05000341/LER-2005-006
| Telephone Number (Include Area Code) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| Initial Reporting | |
| ENS 41847 | 10 CFR 50.72(b)(3)(ii)(B), Unanalyzed Condition |
| 3412005006R00 - NRC Website | |
Initial Plant Conditions:
Mode� 1 Reactor Power� 74 percent
Description of the Event
During review of 10 CFR 50 Appendix R (Appendix R), 111.0.2 compliance on July 17, 2005, it was discovered that a fire in a divisional switchgear room affecting maintenance tie breakers 64T or 65T [EA] could adversely affect the emergency diesel generators (EDG) [DG] in the alternate division. Specifically, a combination of hot shorts between bundled conductors in the maintenance tie breaker switchgear in either divisional switchgear room could result in closure of the associated emergency safety system (ESS) maintenance tie feeder breakers [E13].
Since a loss of offsite power must also be considered concurrent with an Appendix R fire, the EDGs are assumed to automatically start and load as designed. This could result in the asynchronous paralleling of the EDGs from the opposite division which could result in damage to those EDGs. Because the conductors bundled within the maintenance tie breakers are in close proximity to each other, they are treated as if they are part of a single multi conductor cable. This combination of hot shorts is considered to be credible in accordance with the guidance provided in NRC Regulatory Issue Summary (RIS) 2004-03 Revision 1.
On discovery of this condition, the maintenance tie feeder breakers (64B-B9, 64C-C9, 65E-E9, and 65F-F9) were racked out and administratively maintained in that condition. No combination of hot shorts can cause the associated maintenance tie feeder breakers to connect the associated busses. Permanent procedure changes have been made to require these breakers to be racked out for the normal electrical lineup for Modes 1, 2, and 3.
There were no actual equipment failures, and the scenario involved would require two specific hot shorts to occur in adjacent conductors bundled within a maintenance tie breaker before the associated 130 VDC power source shorted and its circuit fuse isolated due to the same fire. Although this occurrence is not very likely, it is considered possible.
Immediate notifications were made to the NRC in accordance with 10 CFR 50.72 at 00:18 EST on July 18, 2005 (EN 41847).
This event is being reported under 50.73(a)(2)(ii)(B), as an event or condition that resulted in the plant being in an unanalyzed condition that significantly degraded plant safety.
Cause of the Event
The Fermi electrical system design predated the issuance of Appendix R and included divisional cross-tie breakers to provide the ability to power ESF buses from the opposite division. The design included control circuits to monitor breaker status and to provide electrical interlock features. To effect the intended interlocks, control cables were routed from the maintenance tie feeder breakers (64B-B9, 64C-C9, 65E-E9, and 65F-F9) to the maintenance tie breaker in the opposite division. The original associated circuit assessment review was performed in 1984, but the analysis performed was not of sufficient scope and rigor to fully identify all Appendix R associated circuit issues. The analysis was also not structured to evaluate multiple spurious actuations. This was an interpretation of the NRC requirements at the time, and it was not until the issuance of Regulatory Issue Summary (RIS) 2004-003 that the requirements were clarified by the NRC.
Subsequent to the issuance of RIS 2004-003 in March 2004, Detroit Edison prepared a design calculation DC 4921 Revision E, issued December 21, 2004, to review safe shutdown related equipment for multiple spurious circuit actuations. For the tie breaker control circuits, that design calculation indicated that the maintenance tie feeder breakers needed to be racked out in order to preclude the possibility of multiple spurious hot shorts tying together the outputs of two EDGs in the opposite division in the event of a fire in a maintenance tie breaker (64T or 65T). However, that prerequisite was not verified at the time the design calculation was issued. During an associated procedure development activity, it was decided to verify all of the assumptions made in DC-4921.
That review determined that the maintenance tie feeder breakers were in fact not racked out by the controlling system operating procedure.
Analysis of the Event
This event involves the ability to safely shutdown the reactor under circumstances where a postulated Appendix R fire occurs in a divisional switchgear room concurrent with a loss of offsite power that results in a combination of hot shorts within that room's maintenance tie breaker that results in the asynchronous connection of the opposite division's emergency diesel generators. If the fire involves the Division 1 switchgear, the ability to shutdown the reactor utilizing the dedicated shutdown system powered by combustion turbine generator 11-1 would also be affected.
The EDGs are designed to come up to speed rapidly after a loss of offsite power. They are then automatically connected to their respective ESS buses. There is no need to synchronize the EDG with the ESS bus when picking up loads, because there is no other power source on the bus at the time it is connected to the EDG. When offsite power returns, the ESS buses and the running EDGs must be synchronized with the grid before the running EDGs are removed from service.
