Semantic search

On October 16, 2017, with Unit 2 shutdown for a refueling outage, investigation into a boric acid indication identified a through wall leak at the socket weld that joins a 3/4 inch line to Loop A Reactor Coolant System (RCS)(AB) shutdown communication line valve 2RC-8-37 )(VTV). The leak was isolated by closed valves that would have limited primary coolant leakage to within the capacity of the charging system when the reactor coolant system was pressurized. The quantity of dry boric acid at the location was small (estimated at 1/2 teaspoon in volume). This failure constituted a welding or material defect in the primary coolant system that was not found acceptable under ASME Section Xl and an event or condition prohibited by Technical Specifications.

The cause of the leakage was determined to be stress corrosion cracking. Valve 2RC-8-37 was replaced. In addition, Prairie Island Nuclear Generating Plant intends to perform phased array ultrasonic inspections of socket welds on similar Class 1 piping containing stagnant water during future refueling outages.

On December 18, 2016, at 0818 CDT, the Prairie Island Nuclear Generating Plant (PINGP) had a fire in the PINGP Switch Yard due to 8H8 Breaker-CT (Current Transformer) catastrophic failure. During the event, 121 Motor Driven Cooling Water Pump (MDCLP) auto-started on low header pressure (80 psi) as designed, and supplied load to the Cooling Water (CL) Header to increase header pressure. This event is reportable under 10 CFR 50.73(a)(2)(iv)(A) as an event that resulted in automatic actuation of an emergency service water system.

The cause of the 121 MDCLP auto-start was a low-pressure transient in the cooling water pump discharge header that was caused by the trip of the Containment & Auxiliary Building Chiller. When the chiller tripped, Unit 2 Containment Fan Coil units automatically swapped to cooling water. This additional load on the CL system, which caused system pressure to drop below 80 psi. The health and safety of the public was not at risk.

On April 3, 2015, Prairie Island Nuclear Generating Plant (PINGP) Unit 2 was operating at 100 percent power, when at 0652 CDT, an unexpected annunciator, 47510-0104 21 FEEDWATER PUMP LOCKED OUT was received. The reactor was manually tripped as required by the annunciator response procedure. This also resulted in a turbine trip as designed. The Operations crew entered the reactor trip emergency operating procedures and stabilized the unit in Mode 3, at normal operating pressure and temperature. All control rods fully inserted into the core following the trip. The Auxiliary Feedwater Pumps actuated as designed on low narrow range steam generator level. Steam Generator levels were returned to normal.

This event is reportable under 10 CFR 50.72(b)(2)(iv)(B), any event or condition that results in actuation of the reactor protection system (RPS) when the reactor is critical except when the actuation results from and is part of a pre-planned sequence during testing or reactor operation, and 10 CFR 50.72(b)(3)(iv)(A), any event or condition that results in valid actuation of any of the systems listed in paragraph 10 CFR 50.72(b)(3)(iv)(B)(6), PWR auxiliary or emergency Feedwater system.

The cause evaluation determined that the event was caused by pressure fluctuation within the system which resulted in the bourdon tube movement at a high frequency causing wear of the internal components of the pressure switch.

Corrective actions: Pressure Switch (PS-16012) was replaced immediately on April 3, 2015, and to install snubbers to reduce process flow fluctuations experienced by Feedwater Pump pressure switches.

At 1110 Central Standard Time (CST) on 1/29/2016, the Prairie Island Nuclear Generating Plant (PINGP) performed a planned overspeed post-maintenance test (PMT) of 22 Diesel-Driven Cooling Water Pump (DDCLP) in accordance with plant maintenance procedure. During the overspeed trip test PMT, 22 DDCLP tripped as expected, and 121 Motor-Driven Cooling Water Pump (MDCLP) unexpectedly started automatically ("auto-started") on low pressure in the cooling water pump discharge header. This event is reportable under 10 CFR 50.73(a)(2)(iv)(A) as an event that resulted in automatic actuation of an emergency service water system that does not normally run and that serves as ultimate heat sink.

