ML19308C024
| ML19308C024 | |
| Person / Time | |
|---|---|
| Site: | Rancho Seco, Crane |
| Issue date: | 06/19/1978 |
| From: | Shaun Anderson, Dunn J, Keilman L SACRAMENTO MUNICIPAL UTILITY DISTRICT |
| To: | |
| Shared Package | |
| ML19308C021 | List: |
| References | |
| TASK-TF, TASK-TMR NUDOCS 8001170779 | |
| Download: ML19308C024 (11) | |
Text
.
[ COMMITTEE' REPORT 0Nt RANCHO SECO UNIT N0.ol..
TRANSIENT OfjMARCH;20.c1978; I.
13TR000CTION:
In a meeting held on March 22, 1978, the SMUD Management Safety Review Committee (MSRC) established a three member committee to investigate the Raricho Seco Transient of March 20,1978 that occurred as a result of the loss of the Non-Nuclear Instrumenta-tion (NNI) "Y" power supply.
The members of'this committee are:
Chairman - John D. Dunn Member
- Stanley I. And'erson Member
- Lee R. Keilman in the March 22, 1978 meeting, the MSRC directed this committee to investigate and report on the following:
A.
Circumstances that led to shutdown.
B. FIf. ilifime79ehcy 's ditdiw'n"siqiieke $isIM5'imum 5Sc$5$bd
~
~ improvedj,on by c5nsid6idf alteinate design considerations
'}, including separation of non-critical circuitry from critical func ti ons.
C.
Evaluate significant parameters connected with the rapid
. shutdown to determine if any damage resulted to components in the plant.
D.
Recommend corrective action to prevent future recurrence of this or a similar problem.
In an MSRC meeting held on April 7,1978, this committee was requested to review and report on the following additional. items:
i 1.
A recommendation as to what action should be taken on other circuits not to be studied by the special committee.
- 2. Investigate and report on the possibility providing a redundant instrument reading of steam header pressure.
3.
In regards to the special plant operating procedure that was being prepared for shutting down without the "X" or "Y" f.
instrument power supply, the coanittee should look at the j
itims to be monitored on the computer and connent' on the k
adequacy of these readings for safely shutting down.
O 800117077%.
11.
COMMENTS R[D ASSESSMENTS:
The ccanittee's connents cn and assessments of the significant items related to the Rancho Seco Transient of March 20, 1978 are as follows:
A.
Initiatino Event:
1.
An operator had removed the bulb retainer section of the back-lighted push button module in the operator's console for the turbine throttle pressure instrument channel selection for loops A an B to change a burned cut bulb.
In the process of handling the bulb section of the module, i
a bulb popped out and fell into the cavity left af ter removing the bulb retainer portion.
This caused a short circuit on the -24 VDC-Y power system load circuits.
B.
Reason for Total loss of NNI-Y Power Sucoh:
J l.
The design of the overcurrent protective scheme for this circuit is such that a fuse is provided to protect each J
back-lighted push button module and its associated auxiliary relays.
In case of a short circuit in one of these devices, the fuse should open and at the most limit.}
the_ loss to one single instrumentation function.
Ths2 fuse Ldid nofo}eFa'telforf the: devic'e1Whe~reithe c
~
~
[undepinvestigat_f.onfocct tred."'""~"
"^^ '
2.
A power supply monitor is provided to monitor,the output of the NNI-Y 24 volt DC power supply modules.
This monitor detects a low output voltage condition and trips the NNI-Y system's 120 volt AC input circuit breakers.
The short circuit apparently caused the power supply output voltage to drop.
The power supply monitor has a.5 second. delay between the time the voltage drops below 22 VDC (trip point) and the time the input circuit breakers are opened. The time delay should have been enough to allow the fuse to clear
,l the short circuit before interrupting the AC input to the pcwer supply modules.
3.
Since the fuse did not operate during the short circuit, the tripping of the two input circuit breakers.was correct.
However, the automatic tripping of the input circuit breakers interrupted the power source to the NN!-Y instru-mentation system.
'C.
Reasons for Plant Trip:
Essentially all significant signal inputs to the Integrated Control System (ICS) feed through the contacts of energized i
signal source selecting relays.
