05000317/LER-2006-001
| Calvert Cliffs Nuclear Power Plant | |
| Event date: | 03-24-2006 |
|---|---|
| Report date: | 12-26-2006 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| 3172006001R01 - NRC Website | |
I. DESCRIPTION OF EVENT
On March 24, 2006, with Unit 1 shutdown in Mode 6, the 1A Emergency Diesel Generator (1A EDG) was secured by Operations during performance of Surveillance Test Procedure (STP) 0-004A-1 (Unit 1 A-Train Engineered Safety Features Test). During the test, the 1A EDG started and loaded on a 4 kV Bus 11 loss of voltage as expected however, an unexpected condition occurred when its vital Motor Control Center (MCC) (1MCC123) Feeder Breaker (52-1703) tripped on short-time overcurrent. The 1A EDG ran for approximately 20 minutes loaded on the 4 kV bus but was secured by operations personnel when it was determined that the feeder breaker had tripped. Subsequent troubleshooting determined that the feeder breaker amptector short-time circuit design setting (2400A) was too low and had drifted to 2232A. When the 1A EDG started and re-energized its dedicated busses including 1MCC123, the loads on 1MCC123 caused a normal current inrush of 2340A which is greater than the 2232A setting, tripping the MCC feeder breaker on its short-time setting.
II. CAUSE OF EVENT
The subject condition is applicable to one of the four onsite emergency power sources, the lA EDG which is a Societe Alsacienne De Constructions Mecaniques De Mulhouse (SACM) design diesel generator. The other three EDGs are of a different design (Fairbanks Morse) and are not susceptible to the subject condition. The Fairbanks Morse engines are cooled by service water and do not use electric radiator fans like the SACM diesel engines. The overcurrent settings for the Fairbanks Morse emergency diesel generator Auxiliary MCC were evaluated as a result of this activity and found to have acceptable margin. The feeder breakers for Fairbanks Morse auxiliary MCCs do not have a short-time overcurrent trip.
The lA EDG is a self supporting, radiator cooled diesel generator housed in its own concrete, safety-related building. The lA EDG vital auxiliaries powered from 1MCC123 include six radiator fans, four room ventilation fans, one building supply fan, one building exhaust fan, several room heaters, battery charger, battery exhaust fan, fuel oil transfer pumps, battery room heater unit and fan, Duct Heater-4, and a few other loads. The variance in inrush current on 1MCC123 is dependent upon the environmental conditions. The diesel room ventilation fans start based on diesel generator room temperature. One of the ventilation fans is always running, a second fan starts at 85 degrees F, the third fan starts at 95 degrees F, and the fourth fan starts at 105 degrees F. When battery room temperature is below 78 F, additional load from the battery room heater unit increases the inrush current. The 1MCC123 Westinghouse Feeder Breaker (52 1703) is provided with amptector long-time, short-time, and ground overcurrent protection.
To determine the cause of the event, Calvert Cliffs Nuclear Power Plant (CCNPP) electricians inspected the feeder breaker and found that the Amptector Current-Amperage Short-Time Overcurrent Trip Flag was set. The electricians also identified that the short-time setting had drifted to 2232A (a 7 percent drop from the 2400A setting). The associated loads on 1MCC123 NRC FORM 366AU.S. NUCLEAR REGULATORY COMMISSION (1-2001) CALVERT CLIFFS, UNIT 1 05000 317 2006 - 001 03-�� �� 01 F 0 008 were found to be operating satisfactorily and the associated steady-state currents were found to be within the vendor's nameplate data. Therefore, the electricians concluded that the amptector did not actuate on a fault condition.
Engineering evaluated the inrush currents associated with energizing 1MCC123 during an under voltage (UV) EDG start event. The evaluation determined that an expected inrush current of 2784A exists with all four ventilation fans starting along with the other auxiliary loads. The 2784A value is well above the 2400A amptector short-time setting. As stated earlier, the ventilation fans start based on diesel generator room temperature. During performance of the STP, diesel generator room temperature was below 85 degrees F, therefore only one ventilation fan was running. Battery room temperature was below 78 degrees F, therefore the battery room heater unit was running. With one ventilation fan running, and with the other loads on including the battery room heater unit, the estimated inrush current is 2340A which is below the 2400A nominal amptector short-time setting. However with the 7 percent amptector drift, the as-found setting of 2232A, which is less than the 2340A inrush current, would trip the MCC feeder breaker on short time overcurrent. The 2400A nominal amptector setting has existed since the diesel generator was placed in service in 1996. The surveillance tests are typically performed in the spring, during refueling outages, when diesel building temperature is below 85 degrees F and battery room temperature is below 78 degrees F. Under these conditions, the 2400A setpoint would not result in a trip unless the setpoint drifts below the estimated inrush current of 2340A. This may explain why previous surveillance tests were performed successfully. However, it is clear that the short time setting of 2400A was inadequate and lacked appropriate design margin for simultaneous starting of all radiator and all ventilation fan motors upon a 1A EDG start and load with an UV event under all design bases conditions. Therefore, an engineering change was issued raising the setpoint to 3600A which is well above the maximum estimated inrush current of 2784A.
