Text

LER 98-002-00:on 980513,discovered Potential LOCA-initiated Electrical Fault Which Places ECCS Outside Design Basis. Caused by Inadequate Review of Effect on non-safety Circuit failures.Re-powered PC-*-600A Relays
	ML17354A974
Person / Time
Site:	Turkey Point
Issue date:	06/09/1998
From:	Mowrey C; FLORIDA POWER & LIGHT CO.
To:	;
Shared Package
ML17354A973	List: ML17354A972; ML17354A974;
References
	LER-98-002-02, LER-98-2-2, NUDOCS 9806160124
	Download: ML17354A974 (12)
	v • d • e

LICENSEE EVENT REPORT (LER)

DOCKET NUMBER (2) PAGE 3)

FACILITY NAHE (1)

TURKEY POINT UNITS 3 & 4 05000250 OF TITLE (4) Potential LOCA-Initiat:ed Electrical Fault Places ECCS Outside Design Basis EVENT DATE (5) LER NUMBER(6) RPT DATE (7) OTHER FACILITIES INV. (B)

MON DAY YR YR RI MON DAY FACILITY NAMES DOCKET 4 (S) 98 98 00 98 Turkey Point Unit 4 05000251 OPERATING MODE (9)

PONER LEVEL (10) 40/100 LICENSEE CONTACT FOR THIS LER (12)

Telephone Number C.L. MOWREY, COMPLIANCE SPECIALIST (305) 246-6204 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT (13)

CAUSE SYSTEM MANUFACTURER EPIX2 CAUSE SYSTEM COMPONENT EPIX2 EXPECTED MONTH SUPPLEMENTAL REPORT EXPECTED (14) = NO YES Cl SUBMISSION DATE (15)

(ii yes, cmrplete EXPECTED SUBMISSION DATE)

ABSTRACT (16)

During a design review of the 120 volt AC instrument busses, Florida Power &

Light Company discovered that faults associated with instrument panel 3(4)P06 .

could result in opening of a vital instrument bus breaker causing loss of power to pressure control auxiliary relay PC-*-600X. A loss of "B" power to this relay would prevent Emergency Core Cooling System (ECCS) train valve MOV-*-863B from being opened using existing procedures. This valve is required to be opened post-accident to permit emergency sump recirculation in the "piggy-back" mode of operation, in which a Residual Heat Removal pump pzovides suction boost to the Safety Injection and/or the Containment Spray pumps. The redundant ECCS train "A" pressure controller relay PC-*-601X is properly designed. If, in addition to the mechanistic failure of MOV-*-863B described herein, a single failure of MOV-

-863A is assumed, emergency recirculation in piggy-back mode will be lost, with the potential for inadequate core cooling. This is a condition outside the design basis of the plant.

The cause of this condition was inadequate review of the effect of non-safety circuit failures on safety related equipment, when the PC-*-600X/601X relays were repowezed in 1984.

The PC-*-600X relays have been repowered.from a safety related power supply.

Turkey Point is evaluating separation and breaker/fuse coordination for other equipment powered from the 120 VAC instrument panels.

9806160124 980609 PDR ADOCK 050002SO S PDR

LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 98-002-00 2OF7 I. DESCRIPTION OF THE EVENT While performing an evaluation of separation and breaker/fuse coordination for equipment powered from the safety related 120 VAC instrument panels [EF:pl], Turkey Point's Design Engineering Group identified a safety concern related to the separation and coordination of power provided to safety related pressure control auxiliary relay PC-*-600X [BP:68] supplied for each nuclear unit (PC-3-600X for Unit 3, and PC-4-600X for Unit 4). This relay provides a pressure inte'rlock to prevent opening of train "B" safety related motor operated valve MOV-*-863B [BP:isv] in the event of high Residual Heat Removal (RHR) system operating pressure. A loss of power to this relay would prevent the opening of MOV-"-863B when required for the recirculation phase of a Loss-of-Coolant Accident (LOCA). Power to the redundant train "A" pressure controller relay PC-*-601X, which interlocks train "A" valve MOV-*-863A, is properly designed.

For the Emergency Core Cooling System, Turkey Point's Updated Final Safety Analysis Report (UFSAR) states in Section 6.2:

"Redundancy and segregation of instrumentation and components is incorporated to assure that postulated malfunctions will not impair the ability of the system to meet the design objectives. The system is effective in the event of loss of normal plant auxiliary power coincident with the loss of coolant, and can accommodate the failure of any single component or instrument channel to respond actively in the system."

A single failure is a single active failure of a component. A component or device that fails as a consequence of the initiating event is not considered a single failure.

