ML20148F097

Special Rept SR-88-003-00:from 850801-880308,several Emergency Diesel Generators Failed to Start.Caused by Malfunctioning Trip Mechanisms.Diesels Will Not Be Taken Out of Svc Until Plant Scheduled to Be out-of-svc for Maint

ML20148F097
Person / Time
Site:	Waterford
Issue date:	03/18/1988
From:	Carns N LOUISIANA POWER & LIGHT CO.
To:	NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM)
References
SR-88-003-00, SR-88-3, W3A88-0022, W3A88-22, NUDOCS 8803280064
Download: ML20148F097 (10)

Text

.

s Ref: License No. NPF-38 l.c L2issistruJa /

POWER & LIGHT WATERFORD 3 SES

• P. O. BOX B e KILLONA. LA 70066 NN SYNEA March 18, 1988 W3A88-0022 A4.05 QA U.S. Nuclear Regulatory Commission ATTENTION:

Document Control Desk Washington, D.C.

20555

SUBJECT:

Waterford 3 SES Docket No. 50-382 License No. NPF-38 Reporting of Special Report Attached is Special Report Number SR-88-003-00 for Waterford 3.

This report describes several nonvalid failures which have occurred during testing of Emergency Diesel Generators over the last three years.

The Waterford 3 Technical Specifications require the reporting of all valid and nonvalid test failures in accordance with Regulatory Guide 1.108.

Since the phrase "nonvalid failure" is not used in the guide, we have expended considerable effort in attempting to properly define this term, and have encountered a wide variance in the industry as to the types of events so classified.

It is our understanding that significant revisions to Regulatory Guide 1.108 are in progress to resolve such problems.

The guide does use the phrase "should not be considered valid tests or failures" for several categories of events, including those in which the diesel is secured manually without loading, which is generally not consid-ered reportable.

Since this was known to us, and the same phrase is used to classify the events contained in this report, they were initially also classified as not reportable.

After it was pointed out by our Resident Inspector that this classification might be in error, clarification of the types of events which should be reported under this wording was requested from our Project Manager by telephone in late 1987. Discussions were held at our facility with several members of the NRC staff knowledgeable in this area during the first week of March, 1988. Although no explicit definition of "nonvalid f ailure" could be arrived at that would capture only those events the staff wishes to be reported, our discussions have provided as with a clearer sense of the types of events of interest to the NRC staff.

Accordin; j, the s' Obh

/

V

.. suuAL OPPORTUNITY EMPLOYER" g

Page 2 W3A88-0022 March 18,1988 events which we have reclassified as nonvalid failures are described in the attached report which is submitted in accordance with Technical Specifications 3.8.1.1 and 6.9.2.

Although the precise classification of "nonvalid failures" may be unclear in Regulatory Guide 1.108, it is clear that such failures are, by definition, not significant to the safety function or reliability of the diesel.

There was, therefore, no change in testing frequency as a result of these events. We look forward to reviewing the proposed revision to R.G.

1.108 which should further clarify this issue.

Very truly yours,

=p

,.y N.S. Carns Plant Manager - Nuclear NSC/DEBirk 1

Attachment cc:

R.D. Martin, NRC Resident Inspectors Office, INPO Records Center (J.T. Wheelock), E.L. Blake, W.M. Stevenson, D.L. Wigginton 1

l

=

SPECIAL REPORT SR-88-003-00 Invalid Failures of Emergency Diesel Generators Due to Spurious Operation of Trips Which are Bypassed in the Emergency Mode INTRODUCTION From August 1, 1985, to March 8, 1988, there were several failures of the Emergency Diesel Generators (EDGs) to start due to actuation of trips which are bypassed in the emergency mode.

There were nine shutdowns due to actuation of the Turbocharger Low Lube 011 Pressure trip, one shutdown due to actuation of the Generator Fault trip, one shutdown due to an air leak in the Pneumatic Control System (PCS), and two shutdowns due to attuation of High Generator Bearing Temperature trips.

The Turbocharger Low Lube Oil, Generator Fault, and Generator Pearing High Temperature trips actuate the Safety Trip Valve in the PCS to shut down the diesel. All the trips associated with the PCS are bypassed in the emergency mode. There were no failed starts in the emergency mode (i.e., valid failures) which have not been previously reported and corrected.

In each case, observation of engine parameters and subsequent troubleshooting demonstrated that the trip actuation was due to a malfunction of the trip mechanism rather than an actual out-of-range parameter.

