ML20202J429
| ML20202J429 | |
| Person / Time | |
|---|---|
| Site: | Crystal River  |
| Issue date: | 02/13/1998 |
| From: | Hill D, Moroney J MPR ASSOCIATES, INC. |
| To: | |
| Shared Package | |
| ML20202J399 | List: |
| References | |
| MPR-1887, MPR-1887-R02, MPR-1887-R2, NUDOCS 9802230151 | |
| Download: ML20202J429 (18) | |
Text
. ______-____-__ __-_- __ -
Crystal River 3 Reactor Building Cooling Fan Logic Modification Failure Modes and Effects Analysis MPR 1887
- Revision 2 January 1998 l
l l
L Principal Contributors Douglas Hill James Moroney f
OUALITY ASSURANCE DOCUMENT This document has been prepared, reviewed, and approved in accordance with the Quality Assurance requirements of 10CFR50 Appen ix B, as.specified in the MPR Ouality Assurance Manual.
Prepared by //684 # d2[/3!N Reviewed by 8 b /3-/16-/FfS Approved by Y 2-/8-78 Prepared for Florida Power Corporation Crystal River Nuclear Power Plant 15760 W. Power Line Street Crystal River, FL 34428-6708 Glenn Ward Engineer 9802230151 980219 PDR ADOCK 05000302 P PDR a
CONTENTS Section Pace i 1 EXECUTIVE
SUMMARY
1-1 2 INTRODUCTION AND CONCLUSIONS 2-1 i
Background 2-1 Technical Approach 2-1 Scope Boundary 2-2 Conclusions 2-2 3 SYSTEM / MODIFICATION DESCRIPTION 3-1 4 COMPONENT LEVEL FAILURE MODES AND EFFECrS ANALYSIS 4-1 5 REFERENCES 5-1 ii
RECORD OF REVISIONS I Revision Date Brief Description 0 November 1997 OrhinalIssue 1 January 1998 Revisions to Sections 3 and 4.
Section 3: delete parenthetical reference to diesel margin (3-1); revise time delay value (3 2).
Section 4: revise reference to fan power supply sources (4-4); revise item 6a by combining the last two sentences for clarification (4-7).
2 February 1998 Revisions to Sections 2,3,4, and 5.
Section 2: delete reference to two RB fans for accident basis RB cooling and reword sentence associated with operating procedures (2-2).
Section 3: change "which provide the power supply" to
" associated u ith actuation" and " isolated" to " separated" in second paragraph (3-2).
Section 4: change " coil to coil isolation" to " coil to contact isolation" (4-2); added discussion on the acceptability of one fan running in fast speed (4-2);
delete reference to two RB fans for accident basis RB cocling in note 1 (4-8); various wording changes in note 3 l
(4-8).
Section 5: add Reference 12 (5-1).
iii
~
Section 1 EXECUTIVE
SUMMARY
This report documents a Failure Modes and Effects Analysis (FMEA) of Crystal River l
Unit 3 (CR3) Reactor Building Cooling Fan Logic Modifications. This FMEA provides a
! qualitative assessment of the effects of failures of the various components that are part of l the fan controllogic modification detailed in MAR 97 09-05 01. The objective of the FMEA is to determine whether the design satisfies single failure criteria in accordance with l the Crystal River Unit 3 Topical Design Basis Document for the Single Failure Criteria.
) The scope af this FMEA is limited to those components affected by the modification and those that interact with the modified components.
The modified logic design is evaluated for its ability to accomplish the required function of preventing two Rer.ctor Building (RB) cooling fans from running simultaneously following a Large Break Loss Of Coolant Accident (LBLOCA). Component level evaluations are then performed for the various circuit components. Failures are postulated and their effects on the capability of the circuits to perform their post accident design functions are determined and evaluated.
The FMEA shows that there are no credible failures for the components in the RB cooling fan control circuits, as modified by MAR 97-09-05-01, that would result in two fans that could continue to run at the same time following the initiation of an Engineered Safeguards Actuation System (ESAS) signal. Single failures which result in no fans running are discussed in Section 4, Note 1.
