ML20027B371

Interim Significant Deficiency Rept Re Undetectable Failure in Design & Const of Solid State Protection Sys.Initially Reported on 820804.Test Procedure Revision Being Implemented

ML20027B371
Person / Time
Site:	Millstone
Issue date:	09/10/1982
From:	Cagnetta J, Counsil W NORTHEAST UTILITIES
To:	Haynes R NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
References
10CFR-050.55E, 10CFR-50.55E, AECM-MP3-287, B10560, NUDOCS 8209200323
Download: ML20027B371 (3)

Text

_ _ _ _ _ -

DESIGNATED ORIGINAL kW Certified By -

, g General Offices e Seiden Street. Berkn. connecticut 3 vi 35a =

HARTFORD. CONNECTICUT 06141-0270 mm ama wa u"*"

(203) 666-6911 k k J [. $ v co--

September 10, 1982 AEC-MP3-287 B10560 Mr. Ronald C. Haynes, Director Region 1 Office of Inspection and Enforcement U. S. Nuclear Regulatory Commission 631 Park Avenue King of Prussia, PA 19406 Gentlemen:

Millstone Nuclear Power Station, Unit No. 3 Reporting of Potential Significant Deficiencies in Design and Construction: Solid State Protection System - Undetectable Failure (SD-26)

As required by Title 10, Code of Federal Regulations Part 50, Paragraph 55(e),

No.theast Nuclear Energy Company (NNECO) reported a potential significant deficiency in the design of Millstone Unit No. 3 in a August 4,1982 telephone conversation between your L. Briggs and our R. Lefebvre.

Our notification to you was made under the advice of Westinghouse, who besides notifying affected customers on August 4,1982, provided an initial notification of a potential problem to the NRC on the same day.

Attached is the letter from Mr. R. L. Hofer, Westinghouse, to Mr. S. Orefice, NUSCO, providing a written confirmation of the significant deficiency, a description of it and a minor revision to test pr'ocedures conducted from the Safeguards Test Cabinets where operation of the SSPS output relays is verified.

At present, we are implementing the recommended test procedure revision. As such, it is our position that this commitment, in addition to the attached documentation, constitutes our final report on this significant deficiency.

We trust this satisfies any concerns you may have.

Very truly yours, 2

W. G. Counsil Senior Vice President IA By/J. P. Cagnetga Vif resident Fuclear and E ronmental Engineering 8209200323 820910 PDR ADOCK 05000423 S PDR "* -f(N1

_ _ . _ _ _ _ _____ _ _ _ _ _ _ _ - - J

xx

w - -u

.

7q t :a

' ewcm:e ..x 1

owinensa+s 52E h

.1 a

e558rs

@Perns,wa* g Water Reactor ~;'

Cestinghouse . ration Divisions 16, 1982 ,jf.

August

-i! Electric rorpo 3 5.0. NEU 7.35.28 ,Ty; 4

'I Mr. S. Orefice - SERVICE COMPANY Project EngineerNORTHEAST 06101 UTILITIES Q ERVICE COMPANY Et P. O. Box 270 Hartford, NORTHEAST Connecticut STATION UTILITIES Failure S .

MILLSTONE UNIT NO. 3 NUCLEAR POWERSyste Solid State Protection tion of

i

. .s ~-

ovidedCinitial protection notif casystem to ,

Deer Mr.4,1982, Orefice: Westinghouse State pr Protection Systemconfirmation

, in the Westinghouse a written I& -

4n August utilizing the Solid

'a potential problem This le'.ter provides for -

its NSSS customers of the SSPS, redrawnuncovered (SSPS) of that andschematic the NRC. initial notificatior .

diagram engineerson line testing of a Westinghouse in During review ion,ich h

could exist relays purposes undetectable of consolidat failure system.

wrelays in the of master relay actuation i

an circuits for SSPS includes When a preselected masteroutput (slave) re relsy is with the of the20VAC to 15VDC a Periodic testing rds of the systems.seriesOperation lamp in O' losed copySubsequent which is actuate Safeguaenergized, the circuit voltage sent to the from a provingelectrical NRC),h1output sketch attach co g,

coil confirms the which has beenenergize (120VAC) i g lamp eacIn those q.j; prevented by reducing t field i

g*s during test. (Refer tonotification rds Test Cabinetsof be letter tolert the ad, a prov Safeguards n dev ce.

