IR 05000304/1986024
| ML20214F618 | |
| Person / Time | |
|---|---|
| Site: | Zion File:ZionSolutions icon.png |
| Issue date: | 11/18/1986 |
| From: | Burgess B NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| To: | |
| Shared Package | |
| ML20214F571 | List: |
| References | |
| 50-304-86-24, NUDOCS 8611250370 | |
| Download: ML20214F618 (11) | |
Text
~
U.S. NUCLEAR REGULATORY COMMISSION
REGION III
.
Report No. 50-304/86024(DRP)
'
Docket No. 50-304 License No. DPR-48 Licensee: Commonwealth Edison Company P. O. Box 767 Chicago, IL 60690 Facility Name: Zion Nuclear Power Station, Unit 2 Inspection At: Zion, IL Inspection Conducted: August 11 through October 10, 1986 Inspectors:
M. M. Holzmer J. Bauer fY Approved By:
B. L. Burgess, Chief
////
TG Reactor Projects Section 2A Date Inspection Summary Inspection on August 11 through October 10, 1986 (Report No. 50-304/36024(DRP))
.
Areas Inspected:
Special, unannounced region based and resident inspection of l
potential for asynchronous closure of Unit 2 diesel generators onto loaded engineered safety feature (ESF) buses.
Results: One violation and no deviations were identified (failure to follow
,
document control procedures).
In addition, concerns were identified relative to the licensee's post modification testing program, that it may not adequately
,
j provide for testing to assure that modifications do not reduce the safety of l
operations per the licensee's commitment to Paragraph 6.5 of ANSI N18.7, and
to the length of time taken by operators to resolve unsatisfactory test results.
i
/4 DOCK O
[
G
- a -
-
-a
+-
A,--
--- _
1-
-.
x
'
DETAILS
.
1.
Persons Contacted
- G. Plim1, Station Manager
- E. Fuerst, Superintendent, Production
- T. Rieck, Superintendent, Services W. Kurth, Assistant Station Superintendent, Operations N. Valos, Unit 2 Operating Engineer
- R Cascarano, Technical Staff Supervisor
- C. Schultz, Regulatory Assurance Administrator
- G. Fanning, Engineering Assistant, Technical Staff W. Stone, Quality Assurance Supervisor
- C. Sprandel, Quality Assurance Staff
- Indicates persons present at exit interview.
2.
Licensee Action On Previous Inspection Findings (Closed) Unresolved Item (304/86018-03):
Engineered safety feature (ESF)
bus breaker interlock installed improperly.
This item was unresolved pending a determination by Region III of appropriate level of
'
enforcement. A meeting was held in the Region III office on October 9, 1986 regarding this issue, the results of which are contained in Paragraph 3 of this report. This item is considered closed.
3.
ESF Bus Breaker Interlock Problem On July 27, 1986, while performing Periodic Test (PT) 10, Safeguards Actuation, Unit 2, en operator observed what he thought to be improper
.
operation of an ESF bus electrical breaker.
Further investigation by the licensee identified that during certain testing sequences, the potential existed for the asynchronous closure of the emergency diesel generator onto a loaded bus.
If the electric phase angle of the emergency DG differed from the phase angle of the decaying electric field of one or more motors on the bus, the potential would exist for damage to the motors and the resultant unavailability of ESF components. A modification (83-20), which was installed during the September 5, 1985 through January 27, 1986 refueling and maintenance outage, was the cause
of the potentially improper breaker operation. This modification affected t
Diesels 2A, 2B and 0 (common).
a.
Event Chronology
^
September 1985 through January 1986 Refueling Modification 83-20 was completed prior to the Unit 2 startup on January 27, 1986. This modification added an electrical interlock i
-
-
-
- - - -. -
.
,-
..-
.-
- -, _ - --.
--. --
"
botween the two series feeder breakers, 2424 and 2471 (see Attachment 1), from Bus 242 to 247 such that if 2424 opens for any reason, a "b" contact would send a signal to trip open 2471.
Prior to this modification, if Breaker 2424 opened, Breaker 2471 would not open automatically until a 72% bus undervoltage on Bus 247 occurred.
The modification was intended to " gang" the operation of these two breakers to make the design similar to other CECO facilities.
The design basis for Modification 83-20 depended partly on the false assumption that a previous modification (81-09) was already installed. Modification 81-09 proposed to add a 2 second time delay interlock to the closing logic of the DG output Breaker 2473. After the installation of Modification 81-09, the DG output breaker would close two seconds after the bus 247 undervoltage condition occurred.
Modification 81-09 was not installed because site personnel questioned its value and decided it required further review. The Station Electrical Engineering Department (SEED), who designed Modification 83-20, used an uncontrolled drawing which showed Modification 81-09 drawn in by hand (indicating that it was installed)
although it had not yet been installed in the field.
