05000346/LER-2021-003, Reactor Trip Due to Failed Uninterruptible Power Supply and Steam Feedwater Rupture Control System Actuations
| ML21250A131 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 09/07/2021 |
| From: | Tony Brown Energy Harbor Nuclear Corp |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| L-21-195 LER 2021-003-00 | |
| Download: ML21250A131 (8) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| 3462021003R00 - NRC Website | |
text
energy harbor Terry J. Brown Site Vice President, Davis-Besse Nuclear September 7, 2021 L-21-195 ATTN: Document Control Desk United States Nuclear Regulatory Commission Washington, D.C. 20555-0001
Subject:
Davis-Besse Nuclear Power Station, Un it 1 Docket Number 50-346, License Number NPF-3 Licensee Event Report 2021-003-00 Davis-Besse Nuclear Power Station 5501 N. State Route 2 Oak Harbor, Ohio 43449 419-321-7676 10 CFR 50.73 Enclosed is Licensee Event Report (LER) 2021-003-00, "Reactor Trip due to Failed Uninterruptible Power Supply and Steam Feedwater Rupture Control System Actuations." This event is being reported pursuant to 10 CFR 50.73(a)(2)(iv)(A).
There are no regulatory commitments contained in this letter or its enclosure. The actions described represent intended or planned actions and are described for information only. If there are any questions or if additional information is required, please contact Mr. Robert W. Oesterle, Manager, Site Regulatory Compliance and Emergency Response, at (419) 321-7462.
Sincerely, GMW Enclosure: LER 2021-003-00 cc: NRC Region Ill Administrator NRC Resident Inspector N RR Project Manager Utility Radiological Safety Board
Abstract
On July 8, 2021, with the Davis-Besse Nuclear Power Station operating at approximately 100 percent power, an automatic reactor trip occurred due to de-energization of Motor Control Centers caused by a breaker failure during planned testing. The simultaneous failure of an uninterruptible power supply (UPS) caused a loss of power to the Main Generator Automatic Voltage Regulator (AVR), resulting in a Generator lockout and trip of the Main Turbine and Reactor. Following the Reactor trip, overcooling was observed due to loss of power to a Moisture Separator Reheater steam source valve, and operators manually initiated Emergency Core Cooling Systems (ECCS) per procedure. The Steam and Feedwater Rupture Control System (SFRCS) actuated on low Steam Generator (SG) 1 level, starting the Auxiliary Feedwater System. During post-trip response, SG 2 low pressure was experienced while transferring Gland Steam Supply, actuating SFRCS to isolate Main Feedwater and close the Main Steam Isolation Valves.
The cause of the reactor trip was inadequate review for impact on the UPS when selecting it as a power source during AVR installation. The cause of the subsequent SFRCS actuation was failure of the Gland Steam Seal feed valve pneumatic actuator. This event is being reported pursuant to 10 CFR 50.73(a)(2)(iv)(A) as automatic actuations of the Reactor Protection and Auxiliary Feedwater Systems, and manual actuation of ECCS.
Energy Industry Identification System (EIIS) codes are identified in the text as [XX].
System Description
The Davis-Besse Nuclear Power Station (DBNPS) Main Generator [TB] converts rotating mechanical energy of the Main Turbine [TA] into electrical energy. The excitation system provides regulated Direct Current (DC) power to the Main Generator field/rotor for controlling the voltage and reactive volt-ampere output of the Main Generator.
The alternator-exciter is a direct-coupled AC synchronous generator driven from the Main Generator rotor.
Generator excitation is controlled by varying field current to the exciter by using the Automatic Voltage Regulator (AVR) as a power source for excitation.
The Steam and Feedwater Rupture Control System (SFRCS) [JB] is a protection system designed to automatically start the Auxiliary Feedwater (AFW) System [BA] in the event of a main steam line break, Main Feedwater (MFW) line rupture, a low level in the Steam Generator [AB-SG] or a loss of all four Reactor Coolant Pumps [AB-P]. SFRCS is designed to automatically isolate the Main Steam System and MFW System in the event of a Main Steam Line Break or MFW line rupture. The AFW System is automatically aligned to feed the unaffected steam generator (SG) upon a loss of steam pressure in one of the SGs. The SFRCS is required to ensure an adequate feedwater supply to the SGs to remove reactor decay heat during periods when the normal feedwater supply has been lost.