A fire in either switchgear room does not result in evacuation of the main control room. The EDGs are the credited power source for the ESS buses for a fire that occurs in the maintenance tie breakers / divisional switchgear rooms. It is assumed when a fire occurs in a divisional switchgear room that the same division's EDGs will not be available due to the fire damage that occurs in that room, and the alternate division's EDGs will be used to power safe shutdown loads. If the initiating fire were to occur in the Division 2 switchgear room, combustion turbine generator (CTG) 11-1 could be used to power the safe shutdown loads using the alternative shutdown procedure for shutdown outside of the control center. However, if the fire were in the Division 1 switchgear room, that method would not be available because it involves the operation of equipment in the Division 1 switchgear room.
Several outcomes are possible if a division's EDGs are asynchronously connected. If the EDGs were completely out of phase this would likely result in the immediate tripping of both EDGs. However, if the EDGs were out of phase by some lesser amount, the winding currents could be less than that required to trip, and the EDGs could be damaged due to the mechanical forces associated with the asynchronous connection. If the asynchronous connection occurred when the EDGs were nearly synchronized (within about 20 degrees), the units would normally pull each other into synchronization. This is the same level of asynchronous connection allowed by the synchronization check relay that is used when paralleling an EDG to the electrical grid during surveillance testing. However, these units have not been designed to share the load and uneven loading could result in the overloading of one of the EDGs. Therefore, connecting the outputs of two EDGs, either synchronously or asynchronously, is assumed to result in damage to one or both of the EDGs.
For most fire scenarios that do not involve the divisional switchgear rooms or which do not directly affect the wiring associated with the maintenance tie feeder breakers, there is no impact on plant safety. If the fire were to occur in the Division 2 switchgear, plant operators would retain the ability to safely shutdown the plant using the combustion turbine generator 11-1.
The plant design includes provisions that provide a defense-in-depth approach to fire protection. For the divisional switchgear rooms, this includes minimizing the susceptibility to fire through the use of fire retardant cables, fire detections systems, manual suppression activities, and limits placed on the amount of transient combustible material allowed in fire zones. These provisions minimize the chances of a fire that would result in extensive damage within a divisional switchgear room, and minimize the damage that would occur as a result of such a fire. Manual suppression activities would likely limit the extent of damage in a switchgear room fire which would lower the probability of sustaining the required circuit damage discussed herein. The plant is walked down monthly to ensure that combustible material is not allowed to accumulate. Fire detection and a trained fire brigade are available to mitigate the consequences of plant fires in the divisional switchgear rooms.
Fire detection equipment is maintained and tested periodically in accordance with industry and Technical Requirements Manual specifications to ensure a high degree of reliability.
In summary, this event involves only those postulated scenarios involving an Appendix R fire in a divisional switchgear room concurrent with a loss of offsite power that causes multiple hot shorts in the room's maintenance tie breaker control circuits causing both of the maintenance tie feeder breakers in the opposite division to close.
This results in the asynchronous paralleling of the running EDGs of the opposite division which is assumed to damage the EDGs. It is also assumed that power is not and cannot be subsequently made available from the division in which the fire occurs. For fire scenarios that do not involve the divisional switchgear rooms or which do not directly affect the wiring associated with the maintenance tie feeder breakers, there is no impact on plant safety.
The effect of this event on plant risk has been evaluated, and it has been determined to be of very low safety significance. Therefore, the health and safety of the general public was not adversely affected by this event.
Corrective Actions
An hourly fire watch for the Division 1 and Division 2 switchgear rooms was instituted as an immediate compensatory measure. The failure mechanism was eliminated by tagging and racking out the four maintenance tie feeder breakers (64B-B9, 64C-C9, 65E-E9, and 65F-F9) that could be affected. The fire watch requirements were subsequently terminated.
Permanent procedure changes have been made to system operating procedure 23.321 that require the normal lineup for maintenance tie feeder breakers (64B-B9, 64C-C9, 65E-E9, and 65F-F9) to be racked out in Modes 1, 2 and 3. In this condition, the breakers cannot operate to asynchronously tie together the outputs of the opposite division's EDGs during an Appendix R fire.
The legacy design issues discussed in this LER have already been addressed by the design reviews performed and compiled in design calculation DC-4921 Revision E. This design calculation utilized self assessments and the most current regulatory guidance as a basis for analyzing associated circuit issues at Fermi 2. A recent informal review of the prerequisites and assumptions made in that design calculation resulted in this LER. A formal evaluation of the design calculation DC-4921 Revision E prerequisites credited for Appendix R compliance has since been completed. Therefore, DC-4921 Revision E documents the completed review of the Appendix R associated circuits to the latest NRC guidance discussed in Regulatory Issue Summary 2004-03 Revision 1.
