ML20137J689
| ML20137J689 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 01/08/1986 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20137J676 | List: |
| References | |
| NUDOCS 8601230147 | |
| Download: ML20137J689 (9) | |
Text
_
Enclosure 1 SAFETY EVALUATION - DAVIS BESSE ROOT CAUSES, CORRECTIVE ACTIONS AND GENERIC IMPLICATIONS CONCERNING SPURIOUS STEAM AND FEEDWATER RUPTURE CONTROL SYSTEM ACTUATION AND SPURIOUS MAIN STEAM ISOLATION VALVE CLOSURE 3.2.1 Event Specific Investigations; Root Causes And Corrective Actions Concerning Spurious Steam And Feedwater Rupture Control System Actuation And Spurious Main Steam Isolation Valve Closure Introduction The steam and feedwater rupture control system (SFRCS) at Davis-Besse is designed as an engineered safety features system to monitor plant parameters (steam generator level and pressure, differential pressure between the steam line and main feedwater line for each steam generator, and the loss of all four reactor coolant pumps), and under plant conditions indicative of a main steam line break, main feedwater line break, or loss of heat sink to initiate appropriate actions to isolate a ruptured steam generator and initiate auxiliary feedwater system (AFWS) flow to the intact steam generator (s).
Valves controlled by the SFRCS to isolate a rupture steam generator include the main steam isolation valves (MSIVs).
On June 9, 1985, an event occurred at Davis-Besse which involved the loss of main feedwater (MFW) flow and auxiliary feedwater flow to both steam genera-tors. MFW flow was lost due to a trip of the #1 MFW pump, and spurious closure of both MSIVs resulting in loss of steam to the #2 MFW pump turbine. The NRC investigation conducted following the event (the results of the investigation are documented in NUREG-1154) indicates that the operators believed that either a partial or full actuation of the SFRCS may have closed the MSIVs. However, the control room annunciator panels did not indicate that a SFRCS actuation had occurred, and other equipment which normally would have responded to a SFRCS full trip did not actuate. A review of the computer alarm log after the event revealed that a SFRCS actuation channel #2 full trip on steam generator low level had occurred. The SFRCS actuation occurred ininediately following a reactor trip and turbine trip on high reactor coolant system pressure. At the 8601230147 e60100 PDR ADOCK 05000346 S PDR l
2 time or the SFRCS low level actuation, the water level in both steam generators was above the SFRCS low level trip setpoint. The licensee has perfonned an analysis (Plan No. 5, 6 and 7 of Appendix C.1.1 to the Course of Action report dated September 9,1985) to detennine the root causes for the spurious SFRCS actuation and MSIV closures. The staff has evaluated the licensee's analysis and proposed corrective actions, and generic implications of the spurious actuations as discussed below.
Discussion The SFRCS at Davis-Besse consists of two actuation channels. In general, actuation channel #1 provides output signals to actuate equipment associated with loop #1 (i.e., valves in lines associated with steam generator #1, AFWS train #1, etc.), and similarly, actuation channel #2 actuates equipment associated with loop #2. Each actuation channel consists of two redundant logic channels, one of which is ac powered, the other is de powered. Most SFRCS actuated equipment requires both logic halves of its associated actuation channel to trip in order for the equipment to actuate. This is referred to as a full trip. The trip of a single logic channel is referred to as a half trip.
The MSIVs require full trips to isolate. However, unlike most SFRCS equipment, a trip of either actuation channel will close both MSIVs. The SFRCS uses a deenergize to actuate trip logic (i.e., a logic channel will trip upon loss /
failure of its power supply). A block diagram of the SFRCS actuation and logic channels (Figure 4.6 from NUREG-1154) is attached.
There are eight Rosemount 1153 differential pressure (dp) transmitters used to monitor steam generator level for the SFRCS. The corresponding instrument channels provide inputs to the SFRCS logic; four instrument channels provide inputs to each actuation channel. Each logic channel receives inputs from two steam generator level instrument channels, one channel associated with each steam generator. For a given logic channel to trip, either of its two associated instrument channels must sense that steam generator level is below the SFRCS low level setpoint. Thus, both MSIVs will close on a SFRCS low level
trip by either actuation channel when each of its two logic channels senses low level in either steam generator.
The licensee's analysis to determine the root cause for the spurious SFRCS actuation and closure of the MSIVs included testing to determine SFRCS steam generator level instrument channel response times, actuated equipment response times, and actuation and reset times of the SFRCS trip alarms. The analysis also included visual inspections of SFRCS components, and tests to determine whether electrical interconnections or interference existed between redundant SFRCS logic circuits, or between the turbine trip circuits and the SFRCS.
