ML20046A487

LER 93-001-00:on 930607,determined RCP Uv & Underfrequency Portion of Rt Sys,& TDAFP Autostart Signal from RCP Bus Uv Contained Design Deviation Due to Personnel Error. Procedural Guidance enhanced.W/930723 Ltr

ML20046A487
Person / Time
Site:	Farley
Issue date:	07/23/1993
From:	Hill R, Dennis Morey SOUTHERN NUCLEAR OPERATING CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
LER-93-001-01, LER-93-1-1, NUDOCS 9307280180
Download: ML20046A487 (6)

Text

Schern tJudear Operatng Company Post Othee Box 1295

• G. rm,ngham, Alabama 50201 1235

.** Trephone 205 NS 5000 L

Southern Nudear Operating Company

he 8ou nem elecinc eystem July 23, 1993 Docket No. 50-348 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555 Joseph M. Farley Nuclear Plant - Unit 1 Licensee Event Report No. LER 93-001-00 Gentlemen:

Joseph M. Farley Nuclear Plant, Unit 1, Licensee Event Report No.

LER 93-001-00 is being voluntarily submitted. If you have any questions, please advise.

Respectfully submitted,

(.f]! Len Dave Morey Vice President Farley Project BHW:maf LERBHW.BHW Enclosure cc: Mr. S. D. Ebneter Mr. G. F. Maxwell l l 5'70071 t ph DO hU _ ; y

        $c: Mr. J. D. Woodard                                                  -

Mr..R.' D. Hill' (G9.07 & A4.05)  ; Mr. C. L. Buck i Mr. L. S. Williams  : Mr. G. T. Lassiter Mr. W. R. Bayne Mr. P. T. Webb .: Mr. J. M. Powell Mr. John Hoffman Mr. O. Batum i Mr. J. W. McGowan ' INP0 Records Center Commitment Tracking System (2) - Document Control (1) ., File: A-3.1/F-6 ANI Library '

                                                                             .n 1

i j i i. l 1 i

;                                                                               i p

+

  . -                                                 . .,,, .,....~. . ..,,

WC,Jorn 366 U.S. NULLLAR RE WLAlukt Cu M 551UN APMWED 06 NO. 315U-0% , i (6' W ) , EXPIRES: 4/30/92

 . .                  LICENSEE EVENT REPORT (LER)

FACILily hAME (1) DOCAEl huMaER (2) puJ #31 Joseph M. Farley - Unit 1 05000348 1 g7l4 Reactor Coolant Ptanp Undervoltage/Underfrequency Circuitry EVENT DAIE (5) LER NUMBER (6) REPORI DATE (7) OTHER FACILlilES INVOLVED (8) MON 1H DAY YEAR TEAR SEQ NUM REV MONTH DAY YEAR FACILITY NAMES DOCKET NUMBER (S) J. M. Farley-Unit 2 05000364 06 07 93 93 0 ') 1 00 07 23 93 05000 I OPERATIkG MODE (9) 1 20.402(b) 20.405(c) 50.73(a)(2)(iv) 73.71(b) POWER - 20.405(a)(1)(i) - 50.36(c)(1) - 50.73(a)(2)(v) 73.71(c) . LEVEL 100 20.405(a)(1)(ii) 50.36(c)(2) 50.73(a)(2)(vii) T OTHER (Specify in 20.405(a)(1)(iii) 50.73(a)(2)(1) 50.73(a)(2)(viii)(A) Abstract below) i 20.405(a)(1)(iv) 50.73(a)(2)(li) 50.73(a)(2)(viii)(B) Voluntary l

