05000346/LER-2003-007

LER-2003-007,

Docket Women
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(i)(E) 10 CFR 50.73(a)(2)(v), Loss of Safety Function
3462003007R00 - NRC Website

DESCRIPTION OF OCCURRENCE:

As part of the Return to Service Plan, the Davis-Besse Nuclear Power Station (DBNPS) staff completed a Safety Function Validation Project review of the 4160 Volt electrical distribution system. This review revealed a number of unverified assumptions in previous analyses of the electrical distribution system. To address this, analysis of the electrical distribution system is being performed utilizing the Electrical Transients Analysis Program (ETAP) computer modeling software. This analysis includes load flow and voltage drop calculations for various plant operating conditions and design basis accident conditions. On June 6, 2003, with the plant in Mode 5, this analysis identified deficiencies with the low probability limiting analysis cases involving a loss of coolant accident (LOCA) with the plant operating in Mode 1 with degraded grid voltage conditions, either with only one startup transformer and/or one bus-tie transformer in service, or with both startup and both bus tie transformers in service.

The DBNPS onsite electrical systems include the 13.8 kV MB], the 4160 V (EA, BB), and the 480 V (EC, ED) AC distribution systems, two 4160 V emergency diesel generator unite (EIC-DG] and one non-essential 4160 V diesel generator which serves as the alternate AC source for station blackout concerns (All voltages listed are nominal voltage). Refer to Figure 1 for a diagram of the DBNPS 4160 V and above electrical system. With the turbine-generator (EL-TG] operating, the normal source of station power is from the unit auxiliary transformer (EA-XFMR) to the 13.8 kV buses (EA-BU). There are two 345 kV to 13.8 kV startup transformers that provide reserve and startup power from the offsite distribution network. Isolation of the turbine-generator from the 345 kV grid system (FK] results in de-energization of the unit auxiliary transformer and fast transfer of the 13.8 kV buses A and B to their respective startup transformer. The specific startup transformer used to power each 13.8 kV bus is pre-determined by the position of a reserve source selector switch.

These switches can align either startup transformer to each 13.8 kV bus, but are typically selected so that each 13.8 kV bus is aligned to a different startup transformer. Each startup transformer was originally designed to have sufficient capacity to be operated as a complete reserve source for both 13.8 kV buses if either startup transformer is out of service. This design feature allows for flexible alignment of the offsite to onsite power supply while maintaining power available to non-essential plant equipment if the auxiliary transformer becomes unavailable.

Power to the 4160 V distribution system is from two bus tie transformers that step down the voltage from 13.8 kV to 4160 V. Each bus tie transformer normally supplies one essential and one non-essential 4160 V bus and is available as a reserve source for the redundant set of essential and non- essential 4160 V buses. The capacities of the bus tie transformers and the associated circuit breakers are designed to permit station operation with one bus tie transformer out of service. Transfer schemes are provided to switch each set of 4160 V buses from its normal bus tie transformer to its reserve.

The transfer between the two sources is done automatically by protective relay DESCRIPTION OF OCCURRENCE: (Continued) action, or manually by the operator. Two redundant Emergency Diesel Generators (EDGs) provide onsite standby sources to supply their respective essential buses. If the essential bus voltage is not maintained, the undervoltage relays [E8-27] set at approximately 90 percent of nominal bus voltage automatically initiate isolation of the essential bus following a time delay of approximately 7.5 seconds. The loss of voltage relays set at approximately 59 percent of nominal bus voltage automatically initiate load shedding and EDO starting after a time delay of approximately 0.5 seconds. If a Safety Features Actuation System (SFAS) [JE) actuation occurs in conjunction with the loss of voltage, the sequencer will automatically load the bus. A Station Blackout Diesel Generator (SBODG) [EA-DG) provides an alternate source of emergency power in addition to the EGGS. The SBODG has no automatic start or load feature. However, it can be manually started and loaded from either the Control Room or the SBODG electrical equipment room.

Utilizing the ETAP software, an analysis wfs performed for the low probability event of the plant operating in Mode 1 at 100 percent power with degraded grid voltage (98.3 percent of nominal), the electrical distribution systems aligned to a single startup transformer and a single bus tie transformer bus when a SFAS Level 4 actuation occurs. A SFAS Level 4 actuation is indicative of a large-break LOCA, and so all Emergency Core Cooling Pumps (High Pressure Injection Pumps [BC)-P) and Low Pressure Injection Pumps (BP-P1), as well as the Containment Spray Pumps [BE-P] are started along with closing Containment Isolation Valves [ISV) and initiating a trip of the Reactor and Main Turbine.

