05000280/LER-2001-002

LER-2001-002,

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident
2802001002R00 - NRC Website

FACILITY NAME (1)

DOCKET

05000 - 28b 05000 - 281 LER NUMBER 6) PAGE (3) 2 W OF5 1.0 DESCRIPTION OF THE EVENT The purpose of the Surry Power Station air-conditioning equipment for the main control room [EllS-V1] and emergency switchgear room is to ensure cooling to personnel and equipment during both normal and accident conditions. The main control room, emergency switchgear room, and a total of five MCR and ESGR chillers [EIIS-VI, CHU] are shared between Surry Units 1 and 2. Three of the five chillers are powered from either of two buses, enabling maximum system flexibility in aligning the chillers.

The "A" chiller alternate motor control center (MCC) [EIIS-VI, MCC] feeder breaker [EIIS- VI, BKR] spuriously tripped August 7, 2001 after approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> during performance of a tempo W operating procedure, titled "Single C. ler Single Loop Chilled Water Alignment." Engl. W 'ng was requested to evaluate the adequacy of power feeds to the five chillers. Evai W .in determined that a standard design molded case circuit breaker (i.e., one that W .ot 100%-rated) should be designed to continuously carry no more than 80% of breaker trip rating current. It was estimated that le breaker that spuriously tripped was carrying approximately 93% of its trip rating. As a result of these reviews it was determined on September 14, 2001 at 11 41 hours4.74537e-4 days <br />0.0114 hours <br />6.779101e-5 weeks <br />1.56005e-5 months <br /> that chiller "A" and "B" MCC feeder breakers did not meet design criteria for of ?ration with voltage of less than 460Vac in a dual chiller mode (2 chillers in operatior W With a voltage of less than 460Vac, the electrical current will exceed 80% of its trir W bg and there was a possibility that the MCC feeder breakers serving the "A" and "B" W ,iers could trip. The "C", "D", and "E" chiller breakers met design criteria for degraded v W le conditions.

The "A" and "B" chillers were declared inoperable. W , en-day action statement for both Surry units was entered in accordance with -; eon, :al Specifications (TS). The TS required that three operable chillers were powered from three of the four emergency buses [EIIS-EK, BUJ with one of those chillers capable of being powered from the fourth emergency bus.

After procedures were revised, a training synopsis approved, and training completed on restrictions for operating MCR and ESGR chillers, an operable combination of chillers was verified, and the "A" and "B" chillers were declared operable on September 14, 2001 at 19:07 hours.

Review of the design history revealed that in the 1986 timeframe engineering work requests that replaced the chiller compressors failed to ensure that the station electrical load list was updated for the increased loads. Subsequently, a design change package in the 1993 timeframe repowered the "A" and "B" chillers from new swing MCCs that had a normal and alternate source, and incorrect breaker trip ratings were specified based on the incorrect values from the station electrical load list.

An evaluation concluded that MCR and ESGR "A" and "B" chiller breaker deficiencies Y FACILITY NAME (1)

DOCKET

05000 - 280 05000 - 281

LER NUMBER

1 6) could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident. This condition is therefore reportable pursuant to 10CFR50.73(a)(2)(v)(D).

2.0 SIGNIFICANT SAFETY CONSEQUENCES AND IMPLICATIONS The air-conditioning system for the Surry Power Station main control room and emergency switchgear room includes five chillers with three being powered from either of two emergency buses enabling maximum system flexibility in aligning the chillers. In accordance with Technical Specifications, a minimum of three main control room and emergency switchgear room chillers must be operable whenever either unit is above cold shutdown. The three operable chillers are also required to be powered from three of the four emergency buses with one of those chillers capable of being powered from the fourth emergency bus. This will ensure two chillers are available to maintain design temperature under maximum heat load conditions. In addition, by design the heat removal capacity for each chiller is greater than the accident plant heat load.

The "A" and "B" chiller MCC feeder breakers did not meet design criteria for operation with voltage of less than 460Vac in a dual chiller mode. With a voltage of less than 460Vac there is a possibility that the breakers serving the "A" and "B" chillers could trip.

Chillers "C", "D", and "E" were found to be acceptable for single chiller operation under all scenarios.

During the period the "A" and "B" chillers were declared inoperable, the "C", "D", and "E" chillers were operable and powered from three of the four emergency buses, but no operable chiller was capable of being powered from the fourth emergency bus.

Emergency bus voltages were all verified to be greater than required minimum voltage, and continued to be monitored as greater than required minimum voltage at least once per shift. "B" chiller remained in service even though it was technically inoperable and it was capable of being powered from the fourth emergency bus. A root cause evaluation was initiated.