The cause of the 121 MDCLP auto-start was a low-pressure transient in the cooling water pump discharge when 121 MDCLP started. The health and safety of the public was not at risk.

Corrective actions to be taken for this event include revising plant procedures to ensure 121 MDCLP is running prior to performing the overspeed trip test PMT and to ensure the pump is running or in pullout position to prevent auto-start of 121 MDCLP when stopping a DDCLP.

On 12/21/2015 with Unit 1 (U1) in Mode 1 at 100% power and Unit 2 (U2) in Mode 3, a technical review of a new weak link calculation as part of the transition to National Fire Protection Association's Performance Based Standard for Fire Protection for Light Water Reactor Electronic Generating Plants (NFPA 805) identified a non-emergency unanalyzed condition reportable under 10 CFR 50.72(b)(3)(ii)(B). Specifically, several motor operated valves (MOVs) credited to be manually operated from outside the control room in the event of a fire in the control room or relay room could be damaged in a postulated fire if hot shorts were to bypass the torque and limit switches. Also, MOVs associated with the Gland Steam system of both U1 and U2 had been added to F5 Appendix B but never analyzed in the event of a hot short. These conditions could impact the ability of plant operators to implement procedure F5 Appendix B, Control Room Evacuation (Fire). The identified MOVs are located in Fire Area (FA) 13 (Control Room) and FA 18 (Relay and Cable Spreading Room). New hourly fire watch impairments were created in these areas as compensatory measures. The fire detection systems in the control room and relay room remain in service. The site submitted Event Notification (EN) 51616.

Reviews of the list of MOVs susceptible to hot shorts bypassing the torque and limit switches continued and additional valves were noted to be affected by this failure mechanism. As a compensatory measure, new hourly fire watch impairments were created for FA 31 ("A" Train Hot Shutdown Panel & Air Compressor/Auxiliary 695 Feedwater Room), FA 32 ("B" Train Hot Shutdown Panel & Air Compressor/Auxiliary 695 Feedwater Room), FA 58 (Auxiliary Building Ground Floor U1) and FA 73 (Auxiliary Building Ground Floor U2). EN 51616 was updated on 01/14/2016. The public health and safety was not impacted.

Event Description

During technical review for a new calculation as part of the transition to NFPA-805, the station reviewed MOVs identified in the Appendix R program to ensure they had been analyzed correctly. In this review it was determined several MOVs had been added to the program but had not been analyzed for a weak link. Further, several MOVs would not survive a hot short condition, although they were credited in the Appendix R program to meet programmatic requirements for survivability from a hot short condition. Also, MOVs associated with the Gland Steam system of both U1 and U2 had been added to F5 Appendix B but never analyzed in the event of a hot short. These MOVs could be affected by a fire in FA 13 (Control Room) and FA 18 (Relay and Cable Spreading Room). This unanalyzed condition could impact the ability of plant operators to implement procedure F5 Appendix B. Therefore, the station reported this unanalyzed condition under 10 CFR 50.72(b)(3)(ii)(B) on 12/21/2015 as EN 51616. New hourly fire watch impairments were created in these fire areas as compensatory measures.

After submittal of EN 51616, the review was further expanded for all credited MOVs which resulted in identifying additional MOVs that would not survive a hot short condition if a fire were to occur in the following fire areas: FA 31 ("A" Train Hot Shutdown Panel & Air Compressor/Auxiliary Feedwater Room, 695), FA 32 ("B" Train Hot Shutdown Panel & Air Compressor/ Auxiliary Feedwater Room, 695), FA 58 (Auxiliary Building Ground Floor U1), and FA 73 (Auxiliary Building Ground Floor U2). EN 51616 was updated on 01/14/2016 listing the additional fire areas and the compensatory actions of new hourly fire watch impairments.

