ML20045B037

LER 93-009-00:on 930514,scram Occurred When Mode Switch Moved to Run Position Due to Blown Fuses in Rps.Procedures 52PM-B21-005-1S,52PM-B21-005-2S & 52GM-MEL-007-0S Revised. W/930610 Ltr

ML20045B037
Person / Time
Site:	Hatch
Issue date:	06/10/1993
From:	Beckham J, Tipps S GEORGIA POWER CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
HL-3338, LER-93-009, LER-93-9, NUDOCS 9306160133
Download: ML20045B037 (7)

Text

Georgia Power Company 40 inverness Center Parkway

. . Post Office Box 1295 e Birmingham, /Jabama 35201 '

Toiophone 205 877-7279 m

J. T. Beckham, Jr. Georgia Power Mce President - Naclear $--

Hatch Project (N NN'rn emnc sys!vr*

June 10, 1993 t

Docket Nc. 50-321 HL-3338 005608 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk '

Washington, D.C. 20555 Edwin I. Hatch Nuclear Plant - Unit 1 Licensee Event Report -

Blown Fuses in Reactor Protection System Result in Unplanned Scram Gentlemen:

In accordance with the requirements of 10 CFR 50.73(a)(2)(iv), Georgia Power Company is submitting the enclosed Licensee Event Report (LER) concerning blown fuses in the Reactor Protection System which caused an unplanned scram when the mode switch was placed in the "Run" position.

This event occurred at Plant Hatch - Unit 1.

Sincerely,

'[ 8 -

J. T. Beckham, J OCV/cr

Enclosure:

LER 50-321/1993-009 cc: Georaia Power Company Mr. H. L. Sumner, General Manager - Nuclear Plant NORMS U.S. Nuclear Reaulatory Commission. Washinoton. D.C.

Mr. K. Jabbour, Licensing Project Manager - Hatch U.S. Nuclear Reaulatory Commission. Reaion 11 Mr. S. D. Ebneter, Regional Administrator Mr. L. D. Wert, Senior Resident Inspector - Hatch 15013. ,

,/ ;

9306160133 930610 PDR ADOCK 05000321 s

(/ }

s PDR ,,a

]

i t TTD Jth U.). bl.LLAn KliAA. aim LMiddiVN Arr,Wyld M WJ. Jihi-OAU4 89 EXPIRES: 4/30/92 .

LICENSEE EVENT REPORT (LER) i F AL a'LI I I hAML ( ) bbbblI b6MDLk (d) Ek i i PlNU IMTCH, UNIT 1 05000321 1 gl6 IITLE (4)

B1mN FUSES IN REACIUR PROTECTION SYSTEM CAUSE SCRAM Vt1EN MODE SWITCH IS MOVED 'ID TIIE RIN IDSITION l EVEh1 DATE (5) LER huMEER (6) REPOEI DATE (7) OINER FACILITIES lhWOLVED (6) l M;hin LAT YEAR YEAR SEQ hLM EEv M0hln DA1 TEAR FACILITY hAMES DOCAEI huMbER(5) 05000 05 14 93 93 009 00 06 10 93 05000 CPERAT!hG Inl5 M H S M IM M AM TO InE MMMM U M W (H)

MODE (9) 1 20.402(b) 20.405(c) ^ 50.73(a)(2)(iv) 73.71(b)

POWER -

20.405(a)(1)(i) ~

50.36(c)(3) 50.73(a)(2)(v) 73.71(c)

LEVEL 007 20.405(a)(1)(ti) 50.3E(c),2, 50.73(a)(2)(vii) OTHER (Specify in 20.405(a)(1)(itt) 50.73(a)(2)(1) 50.73(a)(2)(viii)(A) Abstract below) 20.405(a)(1)(tv) -

50.73(a)(2).11) -

50.73(a)(2)(viii)(B) 20.405(a)(1)(v) 50.73(a)(2)itii) 50.73(a)(2)fr)