3' of the from the Safegua tests cannot relay coni 3. clovemen ,

.W confirm actuationof the final device.

h final deviceverifies relay to ircuits 20 where actuation in the Safeguards test cl continuity

• through t e L?d5 q FM wiring and electrica \! t. b NG e h'M;i c,pm . ::

'g"{h.b "i,e9 '~

q

~

0y i%d.;'? h* c '

... 2 A ,o 9 9 j[O%

^. Q; 9 [ P TWCQ e f5;QQ'{Q .Q;.ijfC ;m:. '-

&##]4 -.

Mi

, " '%sl&.gg.f.&g v

+ .v x.; wtw@ Hij 2. [' N, ;:s

'c

' 'MNi ~

p, g% yp r _ _._ _._ . __. __ = .. ____._______ r ________ __---d

't Mr. S. Orefice .

NEU-4279 As rentioned above, output relay coil continuity is confirmed at the SSPS, without operating the relay, by reducing the circuit voltage to 4

15kDC from 120VAC. As shown in the sketch, operation of the moster relay by means of the pushbutton test switch also removes the shunt i

from the SSPS proving lamp and allows the 15VDC to energize it to confirm the continuity of the output relay coil.

Upon completion of the master relay and output relay coil continuity tests, 120VAC circuit voltage is restored. However, if the switch contacts which shunt the proving lamp should fail to reclose as expected, 120VAC would.be applied to the lamp in event the system were called upon to operate. Depending on the output relay coil impedance and the number of output relays being operated by the master relay contacts, the current through the lamp could cause it to burn open before the output relay (s) energized. In such an instance associated Safeguards devices in the affected train would not actuate. Since, during circui,t, analysis, all identified'hondetictable failures must be assumed to have occurred, the redundant Safeguards actuation train must'be assumed to be similarly, if an identically, failed. .

t; ' -

On August 3,1982, the Westinghouse Water Reactor Division Safety Review Committee concluded that the potential for undetectable loss of any Safeguards actuation function constituted an Unreviewed Safety Question under 10CFR50.59 and a Potential Significant Deficiency

.under10CFR50.55(e). .

Although failure of the subject test switch contacts is highly impr'obable, Westinghouse is recommending that operating plants implement a minor revision to test procedures conducted from the Safeguards Test Cabinets where operation of the SSPS output relays is verified. The revision will ensure that the relay test circuits in the SSPS operated properly when the system was returned to its normal operating mode. The procedure changes are described in Attachment III of the attached NRC notification letter. These procedural changes are recommended until Westinghouse completes a review of its consideration of design changes.

If you have any questions or comments please feel free to contact the undersigned.

Very truly yours,

/mme WESTINGHOUSE ELECTRIC CORPORATION

- Attachment {

cc: S. Orefice 4L, 4A . L. Hofer R. W. Ackley 6L, 3A NUSCO Project Manager

,-. . )

d' Westinghouse Water Reactor Bo c 5 Electric Corporation Divisions Pitt:curp Paratvania l!MO August 6, 1982 NS-EPR-2638 Mr. Richard DeYoung, Director Office of Inspection and Enforcement U.S. Nuclear Regulatory Comission 7920 Norfolk Avenue Bethesda, Maryland 20014 *

Dear Mr. DeYoung:

On August 4,1982, Mr. Ed Flack of your staff was notified by Westinghouse via telephone of a potential problem in its I and C protection system.

During review of a schematic diagram of the Solid State Protection System (SSPS), redrawn for purposes of consolidation. Westinghouse engineers uncovered an undetectable failure which could exist in on-line testing circuits for relays in the system. -

Periodic testing of the SSPS includes actuation of master relays which actuate Safeguards systems. When a preselected master relay is energized, a proving lamp in series with the output (slave) relay coil confirms electrical continuity. Operation of the relay is prevented by reducing the circuit voltage from 120VAC to 15VDC during test. [ Refer to the sketch in Attach' ment I] Subsequent tests from the Safeguards Test Cabinets energize (120VAC) each output relay to confinn actuation of the Safeguards device. In those instances where actuation of the final device cannot be tolerated, a proving lamp in the Safeguards test circuits verifies relay contact movement, field wiring and electrical continuity through the final

device.