The "A" and "B" chillers normal and alternate emergency bus voltages over the 36 months preceeding September 14, 2001 were reviewed and no voltage reading less than required minimum voltage was found. Based on this information the non-accident requirements for dual mode operation of the chillers, which is the normal alignment, was met. Single chiller operation for the "A" or "B" chiller did not occur during this period, with the exception of the "A" chiller during performance of temporary operating procedure, titled "Single Chiller Single Loop Chilled Water Alignment".

However, a scenario may be postulated that either the "A" or "B" chiller is operating as one of the three required Technical Specification operable chillers when a loss of offsite power is experienced. In this case, the emergency diesel generators would start and FACILITY NAME (1)

DOCKET

05000 - 280 05000 - 281 LER NUMBER 6) provide the required power. If the emergency diesel generator output voltage drops below the required minimum, the voltage supplying power to the chiller's MCC would drop below 460Vac. If the voltage falls below 460Vac, there is a possibility that the "A" or "B" chiller MCC feeder breaker could trip as the current to the breaker will exceed 80% of its trip current rating. This would leave two operable chillers remaining; however, if a single failure occurs to one of these, only one chiller would remain to remove the required heat load.

In summary, there were 5 chillers available, and chillers "C", "D" and "E" each had the capability to handle the accident plant heat load by design. The Technical Specification required three operable chillers powered from three of the four emergency buses with one of those chillers capable of being powered from the fourth emergency bus. The risk of degradation or loss of offsite power was minimal. Therefore, this event resulted in no safety consequences or significant implications. The health and safety of the public were not affected.

3.0 CAUSE The root cause evaluation (RCE) concluded that the cause of the "A" and "B" MCC feeder breakers not meeting design criteria was a failure in plant configuration control. In the 1986 timeframe engineering work requests thai replaced the chiller compressors failed to ensure that the station electrical load list was updated for the increased loads.

Subsequently, a design change package in the 1993 timeframe repcwered the "A" and "B" chillers, and incorrect breaker trip ratings were specified based on the incorrect values from the station electrical load list.

4.0 IMMEDIATE CORRECTIVE ACTION(S) In accordance with the TS, when the "A" and "B" chillers were declared inoperable, a 7- day action statement was entered. The Technical Specifications required that a minimum of three main control room and emergency switchgear room chillers must be operable whenever either unit is above cold shutdown, and the three operable chillers are required to be powered from three of the four emergency buses with one of those chillers capable of being powered from the fourth emergency bus. However, no operable chiller was capable of being powered from the fourth emergency bus. The "C", "D", and "E" chillers were verified to be operable. Emergency bus voltages were all verified to be greater than required minimum voltage, and continued to be monitored as greater than required minimum voltage at least once per shift. "B" chiller remained in service even though it was technically inoperable and it was capable of being powered from the fourth emergency bus. A root cause evaluation was initiated.

FACILITY NAME (1)

DOCKET

05000 - 280.

05000 - 281 LER NUMBER (6) PAGE (3) 5 � OF5 5.0 ADDITIONAL CORRECTIVE ACTIONS After related procedures were revised for restrictions for operating MCR and ESGR chillers including verification that the emergency bus voltage remains above required minimum voltage, Licensed Operator Requalification Program Training Synopsis approved, Operator training completed,' an operable combination of chillers was verified, proper bus voltage was verified, and the "A" and "B" chillers were declared operable on September 14 at 19:07 hours.

6.0 ACTIONS TO PREVENT RECURRENCE A design change package has been approved which replaces existing "A" and "B" chiller breakers with higher trip rating breakers. The new breaker3 will allow the "A" and "B" chillers to operate in a dual-chiller mode under postulated degraded voltage conditions.

This will prevent spurious tripping and allow the voltage restriction on the emergency buses voltages to be lifted. The station electrical load list has been changed.

The present requirement is that physical setpoint changes for molded case circuit breakers shall be processed through the design change package process. The design change process that is presently used for plcnt modifications is more rigorous than that used for the previous engineering work request process. The design change process now requires that a programs review checklist and controlled document summary be performed; this assures that affected programs and documents will be updated as required. Also, the design change process procedure and the standard for design change package preparation require multiple reviews of all design changes which ensure that compliance with departmental design standards will be maintained. Departmental electrical engineering nuclear standards now include an electrical systems analysis checklist which addresses the effect on the station electrical load list. The measures presently in place should prevent recurrence of similar problems.

7.0 SIMILAR EVENTS None 8.0 MANUFACTURER/MODEL NUMBER No component failure.

9.0 ADDITIONAL INFORMATION None