LICEh5Ei CGhTACI FCR Inl5 LER (11)

%AkE lELEFnCht hvMBER ,

LkEA CODE STEVEN B. TIPPS, MANAGER NUCLEAR SAFEIY AND COMPLIANCE. IRTQ1 912 367-7851 COMPLETE GhE Llh! FGR LACH FAILURE DE5ChibiD Ih Inl5 REFGk1 (13)

R P0RT CAUSE bYSTEM COMPONENT j MAjLhAC- ppd 5 CAUSE LYSTEN COMPCNENT QU[gAC- R PORT 5bFFLEMEhiAL EEFORT EAFECIED (14) M0hin DAY YEAR SUBMIS$10N

] YES(If yes, complete EXPECTED SUBMISSION DATE) DATE (15)

"i] hD AE5IkACi (16) l On 5/14/93 at 0535 CDT, Unit 1 was in the Run mode at a power level of 170 CMVT i (7% rated thermal powel,. At that time, the unit scrammed when licensed

]

operations personnel moved the reactor mode switch to the Run position. At 0536 j CDT, a Group 1 Primary Containment Isolation System (PCIS) isolation signal was  !

received on low reactor pressure while in the Run mode. The Main Steam I Isolation Valves (MSIVs) closed per design. Three seconds after receipt of the {

Group 1 PCIS isolation signal, operations personnel moved the mode switch out of l the Run position as required by plant procedures. This bypassed the Group 1 PCIS isolation on low reactor pressure before two of the four reactor pressure switches could trip. Consequently, sufficient isolation logic was not initiated to close the remaining Group 1 PCIS valves. Reactor water level decreased to a minimum of 25 inches above instrument zero (183 inches above the top of the active fuel) due to void collapse from the rapid decrease in reactor power.

Water level was restored automatically with the "A" Reactor Feedwater Pump.

The cause of the scram was less than adequate maintenance procedures, less than adequate post-maintenance testing, and personnel error. Because the MSIV limit switch maintenance procedures were less than adequate, it appears the l replacement of the limit switches resulted in blown fuses in the Reactor Protection System (RPS). Less than adequate testing and personnel error j resulted in a failure to detect the blown fuses. As a result, a scram on MSIVs less than 90% open resulted when the mode switch was moved to the Run position, arming that portion of the RPS logic tripped by the blown fuses.

Corrective actions include revising procedures and disciplining personnel.

u tonn auA u.5. uw neutAix wmswh uiww am na ww-w LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1) DOCKET NUMBER {2) LER NUMBER (5) PAGE (3)

TEAR SEQ hum REW PIMr HATCH, UNIT 1 05000321 93 009 00 2 0F 6 IEx1 PLANT AND SYSTEM IDENTIFICATION I

l General Electric - Boiling Water Reactor Energy Industry Identification System codes are identified in the text as (EIIS Code XX).

DESCRIPTION OF EVENT l l On 5/14/93 at 0535 CDT, Unit 1 was in the Run mode at a power level of 170 ChWT  !

(7% rated thermal power). At that time, the unit scrammed when licensed Operations personnel moved the reactor mode switch to the Run position. The i only alarms received at the time of the scram were " Reactor Auto Scram System A l Trip" and " Reactor Auto Scram System B Trip." No alarms indicating the source of the scram signal were received.

Reactor vessel water level decreased from its normal valua of 36 inches above instrument zero (194 inches above the top of the active fuel) to a minimum of 25 inches above instrument zero due to void collapse from the rapid reduction in reactor power. Water level was restored automatically and maintained at or above normal level by the "A" Reactor Feedwater Pump (EIIS Code SJ).