1-1 I
i Section 2 INTRODUCTION AND CONCLUSIONS BACKGROUND
- Recent analyses associated with Restart issue D-28 (Error in Design Calculations for SW '
System Heat Loads) have shown that the Service Water (SW) system can become overloaded due to excessive heat removal from the Reactor Building (RB) following an LBLOCA. The RB heat removalis via the RB fan coolers. Previous analyses (including the original SW system design and sizing studies) assumed that the RB fan coolers operated in the worst case degraded (fouled) condition and that fan coil coo'ing water flow rate was at the minimum design point (i.e., one of the two emergency SW pumps in service at minimum acceptable performance). However, the RB fan coolers could actually be in a clean, non degraded condition, and the two emergency SW pumps could be in-service post-LOCA (the normal condition since both receive a start signal from ESAS). These assumptions result in a considerably greater heat transfer rate from the RB atmosphere via the RB fan coolers than previously evaluated. The SW heat exchangers may not be able to maintain design SW temperaturet while transferring heat to the ultimate heat sink (UHS) _
through the Raw Water (RW) system at high UHS temperatures with two RB fans in operation post-LOCA. The resulting higher temperature of the SW cooling water would exceed the analyzed cooling water temperature for SW system cooled equipment.
MAR 97-09 05-01 modifie_s the existing electrical control logic for the RB fans to automatically start one RB fan following an ESAS actuation with the capability to automatically start another fan should the primary fan fail.
TECHNICAL APPROACH The FMEA was performed to confirm that the modified logic for the RB fan coolers meets
_ single failure criteria in accordance with the CR3 Topical Design Basis Document for The Single Failure Criteria. This was accomplished in two phases. First, a system level evaluation was performed to verify that the changes accomplish the goal of ensuring that only one RB fan cooler will start following an ESAS signal and that single failure considerations (train separation, train isolation, circuit protection, redundancy, etc.) were addressed in the modified circuit design. Then a component level evaluation of the potential failure modes of the various circuit components and their effects was performed.
These combine to confirm the integrity of the modified circuit design.
2-1
Specifically, the purpose of the FMEA is to provide assurance that the RB fan coolers'
, circuit design, revised in accordance with MAR 97-09-05 01, will ensure that only one RB
. fan cooler will start following receipt of an ESAS signal and that no system or component level single failure will result in two fans continuing to run simultaneously.
SCOPE BOUNDARY The scope of the FMEA is limited to those components directly affected by the
. modifications in MAR 97-09 05 01. Items that interface with these components, such as,-
the fan rotor, fan motor, and motor control compartment devices are also considered.- The items included in the FMEA scope are listed in Section 4 of this report. The general application of separation criteria for individual wiring, components, and raceway is not evaluated in detail. The FMEA assumes that the CR3 separation criteria have, been properly implemented as defined in the MAR drawings and installation instructions and in accordance with other station drawings, procedures, and practices.
The FMEA only addresses failure modes and effects following an ESAS signal. During normal power operation, the requirements for the RB Cooling Fans and responses to fan failures are covered by Technical Specification. Since the new relay logic is only utilized on receipt of individual ESAS signals for each fan, and interlock wiring is isolated by fan trains, a single failure of a control or power component for one fan cannot cause spurious operation of or disable another fan.
Conceptually, the impact of this modificati n on control room operator response to the l various potential failures is considered to be encompassed by the existing operating
_ procedures with minor changes expected to address specific details. The. change from automatic start of two fans to automatic start of one fan following ESAS actuation is encompassed by the existing case of one faa failing to start. The change in design that has the standby fan automatically starting if the preferred fan fails to start or stops after starting -
is also encompassed by the existing case of one fan failing to start. In either case, the current design allows post-LOCA Reactor Building heat removal using one RB fan and one BS pump or two BS pumps (Reference 4).- It is assumed that appropriate procedures are being changed as part of the modification process.
The failure modes and effects detailed in Section 4 are applicable to all three fans, unless othenvise noted.
CONCLUSIONS The results of the FMEA (Section 4) have identified no credible single failures for the
. components in the modified RB fan coolers logic circuit that would result in two fans continuing to run at the same time following an ESAS actuation.
2-2
The FMEA has identified one possible failure where a fan motor starter contactor could stick in the " hot"(fan running in slow speed) position following a trip signal and where the associated auxiliary relay (limit switch)" reads" the movement of the mechanical linkage as having tripped. This could result in two fans running simultaneously. The results of the FMEA do not consider this credible. This failure is addressed in detail in Section 4.
