ML20211E015
| ML20211E015 | |
| Person / Time | |
|---|---|
| Site: | Crystal River, Rancho Seco, 05000000 |
| Issue date: | 10/30/1985 |
| From: | Delrue J, Field J SACRAMENTO MUNICIPAL UTILITY DISTRICT |
| To: | |
| Shared Package | |
| ML19292G087 | List: |
| References | |
| 73, NUDOCS 8610220335 | |
| Download: ML20211E015 (136) | |
Text
-
15.
TRANSIENT ASSESSMENT PROGRAM REPORT FOR RANCHO SECO REACTOR TRIP ON HIGH PRESSURE, FOLLOWED BY COOLDOWN TRANSIENT ON OCTOBER 2, 1985 TAP NUMBER RS-86-05 l
e i
l 8610220335 060926 PDR ADOCK 05000302 S
P DR_
]
6 i
i w
v TRIP REPORT #73 REACTOR TRIP ON 10-02-85 REACTOR TRIP ON HIGH PRESSURE, FOLLOWED BY C00LOOWN TRANSIENT
/
1 P
4 e
J 4
i Prepared By:
l Joe Delrue/
Jim Field 10-30-85 i
)
s l
-r._---._.-p--h,,_-
-.----_____,-,-.._,__..-,,r,
..m,,--m.-,..._,__-,-,e...w,_,,
..._,_-,_.-,-.-.v--
4 6
M ENCLOSURE 4.5 TRIP REPORT AMENCMENTS AND APFROVAL v 'A A
b" 8
Prepared Sy' Date Engineering /Qujittyycstrol PRC Amendments and Remarks:
.T o c.,s.- W 48f Ob
..)
a.
/O/JP/Pi
, cent'ns.r.ue:er
~
- evie. -r even en i
/
)
v.'.n. es :f r.a e e '..;i !: !re at:2:ned
/0l2?lt3~~
%, R c'a t e' PRC g(/.rean
- an: se:erintencent ierarks:
F/od L*E / LV e- #
f r s e <. ~,.:t b
- i. M. < 4 d. O ()
i vo-
.1.<.
... i a.. *)
-:::: ec
-f' r, ~-
- 6.' 'I s 1
- ste
- .a-- 3.
- er* fe.-:e.:
r i
- t.
?
- .i.'i
~
s n.
TABLE OF CONTENTS
SUMMARY
II SEQUENCE OF EVENTS III PRE-TRIP PLANT STATUS IV INITIATING EVENT AND REACTOR TRIP Y
POST TRIP TRANSIENT RESPONSE VI KEY OPERATOR ACTIONS / PLANT PROCEDURES VII INVESTIGATION OF AREAS OF CONCERN VIII CORRECTIVE ACTIONS /AODITIONAL RECOMMENDATIONS IX CONCLUSIONS h
l
. 1 I
i s
I.
SUMMARY
,e 1ctober 2,'1985, at 0132, the reactor tripped from approximately 15% power on high pressure due to loss of main feedwater.
Following the trip, an overcooling transient occurred.
The unit was descending from 40% power to 15% power for turbine overspeed trip tests. Shortly before separating the generator from the grid, the control room operators experienced feedwater flow oscillations that were reflected in Within several minutes
, steam header pressure and reactor coolant pressure.
after separating from the grid, the operators received a phone call reporting water blowing around the "A" Main Feedwater (MFW) Pump.
In addition, loss of condenser vacuum, loss of both MFW pumps, a reactor trip on high pressure, an automatic turbine trip..an automatic start of both Auxiliary Feedwater (AFW)
Pumps, and manual, full initiation of High Pressure Injection (HPI) occurred in rapid succession.
The reactor cooled down to - 490*F at a pressure of
- 2000 psig.
The Reactor Coolant System was subsequently depressurized to 1400 psig at - 490"F.in accordance with plant procedures.
The cooldown has i traced to a secondary side depressurization through open 4th point heater shell side safety valves via the pegging steam line-from the "A" main steam header, AFW injection, high pressure injection, various auxiliary steam loads, and the lack of decay heat contributed to the cooldown.
The reactor had a very brief power history (40% power for 43 hours4.976852e-4 days <br />0.0119 hours <br />7.109788e-5 weeks <br />1.63615e-5 months <br />) since being shutdown March 15, 1985, for refueling, resulting in essentially no decay heat.
Prior to restart, an extensive investigation was performed to determine the cause of the trip and to identify and resolve the problems resulting From the transient.
t 4
II.
SEQUENCE OF EVENTS - RANCHO SECO October 2,1985 I
99:00:00 The reactor is at 31% power, 265 MWe. Unit load reduction in
~
progress to perform turbine overspeed trip testing.
