05000245/LER-1997-012-01, :on 970214,discovered Seismic Deficiency in Gas Turbine Generator Digital Control Sys.Caused by Inadequate Interface Review During Installation of Digital Control Sys in 1987.Implemented Physical Mod

:on 970214,discovered Seismic Deficiency in Gas Turbine Generator Digital Control Sys.Caused by Inadequate Interface Review During Installation of Digital Control Sys in 1987.Implemented Physical Mod

ML20136H192
Person / Time
Site:	Millstone
Issue date:	03/17/1997
From:	Robert Walpole NORTHEAST NUCLEAR ENERGY CO.
To:
Shared Package
ML20136H188	List: 05000245/LER-1997-012, Provides List of Commitments Made Re LER 97-012-00 05000245/LER-1997-012-01, :on 970214,discovered Seismic Deficiency in Gas Turbine Generator Digital Control Sys.Caused by Inadequate Interface Review During Installation of Digital Control Sys in 1987.Implemented Physical Mod
References
LER-97-012-01, LER-97-12-1, NUDOCS 9703190081
Download: ML20136H192 (3)

LER-1997-012, on 970214,discovered Seismic Deficiency in Gas Turbine Generator Digital Control Sys.Caused by Inadequate Interface Review During Installation of Digital Control Sys in 1987.Implemented Physical Mod

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition
2451997012R01 - NRC Website

text

__ _

NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB NO. 3160-0104 (4-95)

EAPtRES 04/30198

'NO"H&YAT CfYcNE e

T RO ST 60 AS EPO YtD L L'AP?o^"44= "'Parel' oms"'or=$4'nta LICENSEE EVENT REPORT (LER)

P a^V? 'L*R:"A'en'1"a? Eon"s^a^T1s"LL's" @

$Uc'EEfNfdOEI"r78o'"$0"T" EEoE."Ec'Eo'd*

• s (See reverse for required nurnber of digits / characters for each block)

FACluTY NAME nl DOCKET NUMBER (2)

PAGE (3)

Millstone Nuclear Power Station Unit 1 05000245 1 of 3 TfTLE (4)

Seismic Deficiency in the Gas Turbine Generator Digital Control System EVENT DATE (5)

LER NUMBER (6)

REPORT DATE (7)

OTHER FACILITIES INVOLVED (8)

MONTH DAY YEAR YEAR SEQUENTIAL REVISION MONTH DAY YEAR FAcluTY NAME DOCKET NUMBER NUMBER 02 14 97 97 012 00 03 17 97 OPERATING THis REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR 5: (Check one or more) (11)

MODE (9)

N 20.2201(b) 20.2203(a)(2)(v) 50.73(aH2Hi) 50.73(aH2)(viii)

LEVEL (10) 000 20.2203(aH1) 20.2203(a)(3)(i>

X 50 73(aH2)i,i>

50.73(a>(2)(x)

POWER 20.2203(aH2Hi) 20.2203(aH3Hii) 50.73(a)(2Hiii) 73.71 20.2203(aH2)(ii) 20.2203(a)(4) 50.73(aH2)(iv)

OTHER 20.2203(aH2)(iii) 50.36(cH1) 50.73(aH2Hv) specify in Abstract below or in NRC Form 366A 20.2203(aH2)(iv) 50.36(cH2) 50.73(aH2)(vii) e LICENSEE CONTACT FOR THIS LER (12)

NAME TELEPHONE NUMBER (include Area Codel y

Robert W. Walpole, MP1 Nuclear Licensing Manager (860)440-2191 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT (13)

CAUSE

SYSTEM COMPONENT MANUFACTURER REPORTABLE

CAUSE

SYSTEM COMPONENT MANUFACTURER REPORTABLE To NPRDS To NPRDs SUPPLEMENTAL REPORT EXPECTED (14)

EXPECTED MONTH DAY YEAR SUBMISSION

[

YES NO (if yes, complete EXPECTED SUBMISSION DATE).

ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single spaced typewritten lines) (16) i On February 141997, at 1400 hours0.0162 days <br />0.389 hours <br />0.00231 weeks <br />5.327e-4 months <br />, with the plant in COLD SHUTDOWN, a design deficiency was identified in the Gas Turbine Generator (GTG) digital control system which could have resulted in misoperation during a seismic event.

The design deficiency was discovered during the implementation of the corrective actions from the USl A-46 seismic review of the GTG where the interface between control system input relays and the digital control system was being evtluated. The results of the evaluation indicate a potential for the digital control system to respond to relay contact chatter of durations less than 2mS which could render the GTG inoperable. This was immediately reported pursuant to 10CFR50.72(b)(1)(ii)(B) as a condition that is outside of the plant's design basis. There were no automatic or minually initiated safety system responses as a result of this event. This event is a result of an inadequate interface

]

raview during the installation of the digital control system in 1987. There were no safety consequences as a result of this event as the relay contacts have never been challenged by a seismic event. The safety significance is that with ths GTG in this condition, a seismic event could occur that would cause a loss of normal power, and if concurrent with a single failure to the diesel generator, subject the unit to a Station Blackout (SBO) condition. The SBO condition his been previously analyzed and the safety significance of this event would be minimized as a result of Millstone Unit No.1's ability to negotiate an SBO condition as documented in Standard Specification SP-EE-361 in response to 10CFR50.63. Corrective actions include implementing a physical modification to resolve this design deficiency prior to declaring the GTG operable.

