ML20084S542

Updated RO 50-254/76-26:on 760803,rod Worth Minimizer Not Operable for Withdrawal of First Twelve Control Rods to Fully Withdrawn Position While in Startup Mode.Caused by Burned Out Wire Runs on Relay Board.Software Modified

ML20084S542
Person / Time
Site:	Quad Cities
Issue date:	10/30/1976
From:	Kalivianakis N COMMONWEALTH EDISON CO.
To:	James Keppler NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
Shared Package
ML20084S535	List: ML20084S542 ML20084S551
References
NJK-76-395, RO-50-254-76-26, NUDOCS 8306170098
Download: ML20084S542 (6)

Text

,_ _ . _ _ _

• Com lth Edisin 'j Quad-Cities Nue! ear Power Station ~

IE FILE COPY Post Office Box 216 Cordova, Illinois 6* 242 Telephone 309/651-2241 A 5 NJK-76 395 ret $vE0 ev

_ Oc0 7 1976 -__

f g e ummamu -

October 30, 1976 E illllf%"

ll @

J. Keppler, Regional Director Office of Inspection and Enforcement Region lli U. S. Nuclear Regulatory Commission 799 Roosevelt Road Glen Ellyn, Illinois 60137

Reference:

Quad-Cities Nuclear Power Station Docket No. 50-254, DPR-29, Unit 1 Appendix A, Sections 3.3.B.3.b and 6.6.B.I.b Enclosed please find an Update Report for Reportable'Occurr,ence Report No.

RO 50-254/76-26 for Quad-Cities N,uclear Power Station. This occurrence was previously reported to Region Ill, Office of Inspection and Enforcement en August 16, 1976.

Very truly yours, COMMONWEALTH EDISON COMPANY QUAD-CITIES NUCLEAR POWER STATION-

'f r

//f f . A445 N. J. Kalivianakis Station Superintendent NJK/LFG/lk cc: G. A. Abrell

15. .!6 J 8306170098 770318 PDR ADOCK 05000254 S PDR NOV 111976

7 -.. ,

frNNuI$$rtM LICENSEE EVENT REN CCNTR LOCK:l l l l l l l (PLEASE PRINT ALL REQUIRED INFORMATION) 1 8 AME LCENSE NUMBER YPE YPE O1 ll lL lQl Al 0l 1l l0 l0 l-l 0 l 0 l 0l 0l 0l-l0 l0 l l 4 l 1 ll l1lll l0 l1 l 7 89 14 15 25 28 30 31 32 CATEGORY T ff OCCKET NUMBER EVENT DATE REPORf OATE D 1 CONT l l l y l0 l5 l0 l-10 l 2 l 5 l 4l l0 l8 l0 l 3 l 7 l 6 l 68 89 74 l1 lo l3 l0 l7 l 6 l 75 80 7 8 57 58 59 80 81 EVENT OESCRIPTION DE lAn Update Report is submitted to document the portion of Reportable Occurrence Report l 7 89 80 BE Ino 50-254/76-26 related to the improper rod sequence loading into tne Rod Worth l 7 89 80

@ l Minimizer. See attached summary. l 7 89 80 El 7 89 80 l

EXE I l 7 89 pas 80

' CEE CODE COMPONENT CODE SUPPUER ACTURER VOLATON M lRIBl W 7 89 10 11 lZl Zl Zl Zl Zl Zl 12 17 W43 44 l Gl 0l 8l 0l 47 U 48 CAUSE DESCRIPTION DE l NA l 7 89 80 BE I I 7 89 80

. DE I I

's'TiG s power oTsER STATUS "ofSCoTERY oISCovERY oESCni, ton 1 y l0l0l0l l NA l @ l NA l 7 8 9 10 12 13 44 45 48 80 R LEAS 0 0 ASE AMOUNT OF ACTMTV LOCATON OF RELEASE 7 8

[,_Zj 9

Wl10 11 NA l 44 l

45 NA 80 l

PERSONNEL EXPOSURES NUMBER TYPE DESCRIPTON DE I 010 l o I 7 89 11 l.ZJl 12 13 NA 80 l

PERSONNEL INJUR!ES NUMBER DESCRIPTON gg l 0l 0l 0 l l NA l 7 89 11 12 80 OFFSITE CONSEQUENCES DE l NA l 7 89 80 LOSS OR OAMAGE TO FACILITY TYPE DESCRIPTON g] Ql NA l 7 89 10 80 PUBLICITY DE I NA l 7 89 80 ADDITIONAL FACTORS l gg l NA l 7 89 80 DE I I 7 89 80 m e. Gary spedi pgggg;pW22M en. 242

.Pc ......T

r y

. e' REPORT NUMBER: 50-254/76-26 REPORT DATE! August 16, 1976 OCCURRENCE DATE: August 3, 1976 FACILITY: Quad-Cities Nuclear Power Station Cordova, Illinois 61242 IDENTIFICATION OF OCCURRENCE:

The Unit One rod worth minimizer was not operable for the withdrawal of the first twelve control rods to the fully withdrawn position while in the STARTUP mode as required by Technical Specification 3.3.B.3.b.