01:17 Pegging steam control valves open, initiating feedwater swings.
01:19:00 The reactor is at 20% power,100 MWe.
-Unit is swinging in both RCS and secondary side pressure due to feedwater oscillations.
The turbine control is taken from operator auto to manual and control rod drive control (Diamond) is taken to manual to stabilize the plant.
"A" MFW pump is in. hand and has been throughout power operation.
"B" MFW pump is in hand also, but at minimum speed
~ 2400 rpm.
l 01:25:59 The reactor is at 14% power, 43 MWe.
OCBs 220 and 230 are opened, separating the generator from the grid.
The turbine bypass valves are controlling header pressure.
RCS pressure is swinging.
Pressurizer level is 220 - 230".
Tave is 584"F.
The OTSGs are on low level limits (24").
Tne plant is unstable.
01:28:01 Computer alarm prints out "TG Low Vacuum Trip" (setpoint is 21" Hg).
Turbine bypass trips on low condenser vacuum.
Turbine bypass valves close and steam pressure begins to increase to Atmospheric Oump Valve (ADV) setpoints.
Control room operators begin receiving reports of safety valves lifting on the turbine deck. An equipment attendant is sent to investigate.
Steam is reported blowing around MFW Pump "A".
Operators are sent to put both hogging air ejectors on to recover condenser vacuum.
The Senior Control Room Operator (SCRO) starts raising speed on MFW Pump "B" in preparation to take MFW Pump "A" off line.
Blowdown tank is reported to be overflowing.
1 ADVs start cycling to relieve steam pressure..
i II.
SEQUENCE OF EVENTS - RANCHO SECO (Continued)
October 2, 1985 32:00 "A" MFW pump trips. Both AFW pumps automatically start on low main feedwater pump discharge pressure (< 850 psig).
01:32:25 The reactor trips on high pressure, 2300 psig. The turbine trips on reactor trip.
Operators perform immediate actions.
(Manually trip reactor,
-manually trip turbine, reduce letdown flow to 40 gpm, and begin vital systems verification.)
01:32:30 "B" HFW p' ump trips.
~
01:32:35 AFW Bailey control valves open, initially feeding - 400 gpm to both OTSGs.
01:34:04 Pressurizer level is dropping quickly. The "A" HPI inject valve is manually opened (full).
Flow is verified.
The "B" HPI pump is manually started.
"B," "C" and "0" HPI inject valves are manually opened full.
01:36:38 BWST suction valve SFV-25003 is opened and "A" HPI pump manually started.
Letdown is secured.
Approximately 180-200 gpm is flowing through each HPI inject line except "A"; it indicates O gpm.
Operators pull the indicator out and put it back in but still get a 0 indication.
Pressurizer level decreases to 35" before turning around.
Heaters manually start at 40" to maintain pressure.
(Lowest RCS
. pressure reached is 1840 psig.)
The ICS is throttling AFW as 24" level control setpoint is approached.
01:37:10 Tcold (at 542*F) moves outside the post trip window on the Safety Parameter Display System (SPOS). This is the first positive indication to the operators that cooling is excessive.
01:40:52 "A" HPI pump is secured.
HPI valves are throttled.
Pressurizer level is recovering.
01:42:30, Pegging steam to 4th point heaters (PV-32453 and PV-32454) is closed (time estimated).
Steam pressure rate of decrease is reduced.
OTSG level increases due to resulting reduction in steaming rate.
43:40 Tcold at 500*F.
RCS_ pressure - 2000 psig.
l.
i i
II.
SEQUENCE OF EVENTS - RANCHO SECO (Continued)
October 2, 1985 I
- 45:00 Condenser vacuum begins to recover due to the hogging air ejectors.
01:47:40 The RCS overcooling is stopped.
Temperatures are stabilized at
-.. 4 91
- F -.- -.-- -.
01:47:57 All HPI valves are closed.
"B" HPI pump is secured.
The plant is returned to normal nakeup and letdown.
RCS at 491*F, - 2100 psig.
Pressure level at - 120".
OTSG pressure is about 600 psig and holding.
01:48:30 Slow, controlled RCS depressurization is started.
01:51:29 "C" Reactor Coolant Pump is secured (<500"F - core lift considerations).
01:55:26 "B" MFW pump has been reset and started.
OTSG_ feed is swapped over from AFW to main feedwater.
Both OTSGs are on low level limits with S/U valves in auto.
(When the "B" MFW pump is reset, the AFW/ICS control valves go closed.
The operator observing decreasing OTSG levels transfers valve control to manual.
The operator was not aware of this design feature of the ICS.)
02:15 AFW Pump P-318 is secured.
02:28 AFW Pump P-319 is secured.
03:30 RCS depressurization to 1400 psig is complete.
