05000346/LER-2015-003
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident |
| Initial Reporting | |
| ENS 51185 | 10 CFR 50.72(b)(3)(v)(B), Loss of Safety Function - Remove Residual Heat |
| 3462015003R00 - NRC Website | |
The Service Water (SW) System [BI] provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. During normal operation and normal shutdown, the SW System also provides this function for various safety related and non-safety related components. The pumps and valves in the SW System are remote manually aligned, except in the unlikely event of a loss of coolant accident (LOCA). The pumps are automatically started upon receipt of a Safety Features Actuation [JE] signal, and all essential valves are aligned to their post accident positions and valves to the non-essential loads are isolated. The SW System provides cooling to the Control Room Emergency Ventilation System (CREVS) [VI], Emergency Core Cooling System (ECCS) [BN] pump room coolers, Containment Air Coolers (CAC) [BK], and Component Cooling Water (CCW) [CC] System heat exchangers. The SW System provides a safety-related backup source of water to the Auxiliary Feedwater (AFW) System [BA] and the Motor Driven Feedwater Pump (MDFP) [SK]. The principal safety-related function of the SW System is the removal of decay heat from the reactor via the Component Cooling Water (CCW) System.
The Control Room Emergency Air Temperature Control System (CREATCS) [VI] provides safety- related temperature control for the Control Room following isolation of the Control Room. The CREATCS consists of two independent and redundant trains that provide cooling of recirculated Control Room air. A cooling coil with a water cooled condensing unit is provided for each train to provide suitable temperature conditions in the Control Room for operating personnel and safety related control equipment. An air cooled condensing unit is provided as a backup to the water cooled condensing unit. The CREATCS is an emergency system. On a Safety Features Actuation System (SEAS) [JE] signal or a high radiation signal from one of the Station Vent Normal Range Radiation Monitors, the Control Room normal ventilation system is automatically shut down, and the CREVS can be manually started. Operation of the CREVS is required for CREATCS to be in operation. A single train will provide the required temperature control. During emergency operation, the CREATCS performs a safety function of maintaining continuous habitability of the Control Room for 30 days following an accident to support the CREVS isolation function by maintaining the Control Room temperature less than or equal to 110 degrees Fahrenheit.
Technical Specifications:
Technical Specification (TS) Limiting Condition for Operation (LCO) 3.7.8 requires two SW trains to be operable to provide the required redundancy to ensure that the system functions to remove post accident heat loads, assuming the worst case single active failure occurs coincident with the loss of offsite power. In Modes 1, 2, 3 and 4, the SW System is a normally operating system that is required to support the operability of the equipment serviced by the SW System and required to be operable in these modes. TS LCO 3.7.8 Condition A requires with one SW Train inoperable, the train must be restored to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, and in Mode 1 the applicable conditions and required actions of LCO 3.8.1 be entered for the Emergency Diesel Generator made inoperable by the SW System.
Technical Specifications (continued):
TS LCO 3.7.11 requires two independent and redundant trains of the CREATCS be operable to ensure that at least one is available, assuming a single failure disables the other train. Total system failure could result in the equipment operating temperature exceeding limits in the event of an accident. In Modes 1, 2, 3 and 4, the CREATCS must be operable to ensure that the Control Room temperature will not exceed equipment operability requirements following isolation of the Control Room. TS LCO 3.7.11 Condition A requires with one train of CREATCS inoperable, action to be taken to restore the inoperable CREATCS trains to operable status within 30 days. No TS action is specified for having both CREATCS Trains inoperable. Therefore, T.S. 3.0.3 is applicable.
DESCRIPTION OF EVENT:
On June 26, 2015, with the Davis-Besse Nuclear Power Station operating in Mode 1 at approximately 100 percent full power, the breaker, BF1277, for motor-operated valve SW1 395, which isolates non-essential Service Water (SW) System loads during accident conditions, was found in the open position. Based on this information, Train 2 of SW was declared inoperable.