As mentioned above, output relay coil continuity is confirmed at the i SSPS, without operating the relay, by reducing the circuit voltage to

! 15VDC from 120VAC. As shown in the sketch, operation of the master l relay by means of the pushbutton test switch also removes the shunt from

the SSPS proving lamp and allows the 15VDC to energize it to confirm the l continuity of the output relay coil. -

4 Upon completion of the master relay and output relay coil continuity

! tests,120VAC circuit voltage is restored. However, if the switch l contacts which shunt the proving lamp should fail to reclose as expected,

120VAC would be applied to the lamp in event the system were called upon j to operate. Depending on the output relay coil impedance and the number i

Y LI L 6

Mr. Richard DeYoung August 6, 1982 of output relays being operated by the master relay contacts, the current through the lamp cor?d cause it to burn open before the output relay (s) energized. In such an instance associated Since, Safeguards devices in the during circuit analysis, all -

affected train would not actuate.

identified nondetectable failures must be assumed to have occurred, the rGdundant Safeguards actuation train must be assumed to be similarly, if ~

not identically, failed.

'c- . .

On August 3,1982, the WRD Safety Review Committee concluded that the potential for undetectable loss of any Safeguards actuation function constituted an Unreviewed Safety Question under 10CFR50.59 and a Potential -

The affected Westinghouse Significant DEficiericy under 10CFR50.55(e).

domestic plants notified are listed in Attachment II.

Although failure of the subject test switch contacts si highly improbable,

-Westinghouse.-is. recommending, a.. minor.. revision to test procedures conducted from the Safeguards Test Cabinets where operatios o'f ih'e' $$PS " output relays is verified. The revision will ensure that the relay test circuits in the SSPS operated properly when the system was returned to its nomal operating mode. The procedure changes are described in Attachment III and are recomended until Westinghouse completes 'a review of its consideration of design changes.

3 For additional infomation please contact my cognizant staff manager, Mr. George Butterworth, 412-373-5761.

Very truly yours, .

' WESTINGHOUSE ELECTRIC CORPORATION

- '= w we .

. Rahe, Manager

[ NTD Nuclear Safety l 8-- -

FWM/anj Attachments n

-r w __

W EST1HGHOUS E EL ECTRIC CO RPOR ATION T

l

~ ower I

. c-g Q ,/ '

l l 3degua rus f -

Cevice

! -.e e--

m ~

i

=02PA L 120 "AC e 4 , ,. ,

TE:7 15 NCC .

Pushbutton ,

rest , .

Swit:h , , ,

.. . . . . . . - -inocentary)i , , - .

... *j. safer .- -

~~*

,' . / s.

7 e .

g .

. _ _ . . . .s_. . - - . .

. 7 . , ~ . . . . . . - _ . , 1 - .u .. . . . . y . . . . .

J. __ '.

1 j' Logic .

(shawa as contacts .-

int ror sisipi scity; ..-

e vcC NORPSL l

M sa vcC III I

y

• NOTE: Switches shown in

) Normal (non-test) position l .

l NORMAL opr#4770M Logic *:entacts" close to pick:up mster relay H.

Master relay contacts close to apply 120 VAC to Slave relay 3.

Slave relay contacts close to powe tne !afeguards device.

!TTT cpi [D.ATTCN; * #elay de selector switch (not shoisit to TEST position swstches slave relay po==c frem 1:0 VAC to 15 voc. sster relay po==r remains 48 VCC.

• Pushbutton test switch contact: (Il pick up paster relay 9 (2) re=ioves lasip shunt :o that 15 70C is applied to slave relay cost thru proving las'y L.