A 3-hour soak is begun.
04:10 to 05:00 Condenser vacuum decreases again.
Covers are placed on MSR relief valves and vacuum begins to recover.
(
s s
III.
PRETRIP PLANT STATUS (at 01:17)
I 1
neactor Power:
18.6%
Tave:
580'F RCS Pressure:
- 2130 psig (oscillating)
Pressurizer Level:
209" Generated MWe:
115 MWe Vacuum:
28.7" Hg Steam Header Pressure:
860 psig (oscillating)
ICS Stations in Manual:
1)
"A" MFW Pump 2)
"B" MFW Pump (at minimum speed - 2400 rpm) 3)
Diamond Control Rod Station and Reactor Master 4)
Turbine (Operator Auto) 5)
aTc Controller is normally operated in MANUAL.
l.
O r
! l i
IV.
INITIATING EVENT AND REACTOR TRIP 3ctober 1,1985, at 2300, a scheduled unit load reduction from 40% to 15%
power was begun.
The reactor had been operated for 43 hours4.976852e-4 days <br />0.0119 hours <br />7.109788e-5 weeks <br />1.63615e-5 months <br /> at 40% power for physics testing'.
Power was being reduced to 15% power so that the generator could be separated from the grid and turbine overspeed surveillances performed.
It was intended to return to power generation immediately after these surveillances were completed.
. For most.of the duration of the power reduction, the plant responded smoothly. However, at approximately 01:17, with reactor power at ~ 18.6%
and 115 MWe, both secondary and primary side pressure began oscillating.
Feedwater flow was also oscillating.
In an attempt to stabilize the plant and damp the transient, the operators placed the turbine, the control rod drive station (Diamond) and the Reactor Bailey in manual.
The "A" MFW pump was already in manual and had been throughout power operation.
The "8' MFW pump was at minimum speed (~ 2400 rpm).
The pressurizer was.being sprayed to raduce Reactor Coolant System (RCS) pressure.
As explained in more detail in
~
. tion VII of this report, the sudden steam demand associated with the opening of the four (4) pegging steam lines initiated the oscillation in feedwater.
The ICS switching from feedwater flow control to OTSG low level limits may have been a minor contributor to the oscillations. With the turbine ir. Operator Auto, Reactor and Feedwater Oemand in Auto, responsibility for header pressure control transfers to the Reactor and Feedwater.
Review of available data shows that the ICS operated properly in response to these The plant operators efforts in stabilizing the p}aret are also oscillations.
shown to be effective.
' At 01:26 with the reactor at 14-15% power and a unit load of 43 NWe, oil circuit breakers (OCBs) 220 and 230 were opened, separating the generator from the grid, The turbine bypass valves controlled header pressure at about 925 psig.
Once Through Steam Generator (OTSG) levels were bouncing on and off of low level limits.
RCS pressure was still fluctuating.
T,y, had increased to - 584*F, while pressurizer level had increased to - 220-230".
The rators worked to stabilize the plant at 15% power.
~
IV.
INITIATING EVENT AN0' REACTOR TRIP (Continued) 01:28, the computer alarm printed out "TG Low Vacuum Trip" (setpoint is 21" hy).
The turbine bypass valves locked out on low condenser vacuum and closed.
Steam header pressure increased to the atmospheric dump valves (ADVs)
-setpoint and opened.
Operators were immediately sent to put both hogging air ejectors in service in order to. recover vacuum.
The ADVs lif ted for a normal duration (30 seconds, then 20 seconds). The control room received reports from the turbine deck of safety valves lifting. An equipment attendant was sent to investigate.
Shortly thereaf ter, an auxiliary operator phoned the control room to report that the blowdown tank in the reactor yard was overflowing.
(Feedwater heater safety valves discharge into the blowdown tank.)
During this time, condenser vacuum continued to degrade.
The control room received a phone call from one of the equipment attendants, who reported that there was steam blowing around the "A" MFW pump.
The senior control room operator began raising the speed on the "B" MFW pump in preparation to take "A" MFW pump off line.
The "B" HFW pump speed was erratic and would not respond.
At 01:32:00, the "A" MFW pump tripped. Both AFW pumps automatically started on low HFW pump discharge pressure (< 850 psig).
However, they did not feed the OTSGs because the "B" MFW pump had not yet tripped.
l At 01:32:25, the reactor tripped on high pressure (2300 psig). On a CR0 Trip Confirm, the reactor will automatically send a trip signal to the turbine.
It was at this time that the turbine tripped.
The turbine low vacuum trip device had failed to operate at its setpoint of 19" Hg.
l !
V.
POST TRIP TRANSIENT RESPONSE
.** 01:32:30, five (5) seconds after the reactor trip, the "B" MFW pump (6.ipped.
