05000346/LER-2016-004
| Davis-Besse Nuclear Power Station, Unit 1 | |
| Event date: | 04-05-2016 |
|---|---|
| Report date: | 08-30-2016 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(vii)(A), Common Cause Inoperability 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor |
| 3462016004R01 - NRC Website | |
| ML16159A299 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 06/06/2016 |
| From: | Boles B D FirstEnergy Nuclear Generation Corp |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| L-16-146 LER 16-004-00 | |
| Download: ML16159A299 (7) | |
Energy Industry Identification System (El IS) codes are identified in the text as [XX].
System Description:
At the Davis-Besse Nuclear Power Station (DBNPS), the Reactor Coolant (RCS) [AB] System has three thermowells on each of the two RC System Hot Legs/Loops, and each thermowell houses one dual-element Resistance Temperature Detector (RTD) [TI]. Of the twelve RTDs, four provide an input to the Reactor Protection System (RPS) [JC], four provide an input to the Post Accident Monitoring (PAM) [IP] System, and the remaining four provide an input to the Non-Nuclear Instrumentation (NNI) [EE].
The RPS initiates a reactor trip to protect against violating the core fuel design limits and the RCS pressure boundary during anticipated operational occurrences. The protection and monitoring systems have been designed to assure safe operation of the reactor. This is achieved by specifying limiting safety system settings in terms of parameters directly monitored by the RPS, as well as the Technical Specification (TS) Limiting Conditions (LCO) for Operation on other reactor system parameters and equipment performance.
The PAM instrumentation displays unit variables that provide information required by the control room operators during accident situations. This information provides the necessary support for the operator to take the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Events.
The NNI provides the required input signals of process variables for the reactor protection, regulating and auxiliary systems. It performs the required process control functions in response to those systems and provides instrumentation for startup, operation, and shutdown of the reactor system under normal and emergency conditions. The NNI performs no TS required functions.
The Remote Shutdown System monitoring instrumentation provides the control room operator with sufficient instrumentation to support maintaining the unit in a safe shutdown condition from locations other than the control room. This capability is necessary to protect against the possibility that the control room becomes inaccessible.
Technical Specifications:
TS LCO 3.3.1 requires four channels of RPS high Reactor Coolant temperature instrumentation be Operable in Modes 1 and 2. Four of the affected RTD elements (one per channel) provide input to the RPS. Each RTD element supports two RPS functions: Reactor Coolant High Temperature and Reactor Coolant Pressure- Temperature. With one RPS channel inoperable, Condition A requires the channel be placed in bypass or trip within one hour. With two channels inoperable, Condition B requires one channel be placed in trip and the second channel be placed in bypass within one hour. If the Required Action and associated Completion Time of Condition A or B are not met while in Mode 1, Conditions C and D require the unit be in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> along with the Control Rod Drive (CRD) trip breakers being opened for the applicable RPS functions.
Technical Specifications: (continued) TS LCO 3.3.17 requires 2 channels of PAM Reactor Coolant Outlet Temperature instrumentation be Operable per Reactor Coolant Loop in Modes 1-3. With one channel inoperable, Condition A requires the channel be restored to Operable status in 30 days. If the Required Action and associated Completion time of Condition A are not met, Condition B require actions be initiated in accordance with TS 5.6.5 to submit a Post Accident Monitoring Report within the following 14 days. With two channels inoperable, Condition C requires one channel be restored to Operable status'in 7 days. If the Required Action and associated Completion time of Condition C are not met, Conditions D and E require the unit to be in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
TS LCO 3.3.18 requires the Remote Shutdown Monitoring Instrumentation Functions be. Operable in Modes 1-3. With one or more required Functions inoperable, Condition A requires the Function be restored to Operable status in 30 days. If the Required Action and associated Completion time of Condition A are not met,, Condition B requires the unit to be in Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The Bases for TS 3.3.18 shows that only one channel of the RC Temperature — Hot Leg is required to fulfill the function.
DESCRIPTION OF EVENT:
As part of the Steam Generator Replacement Project (SGRP) during the 2014 refueling outage, one of the modifications implemented was the replacement of the six dual-element RCS Hot Leg RTDs and RTD cables.
The RTDs were replaced due to thermal aging and obsolescence of parts with functionally equivalent replacements. The arrangement of the twelve RTDs is shown below (all have the prefix of TERC3) and what channel of RPS (1-4) or which train of NNI (X or Y) is served.
