05000528/LER-2013-003
| Palo Verde Nuclear Generating Station (Pvngs) Unit 1 | |
| Event date: | 10-04-2013 |
|---|---|
| Report date: | 12-03-2013 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| Initial Reporting | |
| ENS 49411 | 10 CFR 50.72(b)(3)(ii)(B), Unanalyzed Condition |
| 5282013003R00 - NRC Website | |
All times are Mountain Standard Time and approximate unless otherwise indicated.
1. REPORTING REQUIREMENT(S):
This Licensee Event Report (LER) is being submitted pursuant to 10 CFR 50.73(a)(2)(ii)(B) to report an unanalyzed condition.
On October 04, 2013, Palo Verde Nuclear Generating Station (PVNGS) engineering personnel determined an unanalyzed condition exists related to the Control Room (CR) fire analysis. The original design of ammeter circuits which provide CR current indication for the train B and D class 1 E batteries and battery chargers does not include overcurrent protection features to limit fault current. In the postulated event, a fire in the CR could cause a ground loop through unprotected ammeter wiring and potentially result in excessive current flow and heating to the point of causing a secondary fire outside the CR in the cable raceways. The postulated secondary fire could affect the availability of equipment needed to place the plant in a safe shutdown condition during a CR fire event. This scenario has not been analyzed in accordance with 10 CFR 50 Appendix R, Section III.G.
This condition was reported to the NRC pursuant to 10 CFR 50.72(b)(3)(ii)(B) via Event Notification 49411 at 1520 on October 4, 2013.
2. DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):
To address situations where the CR could become uninhabitable, the design of each PVNGS unit includes a Remote Shutdown System (RSS) which provides the CR operator with sufficient instrumentation and control capability to place and maintain the unit in a safe shutdown condition from a location other than the CR. To maintain safe shutdown conditions, the auxiliary feedwater system and the steam generator atmospheric dump valves are used to remove core decay heat.
A CR fire is one of the events considered in the design of the RSS. For this event, the CR fire analysis credits the train B safe shutdown equipment to achieve and maintain safe shutdown conditions. Should the CR become uninhabitable due to a fire, the design of the RSS ensures the safety equipment needed for safe shutdown is protected from fire damage by providing separation, fire barriers, and/or alternative shutdown capability.
Abnormal Operating Procedure (AOP), 40A0-9ZZ19, Control Room Fire, provides the necessary guidance to safely shutdown the reactor through a sequence that includes:
tripping the reactor, evacuating personnel from the CR, actuating disconnect switches for the RSS control circuits, disabling selected equipment not provided with RSS disconnect switches and establishing plant control from the Remote Shutdown Panels (RSPB).
For the specific instrumentation and equipment credited for use during the CR fire event, disconnect switches are provided to isolate related electrical circuits from the CR to ensure credited components remain available and are not disabled or spuriously operated as a consequence of fire-related damage. Not all controls and disconnect switches are located at the RSPB. Some controls and disconnect switches are operated locally at the switchgear, motor control centers, or other local stations in the plant. The controls, instrumentation, and disconnect switches are those required for:
- Reactivity Control (initial and long term)
- Reactor Coolant System (RCS) Pressure Control
- RCS Inventory Control
- Safety support systems for the above functions The class 1 E 125 Volts Direct Current (VDC) power system (EDS: EJ) consists of four distinct DC trains (A,B,C,D) which comprise two independent class 1E 125 VDC subsystems: trains A and C (AC) and trains B and D (BD). Each DC train is provided with a battery, control center, distribution panel and battery charger. A class 1 E backup battery charger is provided for each of the two subsystems which is capable of providing class 1 E 125 VDC power to either of the two trains in its associated subsystem (AC or BD).
For each train, indication of class 1 E battery and battery charger current is provided on ammeters on the electrical control board (B01) in the CR. Similar indications are also provided on B01 for the non-class 125 VDC (EllS: El) batteries and battery chargers. Each ammeter is connected to an instrument shunt bar installed in a load carrying conductor for the associated battery or battery charger. The cable which connects an ammeter to its associated shunt bar consists of two 12 gauge copper conductors insulated with Institute of Electrical and Electronics Engineers (IEEE) 383-qualified Cross Linked Polyethylene (XLPE). The cables are routed through the plant to the CR ammeter via cable raceways (EllS: FA) and cable chase paths. The small difference in voltage between the taps on each end of the shunt bar is sufficient to deflect the ammeter in the CR when current flows from the battery or battery charger through the shunt.
3. INITIAL PLANT CONDITIONS:
On October 04, 2013, PVNGS Units 1, 2, and 3 were in Mode 1 (Power Operation), at 100 percent power and normal operating temperature and pressure. There were no structures, systems, or components inoperable that contributed to the event.
4. EVENT DESCRIPTION:
On October 04, 2013, PVNGS completed a review of industry operating experience related to unfused remote DC ammeter circuits that could result in secondary fires due to multiple fire induced faults during a CR fire event. Engineering personnel determined that a similar condition existed at PVNGS which resulted in the plant being in an unanalyzed condition.
