IR 05000458/1990005

Insp Rept 50-458/90-05 on 900213-16.Major Areas Inspected: 900211 Loss of 125-volt Dc Bus,Rhr Sys Design,Procedures for Identifying & Mitigating Potential Injection Sys LOCA, Electrical Sys & Topaz Inverter & Rosemount Trip Unit

ML20012B849
Person / Time
Site:	River Bend
Issue date:	03/06/1990
From:	Stetka T NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV)
To:
Shared Package
ML20012B848	List: IR 05000458/1990005 ML20012B847
References
50-458-90-05, 50-458-90-5, NUDOCS 9003160456
Download: ML20012B849 (20)

Text

--

,

-

-

-

-

-

,

p

_

ey

' %:f,

.,.

(<

,

'i e

<

f,

-APPENDIX.

,

-

U.S. NUCLEAR REGULATORY COMMISSION-

.

REGION IV:

AUGMENTED INSPECTION TEAM-

,

,

-

.-,

e NRC-Inspection Report: 50-458/90-05 Operating License:- NPF-47

'i

'

e

.

Docket:

50-458 Licensee: GulfSt'atesUtilities(GSU)

'

P.O. Box 220-i

<

St. Francisville, Louisiana 70775

+

,

.q FacilityName:._RiverBendStation'(RBS)

Inspection At:: RBS,7St..Francisv111e, Louisiana-t

'

~ Inspection Conducted: February 13-16, 1990

Team Members

: B. Jones, Resident Inspector, RBS-

,

W. Paulson, Project Manager, NRR

.R.CVickrey, Reactor Inspector, RIV

,

'P? Wagner, Reactor Inspector, RIV l Assisting

[

,

i Personnel:

E. Ford, Senior Resident Inspector, RBS s

.

?

-

WJ A

Team Leader:

l/

xd//lAl

$!(.[70

' T. F. Stetka, Chief, Plant Systems Section Dd te'.

, Division of Reactor Safety

.

,

,

,

(f.,

I u.

_

,

,

,

-

t

k

',h cg3Q$$$'

'

m e

.

.

-

= :

=

.

- -

-

--

-

,

, < -

,

Q ' ; ;.; :,;.'

'

?;g,

,

R

.

-2-y,

>

DETAILS

..

-

L

O-

-1.-

PERSONS CONTACTED

!

'

GSU'

J' Burton, Supervisor, Probability Risk Analysis (PRA)

'!

st.

.

G. Bysfield, Control Systems Supervisor

,

"

1 N..Cathey, Senior Nuclear Safety Engineer, PRA

.

'T.,Crouse, Administration Manager

-

R. Cole,-Senior Systems-Engineer:

'

J. Cook.. Technical Assistant

' ~

J. LDeddens,' Senior Vice4 President

,

%

D. Derbonne; Assistant Plant Manager, Maintenance L'.. England, Director,, Nuclear Licensing M. Feltner, Licensing Engineer

~ A. Fredieu,- OperationsiSupervisor P7 Graham,'

.

iW. Hermann,. Plant Manager-

,

i Maintenance Engineer i

'

1,, '

'

.B.~ Hey, PRA Engineer

-

s lG.< Henry, Director, Quality Operations

.

'

X

'J. Huddleston : Senior Area Coordinator..

j

'

.

J. Leavines,tSupervisor,.Huclear Safety Assessment

.J. Mead,. Supervisor, Electrical Design

'

a W.10 dell,1 Manager, Oversight-T.' Plunkett, General: Manager;

'

S.: Pruitt, Manager,' Business' Systems

-

R. Roberts.. Electrical MCTE Supervisor J. Schi1 pert, Assistant Plant Manager i

i

,

?K. Suhrke, Manager, Engineering & Administration

<

-

R. West,'AssistantPlantManager(QA). Engineer

-D.-Williamson, Quality Assurance l'

'

-

Others Contacted u

';

'K.:Byington, Senior' System; Engineer, Stone & Webster

D.. Hill,'. Senior System Engineer, Stone'& Webster L. Johnson, Site Representative, Cajun Electric Power Corporation'

.

~

m V

iThe.NRC' inspectors:also:interv'iewed additional licensee. personnel during the

-

a inspection..

j

.

,

s

2."-GENERAL 2;1 Description of Event At about 9:15 a.m; on February 11, 1990, with the plant at full power, L-

electricians began to perform preventative maintenance (PM) on battery charger

-

p

,;y i

j.

y

[I F

,

t

.

- -

-. ~

-

- - -

..

- -

-

.

.-

7 7 q, c;.< c

,q nn m i

.

.l~

f 0 1.

m

,' l ;tj' '<j;

]

-

,

ip

,

n.

,

e

1 p

ENB*CHGR-18.(IB)Ic To perform this PM, the vital 125 volt DC electrical.bu's-l

-(ENB-1B) supplied by this battery charger was placed on the nonsafety grade E

.

A backup battery charger "D".

Following completion of this PM at about 10 a.m.,-

h battery charger IB was' returned to bus ENB-1B and, per procedure, was placed in

.)

L

the." equalize" mode of operation. At this time several unexpected alarms were

received in the control room. The control room operators responded to these p-alarms as an apparent loss of:a 125 volt DC bus and-entered abnormal operating-procedure (A0P-14) to cope with this event.. While reviewing.the control room j

. equipment status to determine what caused the apparent bus outage, the

operators noted that the two red lights on the TOPAZ inverters, located on a'

back paneliwere deenergized.: These inverters supply 24 volt DC power to j

,

i Rosemount trip _ units-(RTU), which monitor plant parameters and activate some

'

Division 11-engineered safety features (ESF). Realizing that this meant that

'

=the inverters had tripped, the operators reevaluated their initial assumption

!

that a loss of the.125 volt DC bus had occurred and reasoned that the alarms l

i were-caused by'the loss of the inverters. During'the time that the operators

-

lant conditions in the control room, the electricians at were evaluating the p(who were unaware of the control room events) placed the the~ battery charger-battery charger, per procedtre, into the " float" mode. This switching had no

!

Leffect on the plant.