All of tqe signal selecting relays are energized f rom one of the UNI-Y poder supply buses.
Consequently, when the Y power suppiy system was lost the relays O
e -
were deenergized; this resulted in a cutcff of signals into the ICS.
The resultant effect was that the ICS auto-matically reduced the feefwater flo.v to zero.
The reactor subsequently tripped on high pressure due to loss of feedwater.
4 A reactor trip automatically initiates a turbine-generator.
trip and the unit went to a shutdown ccnditicn.
D.
Reason for loss of Control of Coo down Ra te Following the Trip,:
l The cooldown rate of the primary system exceeded the technical specification limits of 100 F per hour because of the following:
l.
In addition to the ICS signal inputs, the above mentioned auxiliary relays disconnect the signals to a number of control board indicating instruments when tne coils of these relays become deenergized (lose power). Also, a number of instrumentation elements (indicators, amplifiers and signal conditioners) lost their source of operating power when the 120 volt AC NNI-Y system input breakers were tripped.
The loss.of a large percentage of NNI primary and secondary i
instruments and the resulting uncertainty concerning valid instrumentation greatly hampered the operator's actions with i
respect to maintaining primary system cooldown rates within Technical Specification limits.
2.
The primary system pressure dropped to the set point for automatic actuation of the safety features injection system.
This resulted in a period of continuous uncontrolled inj-ection of auxiliary feedwater into the steam generators which obviously aggravated the rapid cooldown rate.
E.
Review of Operational Aspects of_ March 20, 1978 Transient and Comments on the Adeouacy of New Procedures and Existing Instr-umenta tion _:
The instrumentatica problems caused by the loss of the NNI-Y power supply created a difficult and procedurally unrehearsed situation for the March 20, 1978 mid-shif t operators.
Their i
uncertainty with respect to valid instrumentation gave them little choice other than to cooldown the plant.
,_.ngm-~n vw?w mw.nnen _Morllossaof381-M. or 1oss of l New. procedures t havehbeeniwti t te NNI-Y. power supplies.
These procedures eliminate the uncertainty with respect to valid instrumentation and provide a suitable response for this situation.
The coanittee has reviewed the instrument readin* s required g
to cooldown the primary systein within tne Technical Specifi-4 cation limits. This instrumentation is equivalent to that provided at the remote shutdown panel for cr.e ECS loop.
(Refer to the " Committee Recommendations" section of tnis report for a list of instrumentation.)
t I
e e
The connittee also reviewed the valid instrumentation that would be available in the control room upon the loss of r.NI-X or UNI-Y power.
With one exception, the existing power supply scheme provides indication equivalent to that at the shutdown panel for one RCS loop with the loss of NNI-X or NNI-Y power.
The exception, makeup tank level, is lost when the NNI-X power supply is lost.
This situation is adequately handled by shifting makeup suction to the borated water storage tank which does have indication.
Therefore, the existing instru-mentation is sufficient for plant shutdown and cooldown within the Technical Specification limits with one or the other of the above stated power supplies out.
However, plant cooldown prior to recovery is necessary because the dryout of one OTSG is required by the new procedure.
The cocnittee does not consider that providing redundant steam header pressure instrument is necessary for cooldown within Technical Specification limits.
The OTSG pressure instrument-a tion is considered to be adequate.
F.
Assessment of Auxiliary Feed System Effect on March 20, 1978 Transient:
Reconstruction of this.. transient and consideration of_s,imilar_ _
, situa tions shows _thatJSFASf actuated auxiliary <feedican aggravate; ithe; severity;of _RCS1cooldownsand depressurization a tes'i
~^
Apparently the Rancho Seco auxiliary f,eed system was added to the SFAS to allow Class 1 initiation in accident situations such as those considered in the steam line rupture ' analysis, theismallLleak ~analys~is', and the large leak analysis.