Thus, these events were not considered valid tests or failures in accordance with Regulatory Guide 1.108, Revision 1, Section C.2.e(2),

and there was no safety significance to these events.

1

NARRATIVE From August 1, 1985, to March 8, 1988, there were several failures of the Emergency Diesel Generators (EDGs) to start due to actuation of trips which are bypassed in the emergency mode. These trips cause the Safety Trip Valve in the Pnetmatic Control System (PCS) to lift, venting air pressure from the Pneumatic Fuel Control Valve.

If this occurs when the diesel is run,ing in the Test Mode, the diesel will shut down.

In the emergency mode, the Emergency Mode Fuel Control Solenoid Valves bypass the Pneumatic Fuel Control Valve and lock the fuel "on" to prevent a trip.

Only diesel "overspeed" or "generator differential" can cause a shutdown in this mode.

At 1350 hours0.0156 days <br />0.375 hours <br />0.00223 weeks <br />5.13675e-4 months <br /> and 1409 hours0.0163 days <br />0.391 hours <br />0.00233 weeks <br />5.361245e-4 months <br /> on August 1, 1985, sith the plant in cold shutdown, (mode 5) EDG 'B' tripped during performance of procedure OP-903-068, "Emergency Diesel Generator Operability Verification," due to a broken connector on the EDG

'B' Connecting Rod Bearing High Temperature Switch, EG-ITS-3002BS. The Connecting Rod Bearing High Temperature Detectors consist of spring-loaded fuse rods secured in place by a low melting-point alloy.

When the t(Operature of a connecting rod bearing reaches 19' degrees Fahrenheit, the metal alloy melts, releasing the fuse rod.

The fuse rod, under spring pressure, unseats a ball valve thus venting off control air to shut down the diesel.

The EDG had just been started manually in the test mude when it trippel.

It was determined by examination of the trip device that no high temperature condition on the connecting rod bearings existed.

The Connecting Rod Bearing Temperature Detector had not melted from a high temperature condition, but the Connecting Rod Bearing High Temperature Switch had broken. The switch was subsequently repaired. The cause of the broken switch was e.e.tributed to personnel who had stepped on the associated instrumentation. The diesel was declared operable at 0552 hours0.00639 days <br />0.153 hours <br />9.126984e-4 weeks <br />2.10036e-4 months <br /> on August 3, 1985.

Since this trip is bypassed i

in the emergency mode, there was no safety significance to this event and this was not considered a valid test or failure.

4 2

l At 1551 hours0.018 days <br />0.431 hours <br />0.00256 weeks <br />5.901555e-4 months <br /> on January 30, 1986 with the plant operating at 100% power, EDG 'B' shutdown on actuation of the Turbocharger Low Lube Oil Pressure trip during performance of OP-903-068. Ar 1608 hours0.0186 days <br />0.447 hours <br />0.00266 weeks <br />6.11844e-4 months <br /> on January 30, 1986 EDG 'B' was declare.l inoperable and the action statement of Limiting Condition for Operation (LCO) 3.8.1.1 was entered.

EDG 'A' was started at 1627 hours0.0188 days <br />0.452 hours <br />0.00269 weeks <br />6.190735e-4 months <br /> and

'A' train equipnent waa verified operable to comply with the LCO.

The turbocharger bearing was inspected and did not exhibit excessive wear.

The

'B' EDG was satisfactorily retested and declared operable at 2354 hours0.0272 days <br />0.654 hours <br />0.00389 weeks <br />8.95697e-4 months <br /> on January 30, 1986.

l Subsequent investigation under Condition Identification Work Authorization l

(ClWA) 11648 described several discrepancies with the

'B' EDG.

EDG lube oil l

vas slightly diluted with fuel oil, the turbocharger was suspected of windmilling due to an imbalance of the Heating, Ventilation, and Cooling (HVAC) system in the room, and high crankcase pressure existed. Work performed per ClWA 25149 found the HVAC supply and exhaust flows were out of tolerance resulting in approximately 20% more air being removed than supplied. According to the EDG manufacturer, low air pressure in the EDG room induces air flow from the EDG exhaust, through the turbochargers, and into the room via the ventilated crankcase, causing the turbocharger to rotate whlie the EDG is at rest.

Ventilation dampers were adjusted to bring these flows back into tolerance and prevent the EDG turbocharger from windmilling. This also eliminated the high crankcase pressure which had been caused by the windmilling turbocharger. Lube oil and fuol oil filters were replaced under CIWA 25441.

A leaking fuel injector was replaced under CIWA 25738.