Since power is available from the offsite transmission network, all electrical loads are started upon receipt of the SFAS Level 4 actuation signal (These loads would be started sequentially if the EDGs were supplying power to the essential electrical buses). The in-rush current from the starting of these essential loads in conjunction with the existing loads associated with normal 100 percent power operation compounded by degraded grid voltage results in voltages at the essential 4160 V buses that drop below the setpoint of the 90 percent undervoltage relays. The analysis shows that the 4160 V bus voltages do not recover above the reset value for the undervoltage relays for this limiting system configuration. Therefore, given these conditions, the undervoltage relays would trip the supply breakers to the essential 4160 V buses. The loss of voltage relays would then load the essential buses onto the EDGs, and the SFAS Level 4 loads would sequence onto the essential buses.

DBNPS Technical Specification 3.8.1.1 requires a minimum of two qualified circuits between the offsite transmission network and the onsite Class lE (essential) A.C. electrical power distribution system be operable while in Modes 1 through 4. A qualified circuit is defined by Technical Specification 3/4.8.1.1 Bases, as well as the Updated Safety Analysis Report, as one that meets the requirements of 10CFR50 Appendix A, General Design Criterion (GDC) 17. With one of these circuits out of service because of a startup transformer and/or a bus tie transformer out of service, power operation would be allowed to continue for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> As allowed by Technical Specification 3.8.1.1 Action "a" provided the correct breaker alignments and DESCRIPTION OF OCCURRENCE: (Continued) indicated power availability are verified for the other circuit within one hour and every 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter, and the ability of the EDG to start and accelerate up to 900 RPM is verified within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. With both of these circuits out of service, power operation may only continue for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> per Action "d" provided the ability of the two EDGs to start and accelerate up to 900 RPM is verified within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

Therefore, when one startup and/or bus tie transformer is out of service coincident with a LOCH and degraded grid voltage, the remaining circuit would not meet the qualification requirements of Technical Specification 3.8.1.1.

In reviewing past operating history, it was found that on January 5, 2002, when the Main Generator was removed from service to support repairs to a hydrogen cooler, 13.8 kV bus "B" transferred from startup transformer X01 to startup transformer X02 unexpectedly due to a shorted relay contact. The appropriate Technical Specification actions were taken for one startup transformer out of service, but because of the condition recently discovered utilizing the ETAP software, neither offsite to onsite circuit remained operable. GDC 17 defines the safety function of both the offsite electrical power system and the onsite emergency power system as providing sufficient electrical power capacity and capability in the event of a design basis accident assuming that the other system is not available. Therefore, this past configuration condition represents an event that could have prevented fulfillment of a safety function, which is reportable in accordance with 10CFR50.73(a)(2)(v). Similar configuration conditions included (but are not limited to) August 7, 2001, when bus tie transformer AC was removed from service to conduct testing of its fire protection deluge system, and August 13-14, 2001, when startup transformer X01 was removed from service for maintenance. Furthermore, because of this unknown condition, on August 13-14.

2001, the EDGs were not tested within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, nor was the plant'shutdown to hot standby (Mode 3) conditions in the subsequent 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> with both offsite circuits inoperable, which is reportable per 10CFR50.73(a)(2)(i)(B) as a condition prohibited by the Technical Specifications.

Utilizing the ETAP software, an analysis was also performed for the low probability event of both startup transformers and both bus tie transformers available with the plant operating in Mode 1 at 100 percent power with degraded grid voltage (98.3 percent), when a SEAS Level 4 actuation occurs.

Similar to the case above, all SFAS Level 4 electrical loads start immediately upon receipt of the SFAS actuation signal. While the motor starting in-rush current also results in the voltage at the essential 4160 V buses dropping below the setpoint of the 90 percent undervoltage relays, analysis shows that the bus voltage recovers above the reset value of the undervoltage relays before the relay time delay expires. For this postulated case, the undervoltage relays would not likely trip the supply breakers to the essential 4160 V buses, and the 4160 V essential buses remain connected to the offsite power sources as required by GDC 17. However, the voltages on the 480 V essential buses may not recover to the level necessary for the satisfactory operation of some essential loads such as motor-operated valves and

• � NRCFORM368A (1.2001) DESCRIPTION OF OCCURRENCE: (Continued) ventilation damper operators (hydramotors). Therefore, during this postulated condition, even with both startup transformers and both bus tie transformers available, the electrical distribution system would not meet the requirements of GDC 17. This design deficiency represents a condition that could have prevented fulfillment of a safety function, which is reportable in accordance with 10CFR50.73(a)(2)(v).

