05000213/LER-1988-001, :on 880114,engineer Noted Design Deficiency in Control Circuit Common to Four Containment Isolation Trip Valves.Caused by Design Error Made During Implementation of post-TMI Mod.Circuit Design Corrected

:on 880114,engineer Noted Design Deficiency in Control Circuit Common to Four Containment Isolation Trip Valves.Caused by Design Error Made During Implementation of post-TMI Mod.Circuit Design Corrected

ML20196C799
Person / Time
Site:	Haddam Neck File:Connecticut Yankee Atomic Power Co icon.png
Issue date:	02/11/1988
From:	Mazzarella D, Miller D CONNECTICUT YANKEE ATOMIC POWER CO.
To:	NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM)
References
LER-88-001, LER-88-1, NUDOCS 8802160236
Download: ML20196C799 (6)

LER-1988-001, on 880114,engineer Noted Design Deficiency in Control Circuit Common to Four Containment Isolation Trip Valves.Caused by Design Error Made During Implementation of post-TMI Mod.Circuit Design Corrected

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(1)
2131988001R00 - NRC Website

text

r o

% C poem se6 y s. wvCLeu aatuteTur Conswisseow

,g APPm0Vic OMS 40 3100416e LICENSEE EVENT REPORT (LER)

" *'" ' 8 8 8' '*

F ACILITY % Aus m DocalT wuesetn(21

' AGE J Haddam Neck o l 5 l 0 l 0 l 0 l 2l113 1loFl015 fi'f L E tes Design Error Found In Steam Generator Blcf.down Isolation Circuit EVENT DAf t sti Le n hva, age n,66 REPOAT DAf t IF)

CTMt R P ACILITIES INv0 lyt 0181 MONTm CAv vlam vtan

$8g3 (a b SM VO%TM Day vtan racekstv % awls CCCat ? Nvwstm<st 015l0tol0l l l 0 l1 1l 4 88 8l8 0l0l1 0l0 0l 2 1 l1 8l 8 o,5ioio,o, ;,

g,g g g y,g TMit attonT tt $U648tTTt0 PUR8UANT TO TMt AtQuta tWENTS OF 10 C84 l (Casce oas er more e, ene reape+,11111 8#

6 M 402lti M 40Giel M 73elalM 73 fi tti 3.w nein.i n rim n Aa,. mu u n.im g

0i a 0 n.0... m..,

w n.,2, o,7=,,,g, g,,,

noau I

]

20 406,.H1 H-l le 7341Qnti le 734ntile un Al JsdA J n.0.os n..,

.a n H.,.

. n,an n.,

M 406 en1Hel N 73 ellf Hiill N 73 e42Hal LICINtit CONT ACT Fon TMit LI A 112)

%AYE flittmo%t Nuvsta aataCCOI D. W. Mazzarella, Encineer 210 l3 2l 67-l 2 5 5l6 1 1 1 1 COM*Laf t 0%E LINE 904 EACM COMPONINT pailyst OttCRitt0 IN TMrs atront liti

" I 'n,I,* 'gd C

pomTA L[

7 7

g ca.st systly CQvp0%3%T W(

CA'lt Svl?tv C0970%E%T l

! I I I I I I

i l l l l l l

I I I I I l l

I l l I l l SUP9ttWENT AL A EPQaf E mPECTE D tt.,

wc%Tm Day vtam NI'E

-], t i,,,, -,.,..,ce,o..,,o% oc,,

i]

.,0 i

i i

L..T..CTm,,,,x.,~...-...,,,...,,..~...~o.,

A55 TRACT During a component qualification review, an engineer noted a design deficiency in the control circuit common to four Containment Isolation trip valves. The review of the wiring diagram indicated that the Steam Generator Blowdown isolation valves (BD-TV 1312-1, 2, 3, 4) would not trip in response to a High Containment Pressure (HCP) signal if preceded by a loss of voltage to 4160V buses 1-2 and 1-3 or 480V buses 4, 6. or 7.

In addition, the blowdown valves would not have closed upon receipt of an undervoltage signal.

The system design called for closure of the blowdown valves if either an HCP or Low Voltage signal was present.

The existing control logic will be modified to meet the required system design.

The design error was made during the implementation of a post-TMI modification to the Containment Isolation valve control circuits.

This event is reportable per 10CFP50.73(a)(2)(v) as it could have prevented fulfillment of a safety function. This event is also reportable per 10CFR50.73(a)(2)(1)(B) since it involves a condition prohibited by the Technical Specifications.

T 8802160236 080211 7

PDR ADOCK 05000213 h

9 PDR

%,s.--

r kmc Fwe setA U s CUCLE12 iEIULOT12Y Couws&SloN LICENSEE EVENT HEPORT (LER) TEXT CONTINUATION Amono ove so mo+o4 E AP1RES 8 31 M P ACILITY NAWE m DOC 8L E T NUM8 t m W LE R NUM8t R 16)

PAGE 43' M'"

Ng ','e IV,Ya Haddam Neck o l5 l 0 l 0 l o l 2l1 l3 8l8 Ol 0l1 0 10 0 l2 0F 0 l5 w a

., m w m ass 4 w nn BACKGROUND Each steam generator is provided with two blowdown connections (EIIS Code: WI),

each at the same elevation on opposite sides of the shell.