CONDITIONS PRIOR TO OCCURRENCE:

Urif t One was commencing rod withdrawals in anticipation of starting up following an outage to repair a primary containment purge line.

DESCRIPTION OF OCCURRENCE: On August 3, 1976 at 7:35 P.M., control rod withdrawal commenced in anticipation of starting up Unit One. At 8:38 P.M.

control rod withdrawal was halted after withdrawal of the 50th control rod. The rod worth minimizer was still displaying the 6th control rod to be withdrawn in group one, and was apparently not following the control rod withdrawals. At this point the control rod pattern was verified as being correct by both the control room operator and the Shift Engineer

• and subsequent rod withdrawals were verifled,by a Nuclear Engineer. , Unit One was not made critical on August 3,1976,. but had control rods withdrawn to Just short of critical. At 10:45 A.M. on August 4, 1976 all control rods were fully inserted due to delays in the primary containment purge line repair. The unit remained with all rods fully inserted until 6:33 A.M. on August 5, 1976 when control rod withdrawal again commenced in anti-cipation of starting up the unit. After successful completion of the pipe repair, Unit One was made critical on August 6,1976 at 4:33 a.m.

On August 4 the computer technician had repaired the rod worth minimizer and declared it operable for the startup on August 5, 1976. In the course of his maintenance repair work, however, he had brought the rod worth minimizer off line, repaired it, and reinitialized it with the wrong con-trol rod sequence loaded. The control rod sequence which should have been loaded, and the one which was loaded, were identical sequences through control rod group 6. Groups 7 and 8 on the improper sequence were identical to groups 7 and 8 on the proper sequence, but were in reverse order.

Both sequences were substantially different from Groups 9 and up.

After the reactor criticality on August 6, 1976, which occurred in rod group 5, control rod withdrawal continued through group six with the rod worth minimizer functioning properly. Then, the operator failed to follow the specified sequence and skipped group 7 and went on to withdraw group 8.

The rod wor.th minimizer followed the withdrawal of group 8 instead of 7 as proper insequence rod withdrawals. The operator then discovered that a group had been skipped and returned to group 7 to complete the rod with-drawals. The rod worth minimizer followed the withdrawal of group 7 after l

group 8 as proper Insequence rod withdrawals. But when the operator moved on to group 9, the rod worth minimizer properly applied rod blocks. The rod worth minimizer was subsequently bypassed with control rod withdrawal continuing with an extra control room operator verifying the rod withdrawals.

The sequence was loaded and the rod worth minimizer was reinitialized at l 11:00 a.m. on August 6, 1976.

DESIGNATION OF APPARENT CAUSE OF OCCURRENCE:

Equipment Failure On August 3,1976, af ter withdrawal of the sixth rod in group one, a diode in the rod position / error message output window display circuitry of the rod worth minimizer failed. This overload failure was detected as a distributor error by the multiple output distributor error detection circuitry, and a signal was sent to apply rod insert and withdrawal blocks as part of the fall-safe design of the rod worth minimizer. The rod insert and withdrawal blocks were never applied, however, because a wire run on relay card KHSK2 was burned out and discontinuous.

The rod worth minimizer program itself, upon detection of a multiple output distributor error, is designed to display the appropriate error message in the control room. When an overload error is detected in a circuit whose function is to display messages in the control room, the rod worth minimizer program goes into an Iterative loop and indicates on the displays in the control room that there is a hardwa.re failure. .This is accomplished by lighting the red alarm light but' not displaying a particula,r message *. The rod selected display remains in the mode of display that was present when the hardware failure occurred. An attributing cause to this occur'rence was the control room operator's failure to notice that the rod worth minimizer was not following the selection and movement of the 7th rod in group one on August 3, 1976. Had he done so, control rod movement could have been halted until the rod worth minimizer was repaired.

The loading of the rod worth minimizer on August 4, 1976 with the incorrect sequence may be attributed to poor communication between the Nuclear Engineers of the Technical Staff and the computer technician, as well as poor documen-tation and filing of rod worth minimizer sequences. There is also a pro-cedural Inadequacy apparent in the operating procedure dealing with verifi-cation that the proper sequence has been loaded into the rod worth minimizer, by checking only the first five groups of the minimizer's sequence against that supplied to the unit operator.

ANALYSIS OF OCCURRENCE:

At'no time during this occurrence did there exist an unsafe condition. On August 3, 1976 the control rod sequence was properly followed and implemented.