APPARENT CAUSE OF OCCURRENCE:

As a result of the Millstone Unit 2 event in July 1976 caused by a reduction in grid voltage, undervoltage relays were installed at the DBNPS to protect the 4160 V essential buses from degraded voltage conditions. As a result of the Arkansas Nuclear One (ANO) Unit 1 event in September 1978 involving degraded voltage on the safety buses, the DBNPS Architect/Engineer analyzed the DBNPS electrical power distribution system using a computer model to ensure adequate voltage existed on the DBNPS safety buses. In 1988, the DBNPS engineering staff selected the Electrical Load Management System (ELMS) computer program to model the electrical distribution system and to perform a more detailed review of the distribution system for calculating short circuit currents and for comparison against equipment ratings, determining bus and terminal voltage throughout the system depending on source voltage and alignment, and calculating load flow within the system. However, the ELMS modeling did not include the most limiting postulated scenario of one startup transformer and one bus-tie transformer in service as had been originally modeled by the DBNPS Architect/Engineer. Although this condition appears to be an original design bases deficiency, no specific cause could be found for why the ELMS modeling did not include the most limiting scenario, which may be due in part to the fact that the ELMS modeling was completed over ten years ago. This was a missed opportunity to identify this design deficiency and is attributed to inadequacy in engineering rigor as well as inadequate management oversight in preparing the ELMS modeling and in preparing the undervoltage relay setpoint calculation, which resulted in incomplete analysis and unverified assumptions in the calculations. The issues of engineering rigor and management oversight are being addressed as part of the DBNPS Return to Service Plan.

In 2001, the DBNPS purchased the ETAP software to replace the now outdated ELMS software. This was due to the fact that the ELMS software is no longer supported by the developer, and the ETAP software, which is widely used at commercial nuclear power plants in the United States, has expanded capability and is designed to run on the current generation of desktop computers.

Because of the increased capability of the ETAP software over previous analysis tools, more detailed models can be made instead of utilizing simplified lumped loading modeling. The ELMS software had specific limitations on the number of buses and loads that it could handle, whereas the ETAP software supports a greater number of buses and loads. Increased rigor when modeling the electrical distribution system led to the discovery that at APPARENT CAUSE OF OCCURRENCE: (Continued) the degraded voltage limit of 98.3 percent, some components at the 480 V level may receive insufficient voltage to ensure they remained capable of performing their designated safety functions in the limiting scenario described above.

ANALYSIS OF OCCURRENCE:

During the low probability period of susceptibility, if grid voltage degraded, voltage on essential buses may be inadequate to assure that essential loads would remain capable of performing their intended safety functions. The low voltage condition on the 480 V essential buses may reduce the control power and voltage within the control circuits to a level insufficient to actuate the main line contactors. As a result, the control power fuses may open when the loads (i.e. motors) are signaled to start. The low voltage could also cause motors to run below synchronous speed and draw current that could damage motor windings or cause the supply breaker to trip on overcurrent.

One particular set of control circuits affected by degraded voltage is the circuits for the Main Feedwater Steam Generator Isolation Valves [SJ-ISV).

These valves receive a close signal from the Steam and Feedwater Rupture Control System (SFRCS) to isolate feedwater flow to the steam generators, but do not receive a signal from the SPAS to close in the event of a LOCA. There is no significant in-rush current associated with actuation of the SFRCS; therefore, these valves would not be affected by the limiting design condition of degraded grid voltage coincident with a SFAS Level 4 actuation as described above. However, these valves may not have operated during other degraded grid voltage events due to insufficient voltage on the 480 V essential buses.

Other valves in the Main Feedwater piping to the Steam Generators remained capable of closing on an SFRCS signal.

Other control circuits affected by the degraded voltage include ventilation damper actuators (hydramotors) for one train of the Component Cooling Water Room ventilation [VF-DRIP] and one train of the Emergency Ventilation Systems [VC-DMPl. The other train of Component Cooling Water Room ventilation was not affected by the degraded voltage, and operators could have taken additional actions to keep the Component Cooling Water Room temperature within equipment operating limits. The other train of the Emergency Ventilation System was also not affected by the degraded voltage condition, and remained available to perform its intended function.