Both AFW ICS control valves opened, initially feeding both OTSGs at about 400 gpm, and then as much as 850 gpm to refill the OTSGs to the low level limits. '
Pressurizer level began dropping quickly. At 01:34, the "A" HPI inject valve
.was opened with flow verified. When level continued to drop, the operator started the "B" HPI pump and fully opened the "8," "C" and "D" HPI inject
' valves. "At 01:36:38, the second Borated Water Storage Tank (BWST) suction valve (SFV-25003) was opened and the "A" HPI pump was manually started.
Letdown was secured.
The makeup valve also stroked full open.
The control room operators noticed an odd phenomenon as "8,"
"C" and "0" inject valves were opened.
With approximately 180-200 gpm indicated on each "B," "C" and "D" HPI line flowmeter, "A" HPI flow meter indicated zero.
An operator pulled the ' indicator out of the control room panel and the needle t to midscale, which is.the normal response.
The indicator was pushed back in and the needle returned to zero.
It is known that flow indication did return on "A" HPI flowmeter because flow was observed to be decreasing when the valve was throttled and then closed.
Also, IDADS information obtained af ter the trip indicated "A" HPI line flow decreased to near zero for about 30 seconds, but then returned.
Special Test Procedure (STP) 180 was performed on 10-10-85, reproducing the phenomenon.
The investigation and resolution of this phenccenon is presented in Section VII of this report.
The HPI valves were throttled within seven (7) minutes and HPI totally secured within 14 minutes.
The lowest pressurizer level reached was 35".
The lowest RCS pressure reached was 1840 psig.
The RCS was returned to normal makeup and letdown.
Operator actions to control pressurizer level were swif t and effective; however, the rapid addition of makeup water played a minor role in the cooling.
V.
POST TRIP TRANSIENT RESPONSE (Continued) 01:42:30 (10 minutes af ter the trip), pegging steam isolation valves to the 4th point heaters (PV-32453 and PV-32454) were closed. The "A" 4th point heater shell relief valve and pegging relief valve closed.
An overcooling of the RCS resulted.primarily from the "A" 4th point heater shell side safety valves (PSV-32427 and PSV-32455) being open. A main steam flow path to atmosphere was presented via the pegging" steam line to the feedwater heater.
The nominal setpoint for PSV-32455 and PSV-32427 is 160 i 4 psig.
The pegging steam control valve to the 4th point heater (PV-32453) controls _at 15d 5 psig.
Post trip investigations showed that due to a downward drift of the safety valve setpoint an overlap existed between the two setpoints. A post trip evaluation shows that the steam flow through these two safety valves was as much as 80% of the total main steam flow.
Other steam loads included the steam needed to drive the dual-driven AFW pump, both hogging air ejectors, both main air ejectors and gland steam.
The problem with pegging steam / overcooling is explored in greater detail in Section VII.
i The plant was stabilized with RCS at 491"F and 2100 psig.
Pressurizer level was at 120".
OTSG pressures were 600 psig and holding.
At - 01:48 a slow, controlled RCJ ;upressurization was started in accordance with Emergency Operating Procedure E.05.
(500*F was exceeded at an undetermined cooldown rate with forced flow.) At 03:30, RCS pressure reached 1400 psig (within the interim brittle fracture guideline curve provided by B&W) and a 3-hour soak was begun.
From 04:10 to 05:00, vacuum began to decrease again.
Operators placed sealing covers on the discharge of the eight moisture separator reheater (MSR) shell side safety valves, which were found to be leaking air.
Vacuum recovered.
It
-has been determined that the loss of vacuum was through these valves.
No further plant events occurred as a result of this transient, t -. _ _
e e
e 4.
O O,,,
g d
1 e
we a I
y s
g O g e-O w
end o.e m
e.
en. s=
8"c
-.3
.~ ' -
- 3. $ =;g e.u S. 33 a
e w
=
- = * -
-g EQ a.
O
~=
=~-
j
_~~w
&. as g O.
a a
to G..
.g e5
.m 9 i
g
%O
.-h
~...
3 w...
,,. 9 v g
i.
e m
6a,,,.
y
- en w
c-O eC.*.se O
l.
1
\\-
mz m
L3 O
e @
e.f e Q
- g. g m e.e
,e g om Q
G.=.
'\\
Ee
~N\\
.= eC
~*
E5 6
- eC gW I 3
u v.
ea a w
oa v
1 m
x.s 3.= 0 O 4, E.
8 wW w EG ens W s%
p-
{
rj
.--- o 3
ssx
%. m af Q
g g"
8 4
-wx'-
N
..-.i m,
sxsi.
?
I x
\\
N... _=.
pg
\\
'x
-3 N
g...