On August 6, 1976, even though the wrong sequence was loaded in the rod worth minimizer, it was an approved sequence and one used previously at quad-Cities Station. Even though the operator skipped a group on the control rod sequence supplied to him, the rod worth minimizer was performing its function in making sure that the operator did not make an unsafe rod with-d rawa l . The actual sequence of control rod withdrawals used on August 6, 1976 was a completely safe one.

u

I .. ". l That which was experienced was a fall-safe failure of the rod worth minimizer, a subsequent defeating of the computer fall-safe ability, and then a failure on August 3, 1976. With the burned out wire run on the relay card KHSK2,

,a subsequent hardware failure of the type experienced does not result in the safe application of rod insert and withdrawal blocks.

CORRECTIVE ACTION:

After the initial action by the operator and the Shif t Engineer on August 3, 1976 to verify that all the control rods were in their proper-Insequence location, the computer hardware technician was notified that the rod worth minimizer was inoperable. His investigation revealed the burned out relay board, the failed diode, and also a bad power supply to the rod worth minimizer.

The rod worth minimizer circuitry responsible for applying rod insert and withdrawal blocks is powered by a 28 volt D.C. power supply. The rod worth minimizer multiple output distributor is powered by a separate 28 volt D.C.

power supply. If a multiple output distributor error occurs, the K-15 relay picks up and seals in, and applies rod insert and withdrawal blocks.

This function parallels the two 28 volt D.C. power supplies, and, as long as both power supplies are putting ou. an accurate 28 volts D.C., everything a

functions safely and normally. However, if one of the power supplies drif ts significantly and the two power supplies are at different potentials, a current flow is established between the two power supplies. If the power supply drift is significant enough, the current flowing can exceed what certain relay board wire runs can handle, and the runs burn up. Since the K-15' rod block initiatin.g relay l's.a. seal-in relay capable. of being powered

• by either of the 28 volt D.C. power supplies, the' rod' blocks remain safely applied until the Error-Clear b'utton is pushed in the process of reinitializing the rod worth minimizer. This de-energizes the K-15 relay and, upon subsequent multiple output distributor errors with the relay card wire runs burned out, the error is detected. However, the rod blocks are not applied because the current signal to the K-15 relay does not get through the burned out wire run. This occurred on Unit One on August 3, 1976.

At some previous time, a power supply drift was experienced at the instant an error message was received. This paralleled the two mis-matched power supplies, burning up some relay board wire runs. The burned up relay boards went undetected and the rod worth minimizer was reinitialized after pushing the Error Clear pushbutton foliowing correction of the initiating problem.

Then, on August 3,1976, an error message was again received, this time from a faulty diode. The control room display panel remained unchanged from what was displayed at the time of the diode failure, and the rod blocks were not received because of the burned out relay board.

The faulty power supply has been replaced and the preventive maintenance schedule has been changed for these power supplies to increase surveillance of their performance. The burned out relay board has been replaced as well as the bad diode. Access to the Error Clear pushbutton in the computer room will be restricted by keeping the rod worth minimizer panel in the computer room locked with only the computer hardware technician, computer engineering assistant, and the Shif t Engineer possessing a key. The operating procedure for the rod worth minimizer will be revised to caution the operators in the control room to only interface with the rod worth minimizer from the panel r -

r in the control room. If an error condition cannot be achknowledged and cleared from the control room, it is an indication of a serious type failure requiring the presence of the computer hardware technician. The computer hardware technician, aware of the potential for burned out relay boards, will always check for such failures each time he clears an error condition on the rod worth minimizer before returning to operation. Such actions should be sufficient to prevent this type of occurrence from happening again.

Additional corrective actions taken to improve station performance in this area are as follows:

1. Company computer systems personnel have been requested to mod!fy the rod worth minimizer software to place the rod worth minimizer in a STALL condition upon receipt of an overload type multiple output dis-tributor error. This will provide an independent and redundant rod block signal in the event of an overload error.

2. The procedure for checking out the rod worth minimizer prior to startup will be changed to require verification of the rod worth minimizer's first ten rod groups to insure the proper sequence is loaded.

3 A rod worth minimizer log book will be instituted which will document any maintenance work performed on the rod worth minimizer. Operational information, such as which sequence is presently loaded in each unit's rod worth minimizer, will also be documented.-

4. The computer hardware t'echnician will require station work requests to accompany any work he performs on the rod worth minimizers, which he feels requires documentation and testing by operations personnel before placing it back in service.

5 The computer hardware technician will investigate wiring changes to the rod worth minimizer in an attempt to supply the special error detection 28 volt D.C. Input to the relay buffer from the same power supply that supplies the relay buffer. This change will eliminate the difference in potential in the relay buffer if a power supply were to faII.

These added measures are expected to improve upon the performance of the rod worth minimizers.

FAILURE DATA:

This is the first occurrence of this type at quad-Cities Station. The power supply that drifted was a 28 voit D.C. peripheral power supply, G.E. part number 68A8451Pil2. The diode which failed and initialed the circumstances  !

of this occurrence was a G.E. part number 68A201P3 diode. There are no safety implications based on cumulative experience.