ML19282A920
| ML19282A920 | |
| Person / Time | |
|---|---|
| Site: | Cooper  |
| Issue date: | 02/16/1979 |
| From: | Seyfrit K NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | Pilant J NEBRASKA PUBLIC POWER DISTRICT |
| References | |
| NUDOCS 7903080330 | |
| Download: ML19282A920 (1) | |
Text
CErlTRAL FILES j,n meco UNITED STATES PDR:HQ f,.
[o NUCLE AR RECULATORY COMMISSION LPDR
[ \\*-
g REGION IV
[4 y4
,, r 611 RYAN PL AZA DRIVE, SUITE 1000 8
ggyg ARLINGTON, TEXAS 7G011
/
February 16, 1979 Docket HJ. 50-293 k
Nebraska Public Power District ATTri: Mr. J. M. Pilant, Licensing &
Quality Assurance Manager Post Office Box 499 Columbus, Nebraska 68601 Gentlemen:
This Infomation Notice is provided as an early notification of a possibly significant matter.
It is expected that recipients will review the information for possible applicability to their facilities.
No specific action or response is requested at this time.
If further flRC evaluations so indicate, an IE Circular, Bulletin or flRR Generic Letter will be issued to recommend or request specific licensee action.
If you have questions regarding this matter, please contact the Director of the appropriate NRC Regional Office.
Sincerely, 7
~
- . j
'~3 Y
%i. j,'y(JUfy ^
- 9 Karl V. Seyfrit f I Director
Enclosures:
1.
IE Information Notice No. 79-04 2.
List of IE Information Notices Issued in 1979 1903080 330
UtlITED STATES flVCLEAR REGULATORY COM14ISSION OFFICE OF IflSPECTION AtlD EllFORCEf4EflT WASillflGT0tl, D.C.
20555 IE Information flotice flo. 79-04 Date:
February 16, 1979 Page 1 of 5 DEGRADATI0tl 0F EllGIflEERED SAFETY FEATURES Summary:
On September 16, 1978, an unusual sequence of events occurred at Arkansas fluclea'r One, Uni ts 1 and 2.
The events involved the electrical power sources and culminated in the spurious activation and degraded operation of Unit 2 Engineered Safety Features (ESF).
Analysis of the course of the incident has identified three safety concerns in the electrical distribution system operation and design.
(1) The offsite power supply for Atl0 Unit 1 Engineered Safety Feature loads was deficient in that degraded voltage could have resulted in the unavailability of ESF equipment, if it were to be needed.
(2) The design of the Afl0 site electrical system that provides offsite power to Units 1 and 2 did not fully meet the Commission's Regula-tions, 10 CFR 50, Appendix A, General Design Criterion 17, because in certain circumstances a loss of one of the two offsite power circuits would also result in a loss of the other such circuit.
(3)
Deficiencies existed in the operation of the Unit 2 inverters that convert DC to AC power for the uninterruptable 120 volt vital AC buses.
Description of Circumstances:
Initially Unit I was operating at 100 percent power; Unit 2 was in hot standby performing hot functional testing in preparation for initial criticality and power operation lf.
Unit 1 auxiliary electrical loads were being supplied from the Unit 1 main generator via the unit auxi' ?ary transformer.
from the offsite grid through Startup Transformer flo. 3. Unit 2 auxiliary el The normal operating status was interrupted by the failure of the Unit 1 Loop "A" liain Steam Line Isolation Valve (MSIV) air operator solenoid causing the MSIV to close as designed.
The Unit 1 Reactor Protection System censed conditions requiring reactor shutdown and tripped the reactor.
The 1/ The Unit 2 Operating License did not permit criticality of power operation at the time of the incident.
IE Information flotice flo. 79-04 Date:
February 16, 1979 Page 2 of 5 Unit 1 turbine-generator tripped concurrently.
Because the Unit 1 generator could no longer supply power for the Unit 1 auxiliary loads, these loads were automatically transferred to Startup Transformer flo. I to supply this power from offsite.
ended at this point.
The sequence of events should have The power to Startup Transfomer flo. 3, which was feeding Unii. 2, and to Startup Transformer flo.1, now feeding Unit 1, normally passes through a single piece of equipment, the Bus Tie Auto-Transformer.
(Figure I shows a simplified block diagram of the principal electrical equipment involved.) The Auto-Transformer has the capacity to provide power for both units, out due to an error, the protective relays were still adjusted for the operation of Unit 1 only.
