05000483/LER-2013-009
| Callaway Plant Unit 1 | |
| Event date: | 10-09-2013 |
|---|---|
| Report date: | 12-09-2013 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| Initial Reporting | |
| ENS 49422 | 10 CFR 50.72(b)(3)(ii)(B), Unanalyzed Condition |
| 4832013009R00 - NRC Website | |
1. DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):
To address situations where the Control Room (CR) could become uninhabitable, the design of Callaway Plant includes an Auxiliary Shutdown Panel (ASP) which provides the CR operator with sufficient instrumentation and control capability to place and maintain the unit in a safe shutdown condition from a location other than the CR. The safe shutdown condition is defined as MODE 5 (Cold Shutdown) where the auxiliary feedwater system and the steam generator safety valves or the steam generator atmospheric dump valves can be used to stabilize plant parameters and remove core decay heat.
A CR fire is one of the events considered in the design of the ASP. Should the CR become uninhabitable due to a fire, the design of the ASP ensures the safety equipment needed for safe shutdown is protected from fire damage by providing separation, fire barriers, and/or alternative shutdown capability.
Off-normal operating procedure OTO-ZZ-00001, "Control Room Inaccessibility," provides the necessary guidance to safely shut down the reactor through a sequence that includes tripping the reactor, evacuating personnel from the CR, isolating the ASP control circuits, disabling selected equipment not provided with ASP disconnect switches and operating the plant from the Auxiliary Shutdown Panel (ASP). The unit automatically enters MODE 3 following the reactor trip. Procedure OTS-ZZ-00001, "Cooldown From Outside The Control Room," will provide instruction to move the plant into MODE 5.
For the specific instrumentation and equipment credited for use during the CR fire event, disconnect switches are provided to isolate related electrical circuits from the CR to ensure credited components remain available and are not disabled or spuriously operated as a consequence of fire-related damage. Not all controls and disconnect switches are located at the ASP. Some controls and disconnect switches are operated locally at the switchgear, motor control centers, or other local stations in the plant. The controls, instrumentation, and disconnect switches are those required for:
- Reactivity Control (initial and long term)
- Reactor Coolant System (RCS) Pressure Control (EIIS: AB)
- RCS Inventory Control
- Safety support systems for the above Functions, including the essential cooling water system and onsite power which includes the diesel generators.
The Class 1E 125-VDC power system (EIIS: EJ) consists of four distinct DC trains (1, 2, 3, 4). Each train is provided with a battery, control center, distribution panel and battery charger which are combined into two independent Class lE 125-VDC system trains, i.e., Train A (1 & 3) and Train B (2 & 4). A Class lE backup battery charger is provided for each of the two trains such that one backup charger is capable of providing Class lE 125 VDC power to either of the two buses in Train A and the other backup charger is capable of supplying either of the two buses in Train B.
For each train, indication of Class 1 E battery and battery charger current is provided on ammeters on the main control board (MCB) in the CR. Each ammeter is connected to an instrument shunt bar installed in a load carrying conductor for the associated battery or battery charger. The two cables that provide the signal to the ammeter are IEEE 383-qualified ethylene propylene rubber with a hypalon jacket (EPHY) cables which are bolted on each end of the shunt bar. The cables are routed through the plant to the CR ammeters via cable raceways (EIIS: FA) and cable chase paths. The small difference in voltage between the taps on each end of the shunt bar is sufficient to deflect the ammeter in the CR when current flows from the battery or battery charger through the shunt.
2. INITIAL PLANT CONDITIONS:
On October 09, 2013, the plant was in Mode 1 (Power Operation), at 100 percent power and normal operating temperature and pressure. There were no structures, systems, or components inoperable that contributed to the event.
3. EVENT DESCRIPTION:
On October 09, 2013, Callaway Plant completed a review of industry operating experience related to unfused remote DC ammeter circuits that could result in secondary fires due to multiple fire-induced faults during a CR fire event. Engineering personnel determined that a similar condition existed at Callaway Plant which resulted in the plant being in an unanalyzed condition. The engineering personnel notified operations personnel of the results of their review. As a compensatory measure, hourly fire watches were established in the affected areas of the plant.
The original plant design and associated analysis for the Class 1 E train B battery and battery charger (including the B swing charger) CR ammeter circuits do not include overcurrent protection features to limit the fault current in the wiring that connects the instrument shunt bars to the CR ammeters.
In the postulated event, a fire in the CR causes one of the ammeter wires to hot short to the ground plane. Simultaneously, the CR fire causes another DC wire of the opposite polarity on the same battery or battery charger to also hot short to the ground plane. The two hot shorts result in a ground loop through the unprotected ammeter wiring which then results in excessive current flow and heating in the ammeter cable wiring to the point of causing a secondary fire in the cable raceways in another fire area. The secondary fire could adversely affect the availability of safe shutdown equipment and potentially cause a loss of the ability to conduct a safe shutdown as required by 10 CFR 50 Appendix R, Section III.G.
The corrective action program evaluation of the extent of condition concluded that only the NK system (safety-related 125 VDC) ammeters and associated cables for both trains are affected.
The NK system DC shunt ammeter circuits provide remote or local indication of current flow in the batteries and chargers. Local ammeter indication is not a concern for post-fire safe shutdown because the local ammeters are in the primary fire area (and thus not relied upon) and any secondary fires would be contained to their respective areas.