From a functional ~itandpoint, safety features /stait oEth'e ausflidy_.,
~
{eedisisteln can.relsult in~.a 1oss,ofLautomatiiOTSG,1evel eontrol:
ica pa bil i ty. and. unnecessary. a uxil ia rys.feedwa ter) inj ec ti oniwi th l a s soc ia ted..the rmal; s tres s; cycl es,
n,,.nm
,The committee investiga tio,n_ ha_sgevealed_tha t[itancho,Secojis; ithe only,177.,fuelJassemblyJBR nuclear steam system with an ;
[ auxiliary. feed :systemiac tuated <bylthejSFAS."In thi~ Con 6ittfe
~
Recommendation section of this report it is suggested that additional review and study be made concerning this matter.
G.
Surnnary of the Impact of Post-Transient Power Assention History on Fuel Performance:
Power assention history for the period March 24, through March 28,1978 did not follow the BW suggested 35 per hour power rate limit above 40% FP.
hs particular, the final ramp from 555 to 72% FP was done at 12*;FP per hour.
Fortuna tely, a 2C-hour hold period at the 55'; to 62r FP level <tas made prior to the ra.Tp.
l SW recomends a limited power ramp rate and/or power holds any tima fuel pellets might possibly have been relocated.
Such procedures allow relaxa tion of stresses caused by the expansion.
of relocated pellets against clad material.
t
-L-
.J..
The 20-hour hold at the 55% to 62% FP p: er level effectively allowed such relaxation to occur.
Thus, in the jud ment of 3
ESW, the power history described above did not degrade the perfonr.ance capability of the fuel.
Pricary ch mistry moni-toring indicated no change in fuel perforT.ance.
fg
,n, H.
Ass?ssment of Possible Darnae to Comoon2nts in the Plant:
The MSRC has directed the comnittee to evaluate significant parameters connected with the rapid cooldown to determine if t
any damage resulted to components in the plant.
The SMUD staff has inspected equipment and have not found any abnorcal movement, f'
All rain steam line hangers, sway suppressors, slide pla tes, and anchor points were checked for proper locations and found
(
to be in the proper positions.
The main steam lines had previously been reviewed for stresses that could result in
.s team line wa ter har.mers.
There is no reason to believe that
^
any abnormal stresses were suf fered by these lines as a result of the rapid cooldown transient, The Babcock & Wilcox Company is evaluating the stresses that were experienced by the primary steam comconents.
The resul ts
~",.
of their analysis is promised by the end of June 1978.
This repo.rt will possibly be amended following the receipt and review of B&W's analysis.
I.
Assessment of Chances made to the NN1-Y Power Sucolv System
..y Prior to March 20, 1978:
In performing its investigation of the NNI-Y power supply
~,c system, the committee discovered that a circuit change was initia ted in 1974 which, at first glance, appears to have crea ted a condition which possibly worsened the situation
.a on March 20, 1978.
liad this change not been made the power supply failure would probably have been iimited to the back-9, lighted push buttons for NNI instrument source selection and the associated auxiliary relays.
-4 While the loss of instrumentation would have.been less with "7
the original circuit configuration, a large number of significant
^4 NNI instrument readings would still have been icst because of f*H 1
the deenergization instrumentation signal source selecting auxiliary relays.
It would not be possible to determine if the d
primary system cooldown rate would have been less had the circuit change not been made as the potential for operator confusion and uncertainty with respect to valid instrument readings would still have been present.
- n all likelihood, the reactor trip wou'.d hive c: curred in the 4
sars manner because of loss of ICS input signals upon the die ^ergiza tion of the auxiliary relays.
5-1 c
,)
s
1 Not only are the ICS input signals interrupted when the auxiliary relays are de-energized, the signals to most of the 3
NNI switchboard instruments are also interrupted when the relay contacts open.
Attached. figure numbers 1 'and 2 illustrates j
the power supply circuit configuration before and af ter the change.
Ill.
C__OMMITTEE RECOMMENDATIONS The committee's recommendations are grouped into three categories:
Items to prevent a total loss of the NNI-Y power supply as a result of an identical type of short circuit.
i Suggested clianges and studies to improve the general overall reliability of both the NNI-X and NNI-Y power supplies.
Recorre.endations concerning indirectly related items.
3 l
A.
The committee recommends that the MSRC consider directing j
the implementation of the following actions in order to prevent the repeat of an identical type of total NNI-Y power i
supply loss:
4 1.