                                                 ~                              -

Report

                      ~

20.405(a)(1)(v) 50.73(a)(2)(iii) 50.73(a)(2)(x)  : LICENSEE C0h1ACI FOR THIS LER (12) I NAME TELEPHONE NUMBER 4REA CODE R. D. Hill, General Manager - Nuclear Plant 205 899-5156 COMPLETE ONE LINE FOR EACH FAILURE DESCRIBED IN THIS REPORT (13) CAUSE SYSTEM COMPONENT MANUFAC- R PORT CAUSE SYSTEM COMPONENT MANUFAC- R PORT T ppg T SUPPLEMEhlAL REPORT EXPECTED (14) MONTH DAY YEAR EXPECTED 1 SUBMISSION DAff (15) ] YES(1f yes, complete EXPECTED SUBMISSION DATE) ] NO ABSTRACT (16)  ! In 1993, Southern Nuclear Operating Company (SNC) conducted a Self-Initiated Safety System Assessment (SSSA) of the Reactor Protection System (RPS) modeled ) after the Safety System Functional Inspections conducted by the NRC. On June 7, l 1993, as a result of the SSSA, SNC determined the Reactor Coolant Pwnp (RCP) Undervoltage (UV) and Underfrequency (UF) portion of the reactor trip system, and the Turbine Driven Auxiliary Feedwater Pump (TDAFP) autostart signal from RCP bus undervoltage, contained a design deviation. The deviation was with respect to the single failure criterion requirements of IEEE-279 (1971) and the fail safe requirement of 10 CFR 50 Appendix A General Design Criteria (GDC) 23. The SSSA found that the RCP UV and UF circuitry uses energize-to-actuate components, with two of three channels powered from one Turbine Building (TB) battery and the third channel powered from the other TB battery. For RCP UV or UF, the RPS logic requires two of the three channels to actuate in order to initiate either a reactor trip or a TDAFP automatic start. Thus, a loss of the particular TB battery (a single failure) which supplies two channels would preclude the RPS from sensing a RCP bus UV or UF condition since only one channel would have power. The purpose of the RCP UV and UF reactor trip is to protect against a complete loss of RCS flow event. The RCS low flow reactor trip has been confirmed by Westinghouse analysis to be adequate to provide the primary protective function such that DNBR limits would not be exceeded. In addition, i the UV portion of the circuitry provides an autostart to the TDAFP that is an anticipatory signal. Steam Generator low low level is the primary start signal to the TDAFP. The existing condition does not prevent the RPS from completing the safety function of the system. The design deviation will be corrected.

mig Fonn 3:4A u.5. Ih0Liivi rauJL4iWY uJTil5510ft frFnU(LU (70 ND 3150-01D4 (6-89) EXPIRES: 4/30/92 , LICENSEE EVENT REPORT (LER)- l

..                      TEXT CONTINUATION                                                                                    -

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (5) PAGE (3) i

  .                                                                           VEAR     SEQ NUM         REW                   {

i Joseph M. Farley - Unit 1 05000348 93 001 00 2 0F 4 IEx1 , Plant and System Identification Westinghouse Pressurized Water Reactor Energy' Industry Identification System  ! codes are identified in the text as [XX). , Summary of Event i In 1993, Southern Nuclear Operating Company conducted a five week Self-Initiated l Safety System Assessment (SSSA) of the Reactor Protection System {JE] modeled after the Safety System Functional Inspections conducted by the NRC. On June 7, 1993, as a result of the SSSA investigation, SNC determined the Reactor Coolant Pump reactor trip system configuration-(UF and UV), and the TDAFP autostart , signal from RCP bus UV contained a design deviation with respect to the single failure criterion requirements of IEEE-279 (1971) and the fail safe requirement of 10 CFR 50 Appendix A General Design Criteria (GDC) 23. The RCP UV and UF , reactor trips are presently considered by the FSAR accident analysis of record  ! as primary protective functions for the complete loss of RCS flow event. The UV portion of the circuitry, which provides the automatic start of the TDAFP, is an i anticipatory signal for a Steam Generator low low level condition. I The SSSA found that the RCP UV and UF circuitry uses energize-to actuate components (timers for UV and auxiliary relays for UF) with two of three i channels powered from one TB battery and the third channel powered from the j other TB battery. For RCP UV or UF the RPS logic requires two of the three l channels to actuate in order to initiate either a reactor trip or a TDAFP , automatic start. Thus, the loss (or single failure) of the particular TB i battery which supplies the two channels would preclude the RPS from sensing a RCP bus UV or UF condition since only one channel would have power (The RPS requires two out of the three channels to provide a coincident signal to actuate this reactor trip). Concurrent with the investigation, an analysis performed by Westinghouse showed that the RCS low flow trip could be considered as the primary protective action, therefore, the RCP UV and UF trips can be considered anticipatory trips. Current accident analysis for the loss of the RCP busses does not take credit for the TDAFP, therefore there is no safety concern relative to the RCP bus UV autostart to the TDAFP. Description of Event In 1993, Southern Nuclear Operating Company, Farley Project, conducted a Self-Initiated Safety System Assessment (SSSA) on the Reactor Protection System (RPS). As a result of the assessment it was determined that the UV and UF reactor trip and RCP UV TDAFP autostart circuitry, as described above, was not 1 in compliance with the IEEE-279 (1971) single failure criterion and the fail l safe requirement of GDC 23. Since the current analysis of record relied upon I the RCP UV/UF reactor trips as the primary protection for the complete loss of

T4 funn M U.5. NJk Un 4 W W U W455Wh knWW UPt NU MM104

          +
             .         LICENSEE EVENT REPORT (LER)
  ..                       TEXT CONTINUATION FACILITY NAME (1).                                DDCKET NUMBER (2)                                      LER NUMBER (5)           PAGE (3)