A post modification test of Modification 83-20 was successfully conducted. The scope of the test was to verify whether the modification performed as designed. There were no provisions to test for adverse system interactions, such as were observed later during PT-10 testing.
July 27, 1986 During the performance of PT-10, " Safeguards Actuation - Unit 2,"
the operator noticed that Breaker 2474 did not cycle as required by the procedure. Breaker 2474 should trip when Bus 247 is stripped due to the bus undervoltage condition caused by opening Breaker 2424, and it should subsequently reclose from a signal from the blackout timer after the DG output breaker closes, restoring power to the bus.
After discussion, it was the conclusion of the Shift Control Room Engineer (SCRE) that the breaker had cycled, but, due to the expected rapid breaker reclosure, the indicator light simply was not able to change state fast enough.
The discrepancy was noted in the comments section of PT-10.
July 28, 1986 PT-10 was performed on the remaining two safeguards trains.
The same operator again noticed that the equivalent breakers to 2474 (2484 & 2494) did not appear to cycle per procedure.
The supervisor on shift (SOS) reviewed the electrical print (which included Modification 83-20) and concluded that Breaker 2474 should not cycle under the test conditions due to the recent modification and that the procedure was therefore in error.
The discrepancies were again noted in the comments section of PT-10.
,
'
August 4, 1986 The July 27 and 28 discrepancies were noted by a shift foreman who
,
was reviewing the status of PT-10 in order to schedule additional operators that week. He immediately requested the assistance of the Technical Staff in order to resolve the difference between the test results and the procedure.
August 5, 1986 After a review by the Technical Staff, the interlock problem between Breakers 2424 and 2471 was identified and the "b" contact interlock was removed using the licensee's lifted lead procedure. The same chcnge was made for the other two safeguards buses.
August 27, 1986 The licensee completed their analysis of the ESF breaker cycle times.
The analysis concluded that ESF bus load stripping and resetting of the safety injection (SI) sequence timer would occur a minimum of 10 cycles (166.7 milliseconds) prior to the diesel output breaker closing (see Attachment 2).
The safeguards loads would then properly resequence on after power was restored to the bus, b.
Technical Analysis Frequent reference to Attachment I, " Zion Diesel Generator 0 Electrical Schematic," will be necessary during the following discussion.
For purposes of this discussion only the "0" diesel and its respective electrical system will be referenced; however, similar circumstances are applicable to the 2A and 2B DGs.
(1) 4160 V power is supplied to ESF Bus 247 through either:
- Breaker 2471, normal feeder breaker from non-vital 4160 V Bus 242,
- Breaker 2472, reserve feeder breaker from Unit 1, or
- Breaker 2473,
"0" DG output breaker.
(2) Breaker 2424 is in series with Breaker 2471.
(3) Breaker 2474 supplies the 4160/480 V transformer (aux transformer 237) for 480 volt ESF loads.
(4) The following conditions will trip the following breakers (this list includes only those trips of significance to the discussion):
'
2424 72% undervoltage on Bus 242 2471 2424 open (installed by Mod 83-20), or "0" DG
.
at rated voltage and frequency and 72% undervoltage on Bus 247 (from relay 427XI)
2474 72% undervoltage on Bus 247 (from Relay 427X2, which operates in parallel with 427X1)
(5) The following conditions will shut the following breakers (this list includes only those closures of significance to the discussion):
2473 2471 open, and "0" DG at rated voitage and frequency 2474 72% undervoltage on Bus 247 (from Relay 427X3 which is energized when 427X2 [ mentioned above]
is energized) and SI signal present (or simulated as in PT-10).
(6) Several ir.iportant sequences of operation which were revealed by the licensee's analysis are discussed below:
(a) If a simultaneous safety injection (SI) and loss of offsite electrical AC power would have occurred prior to the installation of Modification 83-20, the DG output breaker (2473) would not shut until Bus 247 was stripped and the DG was ready to carry the electrical loads.
It takes the DG about 10 seconds to be ready to accept load, so Bus 247 would have ample time to strip its loads.
(b)
If a simultaneous SI and loss of offsite AC were to occur after the installation of Modification 83-20, the outcome would have remained essentially the same, except that Breaker 2471 would open when Breaker 2424 opened. Bus stripping, 2473 shutting, and load sequencing still remain the same and were unaffected by the modification.
(c) If an SI occurred, followed sometime later by loss of offsite AC (before Modification 83-20), Breaker 2473 would not shut until about 10 cycles (166.7 milliseconds)
following Breaker 2471 opening.
Bus stripping occurs at the same time as 2471 opening, since the signals come from the same relay. Therefora, the DG would not close onto a loaded bus.
ESF loads would then be sequenced onto Bus 247 by its blackout timer.