4. ASSESSMENT OF SAFETY CONSEQUENCES:
There were no actual safety consequences of this condition, and the event did not result in a challenge to fission product barriers or the release of radioactive materials. The event did not adversely affect the safe operation of the plant or the health and safety of the public.
A review of industry operating experience indicates that CR cabinet fires are expected to be low energy fires with damage localized to the ignition source. At Callaway Plant, control cabinet fires are similarly expected to be low energy, short duration fires with minimal impact beyond the immediate location of the ignition source.
The materials used in CR cabinets are of low flame-spread type and tend to self-extinguish when the ignition source is removed. Nuclear plant fire data has shown that control cabinet fires are among the lowest in occurrence and in duration. Fires in control cabinets are generally oxygen limited when the doors are closed. The Callaway Plant fire protection program provides administrative controls for limiting the amount and type of combustible material (fixed and transient) within the CR space.
The CR design includes fire detection and alarm capability and is continually manned by operators trained in fire response. The detection and suppression equipment includes ionization detection instruments and manual suppression including portable fire extinguishers and fire hose stations.
To initiate the postulated secondary fire during a CR fire event, the fire-induced faults (in the CR) between the wiring of the affected ammeter circuits would require either an inter-cable hot short or two hot shorts to the ground plane involving a specific combination of a battery ammeter circuit with its associated battery charger ammeter circuit. Additionally, the ammeter circuits of the Class 1E batteries and associated battery chargers were confirmed to be EPHY thermoset type insulating material, which would require a fire of sufficient intensity and/or duration to cause a breakdown of the insulating material. Based on review of cable routing of the potentially affected circuits, failures from these types of shorts and fires would generally be limited to a single train.
The factors discussed above support a conclusion that the combination of a significant CR fire event and the specific wiring faults required to produce a secondary fire that affects the availability of equipment required for safe shutdown is a very low probability event.
For the given CR fire event, the operations staff would enter the CR fire off-normal procedure, OTO- ZZ-00001, in which the CR staff trips the reactor and relocates to the ASP. If equipment specified in the CR fire off-normal procedure does not function due to secondary fire effects, the CR fire off- normal procedure directs the atmospheric dump valves to be operated locally and the B motor-driven auxiliary feedwater pump to be started with local controls at the circuit breaker on the switchgear located adjacent to the ASP.
In the postulated CR fire event addressed by this LER, additional contingency actions exist to address potentially lost instrumentation and safe shutdown systems not already addressed by the CR fire off-normal procedure. The contingency actions are contained in emergency operating procedures and mitigation guidance to control reactor coolant system temperature to maintain the plant in a safe shutdown condition. These contingency actions include operating the turbine-driven auxiliary feedwater pump manually from the pump room and locally monitoring steam generator water levels using instruments staged for these contingencies. Such contingencies would be implemented in concert with the emergency response organization, which is required to be activated upon evacuation of the CR in response to the CR fire. The procedure contingencies provide additional confidence that the safety functions would be maintained for the postulated CR fire event.
The design deficiency did not impact the performance of any other component functions, and no other safety functions were impacted as a result of this event. The condition would not have prevented the fulfillment of a safety function, as the condition did not result in a safety system functional failure as defined by 10 CFR 50.73(a)(2)(v).
5. REPORTING REQUIREMENTS:
This LER is submitted pursuant to 10 CFR 50.73(a)(2)(ii)(B) to report an unanalyzed condition that was conservatively determined to significantly degrade plant safety.
On October 9, 2013, Callaway Plant determined an unanalyzed condition exists related to the CR fire analysis. The original design of ammeter circuits that provide CR current indication for Class 1 E batteries and battery chargers does not include overcurrent protection features to limit fault current.
In the postulated event, a fire in the CR could cause a ground loop through unprotected ammeter wiring and potentially result in excessive current flow and heating to the point of causing a secondary fire outside the CR in the cable raceways. The postulated secondary fire could affect the availability of equipment needed to place the plant in a safe shutdown condition during a CR fire event. This scenario has not been analyzed in accordance with 10 CFR 50 Appendix R, Section III.G.
This condition was reported pursuant to 10 CFR 50.72(b)(3)(ii)(B) as an unanalyzed condition that significantly degrades plant safety. An 8-hour notification was made to the NRC on October 9, 2013 via Event Notification 49422. This LER is submitted pursuant to 10 CFR 50.73(a)(2)(ii)(B), consistent with the 10 CFR 50.72 notification.
6. CAUSE OF THE EVENT:
The cause of the reported condition is that the original design of the DC ammeter circuits did not include fuses to protect ammeter cables. This design has been in place since construction and has only recently been identified as an issue based on testing conducted by the NRC in 2011 and reported in NUREG/CR-7100. The NRC has been developing new guidance for addressing hot short issues within the same cable tray and rules for how to consider DC hot shorts with the ground plane.
7. CORRECTIVE ACTIONS:
As an interim action, fire watches have been established in affected fire areas. Fire watches provide additional defense in depth for the fire protection program and support early detection of fire at the incipient stage.
Once the NRC issues documentation on how to address DC hot shorts via the ground plane, Callaway will determine whether it is acceptable to utilize FIRE Probabilistic Risk Assessment (PRA) to evaluate the issue and either leave the circuits as built or modify the affected circuits (to provide circuit protection) as necessary.
8. PREVIOUS SIMILAR EVENTS:
A review of internal Operating Experience was performed, and no similar conditions have been reported by Callaway Plant in the past three years.