The safety injection [BQ] and RHR [BP] systems provide adequate emergency core cooling following a LOCA. Adequate injection is initially provided through use of accumulators and injection of water from the Refueling Water Storage Tank (RWST)

[BP:tk] using the High Head Safety Injection pumps (HHSI)(high pressure injection)

[BQ:p] and RHR pumps (low pressure, high volume injection) (BP:p]. When the RWST is depleted, sufficient water from spilled coolant and safety injection is available on the floor of containment such that suction for the emergency core cooling pumps can be transferred to the. reactor containment recirculation sumps [NH; rvz], i.e., the floor of containment. In recirculation, the RHR pump takes suction from the containment sumps and provides flow to the suction of the HHSI and Containment Spray (CS) [BE] pumps as required ("piggy-back" operation), which includes a flow path through MOV-*-863A and/or MOV-*-863B.

In the process of transfexxing to containment recirculation, numerous motor operated valves are realigned using plant procedure EOP-ES-1.3, "Transfer to Cold Leg Recirculation." Prior to full depletion of the RWST, the RHR loop is isolated from the RWST by stopping the RHR pumps, isolating the suction valves to the RHR pumps

,(MOVs-*-862A and 862B) and opening the recirculation sump isolation valves (MOVs-*-

860A and B, and MOVs-"-861A and B). When sufficient water is available in the containment recirculation sump, the RHR,pumps are restarted in recirculation mode back to the care. Operation in the piggy-back mode (an RHR pump providing suction boost to the HHSI and/or CS pumps), is required when continued containment spray operation is needed long term and/or when Reactor Coolant System (RCS) [AB] pressure remains above RHR shutoff head. If piggy-back operation is required, RHR recirculation back to the core is isolated (close MOVs-*-744A and B). During this time, a HHSI pump and a CS pump continue to take suction from the RWST. When the

~ )

LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 98-002-00 3 OF 7 RWST is depleted, the HHSI and CS pumps are stopped and the RWST is isolated (close MOVs-*-864A and B). Then the recirculation isolation valves from the RHR to SI pumps are opened (MOV-*-863A and B) and a HHSI and CS pump are restarted.

The 120V Instrument AC System has four sets of equipment for each unit, each set consisting of a 7.5 kVA,'125V DC/120V AC inverter, distribution panel, static transfer switch and an associated constant voltage transformer (CVT) for alternate 120V AC supplied from a vital Motor Control Center. Each inverter is normally

, powered by a separate bus of the vital DC system.

Technical Specification 3/4.5.2, "ECCS Subsystems T,~ Greater than or Equal to 350 Degrees F, " provides the requirements for ECCS operation at power. This specification requires the operability of four HHSI pumps, two RHR pumps, two RHR heat exchangers, an operable flow path from the RWST, and two operable flow paths from the containment recirculation sump. With a required ECCS component (other than a HHSI pump) or flow path inoperable, the inoperable component or flow path must be restored within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or the affected unit placed in HOT STANDBY within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in HOT SHUTDOWN in the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The design basis of the safety injection system is, in part, to provide adequate core cooling for the injection and recirculation phases of a LOCA, considering a Loss-of-offsite Power (LOOP) and a concurrent single active failure. As a result of the, accumulation of water on the floor of containment fr'om a LOCA, certain non-safety related components are expected to become submerged, potentially causing a fault that would open vital AC panel breaker 3(4) P06-10, with the consequence that power is lost to PC-*-600X. A simplified wiring diagram is included with this report to aid in understanding the issue. Loss of power to this pressure control auxiliary relay will have the consequence that MOV-"-863B cannot be opened by an operator using existing procedures to permit containment sump recirculation in piggy-back mode. If, in addition to the mechanistic failure of MOV-*-863B described herein, a single failure of MOV-*-863A is assumed, emergency recirculation in piggy-back mode would be lost, with the potential for inadequate core cooling. This condition is outside the plant's design basis, and reportable in accordance with 10 CFR 50.72(b)(ii)(B). This concern was reported on May 13, 1998

'I.

CAUSE OF THE EVENT The cause of this event was cognitive personnel error, in 1984, on the part of utility non-licensed personnel. Pressure control auxiliary relays PC-*-600X and PC-

"-601X were repowered in 1984 in response to a design deficiency discovered at that time (and reported in LER 250/84-18). During the design process to repower the relays, it is apparent that the design engineer was not aware that non-safety instruments were also powered from 3(4) P06-10. At the time these devices were repowered, certain design tools, such as a vital AC load list and the Total Equipment Database-were not available to engineering personnel. These enhanced configuration control documents would have significantly reduced the potential for this design error. Plant actions were taken in the mid to late 1980s to improve the quality and usability of design information as part of the Performance Enhancement Program (PEP).

i(

LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 98-002-00 4OF7 III. ANALYSIS OF THE EVENT Pressure control relay PC-*-600X is powered from breaker 3(4)P06-10 on safety related 120 volt AC instrument bus 3(4) P06. The 120 VAC vital instrument busses are powered from inverters [EF:invt] which are backed by the plant safety related batteries

[EJ:btry]. Because of specific issues related to instrument panel operation when powered from inverters, the instrument busses use high speed, magnetic only, breakers to prevent an instrument fault from tripping the instrument bus.