4 5 lave relay is not picted up because of reduced voltage of '5 90C.

r 880!LO'? If contact: shunting preving 14 sip L do not reclose hen pushbutton is released and system is return to Nor-el, then 120 VAC -ould he apps ted to Slave relay cos t tMs "e pmvmg iamp if Safeguards actuation wre cat ted for by the i cgic :entac::-

SIMPLIFIED SKETCH OF T/PICAL SAFEGUARDS AC7dATION RELAY TEITING :N HE IIPS MM d 5 - Jf. . .(,,

, PLANTS WITH STANDARD 2-TRAIN SSPS Salem 1* and 2*

Cook 1* and 2*

+ Ringhal s 2*, 3, and 4 Fa rley 1

• a nd 2*

Beaver Valley 1* and 2

'Diablo Canyon 1 and 2 Troja n"

+ Angra i*

Byron 1 c.nd 2 -

2 Braidwood 1 and 2 Marble Hill 1 and 2 Sequoyah 1* and 2*

Watts Bar 1 and 2

+ Almaraz 1* and 2 *

+ Lemoniz 1 and 2

+ Asco 1 and 2 Virgil Summer

+ Ohi 1* and 2*

McGuire 1* and 2 Catawba 1 and 2 PLANTS WITH "NEW" 2-TRAIN SSPS Millstone 3 Seabrook 1 and 2 Comanche Peak 1 and 2 Wolfereek 1 Callaway 1 Shearon Harris 1 and 2

+ Krsko*

+ Ko-Ri 2

+ Maanshan 1 and 2 Vogtle 1 and 2

+ Korea 5, 6, 7, and 8

+ Vandellos 2 PLANTS WITH 3-TRAIN SSPS t

South Texas 1 and 2

+ Sayago 1

• Operating Plant

+ International Plant APDLICABLE DOMESTIC AND INTERNATIONAL PLANTS ATTACHMENT II

~

.o.* '

~

J SOLZD STATE PROTECTZON SYSTEM MASTER RELAY AND OUTPUT RELAY TEST

~

Perform the test described' below irmediately following complet' ion of the Solid State Protection System (SSPS) Output Relay Testing.

i This test will ensure that the pushbutton or relay contacts used to

shunt the output relay continuity lamps located on the Output Relay Test

) Panel have returned to the closed position.

To check the output relay continuity lamp shunts on the Output Relay Test Panel, utilize the Safeguards Test Cabinets as described below:

j 1. For each of the output relay continuity lamps, select an output l (slave) relay which has its continuity checked through the lamp.

For plants with the standard 2-train SSPS this will be eight relays

, per train and for plants with the "new" 2-train SSPS or the 3-train

• i SSPS this will be sixteen relays per train. This selection can j easily be perfomed by using the Output Relay Test Panel Selections table located in the System Maintenance section of each SSPS Technical Manual.

2. Using the Engineered Safeguards System Final Devise or Actuator Test Procedure select the sections of the test which pertain to the i output relays selected above. This can easily be done by referring l4 to the table of contents.

i L 3. Before proceeding with the selected test sections, verify that all j instructions pertaining to precautions, limitations and initial l conditions have been followed.

1

4. Ensure that the Mode selector switch on the SSPS logic train . Output Relay Test Panel is placed in the Operate position.

l S. From the Safeguards Test Cabinet (STC) proceed with the selected sections of the Engineered Safeguards System Final Device or l Actuator Test Procedure. For each;of the test sections verify that the output relay continuity lamps on the associated SSPS Output l Relay Test Panel do not illuminate while rotating and depressing the l STC test switches 7 Fthe SSPS output relay continuity lamps do not illuminate and the selected sections of the STC tests are successfully completed, all of the continuity lamp shunt contacts have properly returned to the closed position.

6. If an output relay continuity lamp illuminates during testing from i the STC it is an indication that the lamp's shunting contact is l open. Should this occur, remove the associated SSPS logic train from service and replace the Output Relay Test pushbutton (for "new" 2-train and 3-train SSPS, replace the relay whose contacts used for shunting the lamps failed to close). Af ter replacement, retest the master and output relays from the Output Relay Test Panel and perf om the tests listed above.-

ATTACHMENT III

, Page 1 of 2

-r 27110 _ _ _ _ _

.t .

,~ , 7. If an output relay continuity lamp does not illuminate during testing from the STC and the STC test i s unsuccessful it may'ba an indication that the continuity lamp shunt contact is open and that the continuity lamp itself has opened. If this is the case, replace the Output Relay Test pushbutton and the continuity lamp and retest. If the continuity lamp and its associated shunting contact are found operational, this is an indication of a failure in the '

Final Device or its Actuation circuit.

f t

l t

i i

l l

t l

i l

l

ATTACHMENT III L

Page 2 of 2 r.

_