There are also several credible failures that could prevent the starting of either RB cooling fan upon an ESAS actuation,i.e., result in no RB cooling fan running. The effect of these failures does not result in operation outside of the design basis because other means to cool and thereby reduce pressure in the RB (e.g., via the Building Spray pumps) would be available. These failures are discussed in Section 4.
i 2-3
~ _
Section 3 SYSTEM / MODIFICATION DESCRIPTION There are three Reactor Building (RB) cooling fans (AHF 1 A, A.HF-1B, and AHF-1C). In normal operation, two fans are running in fast speed. In the event of an initiation of ESAS, the fans will trip from fast speed. In the current configuration, the two fans would then be automatically started in slow speed, based on the ESAS Block Loading sequence. Under the proposed modification, only one fan will be started in slow speed, with a second fan as "b. ' up." The back - fan will start automatically if the first fan does not start, or ifit fails dur. .g operation. Due a Emergency Diesel Generator (EDG) loading considerations, the circuit modifications have been designed to make the A fan the preferred fan and the B fan the back up.
Design modification MAR 97-09-05-01 installs interlocks to prevent more than one Reactor Building (RB) Cooling fan from operating at the same time on initiation of an ESAS signal.
This modification is intended to prevent excessive heat transfer to the SW system in the case of a Large Break Loss Of Coolant Accident (LBLOCA).
As currently configured, AHF-1 A and AHF-1B are powered from ESAS Trains A (MCC 3A2) and B (MCC 3B3), resp:ctively. The C fan is powered from the AB Motor Control Center (3AB), and can be manually selected to substitute for either the A or B fan.
MAR 97-09 05-01 modifies the fan control circuit so that ESAS signals to the fans " enable" a relay logic circuit which is designed to ensure that only one of the selected fans will be running, on low speed. As long as thea .s a standing ESAS signal, only one fan will run. If the running fan stops, the alternate fan will start. Reset of the ESAS signal leaves one fan running and " disables" the relay logic governing one fan operation, restoring normal manual control of the fans.
The modification adds three relays to the A and B fan circuits and five relays to the C fan circuit. There are two timing relays (one to energize and one to de energize) and one interlocking auxiliary relay being added to the A and B fans. Since the C fan mimics the circuitry for both the A and B fans, four timing relays are added to its circuitry. The auxiliary interlock relays receive their actuation directly from existing auxiliary contacts on both the FAST and SLOW speed contactors. The A fan time delay energize relays are set at a minimum setting of 1.5 seconds. The B fan time delay energize relays are set at a nominal 6 seconds to allow the A fan sufficiem time to start first. The time delay de energize relays are set at 2 seconds to ensure agaimt a potential relay race when ESAS is reset. The new logic is biased to select and run the A fan at slow speed on ES actuation.
3-1
4 This is based on the assumption that both ESAS signais come in at the same time. If the B actuation precedes the A actuation by more than the difference in time delays (approximately 4.5 seconds), the B fan will start on slow speed first. Preliminary evaluation as part of the MAR process has determined that both EDG's have sufficient margin; MAR open item 1.b requires formal verification. Note: The ' .a has identicallogic to both the A and the B fans, so that if the C fan was A selecter' sould become the preferred faq and would be logically biased to start first as ifit were the a fan. If the C fan was B selecteri,it would become the back up fan and would be logically biased to start only if the A fan failed to start.
A number of steps have been taken to assure that separation is maintainec'. Equipment boxes are being installed on the outside of the respective MCCs to house the new relays, terminal strips, and associated wiring for each of the fans. These boxes are sized 'a allow sufficient separation between wiring and components from different electrival trains. The conductors associated with actuation for the new interlock auxiliary relays will be separated
[
from other wiring by routing through separate conruits and by using "Siltemp" wrap, which ;
has been qualified and specified for use at CR5 as a separation barrier.
No walkdowns were performed as part cf this report. The physical equipment and wiring changes contained in the MAR and drawings contained in the Squarc D and Allen-Bradley vendor manuals were reviewed.
3-2
~
Section 4 COMPONENT LEVEL FAILURE MODES AND EFFECTS ANA_ s 4-1
__-- J
COMPONENT LEVEL Fall.URE MODES AND EFFECTS ANAIXSIS -
""'I""'."'
