ML20209G576
| ML20209G576 | |
| Person / Time | |
|---|---|
| Site: | Brunswick  |
| Issue date: | 08/29/1985 |
| From: | Ashe F NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | |
| Shared Package | |
| ML20209G564 | List: |
| References | |
| TASK-AE, TASK-T509 AEOD-T509, NUDOCS 8509190539 | |
| Download: ML20209G576 (5) | |
Text
. .
AE00 TECHNICAL REVIEW REPORT 1/
UNITS: Brunswick Units 1 and 2 TR REPORT NO.: AE00/T509 DOCKET N0s.: 50-324 and 50-325 DATE: August 29, 1985 LICENSEE: Carolina Power and Light Co. EVALUATOR / CONTACT: F. Ashe NSSS/AE: General Electric / United Engineers and Constructors -
SUBJECT:
INADEQUATE SURVEILLANCE TESTING PROCEDURES FOR DEGRADED VOLTAGE AND UNDERV0LTAGE RELAYS ASSOCITTED WITH 4160 VOLT EMERGENCY BUSES
REFERENCES:
- 1. Carolina Power and Light Company, LER 85-003 Docket No. 50-325, dated February 11, 1985.
- 2. Carolina Power and Light Company, LER 82-106/03L-0 Docket No. 50-324, dated October 8, 1982. -
_S'JMMARY This Technical Review Report provides information coacerning inadequate testing procedures and practices for degraded voltage and undervoltage relays associated with 4160 volt emergency buses. The safety concern regarding this area is that such inadequate procedures and practices could result in component failures being present and not detected during periodic testing. In addition, since the same testing procedures and practices would be used for redundant electrical trains such conponent failures could exist in redundant trains. The common cause implication for this situation is that such failures could result in a total loss or unacceptable degradation of the associated load shedding and voltage restoration safety functions. However, the review conducted for this concern only identified it as being applicable to the Brunswick Station. In view of the lack of other specific events or situations which would suggest that a similar concern exists at other stations, the report concludes that this concern is not generic although it may be applicable to some other stations.
Based on this, the report suggests that further AE0D actions relating to this issue are not warranted at this time. However, should additional events or situations similar to those described in the referenced reports be identified, it is suggested that further acticns for this issue be taken at that time.
1/ This document supports ongoing AEOD and NRC activities and does not represent the position or requirements of the respcnsible NRC program office.
~
8509190539 850029 PDR ADOCK 05000324 S PDR
DISCUSSION Reference 1 provides a description of a situation which was discovered at the Brunswick Station on January 8, 1985. A plant onsite nuclear safety group j review of various logic system functional test procedures revealed tFat
- procedures did not exist to functionally verify the operability of degraded voltage and loss of voltage actuation relay circuitry on the Units 1 and 2 -
4160 Vac common emergency buses El, E2, E3 and E4. Although procedures existed wMch proved operability of the degraded-voltage relays identified as 27 DVA, B "
and C for each of the four E buses and the associated breaker trip coils, procedures did not exist to test the instantaneous auxiliary trippine relay device 94 located in the logic trip system. In addition, procedures did not exist to test the undervoltage relays identified as 27/59E which are attendant to E buses one through four. These relays provide an undervoltaoe sieral to i the trip circuitry for the Residual Heat Removal (RHR) and Core 5 pray'(CS) pump motors.
Following the above determination, plant standing instructions were implemented to establish continuous monitoring of the four E bus voltages. These instructions specified manual tripping of the master-slave feeder circuit breakers to the buses if the. bus voltage decreased to less than 3750 Vac for greater than ten seconds. In addition, plant standing instructions were implemented and plant equipment caution tags were affixed requiring einimizing use of plant RHR and CS system pumps and to manually trip, within ten seconds, any operating RHR or CS system pump in the event of a loss of power to the associated E bus.