Event Analysis

On February 28, 1992 the NRC released Information Notice 92-18 (IN 92-18), Potential for Loss of Remote Shutdown Capability During a Control Room Fire, addressing the potential for a control room fire causing electrical short circuits ("hot shorts") between normally energized conductors and conductors associated with the control circuitry of motor-operated valves (MOVs) required for achieving and maintaining post-fire safe shutdown conditions. This could result in a loss of capability to achieve or maintain safe shutdown conditions 2

CONTINUATION SHEET

prompted the 12/15/2015 event notification, and the updated notification on 01/14/2016, for an unanalyzed condition due to non-compliant fire protection manual operator actions reportable under 10 CFR 50.72(b)(3)(ii)(B). Compensatory measures were initiated in affected fire areas.

EN 51616 was submitted to the NRC.

During the causal evaluation for the LER, PINGP reviewed its response to a 1997 Unresolved Issue (URI) regarding the review of MOVs in accordance with IN 92-18 (Accession Number 9710200112). The response stated PINGP would use IN 92-18 as guidance to perform additional reviews of the hot short problem following the completion of the Appendix R safe shutdown analysis and create an accurate list of MOVs susceptible to hot shorts (ADAMS Accession Number 9711200012). On August 7, 1998, calculation ENG-ME-353, Mechanical MOV Analysis to support IN 92-18 determined the valve and operator thrust and torque values that may occur during a hot short that bypasses the limit switches and torque switches. The calculation addressed 46 Appendix R related valves and found 32 could potentially be damaged during a fire induced hot short requiring modifications and revision to the Appendix R safe shutdown analysis.

During a fire, a hot short could cause the MOV to operate without its torque/limit switch protection, damaging the valve and preventing manual operation of the valve. All credited MOVs for safe shut-down were reviewed for this condition and seventeen MOVs were found susceptible.

Susceptible MOVs Eleven (11) MOVs require modification to re-wire the torque and limit switches to prevent damage to the actuator:

3 infocollects.Resource@nrc.goy, and to the Desk Officer, Office of Information and Regulatory Affairs, Prairie Island 05000282 1) MV-32006, 1 TURB GLND STM SL SPLY UPSTRM SO MV 2) MV-32010, 1 TURB GLND STM SL SPLY B-P MV 3) MV-32016, 11 SG MS SPLY TO 11 TD AFW PMP MV 4) MV-32017, 12 SG MS SPLY TO 12 TD AFW PMP MV 5) MV-32019, 21 SG MS SPLY TO22 TD AFW PMP MV 6) MV-32020, 22 SG MS SPLY TO 22 TD AFW PMP MV 7) MV-32021, 2 TURB GLND STM SL SPLY UPSTRM SO MV 8) MV-32022, 2 TURB GLND STM SL SPLY B-P MV 9) MV-32238, 11 AFW TO 11 SG MV 10) MV-32246, 22 AFW TO 21 SG MV 11) MV-32333, 11 TD AFW PMP SUCT FROM CST MV Six (6) MOVs require PINGP to revise the Appendix R safe shutdown analysis to credit actions to isolate other valves or to credit check valves.

1) MV-32115, 122 SFP HX INLT HDR MV B 2) MV-32117, 121 SFP HX INLT HDR MV A 3) MV-32166, 1 REAC EXCS LTDN LINE ISOL MV A 4) MV-32194, 2 REAC EXCS LTDN LINE ISOL MV A 5) MV-32335, 12 MD AFW PMP SUCT FROM CST MV 6) MV-32336, 21 MD AFW PMP SUCT FROM CST MV The causal evaluation for this event determined the cause was the failure to include ENG-ME- 353 as an input to the Appendix R safe shutdown analysis. Because of this exclusion, the site did not update ENG-ME-353 to include new weak link data to support the Appendix R safe shutdown analysis.

Additionally, the causal evaluation identified inadequate supervisory oversight during the transition to NFPA 805 that contributed to the event. When one engineer was assigned to both the Appendix R program and the transition to NFPA 805 resulting in untimely responses, in a 4

CONTINUATION SHEET

Infocollects,Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, 05000282 Prairie Island

NO

manner commensurate with their safety significance, to previously identified deficiencies for compliance with IN 92-18.