- dentificatmn Failure h1 ode Effect on System Remarks '
- l. Control Circuit a. Fail Open (Fast Fast speed schematic wiring fail open: Fan will not start /run ,
Wiring Speed, S!ow Speed, in fast speed (logic is energize to start). This is acceptab!c !
Interfock) because ESAS actuation trips fast speed. j Slove speed schematic wiring fail operc Fan with failed wiring will not start /run in slow speed; interlock relay not energized enables backup fan to run in slow speed on standing E.S.
signal.
j New interlock wiring between fans fails open: Fan with failed Interlock wiring and devices are interlock will not run, enabling backup fan to start. isolated from schematicwiring.
Shorts / failures in schematic wiring cannot affect interlock win..g.
- h. Short to Ground Control wiring short to ground: Control power fuse for Interhick wiring is run in affected fan opens; backup fan is enabled to start. separate conduit and has coil to contact isolation.
- c. Short to Another A single hot short to another conductor in the start schematic Interkxk wiring is isolated so t'onductor wiring could cui: e spurious operation of the fan in fast or that failures in the start slow speeds, shorting of the power conductors by actuation of schematic wiring cannot affect the high speed " shorting" contactor while in slow speed, or interlock wiring, and vice versa.
spurious actuation of the interlocking relay. Spurious Analysis associated with Restart operation of a fan in fast or slow speed will cause the issue D-28, has determined that alternate fan to stop through the interlocking relays. Shorting Fast speed operation of one fan the power conductors will cause catastrophic failure of the is acceptable. De increased air htCC compartment or trip the hiotor Circuit Protector htCP llow will not increase the heat (either of which will enabic start of the backup fan.) transfer from the RB to SW Spurious actuation of the interk>cking relay will prevent any system to a point that would fans from running. His is acceptable (See note 1). exceed the analyzed cooling water temperature for SW system cooled equipment.
(Reference 12)
.4-2
s _
COMPONENT LEVEL FAILUltE MODES AND EFFEGS ANALYSIS (cont.) ,
'[,I ],"' Failure Mode EITect on System Remarks 2.' Star. Devices - a. Fail to Operate (open His is bounded by the case of control circuit wiring failing Controt or close) open (la). Control circuit wiring failing open will open the (e.g., Push- current path to/from the device. The result is the same as if Ilutton, Relay, the device did not operate. Fan either Joes not run (and E.S. Matrit) other fan is enabled), or runs spuriously (disabling other fan).
If the interlock relay for ane fan fails, the other fan may be enabled and start (two fans running). Ilowever, the backup fan starting will disable the first (with a different relay),
leaving one fan rtmning.
- b. Fail to Release (stick) This is bounded by the case of a short to another conductor (Ic). A short across two conductors will have the same effect as a control device sticking in the actuated position. Dere will be coniinuous current flow through the device. Spurious opeiation of a fan in fast or slow speed will cause the alternate fan to stop through the interlocking relays.
Spurious actuation of the interlocking relay will prevent any fans from running. His is acceptable (See note 1).
- c. Short to Ground, Shorting the contacts of a control device either to ground or Short across Contacts across two contacts of the device will have the same effect as I a short between t xo conductors (Ic) or a conductor shorted to ground (Ib), both discussed above. Derefore, this case is bounded by the short to ground of a conductor and an open conductor and the consequences are acceptable.
l 4-3
COMPONENT LEVEL FAILURE MODES AND EFFECTS ANALYSIS (cont.) ,
Failure Afode Effect on System Remarks '
Id i in
- 3. Control Power a. Power Fail to either Fan stops, enabling backup fan to start Note:The two Supply Fan operable fans are powered from independent Class IE busses.
- b. Voltage Ifigh or Low This could cause intermittent fan operation or failure of the on either Fan fan control circuit. In both cases, the fan stopping enables the backup fan to start. Once the backup fan starts, the first fan is disabled.
- c. Spikes or Noise on This is not normally considered for relay logie (Reference 2) either Fan and would not be expected to result in any new failure modes not already addressed.'