While the reator remained at full power and with the knowledge that the plant event was caused by the TOPAZ inverter failures, the operators requested

' assistance from.the electricians to restore the inverters.' While the electricians were resolving the reasons for the inverter loss (they initially believed that fuses had blown), the operators proceeded to determine the effects that the inverter restoration would have on the plant. The operators focusedon"operatoraids"(placards)locatednexttotheRTUs-onthepanelon

'I which the. inverters were installed. These placards listed the components

< actuated by the RTUs. The operators compiled a list-of components that they

'

expected to actuate upon reenergization of the RTUs based strictly upon these placards.

L Following review of plant' drawings and discussions with operators, the

electricians determined that the TOPAZ inverters were not fused and that the M

tripping of the units was the result of the high voltage trip protection L

J circuit designedLinto the inverters. They also determined that these inverters L

would reset automatically when the high voltage condition cleared and the voltage dropped-below a reset voltage setpoint. Based upon this finding, the L

operators became concerned that the inverters could reset at' any time (thus

,

L reenergizing'RTUs)andthatthiscouldresultinunexpectedplantactuations.

l H

Therefore, the operators proceeded to disable equipment that they believed j

. ould actuate upon reenergization of the inverters. The equipment that they w

r

l, disabled was based upon the lists developed from the panel placards.

!

Following the disabling of equipment, the operators directed the electricians to lower the " float" voltage on the battery charger below the inverters' reset voltage setpoint so that the inverters would reset. When the inverters reset

.the corresponding'RTUs were reenergized, and a full Div II ESF actuation

~ occurred. This actuation was caused by a low reactor vessel water level signal from a failed-low RTU. This full ESF actuation was unexpected by the operators a

. _ _.

>

>

.n r-

,

[, L.:

s,*

n.

..

.

-4-l

l-r

'

and was the result of their lack of knowledge of the operational characteristics of the RTVs. As the result of the full ESF actuation, additional equi F

actuated including the opening of the low pressure coolant injection.(pment

.

LPCI)

,

valves, E12*MOV 42B and 420. The opening of these valves provided a path from the high pressure reactor coolant system (RCS) to the low pressure residual heat removal (RHR) system isolated by the check valves located in each LPCI injection line. When the operators noted the MOV-42 valves stroking open, they allowed the valves to stroke fully open and then quickly reclosed the valves.

~ Fo110 wing' restoration of the actuated ESF systems, the operators conducted pipe walkdowns of the LPCI piping both upstream and downstream of the MOV-42 valves

.to' determine'if leakage.into the low pressure piping had occurred. These

walkdowns included a " hands on" feel of the piping to determine if backflow had occurred. The piping temperature ranged from warm to cool indicating that no backflow had occurred (subsequent pipe checks conducted two days later indicated thesamepipetempera_tures).

-

All during this event, the plant continued to operate at full power. The prompt operator actions prevented a plant trip from occurring.-

'

The AIT was dispatched on February 12, 1990, and began the onsite inspection on

'

the morning of. February 13, 1990. Prior to that time the NRC senior resident inspector (SRI) monitored the licensee's preliminary response to the event.

The AIT was. composed of. two Region IV inspectors, the site resident inspector, the NRR project manager, and the team leader. The site SRI also assisted the tca min their investigations.

2.2 AIT Tasks-Region IV'in consultation with NRR, formed an AIT on February 12, 1990. The AIT tasks were specified in a charter to Mr. T. F. Stetka from Mr. S. J. Collins.

The AIT was directed to conduct:

'

.A' thorough review of the sequence of events leading to the event;-

'

'

' ~

,' '

-A review of; operator and management response to the event, including

-

.

.

recovery ofcaffected systems;

}

A. review of ESF system vulnerability to a-failure of the TOPAZ inverters

'

with emphasis on unexpected equipment actuations that could challenge y^

plant operation and design. This review was to include but not be limited to, an assessment of the potential for intersystem connection and/or significant' plant transients; and l<

A review of the 11censee's planned corrective actions for this event.

• i The AIT reviewed the event, inspected the affected equipment and interviewed L

.

L cvarious managers, operators, engineers, maintenance personnel, and technicians-involved. Documents reviewed by the team are listed in the Attachment to this

'

report.

m

O a

-

• i,

s.p

,;,7 3

.

..,

-5-

_.

-3L-AIT-INSPECTION 3.1 -Seggence of Events The following sequence of events was developed by the team as the. result of a review of the control room log, written statements by licensee personnel, and interviews with licensee personnel. All times are best estimate, Central Standard-Time.

February 11, 1990 9:14'a.m.

PM on~ battery charger ENB*CHGR IB (18) was initiated.

Charger-1B was removed from service. Safety-related DC

bus, ENB-18, was placed on backup battery charger "0".

'

10:00 a.m.

Completed PM on battery charger IB. Backup battery charger

.

'

"D" was removed from bus ENB-1B and battery chsrger IB was i

placed back on this bus.

'

10:10 a.m.

Battery charger 1B was switched to the " equalize" mode which placed bus ENB-1B on equalize voltage. At this

<.

point several unexpected alarms were received in the control room.

10:11 a.m.

The operators initially believed that power had been lost to DC bus ENB-1B and entered procedure A0P-0014, " Loss of 125 VDC". An operator was dispatched to battery charger

IB. An electrician was. summoned to the control room to

-

assist with the loss of the bus.

10:12 a.m.

Battery charger,18 returned to " float" mode.

i 10:20 a.m.

While checking motor control center (MCC) ENB*MCC 2B located in the control room (all indications were that this MCC was lost), the operators noted that the-two red power lights on the TOPAZ inverters (located on panel H13-PNL 618 in the back of the control room) were out.

Realizing that this meant that these inverters were

deenergized, the operators took the following actions:

'l Determined that the inverter loss'affected residual.

l

-

heat removal (RHR) B&C trains, Division II (Div.II) of

,

(RCIC) and the

!

the reactor core isolation cooling (ADS) and-channel'2 automatic depressurization system of the rod control information system (RCIS).

Requested electricians to determine the cause of the

-

inverter loss.

Reviewed placards on panel H13-PNL 618 to determine

-

what loads were affected.