(d) If an SI occurred, followed sometime later by loss of cffsite AC (after Modification 83-20) the same sequence would occur, except that Breaker 2471 opens immediately after Breaker 2424 opens. Attachment 2 shows relay actuation times and includes tolerances for the Bus 242 and 247 undervoltage
-.
.
.
,
i l
"
devices at the least conservative ends of their respective tolerances.
Summing the respective paths reveals that the bus will strip at least 10 cycles prior to 2473 shutting.
,
(e)
If Breaker 2424 were to be opened during PT-10 (after Modification 83-20), the DG could be allowed to energize a partially loaded bus.
In this condition, the DG is ready to accept load, and ESF loads are removed from Bus 247 by operators prior to the test to prevent transients on systems such as charging, service water, component cooling, or containment fan coolers. After 2424 is opened manually by the operator, 2471 opens immediately (5 cycles) due to the
"b" contact added by Modification 83-20. Ten cycles after 2471 opens, 2473 shuts since the DG is at rated voltage and frequency. No load shed occurs, since load shed depends on the actuation of the Bus 247 undervoltage device, and the urdervoltsge device on Bus 247 needs about 48 cycles to actuate.
(7) In summary, the design objective is. met for all sequences except (6)(e), which is not an accident sequence.
If operators do not unload the ESF bus prior to PT-10 testing, equipment damage could occur because the DG phase angle may not match the phase angle of the decaying electrical field of any motors on the bus.
c.
Root Cause Analysis The following are root causes or contributors to the event:
(1) Modification / drawing control:
-
The CECO Station Electrical Engineering Department (SEED)
designed Modification 81-09 and sent the preliminary drawings to site for review on September 30, 1986.
SEED was never informed that the modification was not installed.
-
SEED designed Modification 83-20 working from an uncontrolled, hand marked electrical print which had Modification 81-09 drawn on it.
It was therefore assumed that 81-09 was installed.
Lengthy delays exist from the time a print is given to Sargent
-
and Lundy for a drawing revision until the revised prints are issued.
(2) The SEED design engineer was aware of the interrelationship between Mods 81-09 and 83-20, but the relationship apparently was not discussed with site personnel.
Site personnel were not aware of this relationship during the site review of Modification 83-20.
--
..
_
~
(3) The post modification test for Modification 83-20 failed to determine whether the modification would have reduced the safety of operations (e.g. produce unsafe system interactions).
,
(4) Procedure (PT-10) documentation of the cycling of Breaker 2474 should be improved by requiring a separate signoff.
This may have improved the ability of operators to detect the problem.
d.
Other Inspector Concerns Operations personnel were slow to involve the Technical Staff in resolving the perceived PT-10 test procedure deficiencies. One reason is that both shifts involved erroneously concluded that PT-10 was at fault. The other is that both shifts incorrectly assumed that the Technical Staff would become involved in resolving the problem
without the shift communicating that need to either management or the technical staff.
(Once the technical staff became involved, their response appeared sufficiently prompt.)
e.
Immediate Corrective Actions (1) The interlock between Breakers 2424 and 2471, installed by l
Modification 83-20, was removed on August 5, 1986.
(2) The applicability of the issue in question was analyzed at all
,
other CECO sites. No other diesels were found to have a similar problem.
(3) A decision was made by August 22, 1986 to install both Modification 81-09 and 83-20.
f.
Long Term Corrective Actions (1) A complete revision of the modification process is being conducted for the entire CECO System.
(2) The Station Electrical Engineering Department (SEED) will no longer be involved in safety related modifications. All safety related modification design review will be done by the Station Nuclear Engineering Department (SNED).
(3) All pending safety related modifications designed by SEED will be re-reviewed for adequate design by SNED.
g.
Safety Significance FSAR Section 8.1, " Electrical System Design Basis," states:
"In
,
the event of total loss of auxiliary power from off-site sources, auxiliary power required for safe shutdown will be supplied from diesel generators located on the site."
II
- -
.
-_
.
- Technical Specifications Section 3.15, " Bases," further states:
"Any two of the three diesel generators can provide the emergency onsite power required to safely shutdown the reactor and remove
,
decay heat..."
Following a loss of outside AC with a subsequent safety injection (LOCA), the diesels would be called upon to start and carry the safeguards loads to safely shutdown the plant. As previously discussed, the 2A, 2B and "0" (common) diesels would have been able to perform that function as designed, whether the loss of offsite AC power (undervoltage) occurred at the time of the SI or subsequent to it.
The possibility exists that during a test (such as PT-10) or the opening of Breaker 2424 for reasons other than undervoltage, if the DG is at rated speed and voltage, the DG could experience asynchronous closure onto the ESF bus.
In such circumstances, the bus may or may not be loaded.