The two connections join to form a single blowdown line per steam generator that discharges through the containment wall (E!!S Code: NH) and isolation valves to the blowdown flash tank.

The flashed vapor is normally condensed in the vent condensers and routed to the main condenser hotwell (EIIS Code: SG;.

The condensate formed in the blowdown tank normally drains through a service water (EIIS Code: KG) discharge line into the circulating water discharge canal.

If the water in the blowdown tank is radioactively contaminated, this water may be diverted to the liquid waste disposal system (EIIS Code: WD).

An automatic diaphragm-operated trip valve (containment isolation valve) is provided in each blowdown line between the containment wall and blowdown flash tank.

These valves are required by design to automatically close if any of the following conditions occur:

1.

Train A or train B containment isolation actuation signal (EIIS Code: JM).

2.

Coincident 4160 volt bus 1-2 and 4160 volt bus 1-3 undervoltage trip signals.

3.

A 480 volt bus 4 undervoltage trip signal of 480 volt bus 6 undervoltage trip signal g 480 volt bus 7 undervoltage trip signal.

A high containment pressure signal provides containment isolation during an accident.

The 4160 volt undervoltage trip signal is intended to icolate steam generator blowdown to protect the blowdown vent condensers from overpressurization due to a loss of service water cooling.

The 480 volt undervoltage trip is intended to isolate Slowdown upon loss of voltaae to either bus 4, 6, or 7 which supply power to the A, B, and C component cooling water pumps (EIIS Code: CC) respectively.

Isolation of blowdown protects the blowdown tank cooler in the liquid waste disposal system from overpressurization due to loss of component cooling water.

EVENT DESCRIPTION

With the plant in mode 6 and the core offloaded, it was determined that the steam generator blowdown isolation valves (BD-TV-131?-1, 2, 3, 4) control circuit was designed improperly. This was determined on January 14, 1988 after design document review and physical plant walkdown.

An engineer performing a component qualification review first noticed the design problem.

The improperly designed circuit was installed as part of a post-TMI modification to the containment trip valve circuits in 1980 g' -

.u s we imw. m..

I LICENSEE EVENT REPORT (LER) TEXT CONTINUATION uezovto ova ho mo-4io4 EKPuttS. S '31 '88 P ActLeYY hAME c18 DOCE4Y kVuetMin Lta huwe4m 161 PAGt (3) vf'a

" M /,i."

3*,W 0l0 l 1

__ Raddam N m k o l5 l0 l0 l 0 l d 113 818 0l 0 0l3 0F 0l5 ten L===== m,

we w m4 w im The design basis for the steam generator blowdown valve trip circuit requires the blowdown isolation valves to trip if one of the following conditions occurs:

1.

Train A or train B containment isolation (CIAS) signal.

2.

Coincident 4160 volt bus 1-2 and 4160 volt bus 1-3 undervoltage trip signals.

3.

A 480 volt bus 4 undervoltage trip signal or 480 volt bus 6 undervoltage trip signal or 480 volt bus 7 undervoltagelrip signal.

Prior to 1980, the circuit met this design requirement.

However, it did not meet the post-TMI requirement which specified that containment isolation valves must not open automatically upon reset of the CIAS trip signal (NUREG 0578, Item 2.1.4).

A modification was implemented to replace the single pilot solenoid valve which operated the four blowdown lines with four pilot solenoid valves, one for each line. These new valves were latching valves wh;ch must be manually latched open (and therefore require operator cction after a containment isolation trip occurs) to reopen the blowdown trip valves.

The circuit as wired for the modification in 1980 would have prevented blowdown system isolation if one or both of the following conditions existed at the time the containment isolation signal occurred:

1.

4160 volt bus 1-2 and 1-3 undervoltage trip, or 2.

480 volt bus 4 or 6 or 7 undervoltage trip.

CAUSE OF THE EVENT

There were several contributing factors related to the cause of the event. They are:

1.

For the 1980 design change DEENERGIZED TO CLOSE pilot solenoid valves (PSV) were installed for a CIAS logic system which was designed to use 1

ENERGIZED TO CLOSE pilot solenoid valves. This change was not properly

)

integrated into the existing logic systen, i

2.

Inadequate testing was performed on the blowdown isolation circuit to verify that the undervoltage trip logic worked correctly.