.

- -

.

.

.

-

_

.

.

R?

Q

,

,

.g

.c b 1. w,

,y y

in-6-

'

,

>

s ReviewedTechnicalSpecifications(TS)to' determine

-

'

'the effect the loss had on the Limiting Conditions for Operations-(LCOs).

'

Wrote a Condition Report (CR) and a prompt Maintenance

'

'

-

Work Order (MWO).

'

-

11:00 a.m.

-The operators closed containinent isolation valves on RCIC

-

as required by TS 3.3.2.

,

11:05 a.m.

- The electricians determined that the TOPAZ inverter loss H

was caused by an apparent-high voltage' spike due to

switching battery charger 1B from " float" to " equalize"

'

mode. The electricians also determined that the inverters

,

had an automatic reset feature and~that a. reset had not

"

occurred (after returning the battery charger to " float")

because the reset voltage on the inverters was. lower than

the " float" voltage.

,

'

11:07 a.m.

_ Based upon the information obt'ained from the: placards on

panel H13-PNlc 618, the operators disabled the following

,

, equipment to: prevent inadvertent actuation when the TOPAZ

~ inverters were reenergized:

'

The_RHR pump circuit breakers for the "B" and "C"

-

pumps were racked out; r

The "B" key switches for the safety / relief valves were

-

placed in the closed, position; The Div II ADS was inhibited; and,

--

t The RCIC trip.and throttle valves were closed.

--

11:11 a.m.

The operators directed electricians to lower the battery charger " float" voltage to allow the TOPAZ inverters to reset. -Upon inverter restoration, a full Div'II ESF

-

actuation occurred which resulted in the-following:

L Starting 'of the Div II emergency diesel generator--

-

!0 (EDG) and control ouilding filter train;

"

'

Opening of service water system valves SWP*MOV 502B

-

and SWP*MOV.503B and closing of valve HVN-MOV 228 to

it's associated containment cooler; l;

Tripping of containment unit cooler "C";

-

L*

~ Initiation of Div II RHR;

-

ls-

.

-

_

$

,-

f

'

a___.,

-

i

'

.~

.;.

.

..

...

.

L-7-Initiation of RCIC; and,

-

Opening'ofLPCIinjectionvalvesE12*M0Y42B-(M0Y-42B)

-

andE12*MOV42C(M0V-42C).

11:13 a.m.

Restored various actuation signals and equipment (except the Div II EOG) to their normal conditions. This included the closing of the LPCI injection valves.

i 11:23 a.m.

Secured Div II EDG and exited procedure A0P-0014.

~

11:26 a.m.

Began warming RCIC system lines in preparation for placing

,

the system in standby.

'

11:35 a~m.

Began-a walkdown of the RHR "B" and "C" LPCI piping and the

.

RHR piping back to the RHR pump rooms.

11:50 a.m.

RCIC system placed in standby. Completed the walkdown of the LPCI piping between the check valves and the MOV-42 valves.

,

12:34 p.m.

Licensee notified NRC of ESF actuation, j

1:00 p.m.-

Completed the walkdowns of the RHR piping back to the RHR

!

'

pump rooms.

-3.2 Review of Operator Response to the Event The team reviewed documentation provided by the licensee and conducted interviews with operations personnel directly involved with evaluating and recovering from the loss of.the TOPAZ inverters. The interviews included the a

shift supervisor (SS), control o erating foreman (C0F),) plant operating foreman'(P0F),unitoperator(U0 at-the-controls (ATC operator, and two nuclear ~equipmentoperators(NE0s). The team was subsequently able to evaluate-operator response to plant conditions at that time, the procedures which were available for reference, the. reasons for the operator determination that a

. "

-quick reset of the TOPAZ inverters was necessary, and the operators' response to the Div 11 actuation.

On February 11,1990, at approximately 10:11 a.m., the control room operators

.

received alarms associated with the DIV 11 safety-related DC bus. The C0F l

i immediately directed the operators to enter abnormal operating procedure A0P-0014 for the apparent loss of the vital'125 volt DC bus. Within

,

approximately 9 minutes of receiving the alarms, the SS and C0F had determined

-!

that the loss of-DC power was not the result of a loss of a DC bus but had

occurred because'of the loss of the TOPAZ inverters located on control room panel H13-PNL 618. No guidance was provided in A0P-0014, or any other procedure, to deal with the loss of these inverters. The C0F noted that the power indicating lights on the TOPAZ unit were not lit during a walkdown of the Div II back panels. The C0F contacted the electrical maintenance department and requested assistance in evaluating the cause for loss of power from the

l

,

,

_

_

-

._

_

,

i j

y, m.

t

-

+

x

. -

,

-8-

.

inverters. The electricians subsequently determined that power was available

'

to the inverters. Because the personnel involved in evaluating the loss of

. power from the TOPAZ inverters believed fuses had blown, efforts were then directed toward' replacing the fuses and ensuring that a fault did not exist downstream of the TOPAZ inverters.

. hile the electricians were reviewing the applicable drawings, the P0F. began W

reviewing the TS requirements for the Div 11 equipment which was affected by.

the loss of the Rosemount. trip units (RTUs) which are supplied from the TOPAZ

,

_

inverters. The P0F utilized the operator aid placards by the affected RTUs to

,

determine what equipment would be affected. The PDF subsequently identified

~

<

that the-Div II. emergency core cooling system (ECCS) was inoperable, placing the plant into a 72-hour shutdown LCO.

In addition, he identified that the DIV II leak detection for the RCIC was inopereble.- He then ordered the RCIC system isolated by closing the steam supply valves.

,

.

,

p e

During this. period, the electricians identified that the TOPAZ inverters did E

'not utilize fuses and that an internal relay had tripped because of a voltage

-

spike to the inverter during restoration from the PM on battery charger 1B.

The electricians also identified that the TOPAZ inverters would automatically

-

L reset'when'the supply bus voltage dropped to approximately 132 volts DC. The L

C0F requested that the actual bus' voltage be determined; it was found to be approximately 133 volts DC.

!