Loop 1(B) B2 (RPS Ch 1) B5 (PAMS) Loop 2(A) A2 (RPS Ch 4) Al (NNI X) B4 (RPS Ch3) B3 (NNI Y) A4 (RPS Ch 2) A6 (PAMS) B6 (PAMS) B1 (NNI X) A5 (PAMS) A3 (NNI Y) On 10/8/2014 it was identified during system monitoring that temperature indications from TERC3B2, Loop 1 RC Hot Leg temperature, had changed slightly, but remained within allowable tolerances. The instrument was monitored for changes, and its output continued to deviate from the other channels. The instrument was recalibrated as necessary to restore operability. On 7/17/2015, following unsuccessful actions to restore operability, RPS Channel 1 was declared inoperable and placed in bypass until repairs could be made during the next refueling outage, since further repairs were not possible with the plant operating.
On 4/5/2016, with the plant in Mode 5 and shutdown for routine refueling activities TERC3B2 was inspected due to the problems previously identified. This inspection identified the RTD wire insulation was severely degraded due to apparent heat damage. All six dual-RTDs on both Reactor Coolant System Hot Legs were inspected and observed to have varying degrees of wire insulation degradation, up to total wastage.
Infocollects.Resource@nrc.goy, and to the Desk Officer, Office of Information and Regulatory Affairs, - 004 Davis-Besse Nuclear Power Station Unit 1 05000- 346 YEAR 2016 - 01 1 NARRATIVE DESCRIPTION OF EVENT: (continued) While the RTDs were being removed from the field for, replacement, the Electrical Conductor Seal Assemblies (ECSA) were taken from the removed RTDs and evaluated for potential reuse on the replacement RTDs that required Environmental Qualification (EQ). During removal on 4/23/2016, it was identified that on RTDs TERC3B5 and TERC3A4 (Conax) the Midlock Ferrules had been installed backwards during the previous outage.
CAUSE OF EVENT:
While analyzing the cause, it was identified that two Engineering Change Packages (ECPs) were developed and implemented to replace the six dual-element RTDs during the Steam Generator Replacement Project (SGRP) in 2014. One ECP was written to support piping insulation removal and re-installation with a new, more effective insulation; and the second ECP was written to support RTD replacement. During comment resolution of the RTD ECP, the EQ Engineer provided comments and statements pertaining to insulation requirements that were not fully addressed and were not ultimately passed on to the engineer responsible for the piping insulation ECP. Additional individual errors were made during ECP development and work order along with post-implementation walkdown. Basic work practice weaknesses resulted in incorrect design development and implementation of the piping insulation for the RTD thermowells.
The direct cause of the RTD conductor wiring insulation degradation was accelerated aging due to high temperatures located at the RTD termination head. This wiring degradation was as a result of improper configuration of piping insulation on the RTD extension stem during the previous outage.
The apparent cause of the incorrect piping insulation configuration was due to incorrect and insufficient guidance provided in the piping insulation Engineering Change Package.
The cause of the backward installation of the Midlock Ferrules on RTDs TERC3B5 and TERC3A4 is that less than adequate instructions were available to support the successful assembly and installation of the Conax ECSAs.
ANALYSIS OF EVENT:
The wire insulation degradation on the RC Hot Leg RTD, TERC3B2, resulted in the output temperature indication to deviate in the downward direction and thus it was unable to perform its intended function of providing Channel 1 input to the RPS for a High Temperature Trip or a Pressure/Temperature Trip. The RPS High Temperature Trip provides backup protection for RCS overheating events and is not used as the primary trip function for any accident analysis. The RCS Pressure/Temperature Trip is the primary trip for only a RCS letdown line rupture accident.
Since the RPS trips associated with these instruments are high temperature trips and the failure mechanism caused by the insulation damage is a failed low condition, the insulation damage would not have resulted in a plant trip or transient, arid therefore would not cause an initiating event, nor the reactor trips associated with those instruments, for mitigating any accidents or transients.
ANALYSIS OF EVENT: (continued) The wire insulation degradation on TERC3B2 also resulted in it not being able to provide accurate hot leg temperature input for the Post-Accident Monitoring System and the Auxiliary Shutdown Panel.
The three remaining RPS temperature inputs (besides TERC3B2) were still functioning (although degraded), as were other hot leg temperature indications on the Auxiliary Shutdown Panel and the Post-Accident Monitoring System. Since diverse temperature indication remained available, hot leg temperature inputs as part of the decision-making process could still be performed. As such, the wire insulation degradation and the backward installation of the Midlock Ferrules is qualitatively evaluated as having very low safety significance.
Reportability Discussion:
RTD elements TERC3B2, TERC3A4, TERC3B4, and TERC3A2 provide input to RPS Channels 1 through 4.
TERC3B2 had been declared inoperable during the past operating cycle and documented in the Corrective Action Program with appropriate actions taken per TS LCO 3.3.1. The RPS Reactor Coolant High Temperature trip and the RPS Reactor Coolant Pressure-Temperature trip are considered to have been incapable of performing their safety functions during the operating cycle. A minimum of two out of four channels are required to meet T.S. 3.3.1. At least two of the channels were subsequently determined to be inoperable during the operating cycle, resulting in the plant operating in a condition prohibited by the TS due to Actions of TS 3.3.1 not met, therefore, reportable per 10 CFR 50.73(a)(2)(i)(B).