During PT-10 testing the bus is normally unloaded to prevent loss of needed components. These types of events appear to be both infrequent and, in most cases, inconsequential.
Drawing control and design control at the corporate engineering level was not sufficient to prevent adverse system interactions when implementing this modification.
Furthermore, there seems to have been insufficient consideration of adverse system interactions in this post-modification testing. ANS 3.2 (ANSI N18.7-1972), Section 6.5, " Tests and Inspections after Plant Modifications or Procedure Changes," states that tests or inspections shall be conducted to confirm that modifications do not reduce safety of operations. While the Commonwealth Edison Company QA program commits the licensee to comply with this ANSI standard, the program appears to have failed to provide measures to ensure that tests or inspections were performed to confirm that the installation of Modification 83-20 did not reduce the safety of operations. These modifications created the potential for the Unit 2 and common emergency DGs to asynchronously close onto a live, loaded bus during periodic testing. Review of the licensee's QA program to determine compliance with their commitment to section 6.5 of ANSI N18.7-1972 is considered an Unresolved Item (50-304/86024-01).
The Operations department request for resolution of test discrepancies was too slow. This appears to have resulted from assumptions on the part of shift management (SCRE's) that the i
!
Technical Staff would somehow get involved in resolving the perceived procedural problems without the operators initiating it.
h.
Enforcement
,
l l
The CECO Quality Assurance Manual, Quality Procedure 6-1,
" Distribution of Design Documents," Step 4.3.1 requires that each receiving office or area shall have a controlled method for checking receipt of new or revised documents, and assuring that the latest l
1
- revised document is in use. During the design of Modification M22-1(2)-83-20 in 1983, the Station Electrical Engineering Department (SEED), used a hand marked electrical print to design
,
and issue Modification 83-20, which was not the latest revision of that print.
Failure to comply with the requirements of Quality Procedure 6-1 is a violation of 10 CFR Part 50, Appendix B, Criterion V (50-304/86024-02).
4.
Unresolved Items Unresolved items are matters about which more information is required in order to ascertain whether they are acceptable items, items of noncompliance or deviations. One unresolved item disclosed during this inspection is discussed in Paragraph 3.g.
5.
Exit Interview The inspectors met with licensee representatives (denoted in Paragraph 1)
throughout the inspection period and at the conclusion of the inspection on October 10, 1986 to summarize the scope and findings of the inspection activities. The licensee acknowledged the inspectors' comments. The inspectors also discussed the likely informational content of the inspection report with regard to documents o processes reviewed by the inspectors during the inspection. The licensee did not identify any such documents or processes as proprietary.
Attachments:
1.
Zion Diesel Generator "0" Electrical Schematic 2.
Breaker Cycle Times
-.
.
. _ _ _ _ _
_ _ - _ _ _ _ _ _ _ _ _
Attactuent 1 Zion Diesel Generator 'O' Electrical Schematic F
-
~
-
.
.
G
'
,1
-
G
-
'C
/
q
<)
4160V Bus 242
/ nterlock installed by N0D 83-20 i
2424 UV
- 5
-. m...
.........g Diesel Generator
"0" d:vice U
i f
b contact
-
(72%)
interlock
{
)
,
{
Reserve Feedeg 4160V Bus U/1
,___-.
_____y I
I i
l
'
(
l,___3
,--
C
2471 e
2473 2472 4160V ESF Bus 247
.
,
'
_
l 4160V ESF Bus 247
,
-h-h --- 1--,
2474
-
--
._
.-
UV device (72%)
wA 4160V/480V Safeguards
"w Trans 237 Loads
-
i 480V ESF Bus 237 l
mcc 2371 l
r 480V/120V Trans T'
120V Bus SI Sequence Timer l
.
'
.
Attachment 2
.
BLACK 0UT
v b
&
Service Bus 242 NOTE: Conservatively assume that ESF Bus 247 UV Relay Bus 242 UV device will actuate UV Relay 48 cycles f2.4 early and Bus 247 UV device 48 cycles
- 2.4 will actuate late.
u a
Slave Relay Slave Relay 427x1 Path 1 427x1 5 cycles 5 cycles
??
'
u Breaker 2424 ESF Breakers opens ev Path 2 open 5 cycles 5 cycles
'
v Breaker 2471 opens 5 cycles
_
u D/G Breaker 2473 closes 10 cycles D/G Breaker Closing Times ESF Load Shed Time Path 1 Path 2 50.4
l 45.6 50.4
5
60 T cycles i
5
10
70 T cycles 703 cycles 70.4 cycles - 60.4 cycles = 10 cycles = 166.67 milliseconds.
Therefore, ESF load shedding will always occur a minimum of 166.67 ms before the D/G output breaker closes.
. _,
-
-.. -
.
-
_.
- _ _