Although testing of the CIAS system in 1980 revealed the problem described in 1 (above) and a design change was made to correct it, the change was not evaluated for its impact on the undervoltage trip logic, l

I t

eoau maa e u a cer)isosoe24 63a oss

r UCENSEE EVENT REPORT (LER) TEXT CONTINUATCN m ovio ows no mo+oe

( APiRES. L 31. 80 P ACit:Tv asAmt (11 doc E. T Wws t a (21 Lim NUndsIn ISI Pact l36 v=

"MW 3,T:

Haddam Neck o l5 l0 l0 l0 l 2l1l3 8l8 q 0l 1 0l0 0l4 oF 0l 5 m.

m e m e w ec r mw.mn 3.

Wire lists (instead of wiring schematics) were used during the modification and testing of the CIAS system in 1980 This caused testing personnel to be unaware of the details and interrelations of the wiring design.

SAFETY ASSESSMENT

This event is reportable per 10CFR50.73(a)(2)(v) as it could have prevented fulfillment of a safety function.

This event is also reportable as a conditions prohibited by the plant's Technical Specifications per 10CFR50.73(a)(2)(1)(B). Technical Specification 3.11(C) requires the steam generator blowdown isolation valves to be operable in modes 1 through 4.

These valves would not have closed during a design basis accident if certain loss of AC power conditions preceded the event.

Although a technical specification has been violated, there are no safety concerns as a result of this event. A radiological evaluation of the changes in offsite dose for each of the accidents potentially impacted is as follows:

DBLOCA - Durirg a design basis LOCA, the prinary side pressure quickly drops below the secondary side pressure.

As a result, no primary-to-secondary transport of fission products occurs, thus, there is no release through the blowdown system.

SBL6CA - Although primary pressure does not drop nearly as fast as during a DBLOCA, the small break LOCA analysis does not require non-mech 3nistic fuel failure assumptions. Fechanistic analysis shows no fuel failure during SBLOCA. Therefore, there will be no significant release through the blowdown system.

SGTR The failure of blowdown to isolate opens another pathway for iodine to be transported out of the stehm generator.

(For analysis purposes, however, all available noble gases are assumed to be rele6 sed to the environment rega

.ess of the number of pathways available.) For the more severe case of loss of offsite power, the steam generator blowdown tank can become a release path.

The volune of the vapor released via blowdown will be a fraction of that through the code safety valves / steam dump valves.

The blowdown release path will tend to reduce generator secondary pressure, providing a compensating effect by reducing the release through the code safety valves / steam dump valves. Additionally, the blowdown lines and tank would reduce iodine concentrations through plateout, impaction, and partitioning.

The overall change in dose due to this circuit error would be insignificant.

Note that the steam generator tube rupture bounds other secondary side accidents, ge~

.usw m.msnm

]

r-Wec Fena 306A U 5 kVCLt Al E 81VL Af onY COMMIS8'09 LICENSEE EVENT REPORT (LER) TEXT CONTINUATION ue:Ovlo0wewo moaio4 unRes; ni se F ACILITY hAhti til DOCES T NUM8t R WI ggR huuttR IS)

PAGS (3) 9*a

" M;;;.

tt*,9 Haddam Neck o l5 Io lo lo l2 l 113 el 8 0l0 li 010 0l 5 0F 0 15 mr v m e m m uc o su,mn CREA The worst case control rod ejection accident analysis predicts 18% of pins in DNB, however, none reach temperatures where release of solid fission products is credible.

The release path of concern here is into the primary containment thus the role of steam generator blowdown is minimal.

CORRECTIVE ACTION

i The circuit design will be corrected by rewiring the auxiliary contacts for the undervoltage trips.

The circuit will then be retested to verify it meets the design basis requirements.

This action will be completed prior to startup l

(Mode 4) from the current refueling and maintenance outage.

The present day design change process and practices involve a series of discipline, independent and supervisory reviews that did not exist in 19$0.

The post-modification testing process has been substantially upgraded.

Proce h res, as they currently exist, provide for greater control of the preparation aM execution of post-modification testing and circuit verification and no further i

action is planned.

ADDITIONAL INFORMATION

None,

PREVIOUS SIMILAR EVENTS

None.

l l

i l

l 1

l l

l r.:t

.U.-,..,..,....

CONNECTICUT YANKEE ATOMIC POWER COMPANY HADDAM NECK PLANT ARs1 e BOX 12; E

• EAST HAMPTON, CT 06424 9341 Februa r.y 11, 1988 Re:

10CFR50.73 U. S. Nuclear Regulatory Commission Document Control Desk Washington, D. C.

20555

Reference:

Facility Operating License No. DPR-61 Docket No. 50-213 Reportable Occurrence LFR 50-213/88-001-00 Gentlemen:

This letter forwards the Licensee Event Report 88-001-00, required to be submitted, pursuant to the requirements of Cornecticut Yankee Technical Specifications.

Very truly yours,

[ Donald B. Miller, Jr.

Station Superintendent DBM: REB /dfv

Attachment:

LER 88-001-00 cc: Mr. William T. Russell Regional Administrator, Region I 475 Allendale Road King of Prussia, PA 19406 J. T. Shediosky Sr. Resident Inspector Haddam Neck ws-3 nvim