The Integrated Control System (ICS) [JA] provides for coordination of the Reactor, SG feedwater control, and Main Turbine under all operating conditions. This coordination consists of producing the best load response to the unit load demand while recognizing the capabilities and limitations of the reactor, SG feedwater system, and turbine. When any single portion of the station is at an operating limit or a control section is on manual, the ICS uses the limited or manual section as a load reference. One of the features of the ICS Feedwater Subsystem is a Rapid Feedwater Reduction (RFR) scheme. The RFR scheme is designed to prevent refeeding the steam generators with feedwater when not warranted, which could cause a primary system (RCS) overcooling transient.
The RFR circuitry provides for a rapid decrease in feedwater flow rate after a reactor trip and is also designed to preclude low steam generator level SFRCS actuations resulting from undershoot of the low level control limits.
After a reactor trip, with all feedwater stations in automatic, an RFR demand signal equivalent to approximately four percent of total feedwater flow is substituted for valve position.
DESCRIPTION OF EVENT
On July 8, 2021, the DBNPS was operating in Mode 1 at approximately 100 percent power, with no equipment inoperable that contributed to the event. Post-Maintenance Testing was being performed on non-safety related Breaker BF306, 480 VAC Motor Control Center (MCC) E32A Alternate Feeder [EC-BKR] following planned preventive maintenance. At 2151 hours0.0249 days <br />0.598 hours <br />0.00356 weeks <br />8.184555e-4 months <br />, Breaker BF306 was tested satisfactorily. At 2154 hours0.0249 days <br />0.598 hours <br />0.00356 weeks <br />8.19597e-4 months <br />, when switching back to the normal power supply, Breaker BE306, the normal feeder for MCC E32A [EC-BKR], failed and operators in the field observed a puff of smoke when BE306 attempted to close. The breaker attempted to close, resulting in a trip of the alternate feeder breaker, BF306, and ultimately a loss of both the normal and alternate feeder breakers to MCC E32A, 480V Turbine Building Non-Essential Motor Control Center [EC], in addition to its cascaded MCC E32B. The significant loads lost include the AC power supply to the Uninterruptible Power Supply (UPS) for the Digital Electro-Hydraulic Control (DEHC) System [JJ], Moisture Separator Reheater (MSR) 1 Second Stage Reheat Steam Source Valve MS199 [SB-ISV], Excitation Cubicle C4301 [TL], EHC Pump 1 [TG-P],
==DESCRIPTION OF EVENT==and Main Feedwater Pump Turbine (MFPT) 1 and 2 support pumps [SJ-P]. For the EHC and MFPT support pumps, alternate pumps powered from an unaffected power source maintained the equipment function.
When the AC power was lost to the DEHC UPS, the UPS failed to pick up load, resulting in a loss of control power to the Automatic Voltage Regulator (AVR) Automatic Transfer Switch (ATS). The UPS supplies one of the redundant sources of power to the DEHC and is the sole source of control power for the AVR transfer switch.
The AVR supplies one of two available sources of power for excitation to the Alterrex exciter. The UPS battery [JJ-BTRY] would normally be expected to pick up and sustain power in the event of a loss of AC power input.
However, the battery feeder breaker was found tripped and a degraded battery cell was discovered following the plant trip. The DEHC remained energized via its alternate feed from MCC F32A. While the AVR did not lose the alternate supply of excitation power from MCC F33A, without the ATS completing the transfer, power was available but not connected. The failure of the UPS and the loss of E32A resulted in a loss of control power to the ATS, resulting in a loss of generator field excitation. The loss of field excitation caused a lockout of the Main Generator, which tripped the Main Turbine and satisfied the Anticipatory Reactor Trip System logic, resulting in a trip of the Reactor Protection System (RPS) at 2154 hours0.0249 days <br />0.598 hours <br />0.00356 weeks <br />8.19597e-4 months <br /> from approximately 100 percent power. Initial unit response to the Reactor trip was as designed, and all control rods fully inserted.
Due to the loss of power to the motor operator for MS199, MSR 1 Second Stage Reheat Steam Source Valve, the valve remained open following the trip instead of automatically closing when turbine load was less than ten percent. This resulted in overcooling of the Reactor Coolant System, which was identified by the Control Room Operators at 2158 hours0.025 days <br />0.599 hours <br />0.00357 weeks <br />8.21119e-4 months <br /> during the immediate post-trip response. High-Pressure Injection (HPI) [BQ], Low-Pressure Injection (LPI) [BP], and Makeup [CB] was placed in service in accordance with procedures starting at 2158 hours0.025 days <br />0.599 hours <br />0.00357 weeks <br />8.21119e-4 months <br />. The source of overcooling was identified per procedure as MS199 and an operator was dispatched to manually close MS199, which was accomplished at approximately 2202 hours0.0255 days <br />0.612 hours <br />0.00364 weeks <br />8.37861e-4 months <br />. However, due to the overcooling the SFRCS automatically initiated at 2201 hours0.0255 days <br />0.611 hours <br />0.00364 weeks <br />8.374805e-4 months <br /> on low level (approximately 23.5 inches) in SG 1. All SFRCS components responded as designed, with both Auxiliary Feedwater Pump Turbines (AFPTs) starting.
