05000346/LER-2016-009
| Davis-Besse Nuclear Power Station Unit 1 | |
| Event date: | 09-10-2016 |
|---|---|
| Report date: | 11-09-2016 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| Initial Reporting | |
| ENS 52232 | 10 CFR 50.72(b)(2)(iv)(B), RPS System Actuation, 10 CFR 50.72(b)(3)(iv)(A), System Actuation |
| 3462016009R00 - NRC Website | |
| ML16319A097 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 11/09/2016 |
| From: | Boles B D FirstEnergy Nuclear Operating Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| L-16-287 LER 16-009-00 | |
| Download: ML16319A097 (7) | |
used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
- 009 05000 - 346 YEAR 2016 - 00 Energy Industry Identification System (EIIS) codes are identified in the text as [XX].
System Description:
The Main Generator [TB] converts rotating mechanical energy of the Main Turbine [TA] into electrical energy.
The excitation system provides regulated Direct Current (DC) power to the Main Generator field/rotor for controlling the voltage and reactive volt-ampere output, with an Automatic Voltage Regulator (AVR) controlling the electrical current to the Main Generator field. The AVR was installed at the Davis-Besse Nuclear Power Station (DBNPS) in 2014 as a digital upgrade from the previous analog voltage regulator.
The Integrated Control System (ICS) [JA] provides for coordination of the Reactor, Steam Generator Feedwater control, and Main Turbine under all operating conditions. This coordination consists of producing the best load response to the unit load demand while recognizing the capabilities and limitations of the controlled equipment. When any single portion of the station is at an operating limit or a control section is on manual, the ICS uses the limited or manual section as a load reference. One of the features of the ICS Feedwater Subsystem is a Rapid Feedwater Reduction (RFR) scheme, which is designed to prevent refeeding the Steam Generators with Feedwater when not warranted to prevent a primary system (Reactor Coolant System) overcooling transient. The RFR circuitry provides for a rapid decrease in Feedwater flow rate after a Reactor trip and is also designed to preclude low Steam Generator level actuations of the Steam and Feedwater Rupture Control System (SFRCS) resulting from undershoot of the low level control limits.
After a Reactor trip, with all Feedwater stations in automatic, an RFR demand signal equivalent to approximately four (4) percent of total Feedwater flow is substituted for Feedwater Control valve position.
The SFRCS [JB] is required to ensure an adequate Feedwater supply to remove Reactor decay heat during periods when the normal Feedwater supply has been lost. The SFRCS is designed to automatically start the Auxiliary Feedwater System (AFW) [BA] in the event of a Main Steam line break, Main Feedwater line rupture, a low level in the Steam Generators [AB-SG] or a loss of all four Reactor Coolant Pumps. The SFRCS is designed to automatically isolate the Main Steam System (MS) [SB] and the Main Feedwater System (MFW) [SJ] in the event of a Main Steam line break or Main Feedwater line rupture. The AFW is automatically aligned to feed the unaffected Steam Generator upon a loss of steam pressure in one of the Steam Generators. Although not a safety function, the SFRCS also isolates MFW to the Steam Generators and initiates AFW to their respective Steam Generators in the event of high Steam Generator level. This is to prevent a Steam Generator overfill condition and subsequent spill over into the Main Steam lines and Main Turbine; which could cause thermal shock of Steam Generator internal structures, and could challenge the integrity of steam line piping and supports caused by excessive Main Feedwater addition. This high Steam Generator level trip isolates the Main Steam Isolation Valves (MSIVs) [SB-ISV] to prevent damage to downstream plant equipment.
DESCRIPTION OF EVENT:
On September 9, 2016, the DBNPS was operating in Mode 1 at approximately 100 percent power. Rain had been forecasted in the evening, and operators were dispatched to close the Turbine Building [NM] roof vents, which were routinely opened to help limit ambient temperatures within the building. Four of the 14 roof vents could not be closed due to known and documented material deficiencies.
used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
2016 - 00 DESCRIPTION OF EVENT: (continued) At some point during the night, a heavy rain storm passed through the area. Rain fell through the four open roof vents and onto the Main Turbine operating deck. At 0336 hours0.00389 days <br />0.0933 hours <br />5.555556e-4 weeks <br />1.27848e-4 months <br /> on September 10, 2016, an electrical ground alarm was received on Direct Current (DC) Bus 2 [EJ-BU], but no other plant impact immediately occurred. On the Northwest side of the Turbine deck, the water pooled on the floor beneath an open roof vent and spread across the floor. The water then ran down a vibration joint between the Turbine-Generator pedestal and the Turbine deck floor, falling onto the top of the Main Generator AVR cabinet. The rain water then migrated inside the AVR cabinet through conduit connections on the top of the cabinet. At 0343 hours0.00397 days <br />0.0953 hours <br />5.671296e-4 weeks <br />1.305115e-4 months <br />, with the unit at approximately 100 percent power, a lockout of the Main Generator occurred due to a loss of field. The generator lockout tripped the Main Turbine, which satisfied the Anticipatory Reactor Trip System logic, resulting in a trip of the Reactor Protection System (RPS). Initial unit response to the Reactor trip was as designed, and all control rods fully inserted.