- 4. Power a. Contactor Fail to Fast Speed: No efrect on system. On E.S. actuation, fast Components Close, or spurious speed fans are tripped.
e.g. contactors, opening motor circuit Slow Speed Interlocking relay should be de-energized, protector allowing backup fan to start. If auxiliary contact changes (MCP's) state when contactor does not, backup fan will not start. This is acceptable (See note 1).
Shorting: No effect on system. On E.S. actuation, fast speed fan operation is tripped.
4-4
COMPONENT LEVEL FAILURE MODES AND EFFECTS ANALYSIS (cont.) ,
",'Iy"," Failure Afode EITect on System Remarks I
- 4. Power b. Contactor Stick Fost Speed: Two separate contauors are required for fast j Components Closed (Fast, Slow, speed operation. Sticking of fast cor. tactor (single failure) e.g. contactors, Shorting) will not allow fan operation because shorting contactor will motor circuit be open.
protector (htCP's) Slow Speed: Contactor sticks and keeps fan running in slow.
Backup fan will not run because auxiliary contact will drop out interk)cking relay.
Shorting: Contactor sticks chised. With fast contactor, fan See black box failure notes 2&3.
starts in fast. With sk)w contactor, shorting contactor is bo!!ed fault which trips h1CP, stopping fan and enabling backup fan to start.
- c. Contactor Spurious This condition is bounded by the cases described above (4b) 'The effects of this failure will be Closure (Fast, Slow, for contactor stuck closed. considered in the black box Shorting) failure section.
- d. hiotor Circuit Catastrophic failure would cause power loss and enable Protector backup fan to start.
- e. CatastrophicShort in Damage to control equipment would trip h1CP (4d). A fire htCC Ilucket would cause hot shorts (Ic). Isolation ofinterlock wiring / devices by the use of barriers (Siltemp, conduit, boxes, etc.) and space will prevent damage to schematic wiring from being propagated to interlock wiring.
- f. Overload Relay Spurious Trip: Ilackup fan start would be enabled. !
Failure to Trip: hiotor overheats and burns up. Would need to trip h1 cps to start the backup fan. If not, no fans would be l running. This is acceptable (See note 1).
4-5
(____ = _ = = .
. - . . - - . = - . - - - - = - - . . - - - - .
~ l COMPONENT LEVEL FAILURE MODES AND EFFECTS ANALYSIS (cont.) ,
Failure hiode Effect on System Remarks h en ifica i n
- 5. Fan / Fan hiotor a. Short If h1CP or overload relays trip, backup fan start is enab!cd. If not, no fans 1.re running. This is acceptable (See note 1). ,
- b. Open Circuit Open field circuit (contactor closed): Afotor not running, backup fan will not start because current is not monitored.
No fans running. This is acceptable (See note 1).
- c. Locked Rotor Overload relays trip and backup fan starts. See above for case in which overloads fail to trip (4f).
- d. Overheat (Iligh Tlie result of this fault will be a mechanical failure of the fan Ambient, Dense Air) and/or fan motor. This possibility is covered in the locked rotor (Sc), fan failure ('r.echanical) (5e), and overload relay sections (4f).
- c. Fan Failure Afotor runs, but provides no air flow. Backup fan would not (hfechanical) start. Therefore, no fans running. This is acceptable (See note 1).
4-6
g ,
.n; .
o
/ .
COMPONENT LEVEL FAILURE MODES AND EFFECTS ANAIXSIS (cont.)
Component ' Effect on System Remarks Failure Mode identification C. " Black Box" a. Control Circuit Sp'irious shorting of control circuit wiring, e.g.,in the case of Wiring: Spurious a loose wire on a terminal board, may cause intermittent Shorting actuation and/or de-actuation of control circuit components l
(i.e. relays, contactors). He effects for a range of these !
failures are covered in the above sections. No combination of postulated intermittent shorts has been identif;cd which will result in the simultaneous energization of two fans, which is i
the only unacceptable fan combination (See Ne ve 1).
- b. Start Devices: De effects of spurious, intermittent failure of control relays Spurious Failures af are the same as for spurious shorting of control circuit wiring, Control Relays u hich could result in intermittent control relay operation.
Herefore, the effects of this type of failure are the same as described above for control circuit wiring: spurious shorting.
- c. Control Power Supply A'l postulated failures are addressed in the Control Power Supply section.