Based on the above information, the SS and C0F became concerned that the TOPAZ

'

cinverters could reset anytime.without their control. They then decided to (

lockout the equipment that they believed could be affected by the reenergizing and resetting of the RTUs. These operators also utilized the operator aid

'

placards _ located next to the trip units to determine'what equipment should be locked out. The SS and C0F subsequently had the Div II RHR pumps."B" and "C" locked out, the Div II' ADS inhibited, and the "B"' key switches for the safety l

relief valves-taken to "close." Based on interviews,.the inspectors noted that i

the-operators were apprehensive about utilizing the electrical' logic drawings to determine what equipment might be affected by. the RTU reenergization. The

~

reason for this apprehension appears to be that the' drawings are lengthy and

-

complicated, i.e., more: suitable for engineering use than for plant operators'

'

use. The SS and C0F indicated that had the TOPAZ inverters not been in an-apparent condition where an_ automatic reset could occur. immediately, that they would have utilized the electrical logic diagrams to fully ascertain the

,

equipment which could be affected by the RTU reenergization.

It was also noted

.that the shift-technical advisor (STA) was not contacted until approximately-

-

= 3: hours after the loss of the TOPAZ inverters and was therefore not available l

'

.to provide additional assistance in evaluating the' event.

Once the operators had locked out the equipment which they believed would be affected by reenergizing the TOPAZ inverters, a shift briefing was conducted to ready all personnel for any unexpected actuations. The C0F coordinated the lowering of the inverter float voltage to allow resetting the TOPAZ units. The operators were stationed at their respective panels. When the TOPAZ units reset, the ATC operator received an alarm of an imminent main turbine trip i

i

.

&

~

w y

,

.,,

,?

.-

,Q.

i

/

c

..

n, p

because of RCIC system actuation. A main turbine trip will result in an

,

automatic reactor scram when the reactor is at full power operation. The i

turbine trip will occur within 15 seconds of the RCIC system initiation. The-UO immediatelyEtripped the RCIC turbine, which reset the main turbine trip.

'

The RCIC system had not actually started because its steam supply lines had

.

>

been previously'= isolated by direction of the PDF. -At this time, the UO:noted the RHR injection valv'es, MOV-42B and -420, stroking open.

In accordance with

."

their training, the operator allowed-the valves:to go completely open before L

.taking action-to reclose them. The open or close stroke time for these valves is approximately:25 seconds. Both valves were reclosed within 2 minutes. At

'

this time the operating crew concentrated.on restoring the remaining ESF components that had actuated including the DIV II EDG, control = building g

,

emergency ventilation-system,' and containment cooling.

,

N'

'Following restoration of the ESF components.and within approximately 20 minutes

!

of_ restoring. power'to the RTUs, the'P0F directed an equipment operator to

'

'

.

-physically walkdown the RHR piping downstream of.the injection valves. This

-

F was-done to verify that no significant backleakage had ' occurred past the check -

valves, E12*F041B and C, that provided the only isolation between~the reactor; vessel which is at high pressure and the low pressure RHR piping. No backleakage was identified during this or a subsequent more' comprehensive walkdown that was-perf ormed about I hour later.

The inspectors concluded:that the operating crew-actions were appropriate given the resources.and trainingsthat-they had at the time to evaluate the event and for. restoration of the RTUs. The operators had not expectoi the full Div II

_ ESF L signal when the RTUs' were reenergized. The operators den.nnstrated that they thoroughly understood the potential for an intersystem loss of coolant

accident (ISLOCA) when they wal ked down the RHR "B" and "C" injertion lines in a timely manner.

The inspectors also considered the operators' actions with regard to keeping.

p the plant operating at full power during the event. The loss of the TOPAZ inverters placed the plant in an indeterminate situation with a high potential l

for equipment actuations and instrumentation losses.. To attempt a plant

.

shutdown under these conditions could have placed the unit, because of the transient, nature of this evolution, in a reduced safety situation. The decision to remain at the stable full power condition was ccnsidered by the inspectors to have been the conservative and appropriate action.

3.3 Residual Heat Removal (RHR) System Design The Div II RHR system consists of two trains, RHR "B" and RHR "C".

RHR "B" is

. designed to operate in the LPCI mode, shutdown cooling-(SDC) mode, or o

suppression pool cooling mode. The RHR "C" system is only capable of operating y

in the LPCI mode.

The RHR "B" LPCI-configuration consists of an inboard containment isolation

"

check valve E12*A0VF0041B (A0V-41B), an injection valve, E12*MOVF0042B L

(MOV-428),-and an outboard containment isolation valve, E12*MOVF0027B

?

(MOV-27B). Position indication for the ADV-41B is provided in the main control

,

,

/

.I

'

--

_ _

_. _

.w

,

'

s

.

.

v.,

,y

,

,

o-10-

,

i room and should indicate closed during all plant conditions except during'

'

"

coolant injection or when used as an alternate path for shutdown cooling. The MOV-42B-injection valve, a motor-operated. valve, is set to open or close against a full reactor coolant differential pressure. This valve is electronically interlocked closJ when reactor pressure is greater than approximately 500 psig.

The piping between the check valve and injection valve is designed for full-reactor pressure and temperature. The piping upstream of MOV-42B was designed

' 'as-ASME Code Class 2 piping with a pressure rating of 500 psig. No relief.

-valves areilocated in the piping between the MOV-278 and MOV-42B valves. The licensee has determined through calculations that this Class 2 pipe-has

, sufficient design margin to withstand full reactor coolant pressure.

The MOV-27B outboard containment isolation valv'e is normally maintained open.

Relief valve protection for the RHR system is provided through three relief valves when the system is in its standby line up. These relief valves will'

,

protect against valve seat leakage, but are not capable of depressurizing the system to 500 psig in the event of. a complete check failure with the MOV-42B

>

valve open. This design appears to be consistent with other plant designs'with.

respect to the relief valve capacities for the protection of low pressure

. systems.

The RHR "C" system consists of the inboard containment. isolation check valve, A0V-410, and an outboard containment isolation valve, NOV-42C. The same design parameters exist for the RHR "C" system, with the exception that the ASME Code Class 1.to Class 2 pipe boundary occurs outside the primary containment.

