ML18149A211
| ML18149A211 | |
| Person / Time | |
|---|---|
| Site: | Millstone, Surry, 05000000 |
| Issue date: | 07/03/1986 |
| From: | Ashe F NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | |
| Shared Package | |
| ML18149A210 | List: |
| References | |
| TASK-AE, TASK-E607 AEOD-E607, NUDOCS 8607110304 | |
| Download: ML18149A211 (5) | |
Text
-
AEOD ENGINEERING EVALUATION REPORT*
UNITS:
Surry Unit No. 1 and Millstone Unit No. 2 DOCKET NOS.:
50-280; 50-336 LICENSEES:
Virginia Electric & Power Company; Northeast Utilities NSSSs/AEs:
Westinghouse/Stone & Webster Engineering Corporation; Combustion Engineering/Bechtel REPORT NO.:
AEOD/E607 DATE:
July 3, 1986 EVALUATOR/CONTACT:
F. Ashe
SUBJECT:
DEGRADATION OR LOSS OF CHARGING SYSTEMS WITH SWING PUMP DESIGNS
REFERENCES:
SUMMARY
- 1.
Virginia Electric and Power Company, LER 85-011, Docket No. 50-280, July 26, 1985.
- 2.
Northeast Utilities, LER 85-009, Docket No. 50-336, July 10, 1985.
- 3.
Northeast Utilities, LER 85-009 Rev. 1, Docket No. 50-336, December 11, 1985.
A study was performed to review and assess information concerning degradation or loss of charging systems due to design deficiencies in attendant interlock circuitry or inadequate maintenance procedures.
The review of these areas was limited to charging systems using swing pump designs (i.e., its motor can be aligned to either of two electrical buses) since the events which were identified only involved such designs.
The recently identified deficiencies remained undetected since the plants initially went into operation.
The related safety concern is that these deficiencies could result in the degradation or loss of the charging system.
The review did not identify any reported deficiencies other than those found at Surry Unit 1 and Millstone Unit 2.
However, due to the types of deficiencies identified, and the apparent length of time (i.e., 10 to 13 years of commercial operation) which had elapsed before the problems were found, these or similar problems could exist at other plants. Accordingly, the report suggest that an IE Information Notice be issued to inform licensees of the identified deficiencies, which potentially could exist in other plants that use swing pump designs.
DISCUSSION Surry Unit 1 On June 26, 1985, Surry Unit 1 was operating at 100 percent power with the 1A 1 charging pump out of service for maintenance.
With the 1A 1 pump already out of service, operators proceeded to rack out the 1B 1 charging pump motor breaker (15J5) in order to perform maintenance on the 1 B 1 pump (Reference 1).
- This document supports ongoing AEOD and NRC activities and does not represent the po~ition or require~ents of the responsible NRC program office.
8607110304 860703 PDR ADOCK 05000280 S
e e
When the 18 1 breaker was racked out, the normal feeder breaker (15H6) for the operating 1C 1 charging pump motor tripped due to an electfical interlock.
With the 1A 1 and 18 1 pumps out of service and the 1C 1 charging pump motor breaker tripped, all charging (also high head safety injection) and reactor coolant pump seal injection flow were unavailable.
Within approximately one minute, the operator immediately racked in breaker 15J5 (breaker for 18 1
charging pump motor) and the 1C 1 charging pump motor restarted. With the 1C 1
pump operating again, an electrical jumper was installed in breaker cubicle 15J5 to prevent the breaker for the 1C 1 charging pump motor from tripping.
Breaker 15J5 was then racked out.
The cause of the event was attributed to the following conditions:
0 0
The procedure used to remove the 18 1 charging pump from service failed to include adequate precautions about existing breaker interlocks.
The senior operator in charge failed to adequately evaluate the consequences of performing the procedure under the given plant conditions.
(That is, two of the three charging pumps inoperable.)
The interlocks associated with breakers 15H6, 15J2 and 15J5 are designed such that breaker 15H6 trips when breaker 15J5 is racked out or breaker 15J2 is racked in.
(See the attached Figure 1.)
In addition, breaker 15J5 and 15J2 are interlocked such that breaker 15J5 trips when breaker 15J2 is racked in.
Further, breakers 15H5 and 15J2 are interlocked such that breaker 15H5 trips when breaker 15J2 is racked out and an undervoltage condition exists. These interlocks are provided to ensure that each of the two emergency buses (Hand J) may provide power to only one charging pump motor.
(Note, that for the event described above, the J bus was not providing power to any charging pump motor.)
Personnel involved were re-instructed on the operation of existing breaker interlocks.
Labels providing warning information relating to the existing interlocks were also attached to the breaker associated 0ith the charging pump motors.
Further, the interlock logic was included in the operator requalifi-cation program, and procedures used to operate the charging pumps were revised to include a description of the associated breaker interlocks.
Millstone Unit 2 On June 11, 1985, during routine testing on the Millstone Unit 2 simulator, an apparent design deficiency was identified in the circuitry attendant to the 18 1 charging pump motor (Reference 2).
