ML19330A982
| ML19330A982 | |
| Person / Time | |
|---|---|
| Site: | Crystal River  |
| Issue date: | 07/18/1980 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML19330A980 | List: |
| References | |
| TAC-12961, NUDOCS 8007290878 | |
| Download: ML19330A982 (8) | |
Text
/
- 4 UNITED STATES y71g7 NUCLEAR REGULATORY COMM:ESION 1
WASHINGTON, D. C, 20555 l
[
f CRYSTAL RIVER 3 SAFETY EVALUATION OF CORRECTIVE ACTIONS FOLLOWING FEBRUARY 26, 1980 INCIDENT 1.0 Introduction On February 26, 1980, a loss of power to the non-nuclear instrumentation (NNI) occurred at Crystal River 3.
This loss of power incident had two major effects:
(a) various malfunctioning inputs to control systems created a significant plant upset condition, which included spurious opening of the pressurizer power-operated relief valve (PORV), and (b) a substantial loss of infonnation to the control room operators (about 80% of the main control board). A description of the February 26, 1980 incident is available in the March 28, 1980, Office of Inspection and Enforcement - Region II Inspection Report 50-302/80-14.
This evaluation encompasses the 21 electrical, instrumentation, and con-trol corrective actions proposed by the licensee to address those defi-ciencies he has identified.
Further, this evaluation addresses only those corrective actions that the licensee proposes to have completed prior to plant restart. Long term, i.e., post startup, aspects of plant modifications will be reviewed as part of future requirements resulting from the issuance and implementation of NUREG-0667, May 1980, Transient Response of Babcock & Wilcox - Designed Reactors (Reference 3).
2.0 Backoround At Crystal River Unit 3 (CR-3), the NNI system serves three basic functions:
(a) provides indication of plant variables on the main control board for use by the reactor operator, (b) provides the values of plant variables as inputs to the Integrated Control System (ICS), and (c) controls certain other plant conditions (e.g., PORY operation, pressurizer spray valve operation, pressurizer heater operation, and reactor coolant pump seal flow).
The incident was initiated by the loss of the positive 24 VDC bus of the NNI X power system. This loss caused:
(1) the PORV control circuit to l
open the PORV and hold it open, (2) the pressurizer spray valve to start opening, and then (3) after an intentional built-in 0.5 second delay, caused the Power Monitor module to trip the a.c. supply breakers (S1 and S2) to both the positive and negative 24 VDC power supplies (4 supplies) of the NNI X power system. When the supply breakers tripped, the PORV remained open and the spray valve motion stopped.
800 g D0 N
With the loss of the NNI X d.c. power, about 80% of the main control board indicators failed to midscale positions. The Integrated Control System inputs that were X-powered also went to thesa erroneous mid-scale values.
Since the indicated Tave went from 577 F to 570*F, the ICS started withdrawing the control rods. This action was automatically terminated at 103% power.
Since the indicated reactor coolant flow went from 73x106 lbs/hr to 4Cx106 lbs/hr, the ICS reduced feedwater to both steam generators to virtually zero.
Since the indicated turbine header pressure went to 900 psig, the turbine control valves opened slightly.
The net result of these ICS actions was a loss of heat sink, i.e., ar, undercooling transient. This transient caused an automatic reactor trip on high RCS pressure at 2300 psig.
With the PORV open and the reactor tripped, the RCS pressure fell rapidly through 1500 psig, at which point the high pressure safety injection system was automatically actuated. At about this time, the RCS Drain Tank level alarm was received and consequently the PORV block valve was manually closed. Not long after the drain tank alarm, reactor building pressure was noticed to be increasing, the first indication that the Drain Tank rupture disk had ruptured.
About 22 minutes after the start of the incident, electric power was manually restored to the NNI system, thus restoring control panel indication.
3.0 Evaluation Subsequent to the February 26, 1980 incident, numerous meetings have been held between the licensee and NRC and there has also been exten-sive correspondence (References 4 through 11) all bearing on the licensees proposed modifications to ameliorate the consequences of a similar inci-dent.
For the purpose of this evaluation, the licensee's submittal of May 2,1980 (Reference 5) is the primary reference.
Enclosure B of this reference identifies and briefly describes the 51 corrective actions that the licensee proposes as " prior-to-restart:" action items.
The items cover a spectrum of topics ranging from revisions to procedures and special operator training to mechanical and electrical system design changes.