Tests were also performed to determine whether the steam generator level trans-mitters were in calibration. The results of this testing and an analysis of data available from the June 9, 1985 event has led the licensee to the following hypotheses for the root cause of the spurious SFRCS actuation and MSIV closures. The licensee believes that pressure pulses in the main steam lines caused by rapid closure of the turbine stop valves (on turbine trip) induced oscillations in the steam generator level instrumentation that caused a momentary full trip of SFRCS actuation channel #2 on low level, and that the full trip remained long enough to initiate MSIV closure, but automatically reset before other SFRCS equipment could be actuated. The SFRCS does not include logic or actuation channel seal in circuits that require manual reset to clear the protective action signals and restore the SFRCS to its normal (non-trip) condition.
Evaluation The licensee has reviewed data available from Davis-Besse and from other nuclear plants to determine the effects of sudden TSV closure on steam genera-tor level sensing instrumentation. Data recorded during a pre-operational turbine trip test from 75% power at Davis-Besse shows that oscillations occurred in the sensed / indicated steam generator level (by the startup range level transmitters which provide inputs to the SFRCS), which were more than 50 inches less than actual level inmediately following turbine trip. The oscillations were of short duration, less than 200 milliseconds (ms), and the
amplitude of the oscillations decreased significantly after several cycles.
The licensee reviewed transient reports from three other nuclear plants that revealed oscillatory behavior in the level transmitter outputs following reactor / turbine trips, apparently due to pressure oscillations in the main steam lines caused by TSV closure. Bailey BY level transmitters were installed during the Davis-Besse turbine trip test. During a 1984 refueling outage, these transmitters were replaced with Rosemount 1153 transmitters. Since the Rosemount transmitters are considerably more responsive / sensitive than the Bailey transmitters, the licensee believes that the amplitude of the transmitter output oscillations would be greater than exhibited by the Bailey transmitters during the test. The licensee believes the oscillations in the Rosemount 1153 transmitter outputs, caused by steam line pressure oscillations from TSV closure on turbine trip, were the root cause for the spurious SFRCS actuation during the June 9, 1985 event.
A review of Figures 3.2 and 3.3 of NUREG-1154 (plots of steam generator level
' as a function of time during the event) indicates that the transmitter output
! oscillations would have to be approximately 70 to 90 inches in amplitude (only slightly greater than the oscillations exhibited by the Bailey transmitters) in order to cause the spurious SFRCS low level actuation. An analysis performed for the licensee by MPR Associates has estimated that the apparent level swing shown by the Rosemount transmitters following turbine trip from 100% power could be several times greater than that shown by the Bailey trans-mitters. This is due to the increased sensitivity of the Rosemount transmitters and the change in the instrument sensing line hydraulic configura-
> tion required for installation of the Rosemount transmitters. Additionally, it was estimated that the effects for the SFRCS actuation channel #2 would be more pronounced due to the level transmitter configuration. The licensee believes that the SFRCS full trip control room annunciator point did actuate at the time of the trip, but that since the trip was present for only a short duration and since the annunciator circuit does not seal in, that the annuncia-tor had returned to nomal by the time the operators looked to see if a SFRCS trip had occurred. Based on a review of the licensee's analysis, the staff concurs with the licensee's determination of the root cause for the spurious SFRCS actuation.
T' The SFRCS equipment is actuated by several different types of components including ac and de motor operated valve starters, solenoid valves for air operated valves, and solenoid valves for pneumatic pilot valves which are used to initiate MSIV closure. The licensee has performed tests to determine the minimum time required for a SFRCS low level trip signals to exist to cause the various types of SFRCS components to actuate. The test results show that the MSIYs have the fastest actuation times. MSIV closure will occur 7.5 ms following an SFRCS actuation signal. Air operated valves have the second fastest actuation time at 12.9 ms. The dc motor starter actuated valves were slowest to actuate at 66 ms following a SFRCS trip. Based on these component actuation times, the licensee has concluded that the root cause for the spurious closure of the MSIVs during the June 9, 1985 event was pressure oscillations in the main steam lines due to rapid TSV closure. This caused multiple short duration oscillations in the steam generator level instrumen-tation which in turn caused a momentary full trip of SFRCS actuation channel #2 of sufficient duration to only close the MSIVs. Because the SFRCS actuation signals do not seal in, the SFRCS low level signal automatically reset (cleared) as the level oscillations subsided and before other SFRCS equipment could actuate. The staff concludes that the licensee's determination of the root cause for the spurious MSIV closures during the June 9, 1985 event appears to be valid.
The licensee has performed tests and analyses to determine the validity of other hypotheses for the spurious SFRCS actuation and MSIV closures. It was hypothesized that inadvertent interactions (cross-talk) between redundant SFRCS logic channels may have caused a partial spurious SFRCS trip of the MSIVs and generated the computer alarms. The hypothesis has been discounted because one logic half of an SFRCS actuatien channel is ac powered, the other half is de powered, and the power supplies are electrically independent (shared power supply returns are not used). Additionally, tne licensee has performed tests which verified that there is no interference or cross-channeling between the main turbine trip circuits powered from non-Class IE supplies and the SFRCS circuits powered from separate Class 1E supplies. Another hypothesis was that circuit malfunctions / anomalies resulting from the changeover to the Rosemount i
n
transmitters during the 1984 refueling outage caused the spurious SFRCS/MSIV actuations. This hypothesis has also been discounted since the integrated SFRCS test performed following the modifications verified proper operation of both the system logic and the SFRCS functions associated with low level in either steam generator. It was also hypothesized that the MSIV closures were caused by failures within the MSIV circuits independent of the SFRCS. The licensee has discounted the hypothesis because testing performed on the MSIVs subsequent to the event verified proper operation of the MSIV closure circuitry, the MSIV solenoid valves, and the pneumatic operated pilot valves.
