05000341/LER-2005-002
| Telephone Number (Include Area Code) | |
| Event date: | 03-30-2005 |
|---|---|
| Report date: | 05-18-2005 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| Initial Reporting | |
| ENS 41551 | 10 CFR 50.72(b)(3)(ii)(B), Unanalyzed Condition |
| 3412005002R00 - NRC Website | |
Initial Plant Conditions:
Mode 1 Reactor Power 100 percent
Description of the Event
On March 7, 2005, a condition assessment and resolution document was initiated to document several possible design and operating procedure deficiencies affecting 10 CFR 50 Appendix R and Station Blackout (SBO) events.
The deficiencies were identified during development of two proposed modifications affecting the existing 120 kV Switchyard and the new installation of an additional Appendix R and SBO Alternate AC power source [EK]. On March 30, 2005, it was determined that applicable Appendix R success criteria could not be assured under all conditions for the postulated Appendix R Updated Final Safety Analysis (UFSAR) scenarios. Under certain conditions where Combustion Turbine Generator [EK] (CTG) 11-1 (the dedicated Appendix R alternate AC source) or other station CTGs (11-2, 11-3 or 11-4) are operating in parallel with the grid, availability of the dedicated alternate AC source cannot be assured. Actions to address the potentially affected Appendix R scenarios were put in place on March 7, 2005, when the deficiencies were identified. Required immediate notifications were made to the NRC in accordance with 10 CFR 50.72 on March 30, 2005 (EN 41551).
The alternative shutdown system consists of one of four combustion turbine generators (CTGs), the standby feedwater (SBFW) system, a dedicated shutdown control panel [H.] with associated instrumentation, and Division I portions of the following systems: Residual Heat Removal (RHR) [BO], RHR service water (RHRSW) [BI], emergency equipment cooling water (EECW) [CC], emergency equipment service water (EESW) [BI], and drywell cooling [VB]. The dedicated shutdown panel is supplemented by local manual operator actions to achieve hot or cold shutdown.
The four CTGs are oil-fired turbine generators located onsite, remote from Appendix R fire areas of concern.
CTG 11-1 is the dedicated alternate AC source used to provide emergency power when a fire occurs in areas of concern, or on loss of offsite power should the emergency diesel generators (EDGs) [DG] be unavailable (a SBO). The CTGs were originally designed to provide supplementary (peaking unit) power to the Detroit Edison system at times of high system load. The design of CTG 11-1 includes black start capability in the event of a total loss of offsite power. CTG 11-1 is used in combination with the dedicated shutdown panel to meet the Appendix R requirements of achieving and maintaining the plant in safe shutdown condition during an Appendix R fire with attendant loss of offsite power.
The Appendix R scenarios have been reviewed by plant personnel. Design and procedural issues were identified that could preclude achievement of the original design intent during an Appendix R fire with the attendant loss of offsite power. Shortcomings in the existing circuit design and assumptions were identified that could complicate or preclude using CTG 11-1 as the dedicated Appendix R alternate AC source. That is, scenarios were postulated using the dedicated shutdown panel in response to an Appendix R fire that could result in the failure to deliver _■It water to the reactor with the standby feedwater system within the time frame specified in the UFSAR safety analysis or to provide power to safe shutdown loads.
An automatic breaker closure feature was included in the design of an undervoltage trip circuit specifically for use during operations from the dedicated shutdown panel. The automatic breaker closure feature operated after establishing operation from the dedicated shutdown panel, startup of CTG 11-1 is completed, and undervoltage conditions are detected during the loss of offsite power. The automatic breaker closure feature was part of the original design, but was not recognized in the dedicated shutdown panel abnormal operating procedure (20.000.18). This design feature was intended to be an aid in establishing a prompt recovery of power to the safety loads by supplying power automatically to what was presumably a dead bus with only the necessary emergency loads properly aligned. Scenarios were reviewed that included this automatic closure feature, various initial conditions, and postulated multiple hot shorts resulting from the fire. Circuit breaker dc control power stripping instructions and timing in the operating procedure were also considered. Assuming fire damage did not disable an EDG, several scenarios identified a potential to parallel CTG 11-1 asynchronously with an operating EDG from postulated repositioning of multiple circuit breakers. Other scenarios identified a potential to overload CTG 11-1 due to operation of the automatic circuit breaker closure feature used for prompt power recovery before the associated breaker loads had been stripped by the abnormal operating procedure. Either of these conditions could compromise the integrity of CTG 11-1 and its subsequent ability to power the post-fire emergency loads. Elimination of the automatic breaker closure feature resolves the CTG 11-1 overload problem by preventing the automatic connection of CTG 11-1 into loads before they are manually shed by the abnormal operating procedure. However, if the breakers that connect CTG 11-1 and the EDG(s) to Division 1 loads were operated manually before their DC control power was stripped, as instructed by the dedicated shutdown abnormal operating procedure, the breakers could reposition in response to multiple hot shorts and either asynchronously tie the EDG(s) and CTG 11-1 together or add unplanned electrical loads.