The 1MCC123 Westinghouse Feeder Breaker (52-1703) trip occurred due to an inadequate short time overcurrent setting that had drifted below the starting inrush currents that existed during performance of the STP. The short-time overcurrent setting design basis was not adequate because the setting did not include the inrush currents associated with the maximum potential loading on the vital MCC. The short-time overcurrent setting of 2400A was based on starting the largest motor with the MCC supplying all other loads and while providing coordination with upstream protection. The root cause analysis (Condition Report number IRE-015-760) performed to address this event concluded that the root cause was a lack of questioning attitude by an Appendix B supplier (vendor) in August, 1994 which was not discovered in CCNPP's Owner Acceptance Process, which was also performed in August, 1994.
The design basis for the original 2400A setting states that the short-time setting was based on the starting of the single largest motor while the MCC was powering all other loads. The basis is not completely adequate because during an undervoltage (UV) event, the diesel starts and load stripping/sequencing occurs and 1MCC123 will simultaneously power all six radiator fans and at least one ventilation fan motor. This results in an expected inrush current which could challenge NRC FORM 366AU.S. NUCLEAR REGULATORY COMMISSION (1-2001) CALVERT CLIFFS, UNIT 1 05000 317 2006 - 001 04-���� 01 p o 008 the 2400A amptector short-time setting. Further, with at least two ventilation fans running, the expected inrush current would exceed the 2400A amptector short-time setting.
The root cause analysis performed to address this event identified system post-modification testing as a potential barrier that could have identified the inadequate short-time setting. However, the post-modification test did not verify operation under all design bases conditions. Specifically, the system was not tested with all four ventilation fans starting simultaneously simulating a maximum temperature condition. Had the post-modification test simulated a maximum temperature condition, the breaker would have tripped and the error would have been detected and corrected.
Another potential barrier identified during the root cause analysis is the owner acceptance review required by plant procedures. Although an owner acceptance review was performed when the calculation was issued in 1994, the reviewer did not question the adequacy of the assumptions in the calculation. Therefore, a contributing cause to the subject event was a lack of questioning attitude when the owner acceptance review of the calculation was performed.
III. ANALYSIS OF EVENT
This event is reportable in accordance with the following:
10 CFR 50.73(a)(2)(v)(D); "Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.
A Significance Determination Process (SDP) evaluation was performed to determine the fault exposure time for the one-year period prior to the failure discovery. The evaluation assumed a linear drift of the amptector short-time overcurrent trip setting from the April 15, 2005 calibration as-left setpoint of 2376 Amps to the as-found setpoint of 2232 Amps on March 25, 2006. The evaluation also considered room and outside air temperature logs to estimate periods when the battery room heaters and/or more than one Diesel Generator Room ventilation fan would have been operating, increasing the MCC inrush current above the trip setpoint. The SDP evaluation determined that prior to June 1, 2005, outside temperatures and room temperatures were low enough that a second ventilation fan was not running and the lA EDG MCC would not have tripped. Because of daily temperature fluctuations and the amptector setpoint drift, the fault exposure period is intermittent beginning June 1, 2005 and becomes continuous on August 28, 2005.
Although the lA EDG would start, load, and run without its vital MCC powered, it would eventually overheat because the radiator fans would not be running. Therefore, during the time of vulnerability the 1A EDG should have been considered inoperable. In determining reportability on any event or condition that affects a system, it is necessary to consider other existing plant conditions. Therefore, a review of maintenance activities affecting the safety function of systems described in 50.73(a)(2)(v) was performed.
The emergency diesel generators are designed to provide a dependable onsite power source capable of starting and supplying the essential loads necessary to safely shut down the plant and maintain it in a safe shutdown condition under all design bases conditions. Two emergency diesel generators are provided for each unit, the 1 A and the 1B EDGs are provided on Unit 1. As stated earlier, the subject condition is applicable to only one of the four safety-related diesel generators, the lA EDG. During the period of vulnerability at least two cases were identified when the unaffected EDG (1B) was out-of-service. Specifically, on August 11, 2005 and again on August 12, 2005, when Chesapeake Bay water temperature exceeded 80 degrees F, the 1B EDG was out-of-service for approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> on each occurrence while service water heat exchangers were removed from service for scheduled cleaning. On August 11 and 12, 2005 with the 1B EDG out-of-service and with the 1A EDG inoperable due to trip setting drifted below expected inrush current, the Unit 1 emergency on-site power source system was not capable of performing its design safety function. Therefore, this event is reportable pursuant to the reportable requirements specified in 10 CFR 50.73(a)(2)(v)(D).