Our review has included the 21 electrical, instrumentation, and control system actions that the licensee proposed in Reference 5 (see enclosure).
-This report discusses the most significant of these actions. The number-ing is that of Reference 5.
- 3.1 Action Item #1 entailed thorough testing of the NNI X system to deter-mine the root cause of the loss of the positive 24 VDC bus. After fully testing the Power Monitor module, all of the NNI X modules using 24 VDC were visually inspected'and electrically tested.
On March 5, 1980, a module containing four (4) buffer subassemblies was found to have a short circuit directly between the po.itive 24 VDC line and ground, causing damage to the printed circuit wiring of the main assembly of the module. The connecting pins between the subassembly and the main assembly were not properly meshed producing the short circuit. The specific faulted module subassembly was a buffer amplifier that is part of cae of two redundant subcooling monitors.
The module had been installed iess than two weeks prior to the incident.
Our review of this situation concluded that this short circuit was caused by a generally poor quality subassembly, less than adequate procedures for the installation of the subassembly into the main assembly of the nelules, and a QA inspection program that did not detect the deficiency. We agree with the licensee and OIE that the coincidence of a technician working on the NNI Y system at the time of the incident did not cause the incident.
As a follow-up to discovering the root cause of this incident, all other buffer modules were inspected.
No other mis-connections existed.
The vendor of the modules has advised all other nuclear utility users of these modules of the potential for such mis-connections and pro-vided for proper procedures for installation of the subassemblies.
3.2 Action Item #46 involved correcting the design of the PORV control circuit such that loss of the positive 24 VDC does not cause the con-trol circuit to go to and lock up in the " pressure-high, valve-open" state.
The PORV control circuit previously had been reviewed, subse-quent to the TMI-2 accident, to assure that loss of power would not cause the PORV to open. Loss of 125 VDC or simultaneous loss of both positive and negative 24 VDC will not cau - the valve to open.
The post-TMI review concluded that since, no other power is involved, these situations envelope or encompass all other possibilities or.
cover the worst case. However, if initially the positive 24 VDC is lost, the intentional time delay (0.5 seconds) in the Power Monitor module permits the PORV control circuit to go to the " pressure-high, valve-open" state, i.e., a case worse than loss of both + 24 VDC simultaneously.
Further, due to the tripping action of the Power Monitor, the control circuit could not respond when the RCS pressure went below the " pressure-low, valve-close" setpoint.
To correct this deficiency, the licensee has proposed (Reference 5) the addition of an interlock that will use auxiliary relays, inde-pendent of the NNI Power Monitor module, to sense loss of ei'her (+)
or (-) 24 VDC and take immediate action to preclude automatic open-ing of the PORV. Manual operation of the PORV will not be affected.
This modification corrected the identified deficiency and is acceptable.
-3. 3 ' Action Item #34 is probably the single most significant action proposed by the licensee.
It addresses the loss of plant status information to the control room operator. The essence of the problem was that a^ ar the NNI X power was lost, so-called NNI Y channels were found to L e signal conditioning or compensation networks, buffer amplifiers, or readout devices that.were also being powered by the NPI X system. As a result of this factor and an unbalanced loading bet.;een the NNI X and Y d.c. power buses, about 70-80% of the main con;rol board indica-tors failed, directly or' indirectly on the loss of NNI X power.
Rather than attempt to untangle this degree of cross-connection, the licensee decided to install two new and electrically separate divisions of channels of indication for 23 key plant variables.
Each division is
^
dependent for power only on the NNI X or NNI Y powe system. Each division is provided with a " power on" light, to indicate which one is to be used in the event of a future loss of power incident. The licensee has confirmed (Reference 10) that a design criterion for these new instru-ments is that the failure of any single component cannot cause a total loss of control room indication of any of these key variables.
We conclude that this modificat. ion will improve plant safety with respect to loss of operator information due to loss of either NNI X or NNI Y power buses.
3.4 Action Item #40 pertains to a modification of the Emergency Feed Water (EFW) auto start (and reactor trip) circuits such that loss of a single instrument bus does not prevent actuation of these systems. This control-grade actuation circuit was to have started the EFW pumps if both OTSG's t
had low-low water level.
Since the level instrumentation for OTSG "A" was powe"ed by the NNI X system, which was lost; the actuation circuit failed to a non-conservative state and therefore EFW was not automaticallv initiated. The licensee has proposed to correct this deficiency. We conclude that.this action upgrades these circu'ts and will improve safe operation of the plant.
