05000387/LER-2010-003
| Susquehanna Steam Electric Station Unit 1 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| Initial Reporting | |
| ENS 46103 | 10 CFR 50.72(b)(2)(iv)(B), RPS System Actuation, 10 CFR 50.72(b)(3)(iv)(A), System Actuation |
| 3872010003R03 - NRC Website | |
CONDITION PRIOR TO THE EVENT
Unit 1 - Mode 1, 89 percent Rated Thermal Power due to ambient conditions
EVENT DESCRIPTION
On July 16, 2010, at approximately 1641 EDT, the Susquehanna Steam Electric Station (SSES) Unit 1 reactor was manually scrammed due to a large unisolable circulating water system leak in the main condenser area. During attempts to isolate the leak, the operators lowered reactor power from approximately 89 percent to about 39 percent.
It was identified that the leak was coming from two separate condenser waterbox manway door seals. Due to delays in the identification of the leak's location and the failure of the condenser waterbox isolation valves to close electrically, the condenser bay continued to flood. Based on rising water level in the condenser area and the unsuccessful isolation of the source of the leakage, Operations manually scrammed Unit 1 by placing the mode switch in shutdown.
All control rods fully inserted. Reactor water level lowered to -28 inches causing Level 3 (+13 inches) isolations.
The Integrated Control System (ICS) Feedwater Level Control (FWLC) system detected the scram condition and automatically entered setpoint setdown mode, which placed the non-lead RFPs in idle mode, and initiated transition to startup level control mode. During this transition, ICS FWLC did not transfer to single element control due to a higher than expected steam flow signal, and concurrent feedwater flow oscillations resulted in an increase in reactor water level. Reactor water level .reached Level 8 (+54 inches) which resulted in the trip of all three RFP turbines, the High Pressure Coolant Injection (HPCI) system, and the Reactor Core Isolation Cooling (RCIC) system to shutdown.
The Circulating Water (CW) System was shut down and the main steam isolation valves (MSIVs) were manually closed. Reactor water level was restored and maintained within normal operating range using the RCIC system.
Pressure control was initiated using the HPCI system in the pressure control mode. All safety systems operated as expected. No steam relief valves opened. It was estimated that approximately one million gallons of water leaked into the condenser bay area.
An ENS notification (# 46103) was made to the NRC in accordance with 10 CFR 50.72(b)(2)(iv)(B) for an event or condition that resulted in the actuation of the RPS when the reactor was critical, and 10 CFR 50.72(b)(3)(iv)(A) due to the manual actuation of the RPS, RCIC and HPCI system.
CAUSE OF THE EVENT
PPL completed a root cause investigation shortly after the event occurred. The root cause identified that the circulating water system leak occurred due to the condenser waterbox manway gasket rolling out of position. The neoprene rubber gaskets tend to "creep" after installation, resulting in the torque on the gasket hold-down bolts to drop below the required torque values as defined in the installation procedure. The root cause determined that the lower preload torque resulting from the gasket "creep" would have been detected and the failure likely precluded had the installation procedure required a re-check of the manway hold-down bolt torque. The procedure does require a leak check to be performed at system operating conditions, but no requirement to re-check the torque values is required by the procedure. This represents a missed opportunity to identify and evaluate previous CW system leaks by the corrective action program.
Other contributing causes of the failure include use of a bolt torque value that was not in accordance with current manufacturer recommendations, irregularities in the manway seating area, and less than optimal manway cover design.
Investigation concluded that the gasket reached the point where it could no longer maintain system pressure and rolled out of position due to gasket "creep" (i.e., inadequate gasket preload to maintain joint integrity). The gasket extrusion was the result of inadequate preload, rather than a system pressure transient or a material defect.
During the flooding, Operations was not able to positively determine which waterbox was leaking due to limited access to the condenser area and the inability to identify equipment due to the water spray from the leak. This difficulty was compounded by the lack of procedure direction supporting operator response to CW system leaks. It is possible that if the correct waterbox was initially selected and isolated, the total leakage into the condenser bay would have been significantly reduced.
PPL subsequently determined that the original investigation did not comprehensively address the organizational, programmatic, and safety culture contributors to the event and established a root cause investigation team to supplement the original root cause evaluation. The root causes identified by the supplemental root cause evaluation include:
- Less than adequate risk informed decision making resulted in the failure to adequately address previous CW system leak events.
- Less than optimal design of CW system equipment (condenser waterbox manway and waterbox inlet/outlet valves' motors compartments) resulted in the failure to maintain the CW system pressure boundary integrity and impacted the flooding mitigation capability.
- Less than adequate procedure quality, use and adherence to maintenance procedures for main condenser leak and CW system leak detection, and operations procedure for immersed heat exchanger internals epoxy lining, resulted in the loss of the CW pressure boundary integrity and inadequate mitigation of the CW leak.
ANALYSIS / SAFETY SIGNIFICANCE
Circulating Water System A circulating water system rupture is an anticipated event as discussed in Section 10.4.1.3.3 in the SSES Final Safety Analysis Report (FSAR). The presence of any water accumulation in the condenser bay is detected by level switches which are mounted on the shielding wall at various points around its perimeter. These switches did alarm in the control room during the flooding event. The condenser bay is designed to contain the water from a circulating water system rupture. The concrete shielding walls which surround the condenser bay are designed to withstand the possible 20 feet of differential water pressure they could experience in the event of a major rupture. Water level reached approximately 12 feet in the condenser bay during the event, which is well within the design flood level.