Safety Significance

The NFPA 805 License Amendment identified the need to revise ENG-ME-353 to incorporate updated vendor information (ADAMS Accession Number ML12278405). During the revision of ENG-ME-353, this issue was identified, There were no structures, components or systems that were inoperable at the start of the event that contributed to the event.

There was no nuclear, environmental, radiological or industrial safety consequences related to this event. PINGP has procedures and controls in places to minimize the likelihood and severity of fires occurring, and a significant fire impacting the ability to safely shutdown did not occur.

This postulated fire scenario requires that a significant fire of sufficient size and intensity to damage MOV control cables and bypass torque and limit switches to cause spurious operation and damage to MOVs. The frequency of fires large enough to damage control cables is much lower than the generic fire ignition frequency that includes fires of all intensities. To damage the MOV, the fire must cause damage to cable insulation to the point that an energized conductor shorts around the torque and limit switches to the MOV control circuit for sufficient time for the MOV to stroke to the opposite position without open circuit or short to ground.

Causes PINGP failed to include ENG-ME-353 as an input to the Appendix R safe shutdown analysis which led to failure to update ENG-ME-353 to include new weak link data.

During the original analysis for IN 92-18, only a specified list of MOVs was reviewed to be credited; however, additional MOVs were added without the required analysis to support survivability.

5

Corrective Actions

• The Appendix R safe shutdown analysis for the fire protection program will be updated to include ENG-ME-353 in the methodology section.

• Document actions necessary to address the 17 MOVs.

o Eleven (11) MOVs require modification to re-wire the torque and limit switches to prevent damage to the actuator:

® MV-32006, 1 TURB GLND STM SL SPLY UPSTRM SO MV ® MV-32010, 1 TURB GLND STM SL SPLY B-P MV ® MV-32016, 11 SG MS SPLY TO 11 TD AFW PMP MV ® MV-32017, 12 SG MS SPLY TO 12 TD AFW PMP MV

• MV-32019, 21 SG MS SPLY TO 22 TD AFW PMP MV

• MV-32020, 22 SG MS SPLY TO 22 TD AFW PMP MV ® MV-32021, 2 TURB GLND STM SL SPLY UPSTRM SO MV ® MV-32022, 2 TURB GLND STM SL SPLY B-P MV ® MV-32238, 11 AFW TO 11 SG MV ® MV-32246, 22 AFW TO 21 SG MV ® MV-32333, 11 TD AFW PMP SUCT FROM CST MV ® Six (6) MOVs require PINGP to revise the Appendix R safe shutdown analysis to credit actions to isolate other valves or to credit check valves.

0 ® MV-32115, 122 SFP HX INLT HDR MV B ® MV-32117, 121 SFP HX INLT HDR MV A ® MV-32166, 1 REAC EXCS LTDN LINE ISOL MV A ® MV-32194, 2 REAC EXCS LTDN LINE ISOL MV A ® MV-32335, 12 MD AFW PMP SUCT FROM CST MV ® MV-32336, 21 MD AFW PMP SUCT FROM CST MV 6

Previous Similar Events

Damage by Fire Induced Hot Shorts" was submitted on September 7, 1998 (ADAMS Accession Number 9809150244).

Corrective Actions

• Compensatory fire watches in each affected area until the affected MOVs had been evaluated or modified as described below:

a. Re-evaluate MOVs to identify alternate shutdown systems, components, or flow paths that are not susceptible to damage and revise the Safe Shutdown Analysis accordingly, or b. Modify MOV's mechanically to prevent mechanical damage (e.g.

smaller motor), or c. Modify MOV's electrically to prevent hot short susceptibility (e.g. hold the MOV circuit breaker open or rewire the MOV control circuit).

• Submit a schedule of corrective actions after the engineering review is completed.

submitted on October 26, 1998 (ADAMS Accession Number 9810300149).