Reactor pressure decreased rapidly due to a low decay heat load (the unit was being returned to service following the completion of a refueling outage begun on 3/16/93). At 0536 CDT, a Group 1 Primary Containment Isolation System (PCIS, EIIS Code JM) isolation signal was received on low reactor vessel pressure with the mode switch in the Run position. The Main Steam Isolation Valves (ZIIS Code JM) closed as designed. Three seconds following receipt of the Group 1 PCIS isolation signal, licensed Operations personnel moved the reactor mode switch out of the Run position per plant procedure 34AB-C71-001-lS, " Scram Procedure,"

as part of scram recovery actions. This bypassed the Group 1 PCIS isolation on low reactor pressure, as designed, before reactor pressure could decrease to the trip setpoints for two of the four reactor pressure switches. Consequently, only the Al and B2 Group 1 PCIS logic channels tripped on low pressure. This was sufficient logic to isolate all eight Main Steam Isolation Valves, but was not sufficient to close the remaining Group 1 PCIS valves, specifically, the  ;

Main Steam Drain Line isolation valves (EIIS Code JM) and the Reactor Water Sample Line isolation valves (EIIS Code JM). Subsequent calibration of all four reactor pressure switches performed on 5/14/93 indicated the switches were in calibration; however, the switches which trip the A2 and B1 Group 1 PCIS logic channels were found to have trip setpoints seven to 12 psig below the other two switches.

A review of the Process Computer (EIIS Code ID) alarm printouts and the Safety Parameter Display System (EIIS Code IQ) computer tape performed by the Event Review Team investigating the scram revealed that three of the four Reactor Protection System logic channels, Al, A2, and B1, monitoring Main Steam Isolation Valve position were tripped prior to the scram. This meant that this logic sensed several Main Steam Isolation Valves less than 90% open, even though i

% + onn 3eu u.s. mvvi ma.m umm g unau om o smews UFB9) D&lRES: Q3C/92 LICENSEE EVENT REPORT (LER) ,

TEXT CONTINUATION  !

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (5) PAGE (3)  !

YEAR SEQ hum REV i

'f PLANT HAICH, UNIT 1 05000321 93 009 00 3 0F 6 100 they had been fully open since 5/11/93. Therefore, the logic initiated a trip in these three Reactor Protection System channels per design. Because the reactor mode switch was not in the Run position prior to the event, the scram {

signal on the Main Steam Isolation Valves less than 90% open was bypassed as  ;

designed. Therefore, no scram signal was initiated until the mode switch.was j moved to the Run position, removing the bypass of the Main Steam Isolation Valve -l position trip and resulting in a full reactor scram.  ;

Upon further investigation, it was found that the three Reactor Protection System logic channels were tripped because 11 of the 16 fuses in the eight Main Steam Isolation Valve position monitoring. circuits were blown. The information from the Process Computer indicated these fuses had been blown at least as early as 5/7/93. With the fuses blown, the relays in the valve position monitoring circuits for seven of the eight Main Steam Isolation Valves were de-energized '

thereby causing trips in channels Al, A2, and B1 of the Reactor Protection System. It appears that the fuses were blown during Main Steam ' solation' Valve ,

limit switch replacement activities completed in April, during the refueling  ?

outage. The limit switches were not isolated from the Reactor Protection System ,

valve position monitoring logic circuits during their replacement; therefore, grounds generated during limit switch removal or replacement (the method by  !

which the switches must be removed / replaced makes grounds possible) could have ,

blown fuses in these logic circuits. No other work common to the seven circuits l with blown fuses was found.  !

The blown fuses were replaced per Maintenance Work Order 1-93-2562 on 5/14/93.  !

The associated logic circuits were tested successfully using plant surveillance  !

procedure 34SV-B21-001-lS, "MSIV Closure Instrument Functional Test " At 0004 CDT on 5/15/93, control rod (EIIS Code AA) withdrawal began and at 0202 CDT, the reactor was critical.

CAUSE OF THE EVENT The cause of the scram was less than adequate maintenance procedures, less than  :

adequate post-maintenance testing, and personnel error. Because the MSIV limit switch maintenance procedures were less than adequate, it appears the replacement of the limit switches resulted in blown fuses in the Reactor Protection System. Less than adequate testing and personnel error resulted in a failure to detect the blown fuses, As a result, a scram on MSIVs less than 90%

open resulted when the mode switch was moved to the Run position, arming that portion of the Reactor Protection System logic tripped by the blown fuses.