The condition reported herein involves a specific set of devices powered from vital instrument breaker 3(4) P06-10 (a 10 amp high speed breaker) . These are shown on the attached simplified diagram (page 7). Each of these devices was evaluated, and only the loss of PC-*-600X resulted in a reportable condition.

In the event of a LOCA, the containment recirculation sump will fill with water as the RWST is depleted: The LOCA may submerge the Reactor Coolant Drain Tank (RCDT) instrumentation powered from 3(4) P06-10 and would expose all of the non-safety related instruments inside containment to environmental conditions for which they have not been qualified. The submergence or environmental conditions affecting these non-safety related, non-qualified devices would be expected to result in a fault that would open 3(4) P06-10.

When less than 155, 000 gallons are available in the RWST, the operator would transition to EOP-ES-1.3, "Transfer to Cold Leg Recirculation." As stated above, the RHR pumps aze initially placed in the recirculation mode when sufficient water is available in the sump. A decision is then made whether to directly inject using the RHR pumps or to operate in the piggy-back mode of operation to permit operation of the SI and/oz CS pumps. Based on analysis, the expected conclusion for small (less than 2 inch diameter) to large break, events is that piggy-back operation is required.

The expected decision point at Step 17 of EOP-ES-1.3 is to go to piggy-back operation. Given the condition described herein, at Step 22, while realigning MOVs-

-863A and B, MOV-*-863B would not open due to loss of power to PC-*-600X. With an assumed single failure of MOV-*-863A or its power supply, piggy-back operation cannot be established without additional, non-proceduralized actions. Following the Response Not Obtained (RNO) in Step 22, the operator would reopen MOVs-*-744A and B to permit cold leg injection from the RHR pumps directly into the RCS. Depending on RCS pressure, however, this RNO step may not provide any flow to the RCS.

For large and intermediate break LOCAs, the result of the significant depzessurization that occurs due to the break size is that recirculation will be available using the RHR pumps for direct injection into the RCS. Therefore, adequate core cooling can be maintained.

For small breaks analyzed in the UFSAR (2, 3, and 4 inch breaks), RCS pressure remains above 200 psig until the transient was terminated. This pressure is greater than the shutoff head of the RHR pumps, precluding direct injection.

Because the small break LOCA analyses in. the UFSAR terminate before transfer to recirculation is expected to occur, an assessment of plant response to several small break events was performed using the plant simulator. A break of approximately 2.3 inch diameter was run assuming a loss-of-offsite power (LOOP) with a single failure of an Emergency Diesel Generator (EDG)[EK:dg]. This break was chosen because it is one of the smallest break sizes for which containment spray would be expected to actuate, and thus would result in a relatively rapid drain down of the RWST (drain down in about 2.25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months ), a high decay heat at transfer to recirculation, and would likely require piggy-back operation due to high RCS pressure. This break was, found

LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 98-002-00 5 OF 7 to result in sufficient RCS depressurization to allow direct injection into the RCS using the RHR pumps without piggy-back operation.

A smaller break of approximately I inch diameter was also run on the simulator assuming LOOP and an EDG failure. This break was selected because containment spray would not be expected to actuate. With no containment spray, between 6 and 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months would be required to drain the RWST to the point that transfer to cold leg recirculation would be required. For these very small breaks, accumulator injection may not occur. After the initial break and blowdown, the HHSI pumps would be able to maintain RCS pressure at a reasonably high level. Following an initial temperature soak on the RCS, a cooldown using the atmospheric steam dumps would be performed.

is expected that RCS subcooling would also be restored as a result of this cooldown.

It Following cooldown, the pressurizer would be refilled by opening the Power Operated Relief Valves (PORVs)[AB:rv). Based on simulator operation, RHR entry conditions would be reached following cooldown and depressurization within two to three hours, with most of the RWST volume still available. At this time operators would place the unit in a normal RHR alignment, with HHSI and charging used as required to maintain pressurizer level. If normal RHR can not be aligned for some reason, transfer to cold leg recirculation could be performed when the RWST is drained (6 to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months into the transient). Direct recirculation through MOVs-*-744A and B would be expected to result in 400 g.p.m. flow or greater into the RCS. The PORVs could also be used in this case to permit additional RCS depressurization to support cold leg recirculation using the RHR pumps.