Corrective Actions

• Include MOV's MV-32075, MV-32076, MV-32077, MV-32078, MV-32178, MV- 32179, MV-32180, and MV-32181 in the Appendix R safe shutdown equipment list. Complete the circuit analysis packages for the valves with recommendations to provide assurance of maintaining the flow diversion path closed.

• Evaluate the valves for IN 92-18 damage concerns. If the valves could be mechanically damaged during spurious operation, circuit modifications will be performed as required under the IN 92-18 program. Results of this evaluation will be provided in a Supplement to LER 1-98-10.

7 NRC with a schedule of the corrective actions as committed to in the original submittal (ADAMS Accession Number 9904150006).

8

On July 1, 2011, Prairie Island Nuclear Generating Plant (PINGP) Unit 1 was manually tripped from approximately 100% steady-state power. The manual reactor trip was in response to the right main turbine stop valve failing closed as the result of an Electro-Hydraulic (EH) oil leak located at the stop valve. As designed, 11 and 12 Auxiliary Feed Water (AFW) pumps auto started on steam generator low water level.

The causal evaluation determined that right main turbine stop valve failed closed due to excessive oil leakage from a failed 0-ring. An age related compression set and slight extrusion near the outside contact surface resulted in the failed 0-ring.

On May 9, 2011, Prairie Island Nuclear Generating Plant (PINGP) Unit 2 tripped from approximately 100% steady-state power as a result of a turbine trip from a generator lockout signal. At the time of the trip Unit 1 was in a planned refueling outage in Mode 6 Operation and thunderstorms were in the vicinity of the plant.

Post event diagnostics determined that the relay ground potential circuit had a missing link (wire) between substation panels which resulted in the loss of the reference ground potential to the associated protective relaying in the Switchyard panels. This resulted in the improper operation of the breaker protection relays.

The causal evaluation determined that the proximate cause of the relaying scheme failure was inadequate ground wire installation during a modification to the substation equipment. The evaluation also determined that NSPM (Transmission and Nuclear) did not establish the appropriate standard for procedure quality with respect to work under System Control Center jurisdiction in the PINGP substation such that a means of effectively utilizing human performance tools to minimize errors during work, which directly impacts the safe and reliable operation of nuclear plants, was not in place.

Safety related battery chargers have the potential to stop providing an output, or "lock up", if their AC input voltage drops below their nameplate minimum voltage of 90% of 480V at the battery charger Motor Control Center. Exact voltage, duration of voltage dip, and charger loading conditions which cause lock up of chargers are unknown.0If a reduction in input voltage results in a battery charger locking up, the battery charger will not be able to recharge the battery from a partially discharged state unless operator actions are taken to restore the battery charger.

On October, 22, 2010, an operability determination concluded that specific Design Basis Accident scenarios may include this undervoltage condition which could cause the battery chargers to lock up. The design basis requirements of the safeguards battery are such that it can carry expected shutdown loads for the DC system for one hour. Compensatory measures in the form of new operator actions have been put in place to support restoration of the battery chargers within this timeframe.

On March 23, 2009, at approximately 1200 CDT, Northern States Power Company - a Minnesota corporation (NSPM) design engineering personnel discovered a potential vulnerability with Prairie Island Nuclear Generating Plant (PINGP) Unit 1 component cooling (CC) piping. The potential exists for a tornado missile hazard to impact the CC piping that supplies the 122 spent fuel pool (SFP) heat exchanger (HX). In the normal configuration, a missile impact to this piping would affect both trains of PINGP Unit 1 component cooling thus rendering the CC system inoperable.

This condition is being reported in accordance with 10 CFR 50.73(a)(2)(ii)(B) as an unanalyzed condition that significantly degrades plant safety and 10 CFR 50.73(a)(2)(v)(A) as a condition that could have prevented the fulfillment of a safety function of a system that is needed to maintain the reactor in a safe shutdown condition.

The condition was caused by a design change that added the 122 SFP HX prior to initial plant startup.

The 122 SFP HX is currently isolated to protect the CC system function from a tornado missile hazard.