Following the reactor trip, the control room operators observed Steam Generator 1 level rising due to a failure of the ICS to properly respond to the Reactor trip. Feedwater Loop 2 responded correctly to the reactor trip and controlled level in Steam Generator 2 at approximately 40 inches. The operators took manual control of the Main Feedwater Control valves and attempted to reduce Main Feedwater flow. However, the SFRCS actuated on high Steam Generator 1 level as level reached the 220 inch setpoint approximately one minute after the reactor trip. All SFRCS components responded as designed, with both AFW Pump Turbines starting, both MSIVs closing, and isolation of the Main Feedwater System.
CAUSE OF EVENT:
The direct cause of the generator lockout and subsequent reactor trip was rain falling through an open roof vent onto the Turbine deck, which migrated into the AVR through one or more of the cabinet's conduit connections.
The root causes of the generator lockout and reactor trip were (1) Operations Shift Managers did not advocate adequate and timely compensatory actions to eliminate the risk to generation posed by rain falling onto energized equipment through a stuck open Turbine Building roof vent, and (2) station management failed to recognize the roof vent rain issue as a potential imminent risk to generation. There are fourteen 4-foot by 8-foot smoke and heat vents in the Turbine Building roof, which are designed to automatically open at 165 degrees F due to a fusible link. Manual pull release handles also allow each vent to be opened without disturbing the fusible link. The roof vents had been routinely opened during warm weather to compensate for deficiencies in-the Turbine Building ventilation in order to reduce Turbine Building ambient temperatures. On August 14, 2016, it was identified that four of the roof vents could not be closed, including roof vent number 8 above the AVR. On the evening of August 17, 2016, operators noted water running from the Turbine deck (623 foot elevation) to the floor below (603 foot elevation) following a heavy rain storm due to roof vent 8.
being open. Maintenance personnel inspected the roof vents the following day to identify the necessary repairs, but no accelerated actions were taken beyond the normal work management process to repair the vents. Catch basins were installed below roof vent 8 on August 27, 2016, in attempt to collect the rain water to prevent it from affecting the equipment below.
05000 - 346 - 009
3. LER NUMBER
used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
- 009 05000 - 346 YEAR 2016 - 00 CAUSE OF EVENT: (continued) The direct cause of the high Steam Generator 1 level and resultant SFRCS actuation was a faulty output of ICS Module 5-6-6 which did not position the Main and Startup Feedwater Control Valves to the target positions as required, resulting in overfeeding of Steam Generator 1. The most probable cause of the module faulty output was degradation of an operational amplifier on the module.
The root cause of the high Steam Generator 1 level was that corrective actions taken to address the vulnerabilities in the ICS were not adequate to prevent future events. Contributing causes identified were 1) that the ICS including the RFR circuit are not safety related and in general are not fault tolerant, so a single failure can prevent the system from functioning as desired, and 2) that modifications to upgrade the ICS to make the system fault tolerant and corrective actions to develop RFR circuit testing were not performed.
Actions had been taken to mitigate the potential for ICS/RFR problems by creating/implementing preventive maintenance (PM) activities to periodically calibrate and refurbish ICS modules associated with RFR in accordance with industry standard practices. These actions did not eliminate the system vulnerabilities, however, they served to reduce the likelihood or frequency of occurrences.
ANALYSIS OF EVENT:
All control rods inserted fully as designed. Following the Reactor trip, the SFRCS actuated due to high SG 1 level. All SFRCS components responded as designed, with both AFW Pump Turbines starting, both MSIVs closing, and isolating the MFW System.
To determine the risk significance of the initiating event (Reactor trip due to rain water intrusion), the currently effective Probabilistic Risk Assessment (PRA) Model was used with an initiating event of a Reactor/Turbine trip always occurring along with a loss of Main Feedwater as experienced and described below. Based on this, an Incremental Conditional Core Damage Probability of 4.14E-7 and an Incremental Conditional Large Early Release Probability of 9.59E-9 were calculated for the initiating event. Normalizing these values results in an estimated delta Core Damage Frequency of 4.14E-7 per year, and a delta Large Early Release Frequency of 9.59E-9 per year for the Reactor trip due to rain water intrusion, which are both considered to be of very low safety significance.