Based on the above, the licensee has determined that oscillations in the steam generator level instrumentation is the most logical and probable root cause for the spurious SFRCS/MSIV actuations.
The planned corrective action to be implemented by the licensee prior to restart is to filter out the effects of system induced oscillations in the steam generator level instrumentation following a turbine trip to avoid spurious actuation of SFRCS equipment. The licensee has estimated the fre-quency of the pressure disturbance caused by TSV closure to be 1.25 Hertz (Hz).
The licensee has determined that a filter having a band pass from 0 Hz to 0.1 Hz (i.e., the transmitters will not respond to oscillations with fre-quencies greater than 0.1 Hz) will provide the necessary filtering and still provide the system response necessary to meet the requirements of the Davis-Besse technical specifications. The licensee has stated that an adjustable filter exists on the amplifier boards in the steam generator level transmitters. A new filter setting will be established to accomplish the necessary signal attenuation (filtering), and the transmitters will be tested to ensure proper calibration and response time. This modification does not involve any SFCRS hardware / circuit mcdifications, and is considered sufficient to prevent future spurious SFRCS/MSIV actuations due to system induced oscilla-tions in the steam generator level instrumentation from TSV closure. The staff concludes that there is reasonable assurance that the licensee has successfully identified the root cause for the spurious SFRCS/MSIV actuations and taken C ~
appropriate corrective action to prevent reoccurrence. Additional correc-tive actions to be taken by the licensee will be to develop surveillance pro-cedures to periodically (quarterly) verify proper operation of the SFRCS logic channel power supplies, and provide a seal in feature for the SFRCS full trip control room annunciator point which requires the operator to acknowledge the full trip condition in order to clear (reset) the annunciator.
Prior to and during Mode 1 operation, the licensee will perform testing on the steam generator startup range level instrumentation supplying signals to the SFRCS to determine the magnitude and frequency of hydraulic and/or electronic noise as sensed by this instrumentation. This monitoring will remain in place until the adequacy of the corrective actions has been verified. The licensee is also performing tests, to be completed prior to entering Mode 1, that will determine the effects of the increased sensitivity of the Rosamount transmitters used to monitor reactor coolant system (RCS) flow. These trans-mitters provide inputs to the reactor protection system, and are the only other Rosemount 1153 transmitters used to provide control or trip functions at Davis-Besse. The staff will review the results of these tests when complete. The licensee has concluded that with the possible exception of the RCS flow trans-mitters, that there are no generic implications from the spurious SFRCS/MSIV actuations applicable to other systems at Davis-Besse. The short duration oscillations which caused momentary actuation of the SFRCS should not cause similar responses in other systems because the SFRCS is the only safety related system using the Rosemount transmitters where operator action is not required to reset the trip condition. The staff agrees that the root causes for the spurious SFRCS/MSIV actuations do not appear to have generic implications for other systems at Davis-Besse.
Conclusion Based on the results of the licensee's root cause analysis, the staff has con-l cluded that there is reasonable assurance that the licensee has successfully identified the root cause of the spurious SFRCS low level actuation and spurious closure of the MSIVs which occurred during the June 9, 1985 event, and that the licensee has taken apnropriate corrective actions to prevent reoccurrence. The staff concludes that the results of the licensee's analysis
and the corrective actions implemented provide an acceptable basis to allow plant restart, The staff will evaluate the results of the tests discussed above to be performed by the licensee prior to and during Mode 1 operation when the tests have been completed.
Dated: January 8, 1986 Principal Contributor: R. A. Kendall
ACTUATION CHANNEL #1 ,
SoLic i l I
I LOcic 1 .
INPUT I REv. dp SWITCHES C CHANNEL l RELAY OUTPUT D EIUFFERS g
l at DRIVERS RELAYS y
g LOW PRESS. SWITCHES C 1 !
l '
RCP MONITORS C U j g
- i I i -
I *
- i LOcic I Mov l CHANNEL l l .., u o..
C 3 I
l C l I C 3 l l I s
b 1
- l I l LOGIC l l l C I CHANNEL l T s2 C L I l
. C l l I
I
' i
+ -
+ -
i I l
. 33o.. mov i
l LOGIC l l C I CHANNEL l l N
C i I "
l l l l C l l l ACTUATION CHANNEL #2 INSTRUMENT SENSING CHANNELS Figure 4.6 SFRCS Block Diagram l