As a result, when both units concur-rently drew power from the Auto-Transformer these protection relays tripped and cut off power to Startup Transformer flos. I and 3.
Startup Transformer flo. 2, also shown in Figure 1, thus became the only source of offsite power for both Units 1 and 2.
The onsite switching equipment automatically transferred the full auxiliary loads for both units to this transfomer.
However, this transformer is not designed to carry full auxiliary loads for both units.
Transformer flo. 2 became overloaded and the voltage dropped on theFor th station distribution system for offsite power.
At this time, and during most of the incident, operating personnel at both units were unaware of the degraded voltage,2f condition due to the overloaded Startup Trans-former flo. 2 3_/.
2/ Two other events involving degraded voltage for ESF equipment occurred at Millstone Unit 2 in July 1976.
These events were reported as an abnormal occurrence (flo. 76-9) in flVREG-0900-5, Report to Congress on Abnormal Occurrences, July-September 1976.
3/
It was subsequently determined that the following combinations of Unit 1 and Unit 2 operation would lead to the loss of the Bus Tie Auto-Transformer and the subsequent overloading of Startup Transformer flo. 2:
1.
Both Units in either the startup or shutdown mode, or 2.
Trip of one unit while the other is in either the startup or shutdown mode, or 3.
Simultaneous _ trip of both units.
IE Infonnation tiotice fio. 79-04 Date:
February 16, 1979 Page 3 of 5 At Unit 2, eight seconds after the swi :h to Startup Transformer tio. 2, the relays 4f which operate to protect Engineered Safety Feature (ESF) equipment from low (degraded) voltage disconnected and, therefore, de-energized both Unit 2 ESF buses as designed. At the same time, the Unit 2 Core Protection Calculator (CPC) instrumentation registered trips which indicated a loss of AC power to the circuits 5/ that supply at least two instrument channels.
The loss of power on two 120 volt vital AC instrument buses caused, as designed, an actuation of all Unit 2 Engineered Safety Features.
when the two Unit 2 emergency diesel generators started and providedThus, power to the previously de-energized ESF buses, the Engineered Safety Features equipment began to operate.
However, due to inverter failures, premature actuation of the Recirculation Actuation System (RAS) occurred.
This actuation momentarily opened a flow path directly between the Refueling Water Tank (Riff) and the containment sump.
ESF operation and premature RAS operation combined to transfer approxi_mately 60,000 gallons of borated refueling water to the containment sump in about 90 seconds.
4/
These relays are the second level of undervoltage protection required as a result of the tiRC staff review of the 1976 flillstone Unit 2 degraded voltage event.
Corrective design changes (i.e., undervoltage relays and load sequencing to offsite power) had been implemented on. Unit 2 for degraded voltage protection.
implemented on Unit I at the time of the event.These design changes had n 5/
Each one of the four CPC instrumentation circuits receives power from a vital AC bus which in turn receives power from a battery through an inverter that converts DC power to AC power.
provides power through a circuit with access to both an ESF bus andEac the station batteries.
Each inverter also has an automatic switch that can cut off this normal supply circuit and shift the loads to an alternate supply circuit, which includes just the ESF bus.
insert on Figure 1.)
(See the only source of instrument power was from the station bat through the normal switch position.
However, although the exact cause is unknown, all four inverter automatic switches were found in the alternate position.
Three of four inverters had impt aper settings on time delay relays and one inverter had the undervoltage trip setting too high, which may have in part been the cause.
Failure of 120 Volt Vital AC Power Supplies, dated JanuaryIE Circular fio 16, 1979, provided details of the inverter problems end recommended items to be reviewed to avoid similar problems.
+sa
IE Information flotice tio. 79-04 Date:
February 16, 1979 Page 4 of 5 The normal design sequence calls for the RAS to automatically change the valve lineup when signals from the level instruments on the Refueling Water Tank (RW) indicate that the tank is nearly empty, which is expected to occur approximately 30 minutes after the LOCA.
During this incident, the RAS acted immediately in respanse to the failure of the inverters and made the change in lineup while the RWT was nearly full.
The loss of power from the inverters caused a false low water level indication in the RW.. This false indication provided the signals for the automatic actuation of the RAS.
Had the Emergency Core Cooling System and/or the Containment Spray System been needed in the event of a design basis loss of coolant accident, it would not have performed as designed because of the pre-mature RAS valve actuation.