9703190001 970317

~-

PDR ADOCK 05000245 S

PDR

~_ _ _ _ _

NRC FORM 306A U.S. NUCLEAR REGULATORY COMMISSION (4 9M LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1)

DOCKET NUMBER (2)

LER NUMBER (6)

PAGE (3)

YEAR SEQUENTIAL REvlslON Millstone Nuclear Power Station Unit 1 05000245 NUMBER NUMBER 2 of 3 97 012 00 TEXT Uf more space is required, use additional copies of NRC Form 366Al til) 1.

Description of Event

On February 14 1997, at 1400 hours0.0162 days <br />0.389 hours <br />0.00231 weeks <br />5.327e-4 months <br />, with the plant in COLD SHUTDOWN, a design deficiency was identified in the Gas Turbine Generator (GTG) digital control system which could have resulted in misoperation during a seismic event. The design deficiency was discovered during the implementation of the corrective actions from the USl A-46 seismic review of the GTG where the interface between control system input relays and the digital control system was being evaluated. The results of the evaluation indicate a potential for the digital control system to respond to relay contact chatter of durations less than 2mS which could render the GTG inoperable. The GTG was declared inoperable by this event. This was immediately reported pursuant to 10CFR50.72(b)(1)(ii)(B) as a condition that is outside of the plant's design basis. There were no automatic or manually initiated safety system responses as a result of this event.

11. Cause of Even_1 This event is a result of an inadequate interface review during the installation of the digital control system in 1987. The relay inputs to the control system are qualified to IEEE C37.98 which allows a change of state of up to 2mS during a seismic event. The digital control system will detect an input signal change of state as short as 1mS. Contact chatter between 1 and 2 milliseconds is acceptable per the IEEE standard, but the GTG digital control system could interpret the chatter as a valid input, resulting in compromised availability of the GTG. The modification of the GTG control system in 1987, provided seismic qualification for the individual components in accordance with the recognized standards (IEEE 344-75 and C37.98) but failed to address the interface between the new digital control system and the relays that provide input to it.

lit. Analysis of Event This report is pursuant to 10CFR50.73(a)(2)(ii)(B) as a condition that was outside of the plant's design basis.

The GTG is one of two sources of power utilized to mitigate the consequences of a Loss of Normal Power.

The other source is an Emergency Diesel Generator.

The GTG is designed to start automatically upon the loss of off-site power or the initiation of the emergency core cooling system, to provide emergency power for all necessary auxiliaries important to the engineered safeguards systems and to provide power needed during the shutdown mode of operation. The microprocessor based governor control system provides for the start sequencing and fuel demand of the GTG. The condition described in this event would have prevented the design function from being achieved without manual action to reset control circuits. For example, dependent upon specific contact chatter, the GTG may not have started when required due to seal-in of shutdown circuits requiring manual operator reset, or may have started inadvertently during the seismic event. Additionally, the GTG protective circuitry would have resulted in a five minute lock-out which cannot be overridden by operator action.

There were no safety consequences as a result of this event as the relay contacts have never been challenged by a seismic event. The safety significance is that with the GTG in this condition, a seismic event could occur that would cause a loss of normal power, and if concurrent with a single failure to the diesel generator, subject the unit to a Station Blackout (SBO) condition. The SBO condition has been previously analyzed and the safety significance of this event would be minimized as a result of Millstone 9$RC FORM 366A 14 95) l

.U.S. NUCLEAR REGULATORY COMMISslON i

14 95)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1)

DOCKET NUMBER (2)

LER NUMBER (6)

PAGE (3)

YEAR SEQUENTIAL REVISION Millstone Nuclear Power Station Unit 1 05000245 NUMBER NUMBER 3 of 3 97 012 00 TEXT (If more space is required, use additional copies of NRC form 366A) (11)

Unit No.1's ability to negotiate an SBO conditien as documented in Standard Specification SP-EE-361 in response to 10CFR50.63, " Loss of Alternating Current Power."

IV. Corrective Action

A physical modification to resolve this design deficiency will be implemented prior to declaring the GTG operable.

NNECO will perform a review, prior to startup for operating Cycle 16, of all design changes incorporating digital components that are in progress for similar issues and resolve any found prior to implementation.

NNECO will revise the Design Control Manual to specifically require review of interfaces between dissimilar equipment, in particular, between relays and digital equipment prior to startup for operating Cycle 16.

NNECO willincorporate into the existing engineering review being performed, as part of the Quality Software i

Project for all microprocessor based plant equipment, a review of this condition to identify similar conditions prior to startup for operating Cycle 16.

The results of the entire A-46 program will be submitted to NRC within 6 months of completing RFO 15 as previously stated in LER 96-003-01 and committed to in the response to GL 87-02 Supplement 1 dated September 21,1992.

V.

Additional Information

Similar Events LER 96-049 " Emergency Diesel Generator and Gas Turbine Relays May Not Function During Seismic Event" LER 96-003 " Seismic Deficiencies identified Through the USI A-46 Program" This LER documents a seismic deficiency with the EDG day tank anchorage discovered through a walkdown performed as part of the USl A-46 program. Also the vibration isolator support system of the turbine building secondary cooling water (TBSCCW) air coolers did not meet the seismic adequacy screening criteria. The EDG and TBSCCW were declared inoperable. The LER states that the evaluation of actions required to resolve USl A-46 program outliers was continuing.

LER 91-028 " Seismic Interaction on TBSCCW System" This LER documents that due to inadequate anchoring of room coolers, a seismic event could have resulted in loss of TBSCCW which in turn would have resulted in inoperability of EDG and l

Feedwater Coolant Injection System. As part of the corrective actions, it was stated that "the adequacy for all safety related electrical and mechanical equipment is scheduled to be reviewed under the upcoming USl A-46 inspection program.

This inspection program during its implementation will analyze all safety related component anchorage and ensure the correct number of anchor bolts are installed."

Manufacturer Data Not Applicable ll l