5 x_
..g. _ --
]
s 4.-%.....--
C sN_
gq P
-' -t m.* e X,
\\**
/
mb e
d m
x e
C, x
1
,=
1-g..,. _ -\\.
3.-.g.--..~...-..
-g s-
=, =,, e
=_._ q. _. *"'%.
_..... _... l
_g 3 C w 'JE:
t-
...g....A..........
g....
m gg
..--....g.__
- o. y v.
.... k
.=..... -
- =
.-.s.
.. a -
.-..h..-......,
f,
---\\.-.g.......-..
i
..3, I
V.-.
.w.-.....- _.. -.....
e g,J.
.~3
- e
.... d.
s g
n m_
w
.4_.....-.....
mW O
~ ~ -.
,;.",,2-...-......
6, J.
'.gJ -
-== E. -
i 4
Og.---.......
o x, y
==
-_ 4._
y.
,J t.
=-
,. -. eC".. _. - -.,..-..
=,,,,.O
.=
y*s.-.._...- -... ~ -
,m J
p y-pg s-4
-..._.. -....._.. M-
=. - - - -.
i m
t I
8 I
I j
I e
=
..h h
s
=.b ch h
..h q,
g
=-
.l 81
- .8
=
.g N
s M
l
=.-
g
~~
8%
a.
w.
N w
e.p h
N h
f RCS 3 R ESSU R E kVITH RCS AVERAGE TEMPERATURE 2.4 --
600 5
> harp 2.3 -
570 -
l 560 -
t 2.2 -
- u. 550 -
g 540 -
q E 530 -
2.1 -
cn om
' e 520 -
et c
3c 510 -
a w
o m 2-c 500 -
o3 o
3 cj 490 --
'D 480 -
1.9 -
w
- a. 470 -
~2 w 460 -
1.8 -
450 -
440 -
1.7 -
~
420 -
410 -
i 1.6 -
400 1:00:00 1:15:00 1:30:00 1:45:00 2:00:O' TIME RCS TAVE RCS PRESSURE
O RCS 3RESSURE WITH RCS AVERAGE TEMPERATURE 2.4 --
600 590 -
T-11 580 -
2.3 -
570 -
Rx 1 RIP o
560 -
3 i
j 2.2'-
550 -
]
540 -xI n
2 8
530 -
- 2.1 -
'g 520 -
s l
Q 510 -
l 9
2-y 500 -
I Il 3
490 -
d tr 480 -
i
/
$'~
470 -
\\
3 460 -
n d
F-r 1.8 -
450 -
440 _
430 -
1.7 -
420 -
410 -
1.6 -
400
.,.........s i
1:30:00 1:35:00 1:40:00 1:45:OC TIME RCS TAVE RCS PRESSURE.
D R ESS U R Z E R L EV E WITH RCS PRESSURE 2.4 --
2.4 2.3 -
2.3 -
0$Ip 1
2.2 -
2.2 -
2.1 -
2.1 -
2-2-
1.9 -
1.9 -
1.8 -
1.8 -
1.7 -
1.7 -
cn 1.6 - "i39 1.6 -
CLu 1.5 -
c 1.5 -
W 1.4 - %o 1.4 -
m J
Ds 1.3 - mo 1.3 -
(n.c 1.2 - Wt, 1.2 -
x 1.1 1.1 -
1-1-
0.9 -
O.9 -
0.8 -
0.8 -
0.7 -
0.7 -
0.6 -
O.6 -
0.5 -
0.5 -
O.4 --
O.4
....... ".................... c " " " " " " " " " " "."." i " " " " " " " " '"'" '" " "i " " " " " " " " " ' " " " " "
~
1:00:00 1:15:00 1:30:00 1:45:O0 2:00:00
- TIM E PRZ LEVEL RCS PRESSURE
O 0
0
- 0 i
0:20 t
LEV 0
E 0
L 5
U 4
/
S 1
0 G
S ST I
L N
O P
E 8
IR 1
V x
b tU 0
R E
0 E
-- 0 M
i 3 I
T 1
-- 0 G
S
~
~
O 0
. 0 L
I E
-, 5 V
- 1 EL 1
0 U/S
\\
G ST O
- 0
- 0 A
0
- 0 0
5 0
5 0
5 0
5 0
51 5
4 4
3 3
2 2
1 1
0 l
s O
O..
-O O
5 Ld W
w J
<I I
.o (f)
O
([)
O 0-LU 5
D n
i n
n g
n l
W nh O
O i
O..
I gE-O e
=n a
[
=
i p
i FO 8
=
)
0 g
jO j
ll
(;
E O hb i
- r.
(f) i C
(/)
s O
!O E
!. O..