This event is also reportable in accordance with the following:
10 CFR 50.73(a)(2)(i)(B); "Any operation or condition which was prohibited by the plant's Technical Specifications.
The Technical Specifications require two EDGs, each capable of supplying one train of the onsite Class lE AC Electrical Distribution System, to be operable. With one of the EDGs inoperable, required actions include restoring the EDG to operable status within 14 days. As stated earlier, the evaluation determined that the lA EDG should have been considered inoperable (intermittently) from June 1, 2005 until August 28, 2005 and inoperable (continuously) from August 28, 2005 through March 25, 2006. Unit 1 entered a scheduled refueling outage on February 20, 2006.
Therefore, the Technical Specification was not applicable to Unit 1 after that time. However, the condition still existed for a time longer than the completion time allowed by the Technical Specifications, therefore this event is reportable pursuant to the reporting requirements specified in 10 CFR 50.73(a)(2)(i)(B).
The Technical Specifications also require one EDG from the other unit to be capable of supplying power to the Control Room Emergency Ventilation System (CREVS) and the Control Room Emergency Temperature System (CRETS). The lA EDG provides this Technical Specification function for Unit 2. When the 1A EDG is inoperable, the Technical Specifications required actions include declaring the CREVS and CRETS supported by the inoperable EDG inoperable within a 14 day completion time.
As stated above, the lA EDG should have been considered inoperable (continuously) from August 28, 2005 through March 25, 2006 (a period of 209 days). During that time, the 1A EDG NRC FORM 366AU.S. NUCLEAR REGULATORY COMMISSION (1-2001) CALVERT CLIFFS, UNIT 1 05000 317 2006 - 001 -��01 06 0 F 008 was not capable of supplying power to the CREVS and CRETS. The condition existed for a time longer than the completion time allowed by the Technical Specifications, therefore this event is applicable to Unit 2 and is reportable pursuant to the reporting requirements specified in 10 CFR 50.73(a)(2)(i)(B).
This event is also reportable in accordance with the following:
10 CFR 50.73(a)(2)(ii)(B); "Any event or condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety.
Because this event could prevent the fulfillment of the safety function of a system required to mitigate the consequences of an accident, it is also reportable per 10 CFR 50.73(a)(2)(ii)(B) as a condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety.
This event is also reportable in accordance with 10 CFR Part 21. Specifically, the Appendix B vendor (Bechtel Power Corporation) deviated from the technical requirements in the engineering services procurement document resulting in a defective setpoint. The defect affected a basic component (1A EDG), resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety, and therefore could have created a substantial safety hazard The "other" box is checked in field 11 of this Licensee Event Report because this event is applicable to Part 21.
There were no actual nuclear safety consequences incurred from this event. For periods when the 1B EDG was out of service and when the 1A EDG amptector short-time overcurrent trip setting had drifted below the expected inrush value, Unit 1 was more susceptible to a Station Blackout (SBO) event. The SBO diesel generator is designed to provide a power source capable of starting and supplying the essential loads necessary to safely shutdown one unit and maintain it in a safe shutdown condition during an SBO event. The CCNPP SBO DG is a SACM diesel generator, similar in design to the 1A. However, the OC DG had margin up to the point where three ventilation fans were required and therefore remained capable of performing its design function until ambient temperature in the SBO DG room reached 95 degrees F. This condition existed for short periods during the time of vulnerability. This event has low to moderate risk significance based on recoverability of the diesel generators.
IV. CORRECTIVE ACTIONS
A. Engineering was issued to increase the short-time overcurrent setting from 2400A to 3600A which provides adequate design margin.
B. The 1A EDG was tested satisfactorily with the new 3600A setting while all four ventilation fans were running.
C. Training was provided to engineering personnel regarding adequacy of post-modification test procedures.
D. Training will be provided to engineering personnel regarding owner acceptance review expectations.
E. The Appendix B vendor was notified to ensure this issue is included in their corrective action program.
F. Operating Experience was issued to the industry regarding this event.
G. Safety-related 480V bus feeder breakers and safety-related MCC feeder breakers were evaluated to ensure adequate margin exists between the feeder breaker overcurrent trip setpoint and the maximum design bases inrush.
V. ADDITIONAL INFORMATION
A. Component/System Identification IEEE 803 IEEE 805 Component/System EIIS Function System ID Feeder Breaker 52-1703 BKR EK lA Diesel Generator DG EK 1B Diesel Generator DG EK OC Diesel Generator DG EK SRW Heat Exchanger FIX CC Control Room Emergency Ventilation System/Control Room Emergency Temperature System N/A VI 1 A DG Radiator Fans Fan EK 1A DG Room Ventilation Fans Fan EK lA DG Room Supply Fan Fan VJ lA DG Room Exhaust Fan Fan VJ lA DG Room Heater EHTR VJ lA DG Battery Charger BYC EK lA DG Fuel Oil Transfer Pump P EK Battery Room Heater Unit EHTR VJ Duct Heater-4 EHTR VJ t B.� Previous Occurrences A review of Calvert Cliffs' events over the past several years was performed. No previous occurrences were identified.