4.0 Conclusions The February 26, 1980 incident at Crystal River Unit 3 derived from a single failure in a non-safety grade system, coupled with the above menti'aned design deficiencies. The licensee has determined the root cause of the incident, has made plant modifications to correct deficiencies and has taken major action to provide mon reliable information on plant conditions to the reactor operator.
We have reviewed those electrical, instrumentation, and control systems corrective actions proposed by the licensee in his May 2,1980 sub-mittal.
Even following implementation of all the above actions at Crystal River 3, there will be no guarantee that a similar-incident can be completely prevented.
However, we conclude that a future failure of the NNI X d.c. power will have less serious consequences.
These actions are an overall improvement to plant safety, and therefore are acceptable.
3
.m,
-S-We further conclude that the actions taken by the licensee in response to the February 26, 1980 incident are sufficient to permit restart of Crystal River 3 and to ensure operation in a safe ma'1ner during the interim period until the long term requirements resulting from the Three Mile Island Unit 2 accident and those of the Office of Inspection and Enforcement Bulletin 79-27 are all implemented.
Dated: July 18,1980 O
I e
h
REFERENCES.
1.
B&W Report:
" Transient Assessment Report - Reactor Trip at Crystal River 3 Nuclear Station on February 26, 1980." "rcpcred for Florida Power Corporation.
~
2.
INPO-1/NSAC-3 Report:
" Analysis and Eva?uation of Crystal River -
Unit 3 Incident," March 1980.
3.
NRC Report:
NUREG-0667 " Transient Response of B&W - Designed Reactors," April 1980.
4.
Letter:
R. Reid (NRC) to Hancock (FPC) May 2,1980, Request for Additional Information.
5.
Letter:
Baynard (FPC) to Director, NRR (NRC), May 2,1980.
6.
Letter:
Hancock (FPC) to H. Denton (NRC), March 12, 1980.
7.
Letter:
Hancock-(FPC) to Denton (NRC), March 17, 1980.
8.
Letter:
Bright (FPC) to Reid (NRC), March 24, 1980.
9.
Letter:
Eisenhut (NRC) to Hancock (FPC), April 14, 1980.
10.
Letter:
Bright (FPC) to Reid (NRC), May 2,1980.
11.
Letter:
Baynard (FPC) to Reid (NRC), May 22, 1980, il
ENCLOSURE
~
ELECTRICAL, INSTRUMENTATION, AND CONTROL SYSTEMS ACTIONS o
Item 1:. Thorough testing of NNI X system to determine the root cause of the loss of the (+) 24. VDC bus.
o Item 46: Assure that any power loss will not cause$ the PORV to open, o Item 47: Modify the Pressurizer Spray valve circuitry so that any power loss willl not cause the valve to open.
o Item 34:
Provide operator with redundant indications of key plant parameters.
o Item 40: Modify emergency feedwater auto start circuit and reactor trip circuit so that any power loss will not prevent actuation.
o Item 18:
Repair Events Recorder system.
o Item 19: Eliminate computer alarm overload.
o Item 33: Check other Signal Monitors for seal-in problems, o
Item 49:
Provide separate annunciation for loss of NNI X, NNI Y, and ICS power, o
Item 50:
Install indicating lights on all vital bus branch circuits.
o Item 39: Modify vital bus panels for quick fuse replacement.
o Item 3:
Initiate a more extensive surveillance program on the Events Recorder system.
7 Item 6:
Inspect pressurizer heaters for seal leakage; electrical continuity check of heater elements.
o Item 7:
Check insulation re:istance of each control rod drive motor.
0 -Item 36:
Provide automatic bus transfer switches for NNI X and ICS a.c. power from vital bus power to regulated instrument powe r.-
o Item 48: Provide vital power to ICS X power system.
o Item 38:
Provide positive indication on all three pressurizer relief /
safety valves.
2-I
- o Item 41:
Provide indication lights for PORY solenoid, o Item 28: Provide manual override capability for Reactor' power greater than 22%" relay of each reactor coolant pump start circuitry.
o Item 45:
Electrically interlock motor-driven EFW gump to start on loss of main feedwater.
o Item 37: Assure that one subcooling monitor will be operable on loss of either inverter A, B, C, or D, or loss of offsite power.
w