Nuclear Operations should develop a nonconducting plastic cap or rectangular foam rubber plug to insert in or cover the open back lighted push button modules whenever the lamp bulb section of the module is,lif ted out.
The const-ruction of the module is such that a short circuit will almost invariably occur if a metallic object of' any type is dropped into the open cavity which is exposed whenever 1
the lamp bulb section is lifted out.
Transporting the upper bulb fixture portion of the module to a remote location for removal and replacement of bulbs s
l would provide an additional factor of safety against short circuits caused by dropped bulbs.
2.
Perform tests on the existing NNI-Y power supply system to determine the following conditions.
(Except for 'e',
the tests will require that the plant be in a shutdown co.ndition):
Trip point of the power supply monitors (22V) a.
b.
Time delay to trip circuit breakers Si an'd 52 (.5 seconds) c.
The ampere limiting point of the 24 volt DC UNI-Y power supplies.
d.
Transfer voltage point of the AC automatic transfer switch, relay 83.
i e.
Overcurrent test at least 3 of the 5A fuses and compare test data with the r.anufacturers curves.
.a __
Conduct an actual short circuit test sinilar to the f.
accident case and verify protective device coordin-ation using an oscillograph.
From the results of these tests, determine whether or not 'the coordination of the NNI-Y power circuit overcurrent protection scheme is adequate and is functioning properly.
- 3. Measure or calculate the amperes in the backlighted push-button - auxiliary relay circuits, and determine the possi-Possibly lower rated bility of using lower rated fuses.
fuses would carry the load of the laep bulbs and relay coils and would provide faster clearing of faults and prevent tripping at the 120 volt AC input circuit breakers.
- 4. provide a separate power supply nodule for the NNI instru-ment selector switches, associated indicating lamps and This circuit would be similar t, that auxiliary relays.
This change shown in Figure No. 3 attached to this report.
would not be likely to prevent a plant trip, but it would reduce the quantity of instrumentation lost for a short 20, 1978.
circuit condition identical to that of March For.the consideration by the fGRC, the committee offers the B.
folowing recommendations in regards to studies and circuit The committee considers that these recommendations changes.
have potential for improving NNI-X and NNI-Y instrurent and The actua,1 performance of any of control system reliability.
the following recommended studies and/or changes should be based on cost benefit justification.
- 1. Suggested studies to be made on both the NNI-X and Y power supply schemes:
Make a study of all circuits connected to the NNI-X a.
and Y power supplies that are not fused.
Presently, there are several devices which are tied solid (no fuse) tc the DC and AC source supplies.
In order to provide proper isolation for short circuits, the addition of fuses is recommended.
Make a study on the possibility of using a lower rated b.
fuse rather than the universal $ amp fuse now in use.
A preliminary check on some of the devices, now protected by 5 amp fuses, revealed that this fuse may be oversized.
Since the power supplies are automatic current limited i
to 7 amps, it is critical that the lowest possible fuse Possibly a 1 or 2 amp fuse would provide size be used.
the fast operation necessary to prevent t, ripping of the input breakers for faults that should be cleared by the fuses.
y
> u a
Make a study to determine if it is reascnably possible c.
to improve the present UNI DC pcwer supply configuration.
For the NNI-Y system, the existing scheme provides redundancy for a single power supply failure and/or opening of one of the two AC source input breakers.
However, because of design of the power supply monitor tripping scheme, the redundancy is negated for a low voltage condition on one bus because the monitor trips both AC input breakers at the same time.
- 2. Study the practicability of providing the following instru-
~
ment indications for both RCS loops in the control room even though NNI-X or NNI-Y power supply is inoperative.
Computer readout of these indications is satisfactory.
2 - Uncompensated pressurizer levels l'- Wide range RCS pressure 1 - Wide range RCS Loop A T.C 1 - Wide range RCS Loop B TC 1 - RCS Loop A Th 1 - RCS Loop B Th 1 - 0TSG A startup level 1 - 0TSG B startup level 1 - 0TSG A pressure 1 - 0TSG B pressure 1 - Makeup tank level 1 - Source range nuclear instrument Current operating procedures require RCS cooldown prior to refill of the OTSG which was dried because of the loss J
of its level indication. This proposed modification would eliminate the cooldown requirement because level indication of both steam generators would be continuously available upon the loss of NNI-X or Y power.
