ML20195B727
| ML20195B727 | |
| Person / Time | |
|---|---|
| Site: | Point Beach  |
| Issue date: | 10/26/1988 |
| From: | Fay C WISCONSIN ELECTRIC POWER CO. |
| To: | NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM) |
| References | |
| CON-NRC-88-100 VPNPD-88-517, NUDOCS 8811020176 | |
| Download: ML20195B727 (7) | |
Text
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _____ ______ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
I MSin Electnc mm coumr 231 W VICHIGAN.P o BOX 2046. MILWAUKEE.Wt 53201 Hid) 2212345 VPNPD-88-517 NRC-88-100 October 26, 1988 U. S. NUCLEAR REGULATORY COMMISSION Document Control Desk Mail Station Pl-137 Washington, D. C. 20555 Gentlement DOCKETS 50-266 AND 50-301 SPURIOUS OPERATION OF DIESEL AUTO-STOP FUNCTION POINT BEACH NUCLEAR PLANT, UNITS 1 AND 2 Enclosed is a description of what we originally believed to be an emergency dicscl auto-start at Point Beach Nuclear Plant, resulting in a conservative Emergency Notification System call ~
to the NRC duty officer. At the time of the call, the occurrence was considered as reportabic in accordance with Titic 10 CFR 50.72 and 50.73.
After an investigation of the cause of the dicscl return to full spcod and voltage, we have concitaed that the occurrence is not reportable under 10 CFR 50.72 and 50.73.
If any further information is needed, please do not hesitate to contact us.
Very truly yours,
, y .
$b Y /
C. W. Fy Vice President :
Nuclear Power Enclosures Copies to NRC Regional Administrator, Region III NRC Resident Inspector paPT8CR8"8y#
'h b i
i S
r 4
FAILURE OF 3D TO SHUT DOWN AUTOMATICALLY I. August 31, 1988 Event Description On August 31, 1988, at 0424 hours0.00491 days <br />0.118 hours <br />7.010582e-4 weeks <br />1.61332e-4 months <br />, the G01 cmcrgency dicscl generator unexpectedly returned to full speed and voltage condition as it was being secured following its bimonthly test run. The dicsol generator control switch in the control room had boon placed in the stop position, and the modo selector switch had been switched from "exercise" to "automatic" t6 secure the dicsci in t accordance with the surveillance proceduro. .The dicsol generator had slowed to an idic for its 11 1/2-minuto cooldown run and was rolling to a stop when it suddenly returned to full speed and voltage. An auxiliary operator witnessed the event locally while he was in the 4
dicsol room, second-checking the completion of procedural stops. A circuit failure alarm was roccived at the local '
control panci shortly after the return to full speed.
Eoth units were stable and operating at 100% power when the event occurred. No other safety systems werc
) affected. On September 29 and October 12, 1988, the event recurred.
I It was initially believed, on August 31, 1988, that a
- relay failure in the start circuitry had caused an I automatic fast start of the G01 cmcrgency dicsci i generator. Since this might be considered as an "
automatic actuation of an Engineered Safeguards System, it would be reportable por 10 CFR 50.72 (b)(2)(ii) and <
50.73 (a)(2)(iv). A red phone notification was, l 1 therefore, conservatively mr.dc. ,
j The G01 cmcrgency dt;sel generator was declared technically inoperabic because it was kept in the i exercise mode following shutdown. In the exercise mode, the G01 cmcrgency dicsc1 generator is availabic for use, but does not respond to automatic stcrt signals. When i the event occurred, control room personnel believed the .
j G01 cmcrgency dicsol generator had experienced an f automatic fast start. This was based on speed and voltage indications being at the values expected following a fast start. It was, however, realized that ,
y an actual automatic fast start signal was not present, :
since none of the conditions needed for an automatic ;
fast start existed (SI signals or safcquards bus undervoltage). It was, therefore, concluded that the event was caused by a failure in the automatic fast start .
circuitry, and the dicsc1 was secured in the exercisc -
I modo to prevent a recurrence of the event.
l I !
- r 1
[
P
P' age 2 The investigation and engineering evaluation of the event determined that a fast start circuit failure did not occur and the dicsci did not fast start, but, rather, the i dissel generator failed to shut down automatically. It should be noted that the same logic and relays are used when shutting down t%c dicsci in either the automatic or exercise modo. Consequently, the cauac of the shutdown ;
problem appearad to have boon intermittent because the G01 cmcrgency diesel generator was shut down in the exorciso modo following the event without any problem.
Also, the automatic start ci'icuitry and the ability of the G01 cmcrgency dicsol acacrator to perform its safety ,
function were not affected because the problem was specific to the shutdown sequence.