ESF degradation on Unit 2 did not involve a threat to the health and safety of the public because Unit 2 was pre-operational and had no radioactive fission product inventory in the However, there was no assurance that the inverter deficiencies core.
which caused the premature operation of the RAS valves would have been corrected prior to Unit 2 power operation.
In the event of a LOCA with a fission product inventory, if the RAS were to initiate at the beginning of the accident, as it did in this incident, the low rressure and high pressure coolant injection subsystems (LPCI and HPCI) of Emergency Core Cooling (ECC) and the Containment Spray System might not function properly.
Actuation of RAS causes isolation of the water in the RW, which is the source of short-term cooling water for Emergency Core Cooling'and Containment Spray.
The premature actua-tion of RAS also causes these pump suction lines to be connected to the containment sump when there may not be sufficient water available.
Initially, the sequence of events on September 16 did not indicate any problem with the electrical distribution system of Unit 1.
- However, subsequent analysis indicated that in the event of a LOCA at Unit 1 during which Startup Transfonr.er tio.1 received both the auxiliary electrical loads and starting loads of the Engineered Safety Features a voltage reduction would result.
The safety loads might not initially transfer to the Unit 1 diesel generators but could remain on the startup transformer with reduced (degraded) voltage. Although there is margin in the sizing of emergency equipment and the conditions of operation of such equipment, this situation could cause fuses to blow in Engineered Safety Feature circuits which could result in disabling the safety equipment.
IE Information Notice No. 79-04 Da '.e :
February 16, 1979 Page 5 of 5 Cause or Causes:
The immediate ccuses of the unusual event at Arkansas Nuclear One (1) loss of the Bus Tie Auto-Transformer which resulted in degraded power operation through Startup Transformer No. 2; and (2) multiple Unit 2 inverter failures.
The loss of the Bus Tie Auto-Transformer was caused by inappropriate setpoints for its protective relays.
The Bus Tie Auto-Transformer loss had not been adequately reviewed prior to this event in that the over-loading of the shared Startup Transformer No. 2 had not been identified during the design and review process.
The primary cause of the failure of the inverters to perform as a reliable power supply was the lack of adequate preoperational test procedures, inadequate knowledge of inverter operation and lack of maintenance control (maintenance has been performed on the inverters several times prior to this event).
This Information Notico provides details of. a significant occurrence that is still under review by the NRC staff. After completion of the staff review, this Information Notice will be followed with specific actions to be taken by licensees.
No written response is required.
If you desire additional information regarding this matter, contact the Director of the appropriate NRC Regional Office.
Attachment:
Figure 1, Simplified Block Diagram, Electrical Distribution
IE Information flotice flo. 79-04 ii@
POWER FROM GRIO e
BUS TIE AUTO-TRAflSFORMER
.STARTUP STARTUP STARTUP TRA.*lSFORMER TRAtlSFORMER TRANSFORMER (10. 1 fl0. 2 (40. 3 '
r s'
\\
\\
ANO-UNIT 1 4160V ESF BUS i
ALTERflATE fiORMAL 480V ESF BUS SOURCE SOURCE _
~~AC-~
T
'~0C ~~l I
l BATTERIES I
- yfffj, j--
g
_ {
p-IllVERTER l
IflVERTER I
AUTOMATIC d
I I
SWITCH Ifl I
I fl0RMAL I
l POSITION I
I VITAL VITAL g
l AC AC l
i bus cuS I
AC OUT I
g
~
IllVERTER UNIT ANO-UillT 2 (TYPICAL OF FOUR)
(OilE OF Tl!0 ESF TRAltl5 SHOWil )
$t.5
=
SIMPLIFIED BLOCK UIAGRA?! - ELECTRIC DISTRIBUTION i
Flt;URE 1 A
h
IE Information Notice flo. 79 February 16, 1979 LISTIllG OF IE IllFORMATION t!0TICES ISSUED lti 1979 Information Subject Notice flo.
Date Issued To Issued 79-01 Bergen-Paterson Hydraulic Shock and Sway Arrestor 2/2/79 All power reactor -
facilities with an Operating Licenses (OL) or a Construc-Attempted Extortion -
tion Permits (CP) 79-02 Low Enriched Uranium 2/2/79 All Fuel Facilities 79-03 Limitorque Valve Geared Limit Switch Lubricant 2/9/79 All power reactors facilities with an Operating Licenses (OL) or a Construc-tion Permits (CP)