The RPS logic requires at least two channels to generate a protective trip. Since insufficient channels of the RC High Temperature function of the RPS were Operable to ensure the RPS could perform its required safety function at all times (including during testing of channels that would otherwise have been Operable), the RPS would not have been able to perform all required safety functions as a result of this condition. Therefore, this condition is also reportable per 10CFR 50.73(a)(2)(v)(A) as a condition that could have prevented the fulfillment of the safety function of a system needed to shutdown the reactor and maintain it in a safe shutdown condition. Because the condition with the RC Hot Leg RTDs was found with the reactor defueled, at the time of discovery, these instruments had no safety function. Therefore, this issue was not immediately reportable (within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />) per 10 CFR 50.72(b)(3)(v)(A).
The improper configuration of the RCS piping insulation installed resulted in multiple independent channels of the RPS to become inoperable. Therefore, 10 CFR 50.73(a)(2)(vii), an event where a single cause or condition caused two independent channels to become inoperable in a single system designed to (A) shut down the reactor and maintain it in a shutdown condition is documented.
Two channels of the PAM RC Outlet Temperature function per RC Loop are required to be Operable, and two channels of the RC Hot Leg Level Wide Range function are required to be Operable. However, one channel of the RC Outlet Temperature function was inoperable in each RC Loop during the operating cycle, and one channel of the RC Hot Leg level was inoperable during the operating cycle. Therefore, the plant operated in a condition prohibited by TS 3.3.17, which is reportable per 10 CFR 50.73(a)(2)(i)(B).
Because TERC3A4 remained Operable, TS 3.3.18, Remote Shutdown Monitoring Instrumentation, was met during the operating cycle.
CORRECTIVE ACTIONS:
Completed Actions:
Five of the six dual element RCS Hot Leg RTDs and wiring were replaced during the 2016 Refueling Outage (TERC3B2/B5, TERC3B3/B4, TERC3B1/66, TERC3A1/A2, and TERC3A4/A6). Inspection of the sixth dual element Hot Leg RTD (TERC3A3/A5) during the 2016 refueling outage determined it had exhibited little aging. This sixth RTD was determined to be suitable for continued operation, and with concurrence from the vendor, this RTD was reinstalled and declared operable.
The piping insulation for the six dual element RCS Hot Leg RTDs was modified using two flat insulation halves to satisfy vendor specified insulation configuration for the RTDs and installed during the 2016 Refueling Outage.
At the end of the 2016 Refueling Outage with the unit in Mode 3 at normal operating pressure and temperature, Environmental Qualification (EQ) Engineering personnel performed external surface temperature measurements of all six dual element Hot Leg RTDs. Observations by the EQ Engineer concluded, that the piping insulation engineering change was effective at providing sufficient insulation and extension tube cooling length to limit RTD heat rise.
The RTDs requiring Environmental Qualification were reinstalled with the Midlock Ferrules correctly oriented prior to restart to provide the qualified seal.
The topic of "RCS Hot Leg Temperature RTD Wire Insulation Degradation" was discussed in an Awareness Communication News Flash to engineering personnel. This topic is planned to be discussed in the 2016 continuing engineering training.
Scheduled Actions:
During the next Refueling Outage scheduled for Spring of 2018, visual inspection of dual element RCS Hot Leg RTD TERC3B2/3B5, installed during the 2016 refueling outage, will be performed to verify no wiring insulation degradation has occurred.
RCS Hot Leg RTD TERC3A3/A5 will be replaced during the next Refueling Outage scheduled for Spring of 2018.
Maintenance procedure, "Installation of Connectors," will be revised to incorporate detailed instructions on how to install the Conax ESCAs (including the Midlock Ferrule), and include specific installation instructions from the vendor manual guidance. Initial and periodic Conax ECSA training was created and added to the maintenance continuing training program. Additional training will be provided prior to the next refueling outage. The ECSAs on the Environmental Qualification packages harsh equipment listings will be assessed for proper assembly.
PREVIOUS SIMILAR EVENTS
Licensee Event Report (LER) 2016-001 documents an automatic reactor trip that occurred on 1/ 29/2016 due to the actuation of the RPS while nuclear instrumentation calibration was in progress. Nuclear Instrumentation calibration for RPS Channel 1 was inoperable/tripped due to the issue with TERC3B2 described above. When a fuse failed in an input to RPS Channel 4 with RPS Channel 1 in tripped status and RPS Channel 2 in bypass for calibration, a reactor trip occurred.