Auxiliary Feedwater Train 1 was inoperable at the time of discovery due to scheduled surveillance testing. With AFW Train 2 declared inoperable as a result of the mispositioning of SWI1395, TS LCO 3.7.5 Condition 0 was entered for two Emergency Feedwater Trains inoperable. The Nuclear Regulatory Commission (NRC) was notified via Event Notification 51185 of the loss of Safety Function for the Emergency Feedwater System per 10 CFR 50.72(b)(3)(v)(B) due to both trains of AFW being declared inoperable. AFW Train 1 and the non-safety related motor-driven AFW pump were available to provide emergency feed water if required. The breaker for SW1 395 was reclosed by 0133 hours0.00154 days <br />0.0369 hours <br />2.199074e-4 weeks <br />5.06065e-5 months <br /> on June 27, 2015, restoring the safety function of SW Train 2. Subsequently, a Past Operability evaluation was performed, which indicated that the AFW Train 2 remained operable and capable of performing its required safety function.
Control Room Emergency Air Temperature Control System (CREATCS) Train 1 had been out of service earlier in the day for maintenance during the time SW Train 2 was determined to have been inoperable based on when breaker BF1277 (for SW1 395) was bumped. An additional Past Operability evaluation was performed of the SW System and it determined that SW System Train 2 was not able to provide sufficient pressure and flow for the CREATCS to operate in the water-cooled mode. Therefore, rendering both CREATCS trains inoperable. The remaining SW loads were determined to have remained capable of maintaining their design function as a result of the event.
CAUSE OF EVENT:
The direct cause of SW1 395 being de-energized in the open position rendering SW Train 2 inoperable was breaker BF1277 was most likely bumped by personnel working or traversing through the SW Pump room. Work to replace SW Pump 1 motor was ongoing during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> window prior to discovering the open breaker.
The root cause of breaker BF1277 being inadvertently bumped is that station management did not fully recognize the risk of not protecting the breaker from being mispositioned. The fleet has a component control program that utilizes a graded approach for establishing a bumping prevention / mitigation plan, which considers the probability of a bumping incident in addition to the immediate consequences of a change in position. The criteria for considering installation of breaker covers only included (at the time BF1277 was evaluated) consideration of the immediate consequences of the mispositioning.
Previous evaluations recommended installation of breaker bump covers for Priority 2 Motor Control Centers (MCCs) which would have included breaker BF1277, but the covers were not installed due to being perceived as low priority work. As a result, the plant status control and clearance review committee elected not to prioritize and champion prior corrective actions to install breaker covers on Priority 2 MCCs.
ANALYSIS OF EVENT:
The SW System supports operation of the following safety-related systems: Emergency Core Cooling System (ECCS), Containment Spray and Cooling System, Emergency Feedwater System, Component Cooling Water (CCW), the Emergency Diesel Generators as part of the AC Electrical Power Distribution System, and the CREATCS.
A Past Operability Evaluation was performed with motor-operated valve SW1 395 open and de- energized, to determine if there would have been adequate SW flow and pressure to support Auxiliary Feedwater (AFW) Pump 2 operation, if required. This evaluation, based on actual conditions present during the approximately 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> the valve breaker may have been open, included evaluation of SW Pump 2 available net positive suction head (NPSH), available SW Train 2 supply pressure to ensure sufficient flow from AFW Pump 2, and sufficient SW Train 2 supply pressure to preclude activation of AFW Pump 2 low suction pressure interlocks. It was concluded that SW Train 2 remained capable of providing a sufficient safety-related source of water to AFW.
Pump 2, so AFW Train 2 remained operable and capable of performing its required safety function.
