05000346/LER-2016-001, Regarding Reactor Trip During Nuclear Instrumentation Calibrations and Steam Feedwater Rupture Control System Actuation on High Steam Generator Level
| ML16091A114 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 03/29/2016 |
| From: | Boles B FirstEnergy Nuclear Operating Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| LER 16-001-00 | |
| Download: ML16091A114 (8) | |
| Event date: | |
|---|---|
| Report date: | |
| 3462016001R00 - NRC Website | |
text
FE NOC' RrstEnergy Nuclear Operating Company Brian D. Boles Vice President, Nuclear March 29, 2016 L-16-056 ATTN: Document Control Desk United States Nuclear Regulatory Commission Washington, D.C. 20555-0001
Subject:
Davis-Besse Nuclear Power Station, Unit 1 Docket Number 50-346, License Number NPF-3 Licensee Event Report 2016-001 5501 North State Route 2 Oak Harbor, Ohio 43449 10 CFR 50.73 419-321-7676 Fax: 419-321-7582 Enclosed is Licensee Event Report (LER) 2016-001-00, "Reactor Trip During Nuclear Instrumentation Calibrations, and Steam Feedwater Rupture Control System Actuation on High Steam Generator Level." This event is being reported pursuant to 10 CFR
- 50. 73(a)(2)(iv)(A).
There are no regulatory commitments contained in this letter or its enclosure. The actions described represent intended or planned actions and are described for information only. If there are any questions or if additional information is required, please contact Mr. Patrick J. McCloskey, Manager-Site Regulatory Compliance, at (419) 321-7274.
Sincerely,
~)!~
Brian D. Boles GMW Enclosure: LER 2016-001 cc: NRC Region Ill Administrator NRC Resident lnspeqtor NRR Project Manager Utility Radiological Safety Board
NRCFORM366 U.S. NUCLEAR REGULAT9RY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 10/31/2018 (11-2015)
Eslimated, the NRG may not conduct or sponsor, and a oerson is not 'reauired to resnond to the information collection.
Davis-Besse Nuclear Power Station Unit 1 05000-346 Technical Specifications:
YEAR 2016
- 3. LER NUMBER SEQUENTIAL NUMBER
- - 001 REV NO.
00 Technical Specification (TS) Limiting Condition for Operation (LCO) 3.3.1 requires four channels of RPS instrumentation be Operable in the Modes specified. With one RPS channel inoperable, Condition A requires the channel be placed in bypass or trip within one hour. With two channels inoperable, Condition B requires one channel be placed in trip and the second channel be placed in bypass within one hour. If the Required Action and associated Completion Time of Condition A or B are not met while in Mode 1, Conditions C and D require the unit be in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> along with the Control Rod Drive (CRD) trip breakers being opened for the applicable RPS functions.
DESCRIPTION OF EVENT
On January 29, 2016, the DBNPS was operating* in Mode 1 at approximately 100 percent power. Power Range Nuclear Instrumentation (NI) calibrations were being performed in accordance with TS Surveillance Requirements. Due to an existing issue that rendered RPS Channel 1 inoperable as discussed below, RPS Channel 1 was placed in a tripped status at 1214 hours0.0141 days <br />0.337 hours <br />0.00201 weeks <br />4.61927e-4 months <br /> after calibration of NI 6 was complete to support calibration of Nls 5, 7, and 8 in the other RPS Channels. At 1309 hours0.0152 days <br />0.364 hours <br />0.00216 weeks <br />4.980745e-4 months <br />, RPS Channel 2 was placed in Bypass to perform calibration of NI 5. At 1322 hours0.0153 days <br />0.367 hours <br />0.00219 weeks <br />5.03021e-4 months <br />, a failure occurred in the RCS Flow input to RPS Channel 4. With Channel 1 in trip, this failure satisfied the RPS logic and caused RPS Channel 4 to trip on Flux/Delta-Flux/Flow, tripping the reactor.
Initial unit response to the reactor trip was as designed, and all control rods fully inserted. Following the reactor trip, as the control room operators were progressing through the post-trip procedure steps, they observed Steam Generator levels rising due to a failure of the ICS to properly respond to the reactor trip. The operators took manual control of Loop 1 feedwater and attempted to reduce main feedwater flow, approximately one minute after the reactor trip. However, SFRCS actuated on high Steam Generator 1 level as level reached the 220 inch setpoint. All SFRCS components responded as designed, with both Auxiliary Feedwater Pump Turbines starting, both MSIVs closing, and isolating the Main Feedwater System.