,

3.4 Review of Procedures for Identifying and Mitigating a Potential ISLOCA The licensee had established procedures which would be used to identify and mitigate a potential ISLOCA. These procedures consist of alarm response procedures (ARPs) and the emergency response procedures (E0Ps).

The ARPs. utilized would include the "RHR pump discharge pressure high/ low" alarm and " injection valve pressure permission to open" alarm. For the Div II RHR systems, procedure ARP-601 17 established the immediate and long-term-actions for these two alarms. These alarms-are annunicated in the-main control

. room and an alarm light is provided directly over the RHR system controls. A J

.high pressure alarm is provided for each of the RHR systems including the low U

pressure core spray (LPCS) system. The pressure is sensed downstream of the.

-pump discharge check valve. This alarm would inform the operators that

,

..

significant backleakage may be occurring past the inboard containment isolation

!

check valve (A0V-41) and the injection valves (MOV-42s). The MOV-42 valves are maintained closed with the reactor vessel pressure greater than 480 psig.

Depending on the rate of leakage past the check valve and injection valve, the

. operators are instructed to relieve pressure. through the RHR "A" and "B" heat

. exchanger vent lines or the RHR "A" or "B" test return lines back to the suppression pool if pressure cannot be controlled through the vent lines.

s-

--

.. -

-

.

. - -

-

- -

- - - - -

- -

- -

-.

-.

_

.

-

--

,

P

!

b

-

..

.a

,

~*

it

'

w-11-

'

During normal plant operation, the piping between the A0V-41 inboard containment isolation check valves and the MOV-42 injection valves will

>

eventually pressurize to normal reactor operating system pressure.- Pressure

' sensing is provided between the MOV-42 valves and the check valves. An

' associated alarm is provided that will annunicate when the pressure within this

pipe is.below approximately 500 psig.

In the event those alarms were to

,

2 annunciate during plant operations, it would indicate that the line was

,

depressurizing due to leakage past the MOV-42 valves that was in excess of the small amount at leakage past the check valves.

,

'In the event'of an actual ISLOCA, the operators would utilize procedures E0P-1

• '

and:E0P-3. Procedure E0P-1 would be entered for any condition requiring an

,

automatic or manual-reactor scram. The enthal

. leakage past the inboard check valves (A0V-41)py associated with significant y

and outboard isolation valves

(MOV-42) would eventually be released to the sup of. a line rupture, into the. auxiliary building-(pression pool or, in the event

,

secondary containment).

Suppression pool temperature and level are limited by the Technical Specifications.

iProcedure E0P-3 would require a reactor shutdown and possible emergency

,

depressurization depending upon the amount of energy released.

The' inspectors' review of those procedures indicated that sufficient indication and guidance is providcd for identifying and mitigating a potential ISLOCA through the low pressure ECCS.

3.5 Programs and Controls to Reduce the Probability of an ISLOCA

'

The RHR system configuration is controlled by the TS, station operating procedures (SOPS),andelectricalinterlocks. Theinservicetesting(IST) program-and maintenance program have been established to ensure that leaka MOV-42 and A0V-41 valves is within the integrated leak rate test (ge past theILRT) limits.

,

' The TS. require that the RHR systems be maintained in standby with the reactor i

in the run, startup-or hot shutdown operating _ modes. Procedure 50P-0031 a

requires.the MOV-42 valves to be aligned closed and the MOV-27 valves (for i

RHR_"A" and "B") to be aligned open. Deviation from the required system lineup places the plant into a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> shutdown LCO.

Electrical interlocks are provided to maintain the MOV-42 valves closed whenever reactor pressure is greater than approximate 500 psig. The MOV-27 valves, which are open during normal operation, receive an open signa _1 along with the MOV-42 valves'on an.ESF signal. The MOV-27 valves can only be opened ~ initially if their respective MOV-42 valves are closed.

The torque switch settings for the MOV-42 valves are set in accordance with correctivemaintenanceprocedure(CMP)'1253. The inspectors reviewed this procedure to verify that the torque switches for the MOV-42A, B, and C valves were set properly to insure that these valves would close against full RCS l

differential pressure in the event of a pipe rupture in the low pressure RHR system.

l

.

.

-

-.

.

. _- - - - -.

-

__.

.-

v::

.

$

,4 e6 g

,

s

->

>

<

V I

+-

g

'

m-12-

'

s

The inspectors' review of-Procedure CMP-1253 encompassed valve torque switch

,

~

setting calculations and charts. As the result of-this review, the inspectors-r

,

concluded that the valve opening torque switch setting required by the procedure t

"

'for the'MOV-42A valve was-insufficient to assure valve opening. When this'

'

' observation was discussed with licensee personnel, the inspectors were informed

-;

+

.,.

thatuthis procedure had not been utilized to set the valve torque switch

settings because no' corrective maintenance had been required. The licensee

!

'

w

.provided sufficient documentation to demonstrate that the valve torque switch

' ' '

was properly _ set. Furthermore, the licensee will physically examine the valve.

-

torque switch-setting during _the upcoming mid-cycle outage scheduled to begin-on March 15.

LThe' licensee performs integrated leak rate testing (ILRT) on the A0V-41 check

~

l valves, MOV-42_ valves, and the MOV-27 valves each refueling outage. The.

'

licensee. performs both full pressure water leakage tests and air leakage tests.

,

on each'of these valves. The A0V-41B check valve failed the initial local leak rate test (LLRT) during the second refueling outage. The upstream MOV-42B valve was found to have 0 gpm leakage. The as-left leakage for the A0V-41B,

,

following repairs,.was 0 gpm.

Review of-the maintenance history for A0V-41B and C valves and the MOV-42B and C valves indicated no significant problems with any of these valves.

.

