ML20155G104

Safety Evaluation Re Diesel Generator Circuit Breaker Manual Close Capability.Final Design Acceptable

ML20155G104
Person / Time
Site:	Wolf Creek
Issue date:	06/01/1988
From:	Office of Nuclear Reactor Regulation
To:
Shared Package
ML20155G098	List: ML20155G095 ML20155G104
References
NUDOCS 8806170165
Download: ML20155G104 (4)

Text

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _

hg UNITED STATES

, [ g NUCLEAR REGULATORY COMMISSION g j WASHINGTON, D. C. 20555

,o

• • ..+

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION CIESEL GENERATOR CIRCUIT BREAKER MANUAL CLOSE CAPABILITY KANSAS GAS & ELECTRIC LOMPANY KANSAS CITY POWER AND LIGHT COMPANY KANSAS ELECTRIC POWER COOPERATIVE, INC.

WOLF CREEK GENERATING STATION DOCKET NO. 50-482 INTRODUCTION As the result of an October 14, 1987 occurrence at Wolf Creek Generating Station the staff became aware that manual operation of the diesel generator circuit breakers from the control room was not how it had always assumed.

During the October 14, 1987 occurrence,the control room operators intentionally tripped a diesel generator circuit breaker after the diesel generator had been supplying power to the safety bus. When the operators were ready to reestablish power to the bus from the diesel generator they found that they could not reclose the diesel generator circuit breaker from the control room. It was later detemined that the reason the breaker could not be reclosed from the control room was that the automatic close circuitry used to close the breaker after the diesel generator comes up to speed and voltcge was maintaining a constant close signal to the breaker, and the circuit breaker "anti-pump" circuit was therefore preventing reclosure of the breaker.

Following its own review of the diesel generator circuit breaker close circuits.

the staff found that the circuit breaker also could not be manually closed from the control room unless the diesel generator bus was already energized by one of the offsite circuits. Apparently the reason for this was that the close switch was only intended to be the means of closing the diesel generator circuit breaker when the diesel generator was to be paralleled with the offsite power system. The staff felt that the lack of the above capabilities to marually close the diesel generator circuit breaker from the control room may be contrary to the guidance provided in R.G. 1,62 ("Manual Initiation of Protective Devices") and IEEE Standard 279-1971 ("Criteria for Protection Systems for Nuclear Power Generating Stations").

BACKGROUND IEEE 279 and R.G. 1.62 require that manual initiation of each protective action shall be provided at the system level. It can be argued that manual actuation of the diestl generator circuit breaker is a manual initiation at the component 8806170165 880601 "

PDR ADOCK 05000482 P PDR.

l l

level rather than the system level and is therefore not required by the above position to be located in the control roem. Capability is provided in the Wolf Creek control roon to manually start the diesel generator which would then automatically close its output circuit breaker onto a dead safety bus when the diesel generator comes up to rated speed and voltage. Offsite power can be separated from the safety bus by manually tripping the offsite breaker from the control room. This action would initiate operation of the loss of voltage relays, subsequent start of the diesel generator, and automatic closing of the diesel generator breaker. Either of the above two described operations (manual diesel generator start or tripping offsite pcwer) could be considered manual initiation capabilities of the standby power system and would therefore meet the IEEE 279 and R.G.1.62 requirements for manual initiation at the system level.

Position C 4 of R.G.1.62 however, also recomends that the amount of equipment cormon to both manual and automatic initiation ba kept to a minimum. It states that it is preferable to limit such common equipment to the final actuation de-vices and the actuated equipment. It does allow however that, action-sequencing functions and interlocks associated with the final actuation devices and actuated equipment may be comron if individual manual initiation at the component level is provided in the control room. At Wolf Creek the two systen level manual ini-tiations of the standby power system described in the above paragraph utilire the same circuit breaker control circuits as used for an autcmatic start of standby power. Position C.4 of R.G. 1,62 therefore recommends in this case that a manual initiation capability at the component level be proviaed in the control rocm for the diesel generator circuit breakers.

EVALUATION Wolf Creek Nuclear Operating Corporation (WCNOC) provided the staff with a preliminary design modification of the diesel generator circuit breaker close l circuitry. The modification was intended to allow the operator to reclose the l circuit breaker from the control room following a manual trip of the breaker, and to allow the operator to close the circuit breaker from the control rocm if it failed to autoi..atically close following a loss of offsite power and automatic start of the diesel generator.