The inability to go into the piggy-back mode of operation potentially affects t'e containment response to a loss of coolant accident. Inability to provide containment spray is most significant for a larger sized LOCA where greater containment pressurization occurs. Containment pressure and temperature peak very early in the accident and have already started to decrease when the transfer point to cold leg recirculation is reached. Previous analyses performed for FPL demonstrate that containment spray is secured at 30 minutes after a LOCA, two emergency containment if coolers are capable of maintaining containment temperature and pressure below the peak found in the analysis. While only one emergency containment cooler is assumed to automatically start, a second cooler would be manually started by operator action prior to transfer to cold leg recirculation. The loss of containment spray for containment cooling represents a long term environmental qualification concern.

would therefore be acceptable to restore spray within several days and avoid It environmental qualification concerns'ased on the preceding analysis, loss of the piggy-back mode of operation would not impact the ability to provide either adequate core cooling or adequate containment heat removal. Additionally, actions would have been possible after a LOCA to identify and correct the concern, and restore piggy-back operation should been desired. Therefore the health and safety of the public would not have been it have adversely affected.

Operability is defined in the Technical Specifications as:

"A system, subsystem, train, component or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified function(s), and when all necessary attendant instrumentation, controls, electrical power, cooling or seal water, lubrication or other auxiliary equipment that are required for the system, subsys'tern, train, component, or device to perform its function(s) are also capable of performing their related support function(s)."

LICENSEE EVENT REPORT (LER) TEXT CONTINUATION FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 98-002-00 6 OF 7 The analysis described above demonstrates that, as a consequence of an accident, one recirculation loop, i.e., MOV-*-863B, could become inoperable in that the valve could not be opened by operator actions specified in current procedures. Accordingly, MOV-

-863B was declared inoperable.

The Train "A" recirculation loop is properly protected and will not fail as a consequence of the condition reported herein. Relay PC-3-601X is powered from breaker 3P22-09. Relay PC-4-601X is powered from breaker 4P24-06. There are no other devices powered by these breakers. Therefore MOV-*-863A remained OPERABLE.

Declaring MOV-863B inoperable on each unit placed each unit in a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months action statement under Technical Specification 3/4.5.2.a.

IV. CORRECTIVE ACTIONS

1) PC-*-600X has been repowered from a dedicated, appropriately protected, safety related power supply (bzeakers 3P21-09 and 4P23-05). There are no other loads on these breakers.

2) Drawings are being revised to reflect the change of power supplies to PC-*-600X.

3) Turkey Point is evaluating separation and breaker/fuse coordination for other equipment powered from the 120 VAC instrument panels.

4) Since 1984, enhanced design information and design basis information, including enhanced configuration contzol documents (vital AC load list, Total Equipment Database) have been made available for engineering use, which would minimize similar personnel design errors.

5) Since 1984, design change instructions have been revised to require consideration of electrical separation criteria and other critical design criteria.

6) In the late 1980's, Turkey Point completed a design basis reconsititution program, resulting in a set of Design Basis Documents, which further aid in ensuring design criteria are considered.

V. ADDITIONAL INFORMATION Similar events: LER 250/84-18 reported the original design deficiency in the control circuitry for MOV-*-863A and B.

B. EIIS Codes are shown in the format [EIIS SYSTEM: IEEE component function identifier, second component identifier (if appropriate)].

C. A simplified one-line wiring diagram showing the devices powered from breaker 3(4) P6-10 is attached, to aid in understanding the reported condition.

(i' LZCENSgE NT REPORT (LER) TEXT ONTZNUATXON I

FAClLETY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNlT 3 05000250 98-002-00 7 OF 7 3QR47 3P06 FCCO WATER CONTROL 4 RCACTOR TRIP ANNVH RCtAYS RNR RCIAY PC dOOX MOY-5-IISC-X CYCS IHTCRLOCK I OA SETWEEN LCY 115C ANO LCY 1159 SORATIOH CONTROL AVX RELAYS FIC 5 154X FIC 5 154 795200 RCP SCAL WATER SYPASS UIW FLOW LT 5 470 PRESSVRIZER REUL'F TANK LYL TRANS 14 FT CL OISIOE SIO WALL L'f-5 100$

REACTOR COOtANT ORAIH TANK LYL TRANS 14 fT CL INSIOE e)0 WALL FIC 5 d29 RCP SA CCW RETVRH fLOW SY PASS ROTAMCTER 14 fT CL OVTSIOC SIO WALL TT 5-1055 REACTOR COOLANT ORAIH TANK TEMP TRANS 14 FT CL INSIOC CONTAINMENT SIO WAIL

"I l

ML17354A974

Text

Navigation menu

Search