05000261/LER-2016-003
| H. B. Robinson Steam Electric Plant, Unit No. 2 | |
| Event date: | 08-11-2016 |
|---|---|
| Report date: | 10-10-2016 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(ii) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor |
| Initial Reporting | |
| ENS 52174 | 10 CFR 50.72(b)(3)(ii)(B), Unanalyzed Condition |
| 2612016003R00 - NRC Website | |
Reported lessons learned are incorporated into the licensing process and fed back to industry.
Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (1-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Infocollects.Resource@nrcgov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
H. B. Robinson Steam Electric Plant, Unit No. 2 SEQUENTIAL REV
BACKGROUND
The Tainter Gates [GATE] serve a dual nuclear safety function. Their Updated Final Safety Analysis Report (UFSAR) credited safety function as identified in UFSAR Sections, 2.4.1.1, 2.4.4.2, 3.1.2.2, 3.4, 18.1, is to integrate General Design Criterion 2 (GDC-2) into the design basis to mitigate the Probable Maximum Precipitation Design Basis Event (PMP DBE). Their Technical Specification (TS) safety function, as implicitly identified in TS 3.7.8, is to passively support operability of the Ultimate Heat Sink (UHS) [BS] by maintaining integrity of the segment of the UHS boundary they form. During the existence of the degraded condition, in entirety, the ability to maintain the gates in a fully closed configuration was not adversely impacted. The fully closed configuration for the gates represent the bounding fail-safe position for the gates, which maintained the UHS operable throughout this time period. In particular, Technical Specification (TS) 3.7.8, Ultimate Heat Sink, requires lake water temperature control and maintenance of UHS operability.
TS 3.7.8, states the UHS shall be operable in modes 1, 2, 3, and 4. The conditions for operability as specified in the bases for TS 3.7.8, is as follows:
The UHS is required to be OPERABLE and is considered OPERABLE, if it contains a sufficient volume of water at or below the maximum temperature that would allow the Service Water [BI] to operate for at least 22 days following the design basis Loss of Coolant Accident (LOCA) without the loss of Net Positive Suction Head (NPSH), and without exceeding the maximum design temperature of the equipment served by the SWS. To meet this condition, the UHS temperature should not exceed 97 degree F and the level should not fall below 218 ft Mean Sea Level (MSL) during normal unit operation. In the normally closed position, the Tainter Gates do not have NOR did they have any impact on the ability of the UHS to maintain either technical specification requirements.
They do not have any impact on Service Water temperature and as long as the Tainter Gates are closed, head flow controls lake level.
The Tainter Gates are designed to allow lake water to flow over the top of the Gates at elevation 220.0 feet. Therefore, the inability to fully open the Tainter Gates did not result in adverse impact on TS 3.7.8 or any other TS Structures, Systems, and Components (SSCs).
As it was stated earlier, prevention of flood intrusion on plant grade is achieved through lake level control that is predominantly performed by two electrically-operated Tainter Gates under normal operation. Peak flows at Lake Robinson will be controlled by opening the Tainter Gates. Auxiliary power from a bottled gas engine located on the spillway structure is available to operate the Gates in the event of a power failure. Operation of the Tainter Gates in this manner is standard at hydroelectric installations. During high flow conditions the lake level would not exceed 222 ft. Grade elevation of the plant site is at 225 ft.
The UFSAR Section 3.4, states "flooding is a physical impossibility at this site since the maximum cooling lake level which can be maintained by the drain and appurtenant structures is below plant grade." Subsequent to the discovery of the degraded condition, a preliminary deterministic evaluation was performed that determined the ability to shut down the reactor, maintain safe shutdown, remove residual heat, control the release of radioactive material are not adversely impacted, and credibility of occurrences of UFSAR postulated accidents are precluded. However, the evaluation concluded, site flooding, induced by a PMP DBE, may be credible due to the degraded condition of the Gates. As flooding on plant grade becomes credible, the degradation of plant safety as described in 50.73(a)(2)(ii)(B) could be possible. On August 11, 2016, at 1841 hours0.0213 days <br />0.511 hours <br />0.00304 weeks <br />7.005005e-4 months <br /> EDT, ENS #52174 was made to the NRC under 10 CFR 50.72 (b)(3)(ii)(B), to report this event as an event or condition that placed RNP in an unanalyzed condition that significantly degrades plant safety.
EVENT DESCRIPTION
At the time this condition was identified, RNP Unit 2 was operating in Mode 1 at approximately 100 percent power. No structures, systems or components were out of service at the time of this event that contributed to this event.
On 6/6/2016 the license renewal required full travel functionality test of the "B" Tainter Gate was not completed due to lift gate chain binding. The full travel functionality test was stopped after the chain was inspected and binding was noted that could cause damage to the chain, structural steel components, or mechanical equipment. The test required the Tainter Gates be raised full open. The functional test was stopped after raising the gate approximately 3 feet. Several chain links were bound solid forming a column that jammed between the spur gear drive and the Tainter Gate structural steel track channel. The column prevented further raising of the gate. The chains were refurbished by cleaning the interface between the links and the pins and heavily lubricating the pins prior to reassembly.