I 1
I I
i e
i i
t
[OO O
D O
D O
D O
D O
D "**
O G
Q G3 (O
b b
o e
D N
i
, (s puosnoyl)
(0!sc) 3 MOSS 3Md e
0 0:0 0
- 20 W
O L
0 F
0 D
54 EE S
1 F
'N 0
O X
T U
I A
I D
N P
7 A
IR O
T
\\
C x
R
-- 0 R
I i
- 0 O
4 E
T r0 M
A
- 3 IT R
1 E
0 NE G
MAE TS 0
L 0
E A
V 5
E 1
L 1
U 0
/S GST O
- 0 A
0 c0 0
9 8
7 6
5 4
3 2
1 01 1
0 0
0 0
0 0
O O
O O
g"1G : O1'cOgoc.b E
3 5
0 5
0 5
0 5
0 5
4 4
3 3
2 2
1 1
Mo 3o E
Oo 9
x b
D<
o Z
E CD o
Pi 0
o tt is 9g o
v h
FO 2
F w
Z
[
o we 2
b l-m jo J
~
io W
e jg g
r,-
a v-3 o
x in O
m H
I O
l o
CD l6 i
i i
i i
i i
i i
Eo o#
e e
co b
e in
+
n N
e d
d d
d d
d d
d 6
o (spuosnoqj.)
r wd6 go73 i
i i
4 i
i i
i l~
c o
D o
c a
c a
c t
t n
n N
N e
e sayoul 13A37
1
.! :2.;
e i
n I
i
!.,;I
. l. l l i i....~ ll
. l
- 1. : I:.
.lli i l i
.itico
..i!!
i
.il l i : ; j i l l i!
llti li
,1 l
l'
=
-v.
- lI l i t : : :, ;. i. i:
l n
i b..:[i l'.:
i.ili.l!ll i 3 ! L!Ii! i ! ! i!-
'l c'
l
.'M j'll'ysiill..it";. ' ! i ' l i.?
- 9.. ]
- i.. -
,i.
_f..:
i,
.I
! !- !li! '!! !
l i ! :'
)
l l: i !
.llii!
i li t!!j inii
! ; ! ii
.. s ii
!i.
i illili!!Iliiillilillillillllllillillli'iii!!Ii3!i
'ili;
- 1 i!I::!!
i!'iliilill!!illillililllilll, i i i l l : i r i l i i i i l t i i l l i ; i ! ! ! ! i l l.iA i l l i l i l l i l _l i l l l i s
illil' :il!ii'!!!!!!!iiill!!itI!!!i!Illll!I U.W tf 5
illii.. : 1
. l 'i. ! I. ; !!i i d :l ! !! ! ! !il illi/iil !il j g-C
! l t l ;. i,] 131 I l l 1 i ! l l >%. l l, l l l l l A
i
. '!il*
- l'
.'l
.!,l;*
- 1ii, tle..
=
.s 1
l'iiii.
li.
i
.I '.lill.l!Iiilill!Jlli!i!!ll' 2
vs sj' a
' ' YJ l l l ! ! All l l !.l.l lsi l u!!ll i;'k.'
._~, : e.. ;. i. :. i, ! i, j i. i f; p.ii E
. iiw t
,:.i
.,.,.=i. :.l i,,_ s
,ti i
i 4,: 1 17!i il,iili
-lVlilliiiil!!ili T
lilll!'illlllllliiillilllilllilli!!l.
lillillilllli S
i ' : ' ! ' ' ' ' l ti h i i(y h6i :5 9'iopt iVil!!li!!!lli!i 9
m
. ; /. l. i i'l i !{lli ll Ee m._.
l v tl I l
t.l*
I S 5-il!!!!lliil!if!!Il!jl'i!.l'Iti iil!Ittllli iil i!!!l': 'I !!:;i!ili'i!!!!!!!iit allitillillilill!
.s
'i 1-i t
- 'i
- l
- liliilily i!!! sil i
..l
. !.!.a : i. l. i ' : ; i t i. 5: 1 1
sl l
j.
j.
n 9 li l{sl ;i !I
,1 i
i I.
I i
I:.l8!:llliill lli:lj!':l Iil l2i'*j
.I l-t l
i.
I t
i C
i Iit:1.l.-l:s.lt..
is-E!
1l 4..
it: : f
,n i !;
vi C.;l-
'l e
! ' i : l ; ili l ! : ' l ji
['
.j
'~"-
~
l'ij, i
l l
8 Y
-.----,--c---
,,-.--,,.m---
s.
i T
i
..li::!l:lt:li: il;e;!!i.
l::iil.. :.
i l<:
-;::!,..: :li. l:
!.l:;: > l;I!iliiiil::iilii'iU!! r
- i!.hil!ll
- ;;l.:::! !!il.7, illillll!ililii!!! hill!itililii "sti;i;ill. flu i
!!illii:
!ilillilililliiUl;;i'il!!!!.!ii! i!Ulillilliillilii.iill!!ii liilli'il!!iil:!!!!!!:llililliillliiilllill.!!!ililill'!!ill!!!