Following the turbine trip, problems were experienced with control of feedwater through Startup Feedwater Control Valve SP7B [SJ-FCV], as the valve failed to open to control SG level after RFR was released. HPI, LPI, and Makeup were secured, and the operating crew began taking actions to reduce Main Steam loads, which included startup of the Auxiliary Boiler [SA-BLR], shutting down MFPT 1 and AFPT 1. At approximately 2345 hours0.0271 days <br />0.651 hours <br />0.00388 weeks <br />8.922725e-4 months <br /> Operators started to shift Main Turbine Gland Steam Supply from Main Steam to Auxiliary Steam in accordance with procedure. This procedure instructed the operators to slowly open the bypass valve for the Gland Steam Seal Feed Valve [TC-PCV] from the control room until the Gland Steam Seal Feed Valve went closed automatically or approximately 3 psig pressure is obtained in the Gland Steam Supply header. The Gland Steam Seal Feed Valve did not respond properly to the increasing Gland Steam pressure and was discovered to be approximately 60 percent open following the event with a full closed signal. The increase in steam to the Gland Steam Supply header resulted in lifting the Gland Steam System relief valves [TC-RV]. This extra steam load resulted in actuation of SFRCS Actuation Channel 2 at 2358 hours0.0273 days <br />0.655 hours <br />0.0039 weeks <br />8.97219e-4 months <br /> on Steam Generator 2 low pressure (approximately 630 psig). All SFRCS Components responded as designed, closing both Main Steam Isolation Valves (MSIVs) [SB-ISV] isolating MFW to the SGs. Operators took manual control of the Atmospheric Vent Valves [SB-PCV] to control SG Pressure when they failed to operate in automatic following the SFRCS actuation.
CAUSE OF EVENT
The direct cause of the reactor trip was that with the AVR aligned to MCC E32A, a failure of breaker BE306 to close coincident with a failure of a battery within the DEHC UPS caused a loss of control power to the ATS, preventing the ATS from transferring to the alternate source. The UPS battery failed due to normal aging. The failure of breaker BE306 to close is considered the initiating event, as the breaker failure is not considered an unacceptable failure and the same event would have occurred if breaker BF306 had failed or any other loss of MCC E32A occurred.
The primary cause of the ATS failure was that a change in the ATS control power was not adequately reviewed for impact on the DEHC UPS. The DEHC and Turbine Supervisory Instrumentation (TSI) systems have redundant power sources; two independent 120 VAC power supplies and a single 120 VAC source for cabinet utility power used for lighting, fans, and receptacles. Either source is capable of supplying the full required load, with one supply including the UPS. The 15 kVA single phase UPS and batteries are designed to supply back up power to the components for one hour to allow sufficient time for the turbine to slow to turning gear speed in the event of a loss of normal power. The UPS is fed from breaker BE3214 located on 480 VAC Turbine Building MCC E32A. The second AC source is fed from breaker BF3212 located on 480 VAC MCC F32A to a 15 kVA regulating transformer. The regulating transformer and UPS each feed separate 120V distribution panels to power the DEHC equipment. The original purpose of the UPS was to provide power when there was a loss of both E32A and F32A, which would also result in a turbine trip, so the turbine could be monitored post trip. The UPS is the third source of power for the DEHC and would not be required as long as E32A or F32A were available. Based on this, the equipment was classified as Non-Impact when installed in 2014 since the UPS was not required to support plant operation.
When the Main Generator AVR and ATS were installed at the same time as the DEHC, the control power was taken from a single source that is backed up by a battery. Prior to the July 8, 2021 trip, the 480 VAC supply to the AVR and the normal control power to the ATS via the UPS were on the same bus. Therefore, if the 480 VAC source was lost, the AVR and ATS both lose normal power and the UPS battery must function for the ATS to transfer the AVR to the alternate source. A failure of the DEHC UPS prevents the ATS from working, causing a turbine trip if the 480 VAC source to the AVR is simultaneously lost. The Engineering Change that installed the AVR system and ATS relied upon the UPS installed with the DEHC System. The Engineering Change that installed the DEHC System was not intended to address that the UPS would also supply the ATS. Neither Engineering Change appeared to have evaluated the potential effect of a failure of the UPS on the ATS. While a UPS would normally be considered a reliable source of power, the design did not consider that the AC source of power to the UPS was also the normal control power for the ATS and normal 480 VAC supply for the AVR, thus on a loss of E32A that would require the ATS to transfer to the alternate source, all three components would lose their normal source of power and the ATS would rely on the DEHC UPS battery for control power to transfer the AVR to its alternate power source. The component classifications were not evaluated when the UPS was used as the sole source of power for ATS control power.