On 7/7/2016 the license renewal required full travel functionality test of the "A" Tainter Gate was not completed due to lift gate chain binding. The full travel functionality test was stopped after the chain was inspected and binding was noted that could cause damage to the chain, structural steel components, or mechanical equipment. The test required the Tainter Gates be raised full open, approximately 29 feet. The gate was raised approximately 5.5 feet before encountering binding. The chain was exercised 2-3 times up and down and then 7 feet open was achieved before binding again. Manual agitation from the pier allowed the chain to open 8 feet with margin estimated at a foot additional (9 feet max). The functional test was stopped due to excessive binding. The links were not laying in the chain track and binding was occurring between the pier platform structural steel and the chain.
The 29 ft Gate opening for each Gate is required in order to protect the UFSAR section 3.4, conclusion that flooding at the Robinson site will not occur since the plant grade is above the maximum lake level maintained by the drain and appurtenant structures. The plant entered an unanalyzed condition due to the impact of not being able to release the design basis flood volume of 39000 cfs with the Tainter Gates.
The regulatory impact to the station as a consequence of this circumstance necessitates a 60-day Licensee Event Report (LER) to the Nuclear Regulatory Commission (NRC), under 10 CFR 50.73(a)(2)(v)(A) and 10 CFR 50.73(a)(2)(v)(D), "Prevention of Fulfillment of Safety Function," and 10 CF CFR 50.73(a)(2)(ii)(B), "Degraded or Unanalyzed Condition.
It is noted, the Tainter Gates are non-safety related. Thel0 CFR 50.73, reportability criteria stated above, are met for the Emergency Diesel Generators (EDGs) [DG]. In particular, nonconformance with GDC-2, gives rise to the credibility of flood intrusion onto the EDGs (UFSAR Section 3.1.2.2) and an adverse impact to their UFSAR credited safety function. The Loss of Offsite Power (LOOP) may be credible in conjunction with the occurrence of the PMP DBE and the cascading effect of the flooding scenario, where the EDGs may not be able to perform their intended UFSAR credited safety function when called upon.
CAUSAL FACTORS
RNP has conducted an in-depth evaluation of the degraded condition of the Gates and performed a Root Cause, which has concluded the following. Due to the presence of corrosion products buildup, during the performance of the test, the lift gate chains experienced excessive binding, which resulted in prevention of full travel. This condition was corrected by refurbishing the chains and lubricating the pins and links with an environmentally acceptable lubricant that adheres to metal surfaces even in underwater conditions. Full travel tests were then completed satisfactorily on 6/28/16 (Tainter Gate West) and 7/19/16 (Tainter Gate East).
The 2007 - 2008 refurbishment that did not properly lubricate the chains was performed when Unit 1 (Coal Steam Plant) had Operational and Design control for the spillway equipment. The Vendor Manual that specified the lubrication requirements was not a controlled document in the Unit 2 (RNP Nuclear Plant) configuration management system. As a result, the lubrication requirements for the chains were not included in the Purchase Order details for chain replacement/refurbishment. Therefore, the chains were assembled with no lubrication applied. Because the nuclear risks (design basis flooding) associated with the spillway/dam/Tainter Gates was not understood by RNP, the proper rigor and oversight of this decision was not implemented.
The Organizational and Programmatic (O&P) Analysis confirms RNP did not place the proper focus on this equipment and the remaining Unit I components. This lack of focus is attributed to an inadequate understanding of the nuclear and environmental risk.
The Unit 1 Systems Project Charter Extent of Cause Corrective Action (EOCa-CAI) will implement engineering changes that will incorporate the applicable programmatic requirements and oversight. The referenced Charter will include Probabilistic Safety Analysis (PSA) calculations, Maintenance Rule Scope revisions, Equipment Reliability evaluations, etc., as applicable, to ensure the risk is understood, communicated and managed for the site.
Root Cause — Robinson Nuclear Plant (Engineering, Operations and Management) did not recognize the nuclear safety risks associated with the spillway/dam and associated components as it relates to flooding; therefore the design documentation and the equipment was not maintained commensurate with its safety significance.
CORRECTIVE ACTIONS
Corrective actions taken to restore compliance with regulations are listed below.
Immediate:
1. Entered event into Corrective Action Program Completed:
1. Failure Analysis of the Tainter Gates Chain Binding 2. Completed refurbishment of the chains and lubrication of the pins and links with an environmentally acceptable lubricant that adheres to metal surfaces even in underwater conditions.
Corrective Actions to Prevent Recurrence (CAPRs) to address the Root Cause:
RC I-CA1 (CORR): Create an interim PSA Calculation and Risk Model and provide necessary information to support the development of Risk Mitigation Strategies associated with Tainter operation and maintenance.
