 and 16. The relaying circuit was modified to achieve the required separation.
EVENT ANALYSIS
Unit 1 safeguards buses 15 and 16 are required to mitigate the consequences of an accident. These buses are required to meet the single failure criterion. In the as-found condition, buses 15 and 16 were determined to be vulnerable to a postulated single failure when they were aligned to the CT11 source. By aligning buses 15 and 16 to the 1 RY source, the potential single failure vulnerability of the buses was obviated, however, until the relaying circuits for CT11 source breakers were modified to achieve the required separation, one path from the grid was inoperable.
1 (EIIS Component Identifier: XCT)
(EIIS Component Identifier: BU) 3 (EIIS Component Identifier: XFMR) U.S. NUCLEAR REGULATORY COMMISSION (1 -2001 )
LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION Impact on Safety System Functional Failure Performance Indicator No actual failure occurred as a result of the as-found condition and safety function of the Unit 1 safeguards buses was not lost. Thus, this condition is not reportable per 10 CFR 50.73(a)(2)(v).
PAGE (3) 3 of 4 FACILITY NAME (1)
Prairie Island Nuclear Generating Plant Unit 1
SAFETY SIGNIFICANCE
TEXT (If more space is required, use additional copies of NRC Form 366A) (17)
The as-found condition of the Unit 1 safeguards buses could have resulted in a single failure causing the lockout of both buses, thus, causing a loss of both trains of emergency AC power on Unit 1. The postulated failure causes the protective relaying to lockout both bus 15 and bus 16. The Prairie Island emergency operating procedures (EOPs) for loss of all emergency AC power include steps to protect the reactor coolant pump4 (RCP) seals, such that leakage is limited to 21 gallons per minute (gpm) per seal. The EOPs also include steps to depressurize the secondary, which depressurizes the reactor coolant system5 (RCS). At an assumed flow rate of 42 gpm, the time to core uncovery (with the secondary depressurized) is more than 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />. In order to restore makeup to the RCS, either one train of safeguards 4kV power6 needs to be restored (restoring the emergency core cooling system7 (ECCS) and charging8) or one train of 480V powerg needs to be restored (restoring charging). Either charging or ECCS can adequately makeup a 42 gpm leak out of the RCS.
Engineering and Operations review concluded that, had the postulated safeguards bus lockout occurred, one of the required sources of power could have been restored well within the 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> available. Therefore, the health and safety of the public was not affected.
DOCKET NUMBER (2) 05000282
CAUSE
Nuclear Management Company, LLC, (NMC) conducted an apparent cause evaluation (ACE) to determine the cause of the as-found condition. The ACE determined that the metering portion of the circuit was added as part of the station blackout and electrical safeguards upgrade (SBOIESU) project. The potential for a single failure resulting in a total loss of Unit 1 safeguards AC power was introduced when the cooling tower metering circuit that was connected to bus 16 via breaker 16-8 was tied into bus 15 at breaker 15-7. The change in the metering circuit configuration was not addressed in enough detail or was not thought to be a credible failure. Due to the size of the scope of the SBOIESU modification it is not clear if the failure to recognize the potential single failure is a modification process or human performance related. The most likely cause is the existing design was LER NUMBER (6) 4 (EIIS Component Identifier: P) 5 6 (EIIS System Identifier: AB) 7 (EIIS System Identifier: EB)
(EIIS System Identifier: BQ) 8 9 (EIIS System Identifier: CB)
(EIIS System Identifier: EA) 10 (EIIS Component Identifier: BKR)
REVISION NUMBER YEAR 05 01 0
SEQUENTIAL NUMBER U.S. NUCLEAR REGULATORY COMMISSION (1-2001)
LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION I
FACILITY NAME (1)
Prairie Island Nuclear Generating Plant Unit I
[
TEXT (If more space is required, use additional copies of NRC Form 366A) (17) sound and had no related issues therefore replicating the design in to the post SBO bus 15 and 16 circuitry was considered acceptable.
The ACE also assessed the potential extent of the condition with respect to CT circuits on the Unit 1 and Unit 2 480V safeguards buses. The original evaluation of the Crystal River event assessed the potential for this condition for all the other CT circuits on Unit 1 and Unit 2 safeguards 4 kV buses.
CORRECTIVE ACTION
Immediate:
- 1. Unit 1 safeguards buses were transferred to an alternate source.
Subsequent:
- 2. A temporary modification was installed in the Unit 1 4kV safeguards bus source breakers to remove the common metering circuit from the overcurrent relays CT circuits. This action removed the potential for a single failure to lock out both Unit 1 4 kV safeguard buses.
Planned:
- 3. A permanent plant modification will provide the required separation between the affected circuits.
- 4. The modification process will be reviewed to determine if there are enough barriers in the process to prevent recurrence.
PREVIOUS SIMILAR EVENTS
No previous events involved single failure vulnerability of Emergency AC.