Operations personnel were notified of the results from the engineering review. As a compensatory measure, hourly fire watches were established in the affected areas of the plant.
The original plant design and associated analysis for the class lE train B and D battery and battery charger (including the BD backup charger) CR ammeter circuits do not include overcurrent protection features to limit the fault current in the wiring that connects the instrument shunt bars to the CR ammeters.
In the postulated event, a fire in the CR causes one of the ammeter conductors to short to the ground plane. Simultaneously, the CR fire causes another DC conductor from the opposite polarity on the same battery or battery charger to also short to the ground plane.
The two short circuit faults result in a ground loop through the unprotected ammeter wiring which then results in excessive current flow and heating in the ammeter wiring to the point of causing a secondary fire in the cable raceways. The secondary fire could adversely affect the availability of credited train B safe shutdown equipment and potentially cause a loss of the ability to conduct a safe shutdown from the RSPB as required by 10 CFR 50 Appendix R, Section III.G.
The corrective action program evaluation of the extent of condition concluded that, in addition to the train B and D batteries and battery chargers, the train A and C class lE 125 VDC batteries and battery chargers and the non-class 125 VDC batteries and battery chargers with remote ammeters on B01 in the CR are affected. These additional components are not credited in the PVNGS Appendix R CR fire analysis and, therefore, do not result in an unanalyzed condition.
5. ASSESSMENT OF SAFETY CONSEQUENCES:
There were no actual safety consequences of this condition. This is a postulated event and as such did not result in challenges to fission product barriers, control of radioactive materials, or the health and safety of the public.
A review of industry operating experience indicates that CR cabinet fires are expected to be low energy fires with damage localized to the ignition source. Similarly, at PVNGS, control cabinet fires are expected to be low energy, short duration fires with minimal impact beyond the immediate location of the ignition source.
The materials used in CR cabinets are of low flame spread type and tend to self-extinguish when the ignition source is removed. Nuclear plant fire data has shown that control cabinet fires are among the lowest in occurrence and in duration. Fires in control cabinets are generally oxygen limited when the doors are closed. The PVNGS fire protection program provides administrative controls for limiting the amount and type of combustible material (fixed and transient) within the CR space and the CR design includes fire detection and fire alarm systems and manual fire suppression capability. In addition, early detection and mitigation of a CR fire is expected because the CR is continually manned by operators trained in fire response.
To initiate the postulated secondary fire during a CR fire event, the fire-induced faults (in the CR) of the affected ammeter circuits would require either a conductor to conductor short or two conductors to short to the ground plane involving a specific combination of a battery ammeter circuit with its associated battery charger ammeter circuit. Based on review of cable routing of the potentially affected circuits, failures from these types of shorts and fires would generally be limited to a single train. Additionally, the ammeter circuits of the class batteries and associated battery chargers were confirmed to be XLPE thermoset type insulating material, which would require a fire of sufficient intensity and/or duration to cause a breakdown of the insulating material.
The factors discussed above support a conclusion that the combination of a significant CR fire event and the specific wiring faults required to produce a secondary fire which affects the availability of equipment required for safe shutdown is a very low probability event.
For the given CR fire event, the Operations staff would enter the CR fire AOP, 40A0-9ZZ19, in which the CR staff trips the reactor and relocates to the RSPs. If equipment specified in the CR fire AOP does not function due to secondary fire effects, the CR fire AOP includes guidance to operate the atmospheric dump valves locally and to start the motor driven auxiliary feedwater pump B with local controls at the circuit breaker on the switchgear located adjacent to the RSPs.
If the CR fire AOP guidance is not sufficient, additional contingency actions exist to address potentially lost instrumentation and safe shutdown systems. The contingency actions are contained in emergency operating procedures, and related mitigation guidance, to control RCS temperature to maintain the plant in a safe shutdown condition. These contingency actions operate the train A turbine driven auxiliary feedwater pump manually from the pump room and locally monitor steam generator water levels using instruments staged for these contingencies. Such contingencies would be implemented in concert with the Emergency Response Organization, which is required to be activated upon evacuation of the CR in response to the CR fire. The procedure contingencies provide additional confidence that the safety functions would be maintained for the postulated CR fire event.
The design deficiency did not impact the performance of any other component functions and no other safety functions were impacted as a result of this event. The condition would not have prevented the fulfillment of a safety function; and, the condition did not result in a safety system functional failure as defined by 10 CFR 50.73(a)(2)(v).
6. CAUSE OF THE EVENT:
The cause was determined to be that the original design of the DC ammeter circuits did not adequately address fire protection program requirements.
A contributing cause was the applicable Institute of Electrical and Electronics Engineers (IEEE) standards do not specify protection for shunt fed ammeter circuits.
7. CORRECTIVE ACTIONS:
As an interim action, hourly fire watches were established in affected fire zones. Fire watches provide additional defense in depth for the fire protection program and suppport early detection of a fire at the incipient stage.
A design change is planned to correct the latent design deficiencies by providing circuit protection on affected CR ammeter circuits.
8. PREVIOUS SIMILAR EVENTS:
No similar conditions have been reported by PVNGS in the past three years.