In the recent past, when a startup transformer and/or a bus tie transformer was unavailable, the two Emergency Diesel Generators as well as the Station Blackout Diesel Generator were maintained available in accordance with the requirements of 10CFR50.65(a)(4) to manage the increase in risk. Therefore, during these isolated configuration conditions there was little safety significance because of this defense-in-depth practice.

ANALYSIS OF OCCURRENCE: (Continued) An analysis of the FirstEnergy transmission system was performed by the transmission system operator. The purpose of this analysis was to evaluate the impact of various transmission system contingencies, including the lose of generation from the DBNPS, on the 345 kV system voltage at the DBNPS 345 kV switchyard. The analysis also determined the probabilities associated with potential low voltage at the DBNPS 345 kV switchyard. The conclusion of this analysis was that with the DBNPS not producing power, the probability of experiencing grid voltage at or below 98.3 percent was less than one day in 1000 years, or an annual frequency of 2.75-06. Per NUREG/CR-5750, Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995, the annual frequency of a large-break LOCA that would result in a SFAS Level 4 actuation is 5.0E-6. Therefore, the combined annual frequency of a Large-Break LOCA coincident with degraded grid voltage conditions is 1.4E-11, which per Regulatory Guide 1.174 guidelines results in a very small increase in core damage frequency. Overall, this condition is considered to have minimal safety significance.

CORRECTIVE ACTIONS:

The Trip Setpoint and Allowable Value for the 90% undervoltage essential bus feeder trip relays will be revised to assure voltage to essential equipment is sufficient to support operation. The trip setpoint will be revised prior to entry into Mode 4. The new values will be incorporated into the DBNPS Technical Specifications, and until this change to the Technical Specifications is implemented, administrative controls implemented in accordance with NRC Administrative Letter 98-10 will remain in place.

The tap settings on the 4160 V to 480 V essential substation transformers (ED-XFMR] supplying power to essential buses El and F1 will be changed to increase the 480 V essential bus voltage during power operations. The tap settings on the 480 V to 240 V transformers feeding essential buses YE2 and YF2 [ED-BU] will also be changed to increase the 240 V essential bus voltage.

These tap setting revisions will be completed prior to entry into Mode 4.

Interposing relays will be installed on the NEMA size 3 motor starters (SJ- MSTR1 for the Main Feedwater Steam Generator Isolation motor-operated valves FW 601 and FW612. The interposing relays confine the motor starting current to the MCC, creating only a minimal voltage drop in the circuitry; thereby assuring adequate voltage is available during design basis conditions.

Shorting bars will be installed for selected Hydramotor (DMP1 circuits to reduce the voltage drop seen at the Hydramotor to ensure it remains capable of positioning its associated ventilation damper in the event of a design basis accident. These modifications will be completed prior to entry into Mode 4.

CORRECTIVE ACTIONS: (Continued) Based on the final results of the ETAP analysis and continued evaluation, other actions may be performed to ensure compliance with applicable standards to ensure the offsite to onsite circuits are qualified as described in the DBNPS Licensing Basis. These actions may include such items as permanently defeating the auto-transfer circuitry between startup transformers and/or bus tie transformers, or modifying station procedures to prohibit undesired lineups of the offsite circuits. These actions will be completed as necessary to ensure operability of the offsite to °mate circuits.

FAILURE DATA

offsite power was lost during bus transfer testing during a refueling outage.

The corrective actions from this 2000 event, which was a result of personnel error, would not have prevented this current event, which is a result of a latent design issue.

Energy Industry Identification System (EIIS) codes are identified in the text as [XX].

NP-33-03-007-00 � CRe 02-07646, 03-04435, 03-05347 FMK ISAYF655E EIACTRICAL PUTRIBWION SYSTEM 01110 EDISON LINE 1345 KV) LENOTIE LINE 1345 KY) BOUM LINE 1345 KY)

1. BUS

34562 34564

STARTUP

TRMECCRICR 02 34561 0 BUS 34560

TRANSFORIER

rD B Bus— � AUX ILIARY STARTUP � TRANSFORMER 11 TRANSCO/JCR 01 —3 � 25 KY

GENERATOR

ono) � rot BUS LI* IA

TRANSFORMER AC

AACC2 4160 V BUS C2 AB= 4160 V40.1S IION -ESSENT IAL 4160 V LOADS 0110 AACD I

EDG

AC101 NON-ESSENTIAL 4160 V LOADS 4160 V 10.15 CI AC110

ESSENTIAL

4160 V LOADS

ESSENTIAL

4160 V LOADS NRC FORM MA (1.20D1)