The limit switches on the eight Main Steam Isolation Valves were replaced during the refueling outage using plant maintenance procedures 52CM-MEL-007-OS,

" Installation and Maintenance of NAMCO Limit Switches," and 52PM-E21-005-1S,

" Main Steam Isolation Valve Preventive Maintenance." These procedures were less than adequate in that they did not require links in the limit switch junction boxes to be opened prior to removing the limit switches. Consequently, a potential path to ground existed for the Main Steam Isolation Valve position

l l

l

% f om 306A U.b. hJCLUM nualLAiM uJNbiUN aft W h a UMD NJ dl w-QiO4 (frB9) EXPIRLS: 4/30/92 s

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (5) PAGE (3)

YEAR SEQ hda REW PI ANT 1%TCH, UNIT 1 05000321 93 009 00 4 0F 6 Itxi l monitoring circuits in the Reactor Protection System. In fact, it appears that seven of the eight circuits were grounded during limit switch removal or installation resulting in at least one of the two fuses in each circuit blowing and de-energizing (tripping) the associated logic channel in the Reactor Protection System.  !

l The post-maintenance testing of the limit switch replacement work was less than adequate in that the Reactor Protection System logic was not verified to be l functioning properly. This logic should have been checked as part of the post-maintenance testing of this work because the limit switches provide an input into the Reactor Protection System valve position monitoring logic circuits for each of the eight Main Steam Isolation Valves. Work on the limit  ;

switches, therefore, can have an affect on the Reactor Protection System logic

and this logic should be verified to be functioning properly. Adequate post-maintenance testing would have revealed this problem prior to the mode  ;

j switch being moved to the Run position. l l l Licensed Operations personnel failed to detect a problem in the Main Steam l Isolation Valve position monitoring logic on 5/11/93 when the valves were opened per plant procedure 34GO-OPS-001-15, " Plant Startup." This procedure requires l

that the Reactor Protection System relays in the position monitoring circuits be verified to be energized after the Main Steam Isolation Valves are opened (these eight relays are energized when the valves are greater than 90% open). The operator who checked the relays mistakenly thought all eight valve positioning monitoring relays were energized when in fact seven were not energized as required by the procedure and plant conditions.

1 REPORTABILITY ANALYSIS AND SAFETY ASSESSMENT This report is required by 10 CFR 50.73(a)(2)(iv) because unplanned actuations of the Reactor Protection System and the Group 1 PCIS, an Engineered Safety Feature system, occurred. Due to blown fuses in the Reactor Protection System logic, a full scram occurred when the reactor mode switch was moved to the Run i position. Following the scram, a Group 1 PCIS isolation occurred and the Main l Steam Isolation Valves closed on low steam line pressure while in the Run mode as reactor pressure decreased rapidly due to a low decay heat load.

The Reactor Protection System provides timely protection against the onset and consequences of conditions that threaten the integrity of the fuel and nuclear system process barriers. Specifically, the Main Steam Isolation Valve closure scram anticipates the neutron flux and pressure scrams which would occur in the event that these valves closed. The closure scram limits the flux and pressure increases that occur when the Main Steam Isolation Valves close thereby providing additional margin to the fuel and pressure vessel safety limits, l respectively. This scram signal is armed only when the reactor mode switch is in the Run position.