I l II. Possible Causes and Inspection Three possibic causes for why the G01 cmcrgency dicsci l generator failed to shut down have been identified. The i engine stop delay (ESTD) relay could have timed out too soon; the engino control relay (ECR) could have timed out [
4
' too lates or the governor solenoid could have failed to maintain the fuel in$ection racks in a no-fuel position I i before the dicsc1 was completely stopped. A discussion j of each of these possible causes is provided, following a r brief explanation of the shutdown sequence of the G01 l emergency dicsol. l When the G01 cmcrgency diesel generator is shut down, a 15-mi1ute timo delay on drop-out relay (ESTD) is [
energi:cd. The ESTD contacts close to completo d circui.
j to the engine control auxiliary relay (ECRA) and the I i ongine control relay (ECR). The ECRA relay causes the i governor to lower the engine to idle speed for an 11 1/2- l minuto cooldown run. The ECR relay is a time delay on (
pick-up relay. The 11 1/2-minute longth of the cooldown I
]
run is determined by the timing of this relay. '
i s
When the ECR relay tjmos out, its contacts close to l i
i complete a circuit to energize the governor solenoid, the i governor start (GS) relay, and the speed-checking relay ;
(SCR). Energizing the governor solenoid stops the enginc
- by causing the governor to move the fuel racks to a !
i no-fuel position. Energizing the GS relay causes the i governor synchroni:cr motor to roadjust the governor i
speed setting to the maximum position (940-945 rpm) in '
l preparation for the next automatic fast start signal.
f I l h
1 -
! I i !
l Page 3 The SCR relay energizes and times out in 30 seconds to initiate the circuit failure alarm, if the diesel speed is not zero at that time. Normally, it takes the dicsci approximately 13 seconds to coast down from idle speed to a complete stop following energization of the governor solenoids, well loss than the 30-second SCR relay timing.
The governor solenoid must remain energized until the diesel has sompletely stopped rollings otherwise fuel will be reinjected to the cylinders, allowing combustion to reinitiate.
A. ESTD Relay If the ESTD relay times out too soon, power to the ECR relay would be interrupted. In turn, this would interrupt power to the governor solenoid and allow fuel to be reinjected to the cylinders. The G01 l
cmergency diesel generator would return to maximum speed and voltage because the governor speed setting l
had already been reset to the maximum position, and' l the generator field was still excited. Receipt of I the circuit failure alarm would occur because une I engine would not be Cc zero speed when the SCR times out in 30 seconds.
Tbc ESTD relay is an agastat device that is reset when the control room diesel generator control switch is taken to the step position. This control switch is a three-pccition (stop, auto, start),
spring returned to center position (auto) type switch. It is, therefore, possible that the switch was cycled such that its contacts were not made up long enough to fully reset the ESTD relay. If the relay is not fully reset, it would time out too soon, and power to the governor solenoid would be interrupted. As explained, this would allow the dicsol to return to full speed and voltage, an3 the circuit failure alarm would be received.
B. EER Relay A similar scenario would occur if the ECR relay times out late at approximately the same time the ESTD relay times out. For example, if the ECR relay time out was extended to within 13 seconds or less of the ESTD time out, the drop out of the ESTD contacts would deenergize the ECR relay. This would also doenergize the governor solenoid before the G01 cmcrgency diesel generator is completely stopped and would result with the same consequences as above.
l Pago 4 The ECR rolay is also an'agastat device. If dirt or some other foreign material obstructed the orifico in the device, its time out could be extended. It seems unlikely, however, that this was the actual cause of the noted probicm. A similar event I occurred on thrco different occasions (August 31, September 29, and October 12, 1988), and the timing i
out malfunction would have had to occur within the same relatively short time framo in each instance.
The G01 cmcrgency diesel generator was successfully ,
shut down several times in between the occurrences.
It is improbable that a similar obstruction to the orifice occurred on three occasions separated by !
soveral successful operations. ,
C. Governor Solenoid The third posribic cause is that the governor solenoid momentarily dropped out or operated l sluggishly, allowing the fuel racks to be moved from ,
the no-fuci position and reinject fuel to the cylinders. Again, this would result in the G02 cmergency diesel generator returning to full speed and voltage. A circuit failure alarm would be i received, since the timing out logic of the control ;
circuitry would not have been affected. l t
D. Inspection Results Although the above discussions provido reasonabic ;
explanations for the event, the actual cause could not be deterrined. Following the August 31, 1988 occurrence, the ECR and ESTD relays were individually inspected and tested. Both relays ,
timed out within specified limits and appeared to be L operating normally. Power was supplied to test the ,
governor solenoid, and it operated satisfactorily. t No binding or sluggishness was noted. The ECR relay l was energi:cd for approximately 15 minutes while l voltage to the governor solenoid was monitored to ,
verify continuity. The linkage between the governor and the fuel injection racks was also inspected, ;
with no looseness or unusual conditions noted.
other physical checks of the circuitry and equipment showed no defective components or unusual conditions. Finally, a redundant start test of the i G01 emergency dicscl generator was performed satisfactorily.