The licensee has submitted' an IST relief request for both the A0V-41 valves and -

{

-

'

MOV-42' valves to require full stroke testing only during cold shutdown conditions. An interim approval has been granted by the NRC pending final NRC approval of the relief request. During the review of this testing, the

,

inspectors noted that the licensee was full stroke testing the high pressure l

-

core spray -(HPCS) injection valve' (E22*MOVF004) on a-quarterly basis. -The

,

inspector reviewed the surveillance test. STP-203-3301, under which this

,

activity was' performed and found thatLspecific precautionary steps for early detection of back leakage past the inboard containment isolation check valve were not required to be taken. During the inspectors' discussions with R

operations _ personnel, it was determined that an operator was stationed by the-

injection valve when it was stroked to ensure that no back leakage had occurred. :Although the HPCS system is rated for full reactor system pressure,_

the maximum rated temperature for this piping-is approximately-212'F. This-

~

observation was discussed with licensee management and the surveillance test was revised to require direct observation of the HPCS injection valve operation when it is. full stroke tested. The licensee is also pursuing an IST relief

'

. request to stroke valve E22*M0VF004 only during cold shutdown conditions.

(

f3.6' Electrical Systems Description and Response

The inspection team reviewed the ESF system vulnerability to a failure of the j

TOPAZLinverters with1 emphasis on unanticipated equipment actuations that could 5-

. challenge plant operation and desi n.

The inspectors evaluated the design of

-

-the: major-components of interest, reviewed the available information concerning theLFebruary 11 event, interviewed-involved personnel, and discussed the

'_ licensee's planned corrective actions.

p

,

i

-

.

,'t l-

v m

.

.m

.

. -

-.

.

.

. - -. -

...

.

..

,

l

,

s

.

i y M[+ '-

I a

w, R

,

-13-j (

3.6.1 TOPAZ Inverter and Rosemount Trip Unit (RTU) Design and Operation

$

The' TOPAZ inverters provide the source of electrical power for various

~

electricalactuationdevicescalledRosemounttripunits(RTUs). The inverters

'

,

receive their power from a 125 volt DC bus. The inverters convert the 125 volt DC to 120 volt AC, which is then converted to 24 volts DC by.the trip units'

t

- power supply. An internal protective circuit turns the incoming power to the

'

inverter off if the voltage level is higher or lower than preset limits. The.

.

. inverters' design also provides for automatic restoration of the incoming power

- when the voltage returns'to within allowable limits. The automatic shutdown and restart of the inverters was apparently not well understood by operations

,

'

personnel and led-to some confusion during the February 11 event. Since the normal 125 volt DC bus " float" voltage level was maintained above the automatic

-

reset setpoint value of the TOPAZ inverters, the operators had additional time

,

.

- to-diagnose the problem and take precautionary steps prior to restoring power-to the RTUs..

'

Although the cause of the initial-shutdown of the inverter had not been positively-identified, the most probable cause was a sharp increase in the

g"

- output voltage from the battery charger supplying the battery bus. The battery charger (ENB*CHGRIB).wasbeingreturnedtoservicefollowingpreventative

'

- maintenance. As part of the PM procedure being implemented, the electrician placed the charger in the equalize voltage (approximately 138 volts DC) mode of operation for a short period of time. The licensee assumed that the voltage

"

spike' occurred during the' transfer to the equalize mode. The inspectors

reviewed the battery charter's instruction manual and' electrical drawings. The inspectors agreed with the licensee's determination that a rapid voltage-increase would result when switching from normal l(float) voltage (approximately

,

133_ volts DC) to the equalize voltage mode of operation.

.

t Since the licensee did not routinely perform maintenance or surveillance on the

~ TOPAZ inverters, the high. input voltage shutoff setpoin' had not been recently

• verified.- However, the licensee determined that the voltage spike cwsed by

"

-the battery charger was of sufficient magnitude to cause the shutdown of the

'

inverter. The inspectors also reviewed the instruction m e l and electrical drawings for the TOPAZ inverters and found the licensee's determination to be credible.~ Based on,the reviews of the design documentation and physical inspections of the charger and TOPAZ inverters, the inspectors determined that the components functioned as designed when the voltage spike occurred.

In order to restore power to the RTUs,.the operators had the electricians lower the battery charger's output float voltage until the inverters reset voltage-was reached. The inverter reset at a> proximately 132 volts DC. Based on-design information, which indicates tlat the high voltage shutdown trip value is' controlled at approximately 13 volts.DC higher than the automatic reset

value, the high voltage shutdown value was determined to be approximately

, 'n 145~ volts DC. The 145 volt DC value for the inverter shutdown falls within the available data that indicated that the battery but voltage spike exceeded 145. volts DC. When the inverter reset, power was restored to the trip units through the 24 volt DC power supply.

-

y

_..

.

_

-_ -

-

,

3..-

,

..

.

.

.

4J f

old.

The operators had anticipated a number of actuations that would occur when power was restored to the RTUs and had taken steps to preclude the unwanted actuations.- Because of an apparent lack of detailed information on the loads o

energized by the TOPAZ inverters and the effects of restoring power to the i

RTUs, some unanticipated actuations occurred.

A subsequent review of the RTU circuitry indicated that the units functioned as would be expected when power was restored following a period of being deenergized. The RTVs use a comparison of a reference voltage with a signal voltage to establish a trip setpoint. When the power was restored the g,

refetencevoltagewasrestoredalmostimmediately,whilethesignalvoltage

'

expirienced normal circuitry delays. While these delays in establishing a voltage representative of the measured parameter were of very short duration, the trip units recognized an upset condition. -The trip units which compare the reference voltage to the signal voltage, actuate if the difference between the voltage signais exceeds preset limits.

If the trip was set to occur when the signal voittge exceeded the reference voltage, no actuation would occur due to the delay to reestablish the signal voltage. However, if a signal voltage lower than the reference voltage was needed for a trip condition, a trip signal would have occurred because of the delay in reestablishing the representative signal voltage.

The latter situation occurred during the February 11 event for the RTUs which control the Div 11 legic for an ESF actuation due to a preceived low (l.evel 1)

reactor vessel water level condition. The low pressure injection valves from RHR loops B and C (MOV-42B and C) received an open signal because the permissives were satisfied and an erroneous low level signal (which had a trip setting lower than the reference voltage) was detected by the related RTU.

L The inspectors determined that the licensee's actions in response to coping with the electrical problems were acceptable given the availability of information. The licensee informid the inspectors that procedural guidance for dealing with any future inverter shutdowns was being developed.