!!!illil'Ililillill!!!lilillilillililli!Illiiillli!il!Hlili!
2 h
ijgillis!Illglliljillifiliij!Illj!liljllllflillflili :!!!illl!
- :ti l l Pri l ! !Ti l l lil ! ! !7l i l l'i'i l l lii i l !Ti l l !Tl ! i !?i l ! !'i" ! ! !Ti l l !!
!!i!i!illlli!I!!!;l!!!Il!Ill!!!!!!!il!Illl!lililll!!Ii:i!!llai i t ! ! ! ! ! ! ; ! i l l i l i ! N ! ! i l i i i l l ! I l i l ; ; ! i l i t i l l i l l l l ! ! ! ! I : li l l i'n ! J
~
u liili;ilillililii!!iilli!!Il!!ill!!!illillliiilli!!!liiiFJT~ ~s 1 i
o Iillll!l!!!l!!!!l!!!!!!!!!!!!!!!!!!!!!llli!!ll!!!fI
!I!!!!
L
'.:. I ;i :.' : f : ; i i a ;. ; ; I : i l i a ; i. 1 : l a l l 6. ; i l j j l i:ie/ I I...I o
e
- 1 s
s I:
f..
1;11lll1:rt::.r :! 11 i1: !iI: :=ltiri1.. : l:
a a
1 ;Iti
-s a
h : l ! ! ! l l i l i l l ! : i ! ! ' ! ! ! ! ' ! i. i l i i l ! ! ' ! i t l : l ! ! ! ; ! ! ! l l i l ifi, ! ! ! l ! ! i l l y
3 s
2
.. i!...!'ll.lI/ll'Il!,.!
I.
h:...!'.E i
!lll
- i l!I:!!
t.
.i
'.! ! ;.l e :/g '. t. ' t l : i i > l s
l-
.e t.
...l.
.j[i.ii i
l: '.! : !, 8. ! i. 'l;
'l I
.l:
e
.f f
.._l 7
... II d..
2
,g o.
i
'3l.......l,'!
- 'tllti
- ...ffifl'r;:l E t
. j..
1.:.!::,!'**l:
/
1 Ii
!:illl!ll','l'
!~!
I'l! !i l'I. :l:!ij:.lj:'iil!ii;l:$.!
-d 6 08%O USI U S.Wdba.1:2.i!!4 !: 1.:l 2.
.a 0
O-9
.C
/
5 C
0 0
- 0.., t i e s l :e j :. ; /.o. i 8 p. a ji ;L;., i. 3 i
'!'.l:e:
,1
'l; 9: l
-r
- iW cm *.
- = :.:r.!j c
8.
- itt.
.O.
t-
.1: 1
'..l:
- O i
t l :.:p
.r;i.e
. l :., : 1 1. f.
l.
.It!
- 6
- l.. j i
.I
.e
..i.
t t.
N3 l...
.i
.l.
.6..
- t ili
I:.r ~le..I.:li;:1.!i!!!.,iliiiiiiili:li: ;l.ril!:;!l
[
l'
- !.;!i.jiil!.I'iiilii!il!;ii
%c.
l: :l.r!!:~!!!!!
l's a
=
l:
.,l -..i l
.l-:..j
.iti.il.-i:.l2,;;i.i.;.: l...;
u
- l. - !*iIf hl8!fi*
'!l f l ]
l' t
j:
l:
- l :
ll:! ! l ; i ' i l di ; l ;. ; l :.
1.M; ' '
. j.. l.
j:
i !
i
- l:
Li' lil>:i.i 1:n!N'::!i:i.
- l:'.;'l'.il-i:ll: '!l1;l:!!'!;i.".~!'!!!
!l
.l l
l
..i:. h i n j..j: 1.:ip:oin:!
i ;.
..i... p.. -
l
. i :
i ;. a.. l
.i.
i i-L i
-t i
i
! i i
l M
F
n. - - - -
L.I i
! APM
'g j
e
- 'n t
.c i
i.
i,
3 e..
- a. :....:
e.
c p.
a I.-
s y
s..
o c:
I ;,;r.-
OM j
mE9e d
e j
g
).
em.,
t..
,I l
m,Lp
'.s o
n.
.., i..... ;._.
v
- \\,.
.. l....i
.. i
, i....,
,.. -,..i : :. : ;- 1 J.:
' I i 1
.I i
i l
_,c a,
..a.
a
'..o,,_
_e,..,. o, u.l:;
....si.