Additional equipment anomalies noted following the trip included: 1) Generator Output Breaker ACB34560 opened as designed on the trip with Generator Output Breaker ACB34561 failing to open quick enough (approximately 8 cycles), which led to the subsequent opening of switchyard breaker 34562 and de-energization of the Bayshore Line input to the switchyard (the other three offsite lines to the switchyard remained energized throughout the event, providing power to the two Startup Transformers, therefore, offsite power was not challenged throughout the event). 2) Main Steam Safety Valves (MSSV) [SB-RV] on both Main Steam lines were observed to not fully reseat following the reactor trip (Operators lowered Steam Generator pressures in accordance with procedures in order to allow the valves to reseat, and the Plant was stable in Mode 3 with the AFW System providing AFW to the SGs, as designed).
CAUSE OF EVENT
The first direct cause and the root cause of the reactor trip was the spurious failure of fuse Y 414 providing power to RPS Channel 4. The loss. of power caused cabinet C5756G to de-energize, which contains two modules that provide RCS flow input to RPS Channel 4 (FYRC1A4 and FYRC1 B4). When these two modules lost power, the signals failed low, causing RPS Channel 4 to trip on Flux I Delta-Flux I Flow. A review of industry experience identified potential causes attributed to the manufacture and design of the fuse element: intergranular tearing of the fuse element which reduces the current carrying potential, and (11-2015)
U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 10/31/2018 LICENSEE EVENT REPORT (LER)
CONTINUATION SHEET
, the NRC may not conduct or sponsor, and a oerson is not reouired to resoond to the information collection.
Davis-Besse Nuclear Power Station Unit 1 05000-346
==CAUSE OF EVENT==YEAR 2016
- 3. LER NUMBER SEQUENTIAL NUMBER
- - 001 weakening due to initial in-rush current; both of which can result in fuse failure during normal operations.
The second direct cause of the reactor trip was continued plant operation with RPS Channel 1 inoperable due to the failure of temperature element TERC3B2 monitoring RCS Loop 1 Hot Leg Narrow Range Temperature. Operating with RPS Channel 1 inoperable requires placing the channel in bypass and tripping the channel when it is required to be removed from bypass. RPS Channel 1 was removed from bypass and placed in trip status on January 29, 2016 to allow performance of NI calibrations in the other 3 channels of*
RPS. When Fuse Y414 failed, the 2 of 4 trip logic for RPS was completed, and the reactor trip was initiated.
A contributing cause to the reactor trip was a deficient trend evaluation of failures of the A25X series fuse, such as was installed in Y414. Preventive Maintenance (PM) activities were created with a 15-year periodicity to replace the A25X10 (10 amp) and A25X15 (15 amp) fuses. Spurious failures of these fuses continued to occur following these periodic replacements. However, evaluation of the trend did not recognize that the PM frequency was not adequate to prevent failures.
The first direct cause of the failure of the ICS to properly respond to the reactor trip was due to the failure o,f the RFR circuitry to actuate, which was due to an ICS module not being properly wired for the installed application. In 1990, an ICS module that was used as the Borate Control Switch was removed by a modification and sent to the warehouse for later use. During the most recent refueling outage in 2014, this lCS module was obtained from the warehouse and installed in the ICS functional location for the RFR Defeat Switch. Because the module wiring was not properly wired for this installation, the RFR Defeat Switch prevented the RFR circuitry from actuating even though it was in the ON position.
REV NO.
00 The second direct cause of the failure of the ICS to properly respond to the reactor trip was due to the Steam Generator/Reactor Demand Hand/Auto.station transferring to Hand following the trip of the Main Turbine. If the ICS station would have remained in automatic, it '{"OUld have reduced feedwater demand quickly enough to prevent reaching the SFRCS high level trip setpoint. The cause of the Hand/Auto station transferring to hand was an ineffective software change. Changes were made to the ICS during the 2014 refueling outage to improve control of the Unit Load Demand circuitry. However, these changes inadvertently introduced a new failure mode that caused the Hand/Auto station tQ transfer to hand whenever a large and rapid change in generated megawatts occurred, such as would occur during a reactor or turbine trip. This failure mode was identified while performing training scenarios on the simulator following the 2014 refueling outage, but the software change made in December 2015 to correct the failure mode was not successful.
The first root cause of the failure of the ICS to properly respond to the reactor trip was due to inadequate work package instructions for performing a bench check of the replacement ICS module, as they did not ensure the bench check adequately tested the module's intended function. A continuity check was performed followed by toggling the switch on and off ten times and then rechecking continuity to ensure the switch resistance had not increased. However, the bench check did not validate the switch position with the contact state of the output pins per the vendor manual or ICS drawing, and therefore did not verify the RFR switch was properly wired for the toggle ON position. (11-2015)
U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 10/31/2018 LICENSEE EVENT REPORT (LER)
CONTINUATION SHEET
, the NRC may not conduct or sponsor, and a nerson is not renuired to resoond to the information collection.