The turbocharger i

bearing was inspected per CIWA 24737 and did not exhibit excessive wear. These conditions would not have impacted the ability of the diesel to perform its design function.

A definite cause for the diesel trip could not be determined.

Sinct subsequent starts of EDG 'B" were successful, the diesel generator was declared operable at 2354 hours0.0272 days <br />0.654 hours <br />0.00389 weeks <br />8.95697e-4 months <br /> on January 30, 1986, after performing OP-903-068.

Since this

)

trip is bypassed in the emergency mode and inspections revealed no abnormalities in the diesel, the shutdown was attributed to spurious operation of this trip. Thus, there was no safety significance to this event, and this was not considered a valid test or failure.

3 l

At 0445 hours0.00515 days <br />0.124 hours <br />7.357804e-4 weeks <br />1.693225e-4 months <br /> on March 7,1986, with the plant operating at 98% power, EDG ' A' tripped after running fully loaded in the test mode for 42 minutes.

The EDG was restarted at 0508 hours0.00588 days <br />0.141 hours <br />8.399471e-4 weeks <br />1.93294e-4 months <br /> but could not be stabilized at full load due to erratic load sharing in parallel with the grid and was subsequently secured and declared inoperable. The applicable action statement of Technical Specification (TS) 3.8.1.1 was satisfied within one hour.

Shortly before the unit tripped, it was in the "Test Mode" (Manual Local Control),

loaded to 4.4 MW (governor in droop mode) in parallel with the grid when the load started to hunt. The "Generator Fault" annunciator was actuated, probably due to a trip of the reverse power relay.

There are two other causes that could have tripped this relay: generator excitation fault or a governor system fault.

Vendor personnel reported on site on March 7, 1986, to determine if there was a governor stability problem on the 'A' EDG.

The diesel was run with no apparent problems with the governor system.

On March 8, 1986, an attempt was made to duplicate the problem, but the EDG ran satisfactorily with no rioted problems. A review of EDG operating data indicated no apparent degradation of the diesel due to the spurious trip. Upon completing OP-903-068, EDG 'A' was declared operable at 1310 hours0.0152 days <br />0.364 hours <br />0.00217 weeks <br />4.98455e-4 months <br /> on March 8, 1986.

This failure was classified as invalid since the diesel ran for less than the one hour required for a valid test by Regulatory Guide 1.108, section C.2.e(3), and the trip was attributed to malfunction of the paralleling and synchronizing circuitry, which is not used in the emergency mode, l

1 4

At 1323 hours0.0153 days <br />0.368 hours <br />0.00219 weeks <br />5.034015e-4 months <br /> on May 8, 1987, with the plant operating at 100% power, EDG

'A' failed to start satisfactorily while,erforming OP-903-06S due to an air leak from valve EGA-407A.

EDG 'A' was declat,i inoperable at 1330 hours0.0154 days <br />0.369 hours <br />0.0022 weeks <br />5.06065e-4 months <br /> and the applicable action statement of LCO 3.8.1.1 was entered. EDG 'B' was started at 1420 hours0.0164 days <br />0.394 hours <br />0.00235 weeks <br />5.4031e-4 months <br /> to comply with the action statement of the LCO.

EGA-407A is a three-way valve in the PCS that directs air from the left or right banks of the Control Air Shutoff Panels to the Safety Shutdown Panel.

The Control Air Shutoff Panels are supplied by the Starting Air System. The Safety Shutdown Panel contains the Safety Trip Valve which vents off control air when a trip device is actuated.

EDG-407A had developed a large air leak in the gasket which was sufficient to drop control air pressure and interrupt the manual mode starting sequence.

Tha leak was repaired and the valve was verified to operate properly.

The diesel was declared operable at 1715 hours0.0198 days <br />0.476 hours <br />0.00284 weeks <br />6.525575e-4 months <br /> on May 10, 1987, after performing OP-903-068.

The diesel was tested in the "emergency" mode before the leak was repaired with satisfactory results.

Since this failure was due to spurious operation of the Safety Trip System, which is bypassed in the Emergency Mode, there was no safety significance to this event, and it was not considered a valid test or failure.

i 5

At 1302 hours0.0151 days <br />0.362 hours <br />0.00215 weeks <br />4.95411e-4 months <br /> on June 22, 1987, with the plant operating at 100% power, EDG

'A' shut down on "Turbocharger Low Lube Oil Pressure" and "Jacket Water Pressure Low."

