05000346/LER-2016-006

LER-2016-006, Potential to Trip Emergency Diesel Generator on High Crankcase Pressure

Davis-Besse Nuclear Power Station, Unit 1
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition
Initial Reporting
ENS 52010	10 CFR 50.72(b)(3)(ii)(B), Unanalyzed Condition
3462016006R00 - NRC Website

LER 16-006-00 for Davis-Besse Nuclear Power Station Unit 1 RE: Potential to Trip Emergency Diesel Generator on High Crankcase Pressure

ML16230A488
Person / Time
Site:	Davis Besse
Issue date:	08/15/2016
From:	Boles B D FirstEnergy Nuclear Operating Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
L-16-222 LER 16-006-00
Download: ML16230A488 (6)

Energy Industry Identification System (EIIS) codes are identified in the text as [XX].

DESCRIPTION OF OCCURRENCE:

System Description:

The on-site electric power system [EB] standby power at the Davis-Besse Nuclear Power Station (DBNPS) is provided by two separate and redundant Emergency Diesel Generators (EDG) [EK-DG] each connected to its respective 4160 Volt Essential Bus [EB-BU]. Each EDG is designed to start and reach stabilized voltage and frequency within ten seconds after receiving the starting signal. Upon receiving an emergency start signal from Safety Feature Actuation Signal (SFAS) [JE] or on a loss of essential bus voltage, the EDG is automatically isolated and loaded according to a predetermined sequence. All safety loads are assumed to be loaded within 35 seconds including the 10-second starting interval.

Each diesel engine is a General Motors, Bruce, 2-cycle, 20-cylinder, turbocharged diesel. Each engine drives a generator, which is nominally rated for 2600 kilowatts continuous electric service.

Each EDG is equipped with mechanical and electrical interlocks to ensure personnel protection and to prevent or limit equipment damage. During a non-emergency diesel generator operation (for example, on- line testing) each of the EDGs is provided with mechanical and electrical protective devices capable of initiating an EDG trip. However, during an emergency operation, namely on a loss of essential bus voltage or an SFAS Level 2, controls limit the EDG trip to generator differential relay action and engine overspeed.

This measure is taken to minimize the possibility of the protective devices needlessly preventing the EDG from operating when required, as during a Design Basis Accident. However, alarms are still provided for high crankcase pressure, low lube oil pressure, high engine temperature, and electrical protective relays.

Mechanical protection is provided for the EDG engine by monitoring crankcase pressure to protect the engine from damage. If crankcase pressure increases above the setpoint of 1 inch of water gauge (WG) (with a range of 0.8 to 3 inches WG), the engine will trip and a local alarm will be actuated. The trip function is bypassed by an EDG emergency start signal. The EDG High Crankcase Pressure Switches [PS] are pressure-sensitive devices used to determine abnormal condition of the crankcase. A negative pressure is normally maintained in the crankcase with the engine running. When the EDG is in standby, the crankcase directly communicates with the EDG exhaust and the crankcase pressure would be similar to atmospheric pressure outside of the EDG Rooms in the Auxiliary Building. Therefore, if the pressure of the EDG rooms would be 0.8 inches WG less than the pressure in the crankcase, the EDG High Crankcase Pressure Switches could trip.

Each EDG is provided with storage tanks having a fuel oil capacity sufficient to operate that diesel for a period of 7 days following a Loss of Offsite Power. This onsite fuel oil capacity is based on the fact that 7 days is sufficient time to replenish the onsite tank inventory from outside sources. Additionally, one non- class 1 E diesel generator can be aligned to power either 4160 Volt essential bus in the event of a station blackout.

Technical Specifications:

DBNPS Technical Specification (TS) Limiting Condition for Operation (LCO) 3.8.1.b requires two separate and independent EDGs to be Operable while the plant is operating in Modes 1, 2, 3, and 4. With one EDG inoperable, the Operability of the remaining A.C. sources must be demonstrated by performing Surveillance Requirement 3.8.1.1 (verification of correct breaker alignments and indicated power availability) within one hour and at least once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter and by performing Surveillance Requirement 3.8.1.2 (verification that the Operable EDG starts and accelerates up to 900 rpm) within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Two EDGs must be restored to Operable status within 7 days or the plant must be in Hot Standby (Mode 3) within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in Cold Shutdown (Mode 5) completed within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. With two EDGs inoperable, the Operability of one EDG must be restored within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or the plant must be in Hot Standby (Mode 3) within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in Cold Shutdown (Mode 5) completed within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

DESCRIPTION OF EVENT:

An industry operating experience report in June 2016 identified the potential for differential pressure changes caused by a tornado to actuate the plant's EDG High Crankcase Pressure switches during normal, stand-by mode, locking-out the EDGs prior to receiving an emergency mode start signal.

Review of the DBNPS Auxiliary Building Tornado Depressurization calculation on June 16, 2016, determined the specific scenario had not been previously considered, and the calculated pressure differences between the EDG rooms and outside atmosphere caused by a design basis tornado could exceed the EDG High Crankcase Pressure Switch setting of 1 inch WG (nominal), creating the same situation at the DBNPS.