To allow reclosure of the circuit breaker from the control room after it has been mar.ually tripped, the preliminary design modification inserted two contacts into the circuit breaker close circuitry from the circuit breaker control switch located in the control room. These contacts open whenever the control switch is moved from the norcal position. This acts to interrupt the close signal to the circuit breaker ,

and reset the anti-pump circuit when the operator noves the control switch to the l "trip" position. In order to maintain the circuit breaker in the tripped condition I the operator must put the switch in the "pull to lock" position. Following return of the switch to the normal position the close circuit will be reestablished and, with the anti-pump circuit reset, the circuit breaker will close if all the close permissives continue to he satisfied. The staff found that this portion of the modification provided enhanced manual cperation of the circuit breaker from the control room with only minor modification of the control circuitry and was acceptable.

s The preliminary design modification also included changes intended to allow the operator to close the circuit breaker from the control room if it failed to automatically close following a loss of offsite power and automatic start of the diesel generator. This portion of the modification added the following to the close circuit: an additional time delay relay, additional interlocks with the offsite power supply circuit breakers, additional contact from the diesel generator breaker control switch in the control room, additional contact from the diesel engine speed pemissive relay, additional contact from the diesel cenerator voltage pennissive relay, and an additional contact from the diesel generator transfer switch. The preceding pemissives and interlocks are configured in a circuit that essentially duplicates the automatic close circuit of the diesel generator breaker but with the addition of a close contact from the breaker control switch located in the control room. This circuit would allow the operator to manually close the diesel generator breaker from the I control roon if the same permissives and interlocks are satisfied that must be  !

satisfied to autcmatically close the breaker. Because the pemissives and l interlocks used in the manual circuit are for the most part simply additional contacts off the same devices used in the automatic circuit it is likely that, if the automatic circuit fails to operate, the manual circuit will be inoperable also. The staff therefore found that this portion of the modification provided only minimal enhancement of the circuit breaker manual capability and required a rather extensive addition to the control circuit wiring.

The alternatives to the above approach are to provide a manual close capability in the control rocm with no permissives or interlocks, or to provide completely separace devices for all the pemissives and interlocks in the manual close cir-cuit. The first alternative would provide no protection against operator error and the second alternative would add additional complexity without a commensurate improvement in safety. Without this portion of the modification the standby power system at Wolf Creek would still meet the single failure criteria, the operator could reclose the diesel generator breaker from the control room if he himself tripped it, and the breaker could be closed locally (no pemissives or interlocks in this circuit) if it failed to close automatically. The staff therefore con-cluded that, although cecommended by position C.4 of R.G. 1.62, this portion of the modification should not be required and could be deleted by WCNOC if it so wished.

By letter dated April 18, 1988, WCNOC submitted the drawings for the final design modification of the diesel generator output breaker control circuitry at Wolf Creek Generating Station. These drawings show the modification required to allow the operator to reclose the diesel generator breaker from the control room following a manual trip of the breaker. However, a sinole contact from the breaker control switch in the control room has been used in the final design rather than the two contacts shown in the preliminary design modification for this circuit. The ope-ration of the manual close function however remains the same as that provided in the preliminary design. This is acceptable.

WCH0C chose to delete the portion of the modification which utilized the various diesel generator interlocks and permissives. As discussed previously this is

l

. 4 l

also acceptable, however instructions should be in place informing the operators ;

of the possibility of closing the diesel generator circuit breaker from the 1 local control station if it fails to close automatically. Because this local l manual control does not have the interlocks and permissives associated with the automatic closing circuit, the instructions should warn of the need to verify these parameters manually prior to closing the switch.

CONCLUSION The staff has reviewed the existing and the proposed modifications to the manual close circuitry of the diesel generator circuit breakers at Wolf Creek and has the following conclusions:

a. If sufficient independence cannot be maintained between automatic initiation and system level manual initiation capabilities of a pro-tective action, position C.4 of R.G.1.62 recommends that manual initiation at the component or channel level be provided in the l control room. As applied to the diesel generator circuit breakers l at Wolf Creek however, the staff concludes that when the concerns )

over operator error and undue complexity are considered there is little benefit to be gained from implementing that portion of the manual modification addressed in item "c" below. ,

1

b. That portion of the modification that accomplishes reset of the breaker "anti-pump" circuit provides enhanced manual operation of the diesel generator breaker from the control room with only minor modification of the control circuitry and is acceptable. l

c. That portioni of the preliminary design modification that utilizes i various diesel generator interlocks and permissives, provides only '

minimal enhancement of the circuit breaker manual capability and requires a rather extensive addition to the control circuit. That portion of the modification, although recommended by position C.4 of R.G. 1.62, may therefore be deleted. WCNOC in fact deleted this from their final design modification package,

d. Instructions should be in place informing the operators of the possi-bility of closing the diesel generator breaker from the local control station if it fails to close automatically. Because this manual cir-cuit does not have the interloch and permissives associated with the automatic closing circuit, the in W uctions should warn of the need to verify these parameters manually prior to closing the switch.

- - - .