In addition, the licensee was also evduating modifications to the battery charger circuitry to preclude voltage spikes when shifting to equalize voltage and modifications to the RTU power supply system.

,

3.6.? Battery Charger Maintenance and Operation The inspection teem reviewed the completed maintenance work order (MWO) p537476 e

used to perform preventive maintenance on battery charger ENB*CHGR 1B. The MWO had been completed satisfactory with only one rework which dealt with the adjustment of the float voltage to reset the TOPAZ inverter Pter it had tripped. A visual inspection of the battery charger and a welkdown of the maintenanceprocedure(PMP-1045)withtheelectriciansinvolvedintne maintenance activity was conducted by the inspectors. No discrepancies were found in those areas that would give an indication for the apparent voltage surge / spike output from the battery charger.

The electricians involved with the maintenance activity said they had not observed a voltage surge or noted any unusual conditions. Voltage readings i

>

-

l-

s

,

,

,.....;..

j c'

)

>%

j

!

-15-l>

were taken using a calibrated digital multimeter, and a short time lag existed between the time the charger was shifted from float to equalize voltage and the l

time voltage readings were taken. When the voltage readings were taken, the

- voltage observed by the electricians was within the expected range and the

!

acceptance criteria of the procedure. The inspectors found no cause for the l

apparent voltage surge / spike within the area of the maintenance activity on the

!

battery charger. The electrical maintenance department conducted a search for

'

Condition Reports that identified any occurrences similar to the event of

February 11 and found none. The licensee subsequently tagged the appropriate l

battery charger switches to prevent placing these switches into the equalize voltage mode of operation until appropriate troubleshooting could be conducted.

The licensee plans to conduct troubleshooting of both the battery charger and the TOPAZ inverters during the upcoming mid-cycle outage scheduled to begin on

!

March 15, 1990. The licensee has taken action to. verify the charger

operability by inspecting the charger and conducting checks of the output

!

signal in the float mode of omeration. The licensee did not find any unusual

conditions as the result of t1ese actions and considered the battery charger to i

be operable.

3.7 Licensee Management Response and Corrective Action Plans

{

- As the result of the February 11 event, the licensee promptly formed a task-I force to investigate the event and to develop appropriate corrective actions.

When the AIT arrived onsite on February 13 the licensee conducted a briefing

so that the team was aware of the. licensee's task force progress and was

introduced to the principle members of this task force. During the course of

the inspection the team was kept informed of the licensee's ongoing task force i

investigations and of the developing corrective action plans. -At the end of the inspection, the licensee provided the team with a summary of their

completed and planned corrective actions. These corrective actions included

the following:

'

Subsequent operating shifts were briefed on the event and made cognizant

of the cause, effects, and proper response to this type of event. These

!

briefings were conducted prior to the shifts assuming the watch.

,

Troubleshooting on the battery charger will be conducted during a

mid-cycle outage that is scheduled to begin on March 15.

In the interim,

.

the charger will be checked weekly for proper outputs and the mode selector switch will be left in the " float" position.

The battery charger preventative maintenance (PM) tasks will be deferred

.

to the mid-cycle outage period. The FM procedures will be revised to

.

.

minimize transients that could occur as the result of switching from the

'

" float" to " equalize" modes.

>

-

Load lists will be developed for the TOPAZ inverters. These load lists

will be incorporated into applicable procedures with outlines providing

' specific operator action for loss and restoration.

In addition,

' applicable personnel will be trained on these procedures and hardware.

+

<

-

-,

,

.

.. -,

,,

.

-..

.

- - -

-

- - - - - - - - -

_

_

,

o;*

t

..

.

,

l-16-l

!

PM procedures will be developed for the TOPAZ inverters which will include

'

a voltage trip and reset setpoint check. The Division 11 PM will be performed during the mid-cycle outage and the Division I PM will be

?

performed during the next refueling outage.

,

A design review of the TOPAZ inverters is being conducted to evaluate:

!'

Setpoint changes for these inverters and/or the battery chargers;

-

Possible elimination of the TOPAZ inverters; j

-

The additions of time delays, alternate 24 VDC power supplies, and/or

-

voltage limiters on the battery chargers; and.

A deterMnation as to the validity of having an automatic reset on I

-

these inverters.

!

.

Any required modifications will be performed during the next refueling

'

outage, j

,

A relief request from the IST requirement to stroke quarterly the HPCS

!

injection valve. [22*MOVF004, will be submitted.

'

,

The torque switch setting for the MOV-42A valve will be verified during

the mid-cycle outage.

L 4.

CONCLUSIONS AND FINDINGS

4.1 GSU had no load list and/or procedure for the TOPAZ inverters that would enable a determination to be made of eat loads will be lost. The only information available for operator use were lengthy and complicated electrical

!

. drawings that were not " user friendly."

4.2 No procedures were available to enable operators to contend with a

,

,

loss / recovery of the TOPAZ inverters. The abnormal operating procedure available (A0P-14) only covered the loss of a DC bus, which was not the case in this event.

-

4.3 There was no program to periodically check the operation of the TOPAZ inverters, especially the voltage trip and reset setpoints of these units.

4.4' GSU had not determined the root cause of this event at the conclusion of the inspection. Specifically, the licensee had not confirmed what caused the

,

battery charger voltage spike and whether this spike was an abnormal response

'

or whether the TOPAZ inverters acted abnormally.

4.5 The maintenance and engineering personnel are weak in their understanding of the operation of the TOPAZ inverters and need to better understand the

.' design interface between the battery chargers and the inverters.

..

l-o'

..

l

.

.

!

!

-17-l i

,

4.6 The operator response to the. event was proper considering the amount of

information and training which they had received. The decision to keep the l

plant on-line during response and recovery to the event was considered to be appropriate. The operators gave proper consideration to the ISLOCA as

,

evidenced by their quick reaction to the opening MOV-42B and C valves (maximum

,

open time was about 2 minutes) and their quick decision (within 20 to 25 minutes) to proceed with the pipe walkdowns.