The 656 foot elevation doors, which provide access through the shielding walls, are pressure resistant. While not watertight, these doors do restrict water leakage out of the condenser bay in the event of flooding. Also, while penetrations through the walls are not watertight, they are filled with a sealant for radiation shine which serves to limit the quantity of water leaking out of the condenser bay in the event that it becomes flooded.
There is no safety-related equipment in the Turbine Building below grade (676 foot elevation), and the penetrations below grade, between the Turbine building and the Reactor Building, are designed to prevent flooding of the Reactor Building.
There was no significant water accumulation in the turbine building, outside of the condenser bay, during this event — the flooding was effectively contained within the condenser bay.
Neither a major rupture of the CW system nor a rupture of the condenser hotwell will have an effect on any safety-related system since no safety-related systems are located within this area.
ICS Feedwater Level Control System The ICS FWLC logic is designed to automatically perform a series of actions following a reactor scram in order to prevent overfeeding the reactor vessel and transition to startup level control mode. The ICS FWLC system is a cascade level controller that implements level control by controlling flow in a three element controller. The ICS FWLC system is designed to detect a reactor scram condition based on a reactor vessel level of less than +13 inches and a total main steam flow of less than 0.7 million pounds mass per hour. Upon detecting a scram condition, the ICS FWLC is designed to automatically initiate setpoint setdown mode, which sets the reactor vessel level setpoint to +18 inches, places the non-lead reactor feed pumps in idle mode and initiates transition of the FWLC system to startup level control mode.
Potential Consequences The SSES Plant Analysis group prepared a risk assessment for the plant shutdown initiating event. This risk assessment takes into consideration the plant conditions immediately leading to shutdown, the equipment out of service for maintenance at the time of shutdown, and the conditions at the time of shutdown. Flooding in the condenser bay is not considered an initiating event in the SSES Probabilistic Risk Assessment model. It is assumed in flood calculations that a flood in the condenser bay will eventually result in a plant shutdown due to loss of the main condenser. It is anticipated that the shutdown would occur by either an automatic or manual reactor scram. During the event, a manual scram was executed from approximately 39 percent power. The circulating water system was shutdown and the MSIV's were isolated. Equipment in the area that may have been out of service as a result of the flooding was non-safety related power generation equipment and therefore was not required for safe shutdown of the unit.
Actual Consequences The leak from the CW system resulted in an internal flooding event, and a subsequent manual scram, isolation of the reactor and loss of the condenser heat sink for Susquehanna Unit 1. Although actual plant safety was not compromised, Unit 1 was unnecessarily placed in a higher level of risk as a result of this event. With the manual scram, Unit 1 was safely shut down. A reactor manual scram is consistent with expected operator actions for flooding events of this magnitude. The MSIVs were manually closed and CW was isolated. HPCI tripped and RCIC shut down by design when high vessel water level was received immediately following the scram. Both systems were subsequently reset. HPCI was used for pressure control while RCIC was used for level control. No mitigating systems were out of service during this event. While the reactor vessel level reaching +54 inches following reactor scram was not expected for the ICS FWLC system, the system's basic protection function to prevent overfeeding of the reactor vessel worked as designed. Additionally, although safety systems were required to function as a result of the event, they operated per design, and there were no safety impacts to safety-related equipment due to the flooding nor was Unit 2 impacted as a result of the Unit 1 event. There was no impact to the health and safety of the public.
CORRECTIVE ACTIONS
Completed Actions:
The following actions have been completed on Unit 1 and Unit 2:
- All manway gaskets were inspected and replaced as required.
- The epoxy coating on the manway at the gasket seating surface has been re-worked to provide a smooth and uniform surface where the gasket fits over the end of the manway.
- The manway hatch epoxy coated surfaces have been roughened to increase friction between the hatch and the gasket contact surface.
- An installation check has been incorporated into the work packages to ensure proper seating of the gasket prior to installing the hatch.
- The manway hatch bolt torque for new installation has been increased from 60 ft-lbs to 80 ft-lbs. This torque value optimizes gasket preload and ensures gasket integrity during installation.
- A design change was implemented to the ICS FWLC system logic to automatically transfer FWLC to single element upon initiation of setpoint setdown mode following a scram.
- Revised procedures to address gasket installation procedure deficiencies.
- Enhanced the inspection procedure to ensure compliance with Manway coating specification.
- Revised procedures to address isolating individual waterboxes for leak between waterbox inlet and outlet valves and add diagrams to aid in leak isolation if required.
- Developed revisions to processes and procedures to improve risk informed decision making.
- Established a written policy for risk-informed decision making using a consistent systematic methodology.
Key Planned Corrective Actions
- Design and implement a modification of the Unit 1 and Unit 2 condenser manway joint connections to eliminate flooding potential of these joints.
- Design and implement a modification of the Unit 1 and Unit 2 main condenser waterbox inlet and outlet valves motor compartments to establish reliability for valve operation during main condenser manway cover leak events.
- Identify list of components that need labeling and provide labels (such as condensers, piping areas/access doors) to improve condenser leak identification capability.