l l

l l

I

}

w, s om su u.s. mv. Rusiw ums3ia kra s oehasiw-w, i

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY hAME (1) DOCKET NUMBER (2) LER NUMBER (5) PAGE (3) 1 EAR SEQ hum REV PI M r HATCH, UNIT 1 05000321 93 009 00 5 0F 6 IEXT l Low pressure while the reactor is in the Run mode could indicate a malfunction of the pressure regulator which would cause the Turbine control Valves (EIIS l Code TA) or Turbine Bypass Valves (EIIS Code 50) to open fully. This could j result in rapid depressurization of the reactor pressure vessel causing cooldown '

limits to be exceeded and putting undue stress on the vessel. Accordingly, the l Main Steam Isolation Valves automatically isolate on low pressure when the mode switch is in the Run position, isolating the pressure vessel and limiting the magnitude of the pressure decrease.

l In this event, blown fuses in the Reactor Protection System Main Steam Isolation l Valve position monitoring logic resulted in a scram when the mode switch was l moved to the Run position. Moving the mode switch armed this portion of the logic, which was already in a tripped state because of the blown fuses (all Reactor Protection System logic is designed to fail safe, i.e., in the tripped condition, on loss of power), and resulted in a reactor scram per design.

Following the scram, pressure decreased rapidly due to a low decay heat load, i The Main Steam Isolation Valves closed on low pressure per their design to limit  !

the magnitude of the pressure decrease and prevent vessel cooldown limits from l being exceeded.

Both the Reactor Protection System and the Group 1 PCIS functioned per design given the plant conditions at the time of the event. Based on this analysis, it j is concluded that this event had no adverse impact on nuclear safety. This  !

analysis is applicable to all power levels and operating conditions in which these logic signals are required to operate. '

l CORRECTIVE ACTIONS  !

Procedure 52PM-B21-005-IS will be revised prior to the next Unit I refueling outage to require that the Main Steam Isolation Valve limit switches be isolated  !

completely prior to maintenance or replacement and that the Main Steam Isolation l Valve position monitoring logic relays be verified to function properly (i.e.,

energize when the valves are fully open) as part of post-maintenance testing.

Procedure 52PM-B21-005-2S, " Main Steam Isolation Valve Preventive Maintenance," l will be revised prior to the next Unit 2 refueling outage to require that the j limit switches for the Main Steam Isolation Valves be isolated completely prior to maintenance or replacement and that the Main Steam Isolation Valve position monitoring logic relays be verified to function properly (i.e., energize when the valves are fully open) as part of post-maintenance testing.

Procedure 52GM-MEL-007-OS will be revised prior to the next Unit 2 refueling outage to strengthen the requirements concerning the complete isolation of limit switches and the verification that circuits are de-energized prior to maintenance or replacement of the limit switches.

The involved operator was formally disciplined under Georgia Power Company's Positive Discipline Program, and temporarily suspended from licensed duties. In addition, Operations shifts have been given training on how to determine the status of relays.

% Form JMA U.S. NJM1Aii ,dwAAiJh1 UMishiUli ArwiMLD UMb NQ 41 holo 4 (6-89) '

• LICENSEE EVENT REPORT (LER)

EXPIRES: 4/30/92 i

+< TEXT CONTINUATION FACILITY N'AME (1) DDCKET NUMBER (2) LER NUMBER (5) - PAGE (3) .,

YEAR SEQ hum REV e FIANT HATCH, UNIT 1 05000321- 93 009 00 6 0F 6 .

IEx1 i l

ADDITIONAL INFOPJiATION i

}

No systems other than those mentioned in this report were involved _in this l event. j No failed components caused or resulted from this event. The blown fuses were ,

the result of actual short circuit current when grounds apparently were generated during Main Steam Isolation Valve limit switch replacement work. 1 1

Previous similar events in the last two years in which personnel error or l inadequate procedures resulted in a reactor scram were reported in the following i Licensee Event Reports: l 50-321/1991-017, dated 10/9/91, 50-321/1991-026, dated 12/4/91, )

50-321/1992-009, dated 4/23/92, -

i 50-366/1992-009, dated 7/24/92, '

50-366/1992-026, dated 12/21/92.

Corrective actions for these events could not have prevented this event because-the previous events involved personnel performing activities or procedures different than those personnel, activities, and procedures involved in this event.

1

-