4.7 The plant response to the event was appropriate for the design and plant

.

'

'

conditions at the time of the TOPAZ inverter loss and restoration.

4.8 Procedures were acceptable to cope with this potential ISLOCA event.

l

!

4.9 plant sensitivity to the ISLOCA appeared to be acceptable. This

-

conclusion is based upon the following attributes:

Tight seating check valves (A0V-41A, B, and C) which are subjected to

+

-

LLRTs.

Adequate administrative controls and electrical interlocks over the

-

-

'

operation of MOV-27A and B to preclude overpressurizing the piping between MOV-42A/D and MOV-27A/D.

RHR relief valves that provide for valve seat leakage and therefore

-

provide early detection of such leakage.

The LpCI injection valves, MOV-42B and C, when in the open position

-

should be ca3able of closing against a ISLOCA differential pressure based upon t:1e settings required by the corrective maintenance

!

procedure (CMP-1253). While the team initially identified that MOV-42A might not have had the correct torque switch setting, a subsequent review of plant documentation by both the team and the licensee provide confidence that the valve torque switch is properly

set. GSU has written a CR to investigate the setting of this valve l

and will verify the setting during the mid-cycle outage.

,

Quarterly full stroke testing of the HPCS injection valve

-

-

(IE22*MOV-F004) was not procedurally controlled to ensure that early detection of system backleakage could be determined.

The BWR Owners Group (BWROG) has conducted a study (NEDC-31339)

-

regarding plant vulnerability to an ISLOCA. The study provides information that indicates that a rupture of low pressure piping connected to various high pressure systems would'not-occur. However,

'

this is not an NRC approved study, and the NRC still remains concerned with any event that involves protection of low pressure systems through the use of one check valve. This is considered to be an especially sensitive issue considering the simple power failure that placed the plant in this vulnerable position.

l

..

,

,,

-

..

3,

... '

'

t-18-

.

5.

EXIT INTERVIEW An exit meeting was held at the conclusion of the inspection on February 16,

+

1990. At this meeting. the inspectors sunnarized their findings. The licensee did not identify any of the information discussed as proprietary.

,

,{

s I

r

.

i i f

,;.

.

f

-

-

,

E

L

-,,4

..

o s

ATT!{.HMENT i

Plant Procedures:

A0P-0014, Loss of 125 YDC, Revision 4 ARP-601-17, 601-17 Alarm Response, Pevision 2A CMP-1253, Limitorque Motor Operated Yalves, Revision 6 i

E0P-1, RPV Control, Revision 9 E0P-2, Primary Containment Control, Revision 7 E0P-3, Secondary Containment and Radioactive Release Control, Revision 7

PMP-1045, Quarterly Maintenance of Battery Chargers, Revision 3A SOP-0031, Residual Heat Removal, Revision 6C 30P-0048, 120 VAC System, Revision 5A

SOP-0049, 125 VDC System, Revision 3 i

STP-?03-3301, HPCS Valve Operability and Pump Flow Test, Revision 4

,

STP-204-3304/0304, RHR B Valve Operability

STP-204-3305/0305, RHR C Valve Operability

'

Plant Drawings:

EE-1AC, Startup Electrical Distribution Chart, Revision 2

-

EE-17J 125 VDC One Line Diagram, Revision 11 828E534AA, Sheets 4, 6 and 7. GE Elementary Diagram RHR System

IDT-641, Power Conversion Products Battery Charger Schematic

'

10F-641A, Power Conversion Products Battery Charger Wiring Diagram

P&lD-27-7B, Residual Heat Removal, Revision 19 P&lD-27-7C. Residual Heat Removal, Revision 14

!

Equipment Technical Manuals:

,

Power Conversion Products, Inc., Instruction Manual - Three Phase Thyristor Controlled Model No. 35D-130-200 Battery Charger, dated July

1976

,

TOPAZ Electronics Operating and Instruction Manual, Static Inverters,

!

dated February 1977 e

-

Maintenance Work Orders (MWO):

P537476 - To perform PMP-1045 i

'

R114011 - Pressurization Test of RHR C R038474 - 1E12*MOVF042C

-

R127115 - RHR pressure isolation valve leakage test check valve had

excessive leakage rate R61952 - IE12*MOVF042C breaker tripped

'

ConditionReport(CR) 86-1515 Inverter Calibration in accordance with LD1-2715 BWROwnersGroup(BWROG)ReportNEDC-31339 RiverBendStationPumpandValveProgram(throughRevision5 including relief requests)

"

._.

_

s,~e o

,

o

.

I-

.z.

l NRC letter J. Calvo (NRC) to J. Deddens (GSU), Inservice Testing Program for Pumps and Valves, August 31, 1987

NRC Generic Letter 8910, Safety Related Motor-Operated Valve Testing and Surveillance, June 28, 1989 LicenseeResponsetoGenericLetter89-10,J. Booker (GSU)toNRCDocument Control Desk. December 20, 1989 NRC Generic Letter 89-04, Guidance on Developing Acceptable Inservice Testing Programs, April 3, 1989

,

!

Various Control Room Leg pages that encompassed the event date/ times Motor Operator C lations, C18303210025, dated August 30, 1983 f

Technical Details, SMB-2 Torque Switch Setting Chart, Limitorq:e (0901-211)

,

Limitorque Switch Setting Information, Order No. 3K5294A

..

Security Access Records covering the event period l

Summary of Local Leak Rate Test (LLRT) data

'

MWO History for Valves E12*A0VF0041B, E12*MOVF0042B, E12*A0VF00410, and E12*M0VF0042C t

Field Sketch (FSK) 27-4, Standard Line Designations Table (CSH),

'

Issue 43

!

StoneandWebsterEngineeringCorporation(SWEC)DataSheet, Technical Data Sheet Safety and Relief Yalves, Revision 1

.

SWEC Calculation Number AX71K3, pp. 13-16, 18, and 93~

SWEC' Calculation Number AX710, Revision 2, pp. 18, 63, 114, 125, and 126 i

SWEC Pipe Stress-Work Sketch, Residual Heat Removal - Reactor Building, pp. 2 and 3

.

l r

)

L l

-