9 '
Page 5 III. September 29, 1988 Event Description on September 29, 1988, at 0457 hours0.00529 days <br />0.127 hours <br />7.556217e-4 weeks <br />1.738885e-4 months <br />, the event recurred during the daily test of the dicsci required while G02 was out of service for its annual inspection. The samo ,
sequence of events and indications occurred as in the August 31, 1988 ovent. A red phone notification was not considered necessary following the September 29, 1988 recurrence because in this case we realized it was not.an automatic fast start. The G01 cmergency dicsol generator !
was also not considered inoperabic in the second case ,
because it was kept in the automatic mode (instead of the '
exerciso mode) after it was shut down. Following the occurrence, additional testing was performed on the circuitry. Time versus voltage signatures were taken and analyzed for various individual circuit components for numerous stop actuation seqvonces. In two of the tests, the control switch was actuated quickly to see if switch operation could cause the ESTD relay to time out too quickly. The voltages were also monitored and recorded for an actual shutdown sequence initiated during a test run of the G01 cmcrgency diesel generator. In all of these cases,.the control circuit performed as designed, and no abnormalitics were noted. A bench test of an agastat device, however, offectively simulated an ESTD relay early time out by momentarily supplying power to I the agastat tino delay relay such that it did not fully ;
reset a.nd timod out too soon (loss than the nominal 15 '
minutc9).
IV. October 12, 1988 Event Description At 0306 hours0.00354 days <br />0.085 hours <br />5.059524e-4 weeks <br />1.16433e-4 months <br /> on October 12, 1988, the dicsc1 was again ,
being shut down following Ats monthly surveillance run, i At 0318 hours0.00368 days <br />0.0883 hours <br />5.257936e-4 weeks <br />1.20999e-4 months <br /> (about 12 minutes after the dicsc1 was taken off line), the dicsci came back up to full speed :
the first time. At 0328 hours0.0038 days <br />0.0911 hours <br />5.42328e-4 weeks <br />1.24804e-4 months <br />, when the modo switch was l moved to exercisc, the governor was reset, and the stop switch was moved to stop. At 0336 hours0.00389 days <br />0.0933 hours <br />5.555556e-4 weeks <br />1.27848e-4 months <br />, it was at idle !
speed when the speed started to decrease. This time at !
about 250 rpm, the governor reset, and the dicsc1 came back up to speed for the second time. At 0338 hours0.00391 days <br />0.0939 hours <br />5.588624e-4 weeks <br />1.28609e-4 months <br />, the I modo switch was put in exercise, and the stop switch was ;
held in stop pcsition. Ten minutes later, while the :
diesel was agsin slowing down from idle speed, it came I back up to full load speed for the third time. The mode i scicetor switch was put in auto. The Duty and call i
s Page 6 Maintenance Supervisor was called, who in turn contacted ,
the Superintendent - Maintenanco and Construction. Ho called the Shift Superintendent and told him to leave the ;
machine running until he got to the plant. At 0548 hours0.00634 days <br />0.152 hours <br />9.060847e-4 weeks <br />2.08514e-4 months <br />, he stopped the diesel by depressing the stop push button on the local panol. The dicsol was not dcciared out of service because the dicscl would auto start and assume load as nooded.
V. Conclusion and Further Corrective Action Additional testing is planned over the next 90 days to determine the exact cause of the diosc1's failure to shut down. It is currently believed that the problem is i cither in the ESTD relay circuit or the governor solonoid circuit. The testing will be designed to localize the problem. The Resident Inspectors will be informed of the testing cesults.
In summary, the red phone notification made on August 31, 1988 was conservatively based on the belief that the G01 cmcrgency dicsc1 generator received an automatic fast i start and, therefore, was reportable as an automatic i actuation of tho Engineered Safety Feature per 10 CFR 50.72 (b)(2)(ii) and 50.73 (a)(2)(iv). Our investigation determined that an automatic fast start of the G01 '
cmcrgency diesel generator did not occur in any of the cvents, but, rather, the engine failed to shut down ,
automatically. We, therefore, believe that the occurrences on August 31, September 29, and October 12, 1988 are not reportabic under 10 CFR 50.72 or 10 CFR 50.73. ;
l i
l \
r 1 i l l l l I
\
I i
I L__ - _ - - - . - _ _ _ - - . _ _ _
i