A contributing cause is that the AVR is normally aligned to MCC E32A which is also the source of power to the DEHC UPS, thus the ATS will always lose normal control power when it is required to transfer to the alternate source and must rely solely on the DEHC UPS batteries. If the AVR was normally supplied from F33A, the loss of E32A and the failure of the DEHC UPS would not have resulted in a turbine trip.
==CAUSE OF EVENT==The ICS RFR circuitry throttles the Startup Feedwater Control Valve to approximately 18 percent open following a turbine trip. Several minutes following the trip, when SG levels reach low level limits, the ICS will release the Startup Valves and return to SG level control. The failure of Startup Valve SP7B to control in automatic following the turbine trip is most likely due to a wind-up condition not releasing properly within the tie-back feedback integral control circuit of the ICS module that controls the valve during low level limit control.
The Gland Steam Seal Feed Valve failed at approximately 60 percent open due to a degraded O-ring on the closing side pneumatic piston actuator. The O-ring degradation was age and heat related, causing the O-ring to become brittle and not seal.
ANALYSIS OF EVENT
All control rods inserted fully as designed. Following the Reactor trip, all SFRCS components responded as designed for the SG 1 low level actuation, starting both AFPTs. For the subsequent SFRCS actuation on low SG 2 low pressure, all SFRCS components again responded as designed, closing both MSIVs and isolating MFW to the SGs. The plant risk associated with this event was determined to be of very low safety significance, when assessing the integrated Probabilistic Risk Assessment (PRA) model of record for internal events, seismic, and internal fire hazards.
Reportability Discussion:
The automatic actuation of the RPS while the reactor is critical is reportable within four hours of the event in accordance with 10 CFR 50.72(b)(2)(iv)(B). The automatic actuation of the AFW System by the SFRCS on a valid low SG level, and the later automatic actuation of the AFW System on a valid low SG pressure are reportable within eight hours per 10 CFR 50.72(b)(3)(iv)(A). The manual actuation of the HPI and LPI systems is reportable within four hours per 10 CFR 50.72(b)(2)(iv)(A) as emergency core cooling system (ECCS) discharge into the reactor coolant system. On July 9, 2021, at 0044 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br />, all of these events were reported to the NRC Operations Center as Event Number 55346.
These issues are being reported in accordance with 10 CFR 50.73(a)(2)(iv)(A), which requires reporting of any event or condition that resulted in automatic actuation of the RPS, including a reactor scram or reactor trip, as well as automatic actuations of the AFW and manual actuation of ECCS. All safety systems performed as required to the event, and no loss of safety function occurred.
CORRECTIVE ACTIONS
Completed Actions:
The defective battery cell for the DEHC UPS was replaced and the failed breaker BE306 was replaced prior to plant startup.
The AVR ATS was transferred to its alternate supply F33A on July 12, 2021, in accordance with the Generator and Exciter Operating Procedure.
The O-ring was replaced in the Gland Steam Seal Valve pneumatic actuator on July 22, 2021. As an enhancement, the O-ring material will be upgraded to extend the life of the O-ring.
The ICS module that controls Startup Feedwater Control Valve SP7B during low level limit control was replaced on September 2, 2021, due to the suspected failure of a capacitor used in the tie-back circuit.
Scheduled Actions:
The Generator and Exciter Operating Procedure will be revised to reflect the normal AVR power supply as F33A until a second source of control power is added to the ATS.
A test will be developed to conduct periodic testing of the DEHC UPS battery, and a Preventive Maintenance (PM) activity will be created to periodically replace the DEHC UPS Battery.
PREVIOUS SIMILAR EVENTS
DBNPS LER 2016-009 documented an event on September 10, 2016, where a trip of the Main Turbine and Reactor occurred due to rainwater intrusion into the Main Generator Automatic Voltage Regulator cabinet. The corrective actions taken in response to this event would not have prevented the 2021 event. There have been no LERs at the DBNPS in this same time period documenting issues with the Gland Steam Supply System.