The resulting potential for reduction in loss of power production is s.ignificant.
~
(Any modifications to improve the available instrumentation after a failure of one of the power supplies should be closely coordinated with UNI system changes' proposed in the i
Fire Hazards Analysis Report.)
-t
~
C.
For the consideration by the F$RC, the cor.mittee offers the following recont.andations regarding iters not directly related to f;NI-X or Y circuitry revisions:
- 1. Nuclear Operations should prepare a procedure for safely.
shutting down the plant upon total loss of bph the f!NI-X and NNI-Y power supplies and associated instrurentation.
l 8ecause these systems are non-Class I and non-redundant, their continuous availability cannot be assured; consequently,
the total loss of both systems should be expected to occur at some time during the life of the plant.
j
- 2. B&W is currently reanalyzing the postulated small leak accident.
The committee recommends that if the results of the nea analysis shows that automatic safety features actuation of auxiliary feedwater is not required, then the possibility of removing the automatic SFAS feature should be considered.
Autoratic safety features actuation of auxiliary feedwater hampers the operators ability to prevent an excessively rapid cooldown rate.
IX.
CONCLUSIONS:
A.
The Rancho Seco Unit No. I transient of ?'. arch 20, 1978 did not
~
result in an increase in release of radioactivity to the environment.
The transient did not pose any threat of a safety h'azard to B.
the general public.
C.
The loss of the NNI-Y instrument power supply system did nothing to inhibit an automatic and safe plant shutdown..
D.
The loss of the NNI-Y instrument power supply. system did nothing to prevent reroval of decay heat from the reactor.
E.
Operator uncertainty conc'erning the reliability of instrument readings resulted in a primary system cooldown rate that 4
exceeded the Technical Specifications limits.
F.
There has been ilo evidence of primary system physical damage as a result of the transient.
G.
The primary significant " damage" to the District as a result of the transient appears to be only the economic. losses as a result of the loss of approximately 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> of. generation and the cost of engineering analysis.
I H.
The recently implemented casualty operating procedures should prevent a cooldown rate exceeding the Technical Specification j.
l limits following any future loss of NNI-X or NNI-Y powgr supply These procedures identify the instrumsn.s that will systems.
provide valid readings for the. loss of the N"I-X or Y power s upplies.
f e
e
H.
The recently implementcJ casualty operatinc procedures should prevent a cooldown rate exceeding the Technical Specification limits following any future loss of fin!-X.cr N;;I-Y power supply systems.
These procedures identify the insterents that will provide valid readogs for the lo'ss of the '!?;I-X or Y power supplies.
ps
' G'?] %
h f [/n_,gg,,_ -
.~ J. D. Dunn, Chai rma n L. R. Xeilir.an, Member A a..e
,,,)
S. 1. Anderson, Member June 19, 1978 t
4 -
ATTACHMENT 5 CONCLUSIONS From a regulatory point of view, some of the more significant conclusions which I reached from studying this transient are:
l (1)
The loss of a non-safety instrumentation system caused a transient that required several safety systems to protect the reactor, including reactor trip on high pressure, and high pressure injection of borated i
i water. Although the safety valve opened below its setpoint (2500 psi) the reactor pressure would have probably reached the set point pressure had it not opened early.
(2)' The loss of non-safety instrumentation caused a plant technical specification to be exceded.
1 (3)
The actuation of the auxilliary feedwater pumps with the HPI actuation signal at 1600 psig reactor pressure probably caused the excessive cooldown.
I (4)
The reactor protection system functioned normally whenever it was called upon to do so during the transient.
The reactor was tripped upon reciept by the RPS of a high pressure signal and the SFAS provided HPI and auxilliary feedwater upon receipt of the low pressure I
signal.
(5)
Reliable temperature, pressure and level indications were produced by the RPS instruments but they were in a cabinet in a room next to the control room and not available to the operator.
i i
l l
.