Plant special testing procedures were developed, approved, and performed which adequately tested t,he subject relay logic circuitry. Results of this testing showed the logic circuitry was functioning properly and reoufrements of the applicable section of the Technical Specifications were satisfied. .
The above procedural deficiencies were attributed to insufficient managerent and procedural controls to ensure technical adequacy of the logic system functional tests. In 1979, it was recognized that the load sheddine logic associated with the E buses should be functionally tested. The appropriate plant periodic test procedures were revised to incorporate steps to provide functional testing of load shedding relay logic circuitry. However, during l
this procedural revision, testing of the E bus . load shedding capability i
relative to the RHR and CS systems was not taken into account. This testing was not taken into account since it was determined that the risk of possible equipment damage to the RHR and the CS systems resulting from such testing was unacceptable. Consequently, testing of the RHR and CS system 27/59E relay logic circuitry was omitted from plant testing procedures. Sufficient guidelines and controls did not exist at that time to ensure required testing was promptly implemented through revisions to existing plant procedures or by development of new appropriate plant procedures. In 1982, it was determined that Technical Specification required surveillance testing of E-bus degraded and undervoltage relays was not being performed. This finding prompted a review of Technical Specification and associated plant periodic test i
procedures. However, this review did not encompass verification of sufficient procedural overlap of multiple plant procwures to meet system logic functional
! testing requirements.
i
A comprehensive progran has been developed which will ensure the technical adequacy of existing and future procedures relative to logic system functional testing. This corrective action is embodied within the Maintenance Surveillance Test (MST) procedure rewrite effort which addresses the following key elements:
- 1. The scope is defined to assess and rewrite logic system functional tests for instrument related requirements identified with the -
Technical Specifications. ,
- 2. The MST program provides explicit instructions relative to the development, technical content, and comprehensiveness of the associated procedures.
- 3. The MST program provides for the development of administrative hierarchy procedures which will sustain the quality of existing procedures and provide for the incorporation of new procedures associated with future plant modifications. The following scheduled commitments are associated with this corrective action:'
- a. The MST program is in progress with an expected completion date of October 31, 1985.
E
- b. The MST guide for writers of logic system functional tests was expected to be completed by March 1, 1985. It has been orally verified that this action is presently complete.
- 4. Appropriate plant surveillance test procedures will be revised to include 1ogic system functional testing of the subject logic circuits.
In view of the above, on January 10, 1985 at 1318 hours0.0153 days <br />0.366 hours <br />0.00218 weeks <br />5.01499e-4 months <br /> while making preparations to perform a logic system functional test of degraded voltage relays associated with the E-1 bus, the master slave feeder circuit breakers to the bus automatically opened. Group 3 and 6 primary containment isolations occurred for Unit Number 1. The Unit Number 1 main condenser off-gas steam ,iet air ejector 1A tripped. The Unit Number 2 primary containment drywell coolers automatically shut down. The Units 1 and 2 common augmented off-gas treatment bypass valve automatically opened. Within ten seconds, emergency diesel generator (DG) number 1 automatically started and re-energized the E-1 bus.
The affected Units 1 and 2 systems were restarted and returned to service. The incurred loss of the offsite power supply to bus E-1 resulted in a loss of 4160 Vac power to many Unit 1 and 2 emergency loads which are attendant to that bus.
Within thirty two minutes of the event, the master slave feeder circuit breakers to bus E-1 were reclosed and DG number 1 was secured and returned to standby. At the time of this event, Units 1 and 2 were operating at power levels of eighty-eight and ninety-eight percent respectively.
The loss of preferred power to bus E-1 resulted from an actuation of the bus instantaneous auxili.ary tripping relay, device 94. While disconnecting terminal wires on the 94 device, trip contacts in the device inadvertently closed. The terminal wires were being disconnected to allow actuation of the 94 coils without tripping the master and slave feeder breakers. As a result of
t contact closure in the 94 device, the slave circuit breaker and its corresponding naster circuit breaker to bus E-1 autcratically opened. The inadvertent closure of the trip contacts in the 94 device was attributed to inherent sensitivity of the device. During development of the special test procedure utilized for the subject testing, the sensitivity nf the 94 device was not realized.