RC1-CA2 (CORR): Complete an EC product that includes the Quality Classification evaluation, Maintenance Rule Scope evaluation and possible upgrade to the Equipment Reliability Classification of the Tainter Gates and associated components as applicable.
RC1-CA3 (CAPR): Complete Engineering Change (EC) to transfer the Tainter Gate and associated spillway/dam equipment to Robinson Nuclear Plant configuration management. EC to incorporate all available design and vendor information, drawings, parts information, PSA information and risk model, Impacted Procedures, Maintenance Rule Scope changes, Facility Change Request applicability,Technical Requirements Manual or Technical Specification applicability, and updates to Equipment Reliability Classifications, at a minimum.
SAFETY ANALYSIS
The degraded condition of the Gates and the resulting non-conformance with GDC-2, gives rise to the credibility of flood intrusion onto the EDGs (UFSAR Section 3.1.2.2) and an adverse impact to their UFSAR credited safety function. The Loss of Offsite Power (LOOP) may be credible in conjunction with the occurrence of the PMP DBE and the cascading effect of the flooding scenario, where the EDGs may not be able to perform their intended UFSAR credited safety function when called upon.
The stated degraded condition negates the validity of the conclusion of UFSAR Section 3.4, which states intrusion of PMP induced PMF on RNP Plant grade remains incredible throughout the PMP DBE. As it was stated earlier, the Tainter Gates are non-safety related and their TS function is not adversely impacted by the degraded condition. However, the cascading effect of the PMP DBE induced flooding results in Safety System Functional Failure (SSFF) and loss of safety function for the EDGs.
ADDITIONAL INFORMATION
An Operating Experience (OE) search was made of the Robinson Corrective Action Database for a period of five years from 1/1/2011 to 8/8/2016 on the following keywords:
1) Tainter 2) Spillway 3) Lake Robinson Each set of data was reviewed for condition reports that could have provided lessons learned or insights to the Tainter Gate failures.
Four instances were observed that were either directly or indirectly initiated as a result of the Fukushima Near Term Task Force (NTTF) 2.3 Flooding walkdowns and validations. All four identified operational deficiencies and challenges associated with the spillway equipment including the Tainter Gates. These condition reports were addressing the flood control function of the Tainter Gates, yet the vulnerabilities to plant Risk should the gates fail to open was never formally identified, analyzed or evaluated. These were missed opportunities.
External/Industry A review of Industry Safety Evaluation Reports (SERs) and INPO Evaluation Reports (IERs) was performed for topics related to subject of this RCE. An OE dam failure review was performed for a sixteen year span from 2000 to 2016. No OE reviewed had the same circumstances as the condition being evaluated, where Tainter Gate failure would result in flooding of the affected plant. OE reviewed did include opportunities that should have prompted the site to review the design basis features for flooding, maintenance rule classification, risk impact to the plant, and potential regulatory implications.
Conclusion - OE Summary No OE from the nuclear industry reviewed would have prevented the condition from occurring. One OE document from 2002, detailing Tainter Gate lubrication would have been beneficial and possibly prevented the failure however, documents from the Army Corps of Engineers are not part of the normal review when searching for applicable Operating Experience for the nuclear industry.
This was not a repeat occurrence. This was the first documented occurrence at Robinson of the Tainter Gates not fully opening or not opening to a desired height due to chain binding. It should be noted that this most recent full open functional test is only the second time in plant history that the Tainter Gates have been documented as being tested to the full open position.
ADDITIONAL INFORMATION (Continued) Missed OE Opportunities to Prevent the Event There were no missed opportunities identified that would have prevented the actual event. In summary, there were numerous OE items that were related to external flooding and flood protection barriers. The OE items that were reviewed focused on the specific items relative to how plants mitigate external flooding, specifically looking at flood barriers such as watertight doors, valve vaults, etc.
None of the OE items focused on downstream Dam Spillway Components, Gates or Valves. The issue associated with this Root Cause Evaluation is centered around the RNP Tainter Gates and how they are credited for maintaining lake level and preventing site flooding during rain events. Therefore, since the OE items that were available did not specifically look at Tainter Gate (Radial Gate) failures then it has been determined that the event was not OE preventable.
The Tainter Gates have been repaired, tested and rendered compliant with their original licensing basis function. Prior to repair of the Tainter Gate chains, the plant was in an unanalyzed condition as the Gates did not open enough to allow passage of the discharge flow for the flood induced by the Probable Maximum Precipitation (PMP) Design Basis Event (DBE). No actual PMP DBE occurred during the entirety of the existence of the degraded condition of the Gates. Therefore, for the stated time-frame, given the degraded condition of the Gates, this LER only considers the potential challenge to RNP, where a PMP DBE might have occurred.
Energy Industry Identification System (EIIS) codes for systems and components relevant to this event are identified in the text of this document within brackets [ ]. It is noted, the Tainter Gates are unique and were custom designed by Ebasco, the original firm that constructed the Plant. Hence, the Energy Industry Identification System (EIIS) codes for systems and components are only relevant to a subset of the systems and components described in this document.