The scenario assumes a tornado lowers atmospheric pressure in both EDG rooms, and the pressure inside the engines remains slightly higher, such that the high crankcase pressure switches trip. Although the crankcase pressure trips are bypassed on an emergency start of the engines, the scenario assumes the trips happen before the EDGs are required to start fora Loss of Offsite power (or other bus undervoltage condition). The DBNPS review of the operating experience concluded this scenario could possibly cause the differential pressure necessary to trip the crankcase pressure switches on the DBNPS EDGs. A trip of the crankcase pressure switches, while in standby, causes actuation of the shutdown relays, which in turn causes engine lockouts, keeping the EDGs from being able to start during an emergency condition.

CAUSE OF EVENT

The original design of the EDGs' protective devices did not anticipate the interaction between the High Crankcase Pressure switch and atmospheric pressure outside of the EDG Rooms of the Auxiliary Building during a tornado event. Additionally, there were no means to bypass or delay a trip signal in normal, stand- by mode which contributed to the susceptibility of the High Crankcase Pressure switch to possibly actuate during a tornado event.

Neither the DBNPS nor, others in the nuclear industry recognized that differential pressures due to a tornado could actuate an EDG High Crankcase Pressure Switch until this recent industry operating experience discovery.

ANALYSIS OF EVENT:

This issue is considered to have at most a substantial safety significance. The delta Core Damage Frequency (CDF) of 3.42E-05, when calculated and using the most conservative assumptions is within the substantial safety significance range of significance. However, the conservative assumptions include any tornados striking the site would lockout the DBNPS EDGs because of this condition.

The conservative nature of this assumption is evidenced by the fact that the tornado which did strike the facility in June 1998 did not result in an EDG lockout. As a result, sensitivity studies using less conservative probabilities that a tornado would travel the specific path needed to lockout the EDGs were performed. These studies show that the delta CDF could be as low as 5.8E-07, which is within the very low safety significance range. Also, credit was not taken for operator actions to reset the EDGs. If an operator action with a 1 percent failure rate is taken into consideration, the delta CDF would be 5.8E-07, which is within the very low safety significance range. Combining both operator action credit (1 percent failure rate) with less conservative tornado pathing (1 percent chance to cause the condition) results in a delta CDF of 2.4E-07, which is within the very low safety significance range.

Additionally, since the EDG crankcase pressure lockout is bypassed during an emergency start, it may be assumed that the tornado does not cause a loss of offsite power as it approaches the site in order for this scenario to occur. The prevailing winds at the site and tornados in this geographical area, generally travel from West to East. It is likely that the switchyard and/or offsite power sources would be disabled prior to the tornado impacting the EDG Rooms and actuating the crankcase pressure switches. It is also noted that in the past 3 years, there has only been one tornado in Ottawa County, Ohio, which occurred on November 17, 2013. The tornado was classified as an EF1 and was never within 11 miles of the site.

Reportability Discussion:

The EDG crankcase pressure switch actuation due to pressure differentials during a tornado event is an unanalyzed condition and because it affects both EDGs simultaneously, it would affect all safety related onsite AC power. Therefore, this condition represents an unanalyzed condition that significantly degrades plant safety, and therefore is reportable per 10 CFR 50.73(a)(2)(ii)(B). The NRC was verbally notified of this event per 10 CFR 50.72(b)(3)(ii)(B) at 1459 hours0.0169 days <br />0.405 hours <br />0.00241 weeks <br />5.551495e-4 months <br /> on June 16, 2016, via Event Number 52010.

A further review of this condition, concluded that because this condition was present from the original design and affected both EDGs simultaneously, coupled with the complexity of the tornado / Auxiliary Building analysis, there was not sufficient evidence to support a reasonable expectation that either EDG could have performed their safety function in the past if a design basis tornado had struck the Davis-Besse site.

Because this condition would have affected both of the EDGs simultaneously, this condition is reportable per 10 CFR 50.73(a)(2)(v) as a condition that could have prevented the fulfillment of the safety function of a system needed to: (A) shutdown the reactor and maintain it in a safe shutdown condition; (B) remove residual heat; (C) control the release of radioactive material; and (D) mitigate the consequences of an accident.

ANALYSIS OF EVENT (Reportability Discussion continued) Furthermore, because both of the EDGs, in the postulated tornado scenario with the EDG crankcase pressure switch actuation, were simultaneously affected and would not have fulfilled their safety function, and since the plant operated with the subject equipment in this condition for longer than the TS LCO Action Time; this issue represents an operation prohibited by the Technical Specifications, which also is reportable as a LER in accordance with 10 CFR 50.73(a)(2)(i)(B).

CORRECTIVE ACTIONS:

Completed Actions:

Direction was provided to the operators on June 16, 2016, to implement maintenance activities to remove the Crankcase Pressure Relay/trip, as a compensatory measure, should a local Tornado Watch or Warning be issued.

A Prompt Operability Determination was completed on June 17, 2016, formalizing the compensatory measure to be implemented through the Corrective Action Program. As noted in the Prompt Operability Determination, the engine vendor has agreed that removal of the Crankcase Pressure Relay/trip relay does not adversely impact engine operation.

An Operations Standing Order was developed and issued on June 17, 2016, to provide direction to the operators to implement the compensatory measure during weather conducive to the formation of a tornado as identified by notification of a locally declared Tornado Watch or Warning.

A temporary modification was developed and implemented on June 25, 2016, to disable the EDG Crankcase Pressure Switch trip function for EDG 1 and 2.

Scheduled Actions:

A modification will be developed to permanently disable the EDG High Crankcase Pressure switches trip logic.

PREVIOUS SIMILAR EVENTS

There have been no LERs at the DBNPS in the past three years involving the inoperability of the Emergency Diesel Generators or latent system design issues.