This event has been documented and continues to be evaluated in the Fermi 2 corrective action program, CARD 05-24251. A review is also in progress to assess the multiple, diverse fire protection program regulatory non compliance issues that have been identified in recent Fermi 2 licensee evaluation reports. Any further corrective actions identified as a result of these evaluations will be tracked and implemented by the corrective action program.
Additional Information
A. Failed Components: None B. Previous LERs on Similar Problems:
between 130 VDC supply circuit and breaker trip circuit fuses for the standby feedwater pump switchgear.
At 19:31 EDT on June 30, 2005, this condition was determined to have the potential to significantly affect the ability to provide makeup water to the reactor vessel under scenarios which require evacuation of the main control room. The specific scenarios involved postulate that a fire occurs in the control center that affects standby feedwater related control circuitry such that a fault occurs that causes the fuse for that circuitry to isolate. Since the fuse size ratio was less than the ratio specified by Detroit Edison and the fuse manufacturer for proper fuse coordination, it was assumed that the upstream 130 VDC supply fuse also isolates. That fuse provides the power to the control circuitry for both standby feedwater pump circuit breakers and to upstream circuit breakers that provide the 4160 volt power supply to the standby feedwater pumps. If this condition were to occur in the related breaker control circuitry before the control is transferred to the dedicated shutdown panel, the standby feedwater pump breakers would not have the 130 VDC control power needed to operate. The inadequate fuse coordination was determined to be due to a design deficiency dating back to the early 1980's. The affected 10 CFR 50 Appendix R equipment was declared inoperable until a design change was prepared and implemented on July 2, 2005 to provide the proper fuse coordination. The root cause and corrective actions for this event were still in progress at the time of the current event.
operating procedure deficiencies were identified relating to 10 CFR 50 Appendix R events. Battery charger 2C-1 is relied upon to feed post fire emergency shutdown loads. Although a circuit breaker supplying power to a battery charger 2C-1 was re-closed by procedure after a trip or loss of Division 1 power, an additional action was required to return the battery charger to service. The additional action was determined to involve circuitry that is not isolated from cables in the fire affected zone which is a requirement of the Appendix R circuit design. In addition to the same issues identified for battery charger 2C-1, the dedicated shutdown procedure did not provide for reclosure of the circuit breaker feeding power to battery charger 2C1-2 after a trip. Battery charger 2C1-2 is required to power 260 VDC motor operated valves used by the standby feedwater system to provide reactor cooling water and to control reactor water level after a shutdown due to an Appendix R fire. In these scenarios, power would be initially supplied by the associated batteries, but the batteries are not sized to provide power for the entire duration of the Appendix R event. Therefore, a safe shutdown was not assured using the dedicated shutdown panel during all Appendix R scenarios. The cause of these problems was determined to be design and procedure coordination issues, dating back to the mid 1980's. Interim procedural changes have been put in place, and permanent design and procedure changes are planned to address this issue. LER 2005-003's BOP battery charger issue was identified during the performance of corrective actions for LER 2005-002. The root cause and corrective actions for this event were still in progress at the time of the current event.
be assured under all postulated scenarios described in the Updated Final Safety Analysis Report (UFSAR).
Under certain conditions where Combustion Turbine Generator (CTG) 11-1 (the dedicated Appendix R alternate AC source) or other station CTGs (11-2, 11-3 or 11-4) are operating in parallel with the grid, availability of the dedicated alternate AC source cannot be assured. Actions to address the potentially affected Appendix R scenarios were put in place on March 7, 2005, when the deficiencies were identified.
Additional scenarios were identified and additional corrective actions are being evaluated within the plant's corrective action program. The cause of these problems was determined to be a lack of coordination, dating back to the mid-1980's, between all of the parties involved in implementing the use of CTG 11-1 as the alternate AC source for Appendix R scenarios involving a loss of offsite power. The root cause and corrective actions for this event were still in progress at the time of the current event.
result of the regional electric grid disturbance that affected several eastern and central states and portions of Canada and that led to blackout conditions in a large portion of the United States. Combustion Turbine Generator (CTG) 11-1 did not initially start in response to this event. The causes of the CTG 11-1 failure to start were an improper trip setpoint for the battery powered inverter and a failure to start the DC fuel oil pump due to a starter contact sticking open against its arcing horn. The improper inverter setpoint occurred because the inverter was not properly integrated into the overall system design during a 1996 modification / refurbishment. CTG 11-1 related corrective actions focused on entering the proper inverter setpoint into the design database, periodically testing the low voltage trip setpoint, maintenance to the sticking contactor, and the performance of periodic black start tests on CTG 11-1.