EDG 'A' was being started to comply with the action statement of TS 3.8.1.1 which requires a successful start of the operable EDG every 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> when one EDG is out-of-service.

The diesel was successfully started in the emergency mode 13 minutes later at 1315 hours0.0152 days <br />0.365 hours <br />0.00217 weeks <br />5.003575e-4 months <br /> and functioned as designed.

At 1840 hours0.0213 days <br />0.511 hours <br />0.00304 weeks <br />7.0012e-4 months <br /> on June 23, 1987, EDG 'A' again failed to start in the test mode with the same trips indicated. Again, the diesel was successfully started nine minutes later in the emergency mode and functioned as designed.

It was determined that the cause of these trips was due to a setting of 10 seconds on a lockout bypass relay delay timer which did not allow sufficient time for the air trip system pressure to rise above the shutdown setpoint during the manual diesel start sequence.

As seals and 0-rings in this air system age, they are expected to gradually increase the amount of leakage they allow.

Concurrence was obtained from the manufacturer, Cooper-Bessemer, to increase the setting of this timer to 15 seconds.

Station Modification (SM) 1961 implemented this change for both diesels.

Since the diesel was successfully started in the emergency mode in both cases and the shutdowns were due to a leak in the PCS which is bypassed in the emergency mode, there was no safety significance to these events, and they were not considered valid tests or failures.

At 1938 hours0.0224 days <br />0.538 hours <br />0.0032 weeks <br />7.37409e-4 months <br /> on August 15, 1987, with the plant operating at 100% power, the

'A' EDG would not start in the test mode during performance of procedure i

OP-903-094, "ESFAS Subgroup Relay Test - Operating", due to a high temperature trip on the outboard bearing.

The diesel did start satisfactorily in the l

emergency mode. Operators verified that the outboard bearing temperature was I

normal.

i 1

6

Maintenance personnel discovered that a loose screw from terminal 174 in a junction box mounted on the diesel engine had fallen out leaving the wire connected to the outboard bearing trip switch laying loosely against its terminal. Vibrations caused the connection to break and tripped the diesel.

Similar connectione on the

'B' EDG were inagected and no discrepancies were found, so the loose wire in the 'A' EDG was classified as an isolated case.

This shutdown was therefore due to spurious operation of a trip which is bypassed in the emergency mode, so it was not considered a valid test or failure. Work Authorization 01009095 was authorized to install inte-nal tooth lock washers at wire-end terminal board connections of engine-mounted junction boxes. This action, to be completed during the next refueling outage, should preclude recurrence of this event.

Between October 19, 1987, and March 8, 1988, there were six trips of the ' A' EDG during performance of OP-903-068.

Each shutdown was actuated by the "Turbocharger Low Lube 011 Pressure" trip which is bypassed in the emergency mode.

The most probable cause of the spurious actuations of this trip are small air leaks in the PCS which contribute to the slow buildup of air pressure and may result in a trip during a manual start. A major overhaul of the PCS is scheduled during the next refueling outage which is intended to restore the PCS to a like-new state of leak tightness.

This should correct the root cause of the spurious trips described above.

in all of the events attributed to air leaks in the control system, the EDG tripped when first started in the test mode and started successfully on a second attempt. A test was performed on March 3,1988, where the "A" EDG was successfully started in the emergency mode, secured, and then successfully started in the test mode.

The EDG would have started and run in the emergency mode when required to fulfill its intended safety function.

Thus, there was no safety significance to these events and they were not considered valid tests or failures.

l i

j j

1 s

j 7

A thorough examination of the diesel control systams and the events during which the diesel is required to operate demonstrates that there is no increase in either the probability or consequences of any accident due to this condition.

It is evident, however, that there is some increase in core damage probability if the diesel is taken out-of-service for the time allowed by the action statement of the Limiting Condition for Operation to repair the condition.

It was therefore decided, in order to minimize the overall risk of adverse consequences, that the diesel should not be taken out-of-service until the plant was scheduled to be in a mode in which one diesel may be placed out-of-service for maintenance.

All events described in this report are classified as Invalid Tests. There has been only one failure during a Valid Test of the 'A' EDG and none of the j

'B' EDG since the operating license was issued.

The failure of the 'A' EDG occurred on May 23, 1986, and was reported in Special Report 86-004.

The surveillance test interval required by TS Table 4.8-1 has always been "at least once per 31 days" since issuance of the operating license.

PLANT CONTACT D.E. Baker, Event Analysis Reporting & Response Manager, 504/464-3133 l

8

-