TEAR SEQ h0H REV Joseph M. Farley - Unit 1 05000348 93 001 00 3 0F 4 IEXT Description of Event (continued) RCS flow event, SNC considered this situation as a potential design configuration deviation. SNC discussed the situation with Westinghouse and concluded, based on Westinghouse engineering judgment, that the analysis of record would have sufficient margin to allow the RCS low flow reactor trip to be the primary protective function trip and the RCP UV/UF trip signal to be. anticipatory. Westinghouse was requested to perform an evaluation to verify that the RCS low-flow trip could provide the primary protective function for the complete loss of RCS flow event versus the UV and UF trips as presently outlined in FSAR Chapter

15. The new analyses confirmed the RCS low flow trip could perform as the primary protective function for the complete loss of RCS flow.

As previously discussed the RCP bus UV autostart signal to the TDAFP is considered an anticipatory signal and credit is not taken for the TDAFP in current analysis for the loss of the RCP busses. On June 7, 1993, the issue was discussed with a NRC resident inspector, and the Region II office was informed on June 8,1993 of FNP's intention to voluntarily report this issue. Cause of Event The Farley reactor protection system design requirements were provided by Westinghouse. Bechtel Power Corporation performed most A/E functions for the system. Bechtel interpreted the Westinghouse reactor protection system functional logic diagrams as requiring an energize-to-actuate scheme for the RCP UV timers and UF relays. They failed to consider that having two of the relays powered from the same TB battery would cause the two out of three RPS logic for either a reactor trip or TDAFP automatic start from a RCP bus UV or UF condition to be made inoperable if that particular TB battery were out of service. This resulted in a design that did not meet the FSAR commitments with respect to IEEE-279 (1971), single failure criterion and GDC 23 fail safe requirements for the reactor protection system RCP UV and UF trip functions and TDAFP' automatic start from RCP bus UV. Safety Assessment The operability of RCP UV and UF reactor trip functions has been maintained as demonstrated by periodic surveillance testing. SNC discussed the deviation with Westinghouse, and based on engineering judgment it was determined that the analysis of record would have sufficient margin to allow the primary protective function trip to be. changed from RCP UV/UF to RCS low flow. This judgment was confirmed when Westinghouse performed Parley-specific analysis that demonstrated the RCS low flow trip can provide the primary protective function for the complete loss of RCS flow event described in FSAR Chapter 15. With the RCS low flow trip as the primary protective function the design DNBR limits would not be exceeded. In addition, the plant's emergency response procedures address actions to be taken when a reactor trip is required, whether the trip does or

                                                                  - - - ~.                   a              - ,_ .
                                                                                                                               ~l

% Fonn JbcA U.d. hdLLLim RLudLAiUM LUl%5MQh ArtMNtU Ob NO J150-0104 - EXPIRES: 4/30/92- ' (6-89); . LICENSEE EVENT REPORT (LER)

.  .                   TEXT CONTIhTATION FACIL]TY NAME (1) ;                               DOCKET NUMBER (2)                LER NUMBER (5)                     PAGE (3)    -
         **                                                                Y E_AR     5EQ hum          REV Joseph M. Farley - Unit 1                       '05000348                     93       001            00          4  0F 4       ,

IEXT i Safety Asessment (Continued) l does not take place. Furthermore, control room annunciators alert the _ [ operator should Dr control power be lost to the RCP UV and UF protection system circuit. The design deviatite would not have prevented the Reactor Protection System from completing the safety function of the system. > The overpower delta temperature, overtemperature delta temperature, and high , pressurizer pressure reactor trips also act as diverse backup trips for the complete loss of RCS flow event. The existing accident analysis does not take credit for.the RCP UV start of the. TDAFP since Steam Generator low low level is the primary TDAFP automatic start for this situation. Also, existing emergency and operating procedures address  ; actions to be_taken when a start of the TDAFP is required but has not taken  ; place. Thus, the design deviation associated with the RCP UV start of the TDAFP i-does not affect safety. l Based on the above, no safety concerns exist. Corrective Action i Appropriate Operations personnel have been made aware of the issue. [ Procedural guidance has been enhanced to properly address required actions in the event of a loss of power to the UV/UF relays. This event has been discussed with the responsible design organizations. The design of the RPS where there was a similar interface between multiple  ; design organizations, has been reviewed. It has been determined for the main 1 turbine trip reactor trip, RCP breaker position reactor trip, and autostart of

• motor driven AFW pumps on trip of both SG feed pumps, that this design deviation is not applicable. j The design deviation will be corrected.

Additional Information - No components failed during this event. b

                                   ,  .                 . . _ . .           _.                       ,                    .. -}}