Appropriate revisions were made to the involved special test procedure to eliminate physical contact with the 94 device and the subject testing was "
satisfactorily completed.
f The safety significance of the situation described above is that the testing being performed did not verify the operability of certain degraded voltage and loss of voltage relays associated with 4160 volt emergency buses. That is, J certain of these relays may have been inoperable and the testing being performed would not have detected their inoperability. This being the case, failures may have been present and since the same testing was used for redundant electrical trains such failures may have been present in redundant trains. The function of these relays is to initiate actions which result in the sheddi'ng of electri-cal loads attendant to an emergency bus and restoration of emergency bus voltage.
These actions and results are required when certain energency bus voltage conditions exist so that acceptable operation of bus associated electrical safety loads may occur. The consequences of these relays failing in redundant i
electrical trains in an actual need situation are clearly una.:ceptable.
Using the above safety significance as a bases for further actions, searches were obtained from the Sequence Coding and Search System (SCSS) data base system for other similar events with similar or the same safety implications.
As a result of these searches, only Reference 2 was identified.
Reference 2 provides a description of a situation which was identified at the Brunswick Station on September 17, 1982. As described, the emergency core cooling system emergency bus degraded voltage channel functional test was determined to be inadequate in that it did not sufficiently verify the operability of the emergency bus degraded voltage relays. The test procedure relied on visual confirmation that a target flag on a relay had tripped as verification of operability of the relay. The degraded voltage relays and their target flag counterpart relays are both fed from the output of a single operational amplifier and are contained in separate transistor circuits.
Therefore, an applied test signal which trips the target flag cannot be relied upon as verification of the operability of the corresponding voltage relay and its associated circuitry.
As a result of this determination, the test procedure was revised on September 21, 1982, to verify the relay and its associated circuitry by measuring the trip output of the relay with the applied input test signal.
In view of the lack of other identified events or situations which illustrate inadequate testing of degraded voltage and inss of voltage relays associated with 4160 volt emergency buses, we believe that this concern is not a generic one although it may be applicable to certain stations.
FINDINGS Based on the information presented in the discussion above, the following findines are provided:
- 1. The two situations identified above for the Brunswick Station concerning degraded voltage and undervoltage relays associated with ~
4160 volt emergency buses, illustrate how situations involving failures of components may not be detected using existing testing procedures and practices. Since the same testing procedures and actual practices would be used for redundant electrical trains such undetected component failures could exist in redundant trains. Such situations involving undetected failures of components clearly have common cause implications.
- 2. The review of a set of related events and situations obtained from the Secuerce Coding and Search System resulted in the identification of a similar situation which is described in Reference 2. However, this similar situation was also identified for the Brunswick Station.
No other station with a similar problem involving testing of undervoltage and degraded voltage relays associated with 4160 volt emergency buses was identified.
- 3. Testing procedures and practices for logic system functional testing has been identified as a concern for the Brunswick Station. To address this concern, a comprehensive program has been developed for this station which should ensure the technical adequacy of existing and future testing procedures and practices for logic system functional testing. This program will include testing procedures and practices for degraded voltage and undervoltage relays associated with 4160 volt emergency buses and is expected to be completed by October 31, 1985.
CONCLUSION Based on the above information, we believe that the safety concern regarding inadequate testing procedures and practices for degraded voltage and undervoltage relays associated with 4160 volt emergency buses is not a generic concern, although it may be a concern at certain stations. In view of the lack of specific information which suggests that this concern does exist at other stations, we believe that further AEOD actions relating to this issue are not warranted at this time. However, should additional events or situations similar to those described in the two referenced reports be identified,. it is suggested that further actions regarding this issue be assessed at that time.
.