Davis-Besse Nuclear Power Station Unit 1 05000-346
==CAUSE OF EVENT==YEAR 2016
- 3. LER NUMBER SEQUENTIAL NUMBER
- - 001 The second root cause of the failure of the ICS to properly respond to the reactor trip was that changes were made to the ICS Unit Load Demand (digital and analog) without ensuring it was tested through its full function, resulting in a new, unintended failure mode. A subsequent fix to this new failure mo.de did not quantify available operating margin or account for additional delay in the signal processing hardware, resulting in the change being ineffective when installed in the plant. The procedural guidance for making life cycle changes to in-house software was less than adequate for ensuring changes do not introduce new failure modes and documenting the basis for design and testing.
ANALYSIS OF EVENT
REV NO.
00 With RPS Channel 1 inoperable and tripped due to the existing RTD issue and the in-progress NI calibrations for RPS Channel 2 requiring Channel 2 to be in bypass; when fuse Y414 spuriously failed, the 2 out of 4 trip logic for RPS was satisfied and the reactor trip was initiated. The control rods inserted fully as designed.
Post-trip, the SFRCS actuated due to high SG 1 level. All SFRCS components responded as designed, with both AFW Pump Turbines starting, both MSIVs closing, and isolating the MFW System.
Due to the demands on and priorities of the control room operators following a reactor trip, they would not be expected to identify and correct this improper response of the ICS within the short time period (approximately 60 seconds) available.
As noted above, two ICS anomalies occurred immediately after the reactor trip, which resulted in the SG 1 High Level trip. The first anomaly was the ICS RFR circuit did not function. The second anomaly was that the Steam Generator/Reactor Demand Hand/Auto Station transferred from Auto to Manual, which h~ld the ICS Feedwater Demand Signal high. The combination of these two anomalies resulted in an increase in SG 1 level to the SFRCS high level setpoint. If either SG/RX Demand would have remained in Auto or RFR had fired, the SFRCS SG High level actuation would not have occurred. As discussed previously, the conditions leading to the ICS anomalies were found to have been in existence since the refueling outage in 2014 (i.e.,
greater than one year, which results in the incremental conditional core damage probability (ICCDP) for this period of 1.87E-06).
Investigation has shown that any Reactor/Turbine trip from 100 percent power while these conditions existed would have resulted in an SFRCS Isolation trip on high level that would effectively cause a loss of Main Feedwater.
When performance of a bounding quantitative evaluation was performed, using best available information to determine the significance of the event, the delta Core Damage Frequency (CDF) was estimated to be 1.87E-6/yr which is considered to be low to moderate safety significance. Because the delta CDF for this event was determined to be greater than 1 E-7/yr, a screening was conducted using the Large Early Release Frequency (LERF) screening criteria to ass.ess whether any of the core damage sequences that were affected by the finding are potential LERF contributors. Evaluations of the external events were estimated to be: (Fire - delta CDF 1.94E-6/yr, low to moderate safety significance and seismic - no risk increase, very low safety significance), and delta LERF was estimated to be: (3.3E-8/yr, very low safety significance). (11-2015)
U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 10/31/2018 LICENSEE EVENT REPORT (LER)
CONTINUATION SHEET
, the NRG may *not conduct or sponsor, and a oerson is not reauired to resoond to the information collection.
Davis-Besse Nuclear Power Station Unit 1 05000-346 CORRECTIVE ACTIONS (Continued)
YEAR 2016
- 3. LER NUMBER SEQUENTIAL NUMBER
- - 001 Procedure NOP-SS-1001, Administrative Program for Computer Related Activities, will be revised to incorporate current industry standards for contrplling software life cycle changes that interface with plant systems.
PREVIOUS SIMILAR EVENTS
Licensee Event Report (LER) 2013-001 reported the automatic trip of Reactor Coolant Pump (RCP) Motor 1-2 due an electrical differential current fault that resulted in a RPS actuation and reactor trip. LER 2015-002 documents the manual actuation of RPS to manually trip the reactor, and a manual initiation of SFRCS in response to a steam leak in the turbine building. There have been no similar LERs at the DBNPS involving an automatic actuation of the RPS, or automatic actuation of the SFRCS due to high steam generator level in the past three years. REV NO.
00