The 18 1 charging pump is a swing pump and, as such, its motor can be aligned to either of two electrical power buses.
These two power buses are labeled as Facility 1 and Facility 2.
The problem identified on the simulator resulted in the 1 8 1 pump being rendered inoperable following a loss of normal power for the facility bus opposite to the one to which the 18 1 charging pump motor was aligned.
For example, if the 18 1 pump motor was aligned to the Facility 1 bus and the Facility 2 bus lost power, the 'B' pump would be inoperable even though power would be available for its pump motor from the Facility 1 bus (i.e., because of interlocking circuitry, power must be available on both buses before the starter contactors will close from either bus).
There is no apparent rational for this configuration.
Subsequent investigation of the actual plant circuit design revealed that due to the logic associated with the "kirk-key" interlocks and diesel sequencing, the existing circuitry would render the 18 1 pump inoperable following such a loss of power.
A modification to the circuit design was immediately implemented to prevent inoperability of the 18 1 charging
- i e
e pump for such a situation.
In addition, to determine whether a similar problem might exist with other safety-related swing pumps at the station, a review of other potentially affected circuits was undertaken.
The review failed to identify a similar problem with other similar circuits.
Reference 3 provides additional information concerning the circuitry associated with the charging pump motors addressed in Reference 2.
This additional information included electrical diagrams for the circuitry involved.
Reference 3 also indicated that Northeast Utilities (the licensee for Millstone 2) determined, subsequent to the submittal of Reference 2, that the design error could be a generic problem applicable to other nuclear stations with similar charging pump designs.
However, no specific stations were identified by the reference or as a result of our follow-up activities.
Potential Generic Applicability Searches of the RECON and Sequence Coding and Search System data bases were performed in order to determine if other similar events or situations involving interlock circuitry or maintenance procedures associated with swing charging pump motors had been reported at any other plants. These searches did not result in the identification of any other similar events or situations.
Even so, the above or similar design deficiencies in interlock circuitry or inadequate maintenance procedures could exist at other specific stations which have charging systems with swing pump designs.
These or similar problems are likely to exist at some other stations with these designs, and are likely to remain undetected, because the specific set of circumstances and/or conditions necessary for them to be readily identified are unlikely to have occurred.
Clearly, these types of problems would not necessarily be identified and corrected during the design review process or routine testing.
Safety Sig~ificance The safety significance of the situations described above is that degradation or loss of charging systems with swing pump designs could occur at a time when needed such as during a LOCA.
Such degradation or loss may be attributed to design deficiencies in interlock circuitry and/or inadequate procedures which address maintenance associated with such designs.
Further, such a design or procedural deficiency could remain undetected during normal operation and surveillance testing.
(At the Surry 1 and Millstone 2 plants, the deficiencies apparently remained undetected since the beginning of operation of the units.)
In addition, the event at Surry illustrates why the practice of performing maintenance on more than one train of equipment in a system simultaneously should be limited or be reviewed and planned carefully prior to actual implementation.
FINDINGS AND CONCLUSIONS Based on the information presented in the discussion above, the following findings and conclusions are provided:
- 1.
The events described above illustrate how the safety function of charging systems using*swing pump designs can be degraded or lost due to design deficiencies in attendant electrical circuitry -or inadequacies in maintenan~e procedure~.
e e
- 2.
The event described in Reference 1 illustrates how the practice of performing maintenance activities on more than one train of equipment simultaneously (e.g., in safety system designs with swing pump arrangements) can result in a total loss of the safety function.
This event also illustrates why this maintenance practice should be limited -0r at least the attendant circuitry reviewed carefully to identify potential negative effects prior to conducting maintenance activity.
- 3.
The type of deficiencies identified at Surry Unit 1 and Millstone Unit 2 for swing pump designs are such that design reviews and/or routine testing would not be expected to detect them.
The identified deficiencies in interlock circuitry or maintenance procedures are such that the occurrence of a specific set of circumstances or conditions is necessary in order to readily detect them.
The likelihood of the occurrence of such circumstances and/or conditions is small.
This is evidenced by the fact that Surry Unit 1 and Millstone Unit 2 operated for 10 years and 13 years, respectively before the deficiences were uncovered.
Therefore, these or similar deficiencies may very well exist at other plants which use safety systems with swing pump designs.
SUGGESTED ACTION The identified deficiencies potentially exist at other plants which have swing pump designs.
Accordingly, it is suggested that an IE Information Notice be issued to inform other licensees of the specific deficiencies identified for the charging systems at Surry Unit 1 and Millstone Unit 2.
BUS 'H'
)
BREAKER 15H5
'A' CHARGING PUMP MOTOR e
)
BREAKER 15H6
- c*
CHARGING PUMP MOTOR e
BUS 'J'
)
)
BREAKER BREAKER 15J2 15J5
'B' CHARGING PUMP MOTOR Figure 1 -
Simplified Single Line Diagram Illustrating Electrical Interconnecting Arrangement Between Charging Pump Motors. Attendant Circuit Breakers.
And Buses At Surry Unit 1.