ICS Module 5-6-6, which was determined to be the cause of the improper control of Steam Generator 1 level following the Reactor trip, had been successfully calibrated during the previous refueling outage ending May 9, 2016. Utilizing a maximum exposure time of approximately 0.34 years in the PRA Model results in an estimated delta Core Damage Frequency of 2.0E-7/year and a delta Large Early Release Frequency of 6E-9/year, which are also both considered to be of very low safety significance. Because the delta Core Damage Frequency for this event was determined to be greater than 1E-7 per year, the impact on external events was evaluated. Evaluation of the DBNPS Individual Plant Examination of External Events (IPEEE) Fire PRA model yields a delta Core Damage Frequency of 6.60E-7 per year, which is considered to be of very low safety significance. This condition causes no increase in Seismic risk, so it also is considered to be of very low safety significance.
used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
- 009 Davis-Besse Nuclear Power Station Unit 1 05000- 346 YEAR 2016 - 00 Reportability Discussion:
The automatic actuation of the RPS while the reactor is critical is reportable within four hours of occurrence per 10 CFR 50.72(b)(2)(iv)(B). The actuation of the Auxiliary Feedwater System by the Steam Feedwater Rupture Control System (SFRCS) on a valid high Steam Generator level is reportable within eight hours of the event in accordance with 10 CFR 50.72(b)(3)(iv)(A). On September 10, 2016, at 0723 hours0.00837 days <br />0.201 hours <br />0.0012 weeks <br />2.751015e-4 months <br /> both of these events were reported to the NRC Operations Center (Event Number 52232).
These issues are being reported in accordance with 10 CFR 50.73(a)(2)(iv)(A), which requires reporting of any event or condition that resulted in manual or automatic actuation of the RPS, including a reactor scram or reactor trip, as well as automatic actuation of the Auxiliary Feedwater System. All safety systems performed as required to the event, and no loss of safety function occurred.
CORRECTIVE ACTIONS:
Completed Actions:
The four failed Turbine Building roof vents were closed on September 10, 2016, via a temporary modification and tagged with instructions to not operate the roof vents without Senior Reactor Operator approval.
Additionally, an Operations Standing Order was issued on September 11, 2016, directing that the Operations Manager's permission was required to open any of the roof vents. The Standing Order will remain in place until configuration control steps are instituted in the Turbine Ventilation System Operating Procedure.
Five suspect modules in the ICS RFR Feedwater Loop 1 circuit were replaced with bench tested, refurbished modules on September 14, 2016, and field testing of the affected portion of the RFR circuit for Feedwater Loop 1 was performed and verified to function properly. The five modules removed were sent to a laboratory for failure analysis, which identified the most probable cause of the operational amplifier degradation on Module 5-6-6. Because of this degraded operational amplifier, all 14 spare signal lag modules in stock had the same operational amplifier replaced. Additionally, the work documents used by the laboratory to refurbish the ICS modules has been updated to require replacement of the operational amplifiers, transistors, and diodes as part of the refurbishment.
The conduit penetrations on the top of the AVR cabinet has been sealed to prevent future water intrusion events. While installed in the same location, the AVR cabinet that was installed in 2014 is physically different than the old cabinet, and is more vulnerable to water pooling on top of the cabinet, allowing it to eventually migrate inside the cabinet and affect the AVR circuitry.
Scheduled Actions:
A case study will be developed and presented to the Operations Senior Reactor Operators and to site Superintendents and Managers focusing on information turnover, use of the station operational challenge list, ensuring either compensatory or mitigating actions are addressed along with the ownership of directing these measures, recognition of elevated risk issues, and understanding of issues prior to management review board review of the issues.
The Turbine Building roof vent material deficiencies will be corrected.
Intocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
- 009 Davis-Besse Nuclear Power Station Unit 1 05000 - 346 YEAR 2016 - 00 CORRECTIVE ACTIONS: (continued) The signal lag modules currently installed in the plant will be replaced with refurbished modules that have had the operational amplifiers replaced as described above.
A multi-functional team will be assembled to perform a review of the ICS to address system performance concerns. This review will include the following 1. Recommend additional testing of the ICS RFR circuitry to verify system functions that are not checked during normal plant startups.
2. Evaluate additional monitoring equipment to ensure RFR functions as required.
3. Evaluate ICS module classifications to determine if single point vulnerabilities exist.
4. Review industry operating experience for scram reduction recommendations, and verify lessons learned have been incorporated.
5. Evaluate outstanding ICS modifications and recommendations for modifications to improve the reliability of the ICS Feedwater control.
PREVIOUS SIMILAR EVENTS:
There have been no Licensee Event Reports (LERs) at the DBNPS in the past three years that were the result of rainwater intrusion.
on high Steam Generator Level. In the January 2016 event, the RFR circuit did not actuate due to a miswired RFR defeat switch module that was installed in a previous outage. For the September 10, 2016 trip, the RFR circuit actuated, but only controlled level on one of the two Steam Generators, likely due to a degraded operational amplifier resulting in a module providing a faulty output. The corrective actions taken in response to the January 2016 event would not have prevented the September 10, 2016 event.