- d. Power Components: See Note 3 concerning this postulated failure.
Failure of Main Contactors to Open, with auxiliary contact
) energized.
4-7
COMPONENT LEVEL FAILURE MODES AND EFFECTS ANAIXSIS (cont.) ,
Notes:
- 1. A single failure of one RB fan would mean that, based on the single failure assumption, both EDGs and BS pumps will be operating.
The plant's licensing basis requires either one RB fan and one BS pump or two BS pumps operating for containment cooling l (Reference 4). %erefore, a failure preventing both fans from running is acceptable, since it can be assumed that both BS pumps are operating, based on the single failure criteria.
- 2. Credit can be taken for separation features provided and consideration that coincident failure of auxiliary contacts is less than credible, based on the considerations of the MAR Design input Record Item #19.
- 3. Based on the results of analysis deriving from Restart Issue D-28, a failure that results in two fans continuing to run simultaneously would be unacceptable. A " black box" type failure, involving a double failure, has been identified that could result in two fans running simultaneous!j. The fan starters are actuated when relay 42/S contactor is energized by the fan control logic circuit. The yoke and armature assembly and the moveable contact assembly move upward into the stationary contact block, where the three moveable contacts connect the three upstream stationary contacts with their respective downstream contacts, starting the motor (Reference the y
Allen-Bradley and Square D vendor manuals). The moveable contact support assembly would also actuate the auxiliary coraactors, closing the auxiliary indication contact. This energizes an auxiliary relay, which blocks the starting of the other fans. A case in which l the main contacter actuates, energizing the fan, and catastrophically fails, causing the main contcctors to fail in the closed position, with the auxiliary contactor failed in the de-energized position, has been postulated. This would result in the fan running, but due to the failed auxiliary contactor, the auxiliary relay would nat be energized. The backup fan, receiving the indication that the first is not running, would start. De backup fan running would provide a signal to trip off the first fan, but due to the main contactors being failed closed, the first fan would continue to run. His occurrence would require the failure of both the main contactors and the auxiliary contactor simultaneously, a double failure which does not have to be considered, consistent with the existing licensing basis. l Based on review of contactor designs and discussions with the vendors, no single mechanistic failure mode has been identified which would result in the " black box" failure discussed above. %erefore, no single failures could result in two RB fans running l
simultaneously. !
Note that the starter and auxiliary contact actuation described above pertains specifically to the fans A and C starters, manufactured by ,
Allen-Bradley. The fan B starter is manufactured by Square-D, and has a different actuation arrangement. In the fan B starter, !
closing the main contactors actuates the auxiliary contacts with a rotary cam mechanism. A'l of these components are highly reliable Review of IEEE STD. 500 failure data states that the failure rate for circuit interrupter / relay is less than I per 10' year, and less than 0.5 per device per 10' operating cycles, covering all types of failures of this equipment.
4-8
A Section 5 REFERENCES
- 1. ANSI /IEEE Std. 352-1987,IEEE Guide for General Principles of Reliability Analysis of Nuclear Power Generating Station Safety Systems.
- 2. IEEE Std. 5001984,IEEE Guide to the Collection and Presentation of Electrical, Electronic, Sensing Component, and Mechanical Equipment Reliability Data for Nuclear-Power Generating Stations.
- 3. ANSI /IEEE Std. 242-1986, IEEE Recommended Practice for Protection and Coordination of Industrial and Commercial Power Systems.
- 4. Crystal River 3 Restart Action Plan, Revision 2, Issue Number D 28.
- 5. Florida Power Corporation, Nuclear Engineering Department, Crystal River Unit 3, Inst.uction Manual 150," Motor Control Cents " Revision 1.
- 6. Florida Power Corporation, MAR 97-09-05-0;,'RB Fan E.S. Run Logic." FCN 1, "High Speed Interlock."
- 10. Florida Power Corporation, Crystal River Unit 3, Interim Drawing D12-70201-A7,
" Wiring Diagram E.S. MCC 3B3-6AN RB Fan AHF-1B," Interim Revision B.
- 11. NFPA-70, National Electric Code,1996 Edition.
- 12. Florida Power Corporation, Crystal River Unit 3, Calculation M97-0133, Revision 0,
" Evaluation of UHS Temperature for Restart Item D 28".
(
5-1