CREATCS Train 1 was declared inoperable for planned maintenance activities from June 22, 2015 at 0400 hours0.00463 days <br />0.111 hours <br />6.613757e-4 weeks <br />1.522e-4 months <br /> to June 26, 2015 at 1653 hours0.0191 days <br />0.459 hours <br />0.00273 weeks <br />6.289665e-4 months <br />. With the assumption that breaker BF1277 could have inadvertently bumped and positioned open as early as 0800 hours0.00926 days <br />0.222 hours <br />0.00132 weeks <br />3.044e-4 months <br /> on June 26, 2015 with the commencement of daily work on SW Pump 1, 8.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> of CREATCS Train 1 inoperability overlapped the time period valve SW1 395 was assumed to be de-energized in the open position.
Both the water-cooled and air-cooled condensing units must be Operable for the CREATCS to be Operable. Evaluation of the SW System determined that the SW System was not able to provide sufficient pressure and flow for the water-cooled condensing unit of CREATCS to operate in the water-cooled mode. Therefore, it is postulated both trains of CREATCS were inoperable for 8.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />.
There is no increase in Core Damage Frequency (CDF) or Large Early Release Frequency (LERF) due to both CREATCS trains being operable simultaneously, therefore, this event had a very low safety significance.
Reportability Discussion:
As described above, a Past Operability Evaluation concluded that SW Train 2 remained capable of providing a sufficient safety-related source of water to AFW Pump 2, so AFW Train 2 remained operable and capable of performing its required safety function. Therefore, while AFW Pump 1 was out of service for testing during the time breaker BF1277 was open, this issue did not represent a loss of safety function of AFW per 10 CFR 50.72(b)(3)(v)(B).
entered. In accordance with TS LCO 3.0.3, action shall be initiated within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to place the unit in Mode 3 within 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />. With the assumed mispositioning of breaker BF1277 on June 26, 2015 at 0800 hours0.00926 days <br />0.222 hours <br />0.00132 weeks <br />3.044e-4 months <br />, both CREATCS trains were inoperable for more than 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> with the plant remaining in Mode 1. Therefore, the plant operated in a condition that was prohibited by the TS, which is reportable per 10 CFR 50.73(a)(2)(i)(B). Additionally, since both trains of CREATCS were inoperable and incapable of performing all required safety functions to mitigate the consequences of an accident, this issue represents a loss of safety function for the CREATCS, which is reportable per 10 CFR 50.73(a)(2)(v)(D). No immediate reporting of this loss of safety function is required per 10 CFR 50.72(b)(3)(v)(D) because at the time of discovery that breaker BF1277 was open, CREATCS Train 1 had been restored to operable status.
CORRECTIVE ACTIONS:
Breaker covers will be installed on the safety related MCCs located in the SW Pump Room.
The previously completed susceptibility evaluation for plant MCCs from the self-assessment will be reviewed to ensure results are consistent with guidance in First Energy Nuclear Operating Company (FENOC) Business Practice, NOBP-OP-10 14, Component Control Program.
NOBP-OP-1 014 provides strategies to mitigate inadvertent bumping or mispositioning of components. This business practice states that covers or locks should be considered if mispositioning by bumping would result in a Level 1 (Severe - an unintentional or unexpected component manipulation that results in a significant transient or challenge to personnel, nuclear, radiological or environmental safety) or 2 (Major - an unintentional or unexpected component manipulation that results in impact to operation of the plant or reportability to regulatory agencies below the threshold of a Level 1 event) Plant Status Control Event, which implies that these controls may not be considered for other bump sensitive breakers. To drive a lower tolerance for risk, the business practice will be revised to clarify that the potential misposition level is not the limiting factor for determining if a cover/lock is warranted.
This event will be presented to the Plant Status Control and Clearance Committee for discussion and lessons learned. This discussion will include the impact of management decision-making and the acceptance of risk on the plant and organization.
PREVIOUS SIMILAR EVENTS:
There have been no Licensee Event Reports (LERs) at the DBNPS in the past three years involving a loss of safety function due to the inadvertent mispositioning of an electrical breaker.