Scenarios were also reviewed where one or more of the non-dedicated Appendix R CTGs (Units 2, 3 and 4) are running at the time of the event. If the CTG(s) were running at minimum load, they may not trip on load reject because of non-disconnected house loads. If CTG 11-2, 3 or 4 are in operation and do not trip, operation of CTG 11-1 from the dedicated shutdown panel is inhibited, preventing connection of CTG 11-1 to the emergency loads.
Although this condition would not be serious if the running CTG(s) could be used to power the required emergency loads, it was determined that insufficient procedural guidance exists to ensure that the required loads are properly fed by the operating CTGs or to locally trip the operating CTGs, allowing control of CTG 11-1 from the dedicated shutdown panel. The interim action taken to address these scenarios is to declare CTG 11-1 inoperable for Appendix R purposes whenever any CTG is being operated as a peaking unit in parallel on the grid.
This event is being reported under 50.73(a)(2)(ii)(B), as an event or condition that resulted in the plant being in an unanalyzed condition that significantly degraded plant safety.
Cause of the Event
There was a lack of coordination, dating back to the mid-1980's, between all of the parties involved in implementing the use of CTG 11-1 as the backup power source for Appendix R scenarios involving a loss of offsite power. The electrical relaying design was performed by specialists at electrical system design who were not made aware of all of the nuances associated with meeting Appendix R requirements. The procedure writers were not familiar with all of the design features incorporated into the electrical relaying, consequently procedures and subsequent procedure revisions were written over the years that did not recognize all of the design features.
Organizational and programmatic deficiencies contributed to the lack of coordination and the resultant ineffective design control.
Analysis of the Event
This event involves the ability of CTG 11-1 to provide emergency power to Appendix R loads under circumstances where a postulated Appendix R fire occurs that forces evacuation of the main control room and shutdown of the plant from the dedicated shutdown panel, concurrent with a loss of offsite power and in some cases the right combination of multiple postulated hot shorts occurring at the wrong time. Whereas it is unlikely that such an event would occur over the life of the plant, it is intended that CTG 11-1 be able to supply power to a standby feedwater pump and other safe shutdown loads to safely shut down the plant under such conditions.
The plant design includes provisions that provide a defense-in-depth approach to fire protection. This includes minimizing the susceptibility to fire through the use of fire retardant cables, automatic suppression systems, and limits placed on the amount of transient combustible material allowed in fire zones that could result in a scenario using the alternative shutdown system. The plant is walked down monthly to ensure that combustible material is not allowed to accumulate. Fire detection, fire protection systems, and a trained fire brigade are available to mitigate the consequences of plant fires.
In summary, this event involves postulated scenarios involving potential failures of equipment during an Appendix R fire. For most scenarios, CTG 11-1 would have performed as intended. Additionally, the alternative shutdown design is one of several defense-in-depth measures taken to mitigate the consequences of plant fires.
Therefore, the health and safety of the general public was not adversely affected by this event.
Corrective Actions
A temporary modification has been performed that removes the capability for CTG 11-1 to automatically close into plant loads after CTG 11-1 is started following evacuation of the main control room under appendix R conditions.
Procedure changes have been made to declare CM 11-1 inoperable for Appendix R any time any CTG is operating and synchronized to the grid. This is an interim measure.
This event has been documented in the Fermi 2 corrective action program, CARD 05-21500. Permanent equipment and procedural changes to address the problems identified are being considered and evaluated under this CARD. Interim measures and temporary modifications discussed above will likely be replaced by permanent modifications and procedure changes. Any further corrective actions identified as a result of these evaluations will be tracked and implemented by the corrective action program.
Additional Information
A. Failed Components: None B. Previous LERs on Similar Problems:
result of the regional electric grid disturbance that affected several eastern and central states and portions of Canada and that led to blackout conditions in a large portion of the United States. Combustion Turbine Generator (CTG) 11-1 did not initially start in response to this event. The causes of the CTG 11-1 failure to start were an improper trip setpoint for the battery powered inverter and a failure to start the DC fuel oil pump due to a starter contact sticking open against its arcing horn. The improper inverter setpoint occurred because the inverter was not properly integrated into the overall system design during a 1996 modification / refurbishment. CTG 11-1 related corrective actions focused on entering the proper inverter setpoint into the design database, periodically testing the low voltage trip setpoint, maintenance to the sticking contactor, and the performance of periodic black start tests on CTG 11-1.