=
a n._.. o,.
....I n...
l.e n ',,jl.l.'4';,:
y
.l.
s :: I
.i *
.i:
e Q,...... t.... l... l.,.
- "..e
... L..;...
.+-..
3.,;,,se';..
-l.I..:.. ; -
. a,.1. g..
l i
s.
...l.l
. s.. 6....
l l.
.l.....:
g..
o s.
g
..i. I i,..
"i c
!..;. i. '
a g
- t
..i".
'"';*3i
- 3. 3 2b.,
c o
e v
oC
^-
I O
(*1 f*1
=-
.i "w
==
i i
l.,..j;e. i.... Q. l, s,l t'i.. ;
.a..;.l. l. g > j.
- ... l ?: l.,..
3 l<
l....
o oC
.:l::j.: I j.
i.-
N N I
l e
c I
l
=
a
.i. l,..
c 6.
8 3.,
6.
.e _.g.. ; t:
l.C * ', - O.' &
e...
./.o
..~t C
~-
e-v.
N..
. = Q -, I. ~ ~... -
3 t
c o gi f
l C
+
6
.-A L.
I 01 O =
l : ;
- l...f ?.t.,'
m:
=
4 i
'1 i.
g s
c o o J;
i s
m c c
.l....-
.C g
s g
3 g
4,,,,_.
._... __. TO AM c
u u i
'5;*1~*
...I e
f.
- t,..
3._: 0, l
j.'..
i
)
i I.
.e - -
.i r z.
e
.a
- s. w.
=
l
.. i...
v t
7 C
- 7. _ O
.O 4
c.
c.
a
...O,,
. a C... D,.....
+
O
=.
.~
.I t.=.a
. i.
.' i i
i I
g I
l a
! iS A M !.
}
a._. _.._...
... _..... ~... -
i.
.r
- 6 I
k.
j I
e l.
I t
5 R
l
'.,i...
j i. ;
.I
......a f
{51,$300'fQQligN f-3..IS
. 3
. _ g __ _ o.._. c,. _._g,._ _. c, _ _. +._.. g. _ o 1
.l
.-l 1
3 I.. t
...t g
9 g
2.
LE
- f. * 'A 7
.g I
i a._
.D P'Ib
9 8
i o.
o..
I t..
g s< 5 I
t OU I-- W 5
i r
CL. M A
W
([)
v o
g
=
Lt.I
- o i
IIz
(
O
-~
g
~~
m d($
i I
R i
i 2
=
a ON 7 E
l l
?
I A
4 o
to V
ll 5
e
_ _2 l
o
~
i v
e h
O n
,w 3
CL. W l
e A
V J
nh ag
/\\
OE V
=
i 1
1 l
o l o 6
n 35 o
o o
o o
o o
o o "-
N-o o
o o
o o
o o
2 3 o
N o
o
+
n N
e WdD I
l l
l
v O
-d a.b t
O
?
I e.
[
[
h O
I$
y-9.
<a
-O t
<C n
E L
o f
C' J
3
'5 t
O
~
O a
lr 1
Es ly l
/\\
-I g
lt f
2 0 *;
JI O
0 1
ht i
~
B l
d.m e
g.
as Em d
/
V CD g i
O 1
O..
I-k I
I I
i i
i t
i I
I i
i l
O O
O O
O O
O O
O O
O O
O O ""
z e
+
N O
o e
t N
O o
o
+
N De Ng N
N N
N e
e e
e e
2H*
l
~
wd6 golj j
l 1
I
{
t
VI.
KEY OPERATOR ACTIONS / PLANT PROCEDURES rview
~
It is important to understand that the plant drives the transient and the
' operator then responds.
By proceeding through the instructions provided by the E0P's, the operators will eventually stabilize the vital plant parameters in a safe condition.
The time it takes for the operators' actions to actually
" catch-up" to where the plant is, and the status of the vital parameters when they do, depends on the many variables that can exist such as:
equipment response, heat in/ heat out (heat balance), emphasis in procedures and training.
These factors are particularly important with overcooling type event because of the potential for very high cooldown rates.
[
l For this event the heat balance appears to be the primary factor contributing to the cooldown rate and the final RCS temperature when stable conditions were achieved.
The " Heat in" consisted of RCP heat and a very minimal amount of core decay heat.
The " Heat out" consisted of HPI flow, pegging steam flow ough FW reliefs, hogging ejector steam flow, main air ejector steam flow, turbine sealing steam supply, " Terry" turbine steam supply and auxiliary feed to the steam generator. With a more " normal" core power history sufficient decay heat would probably have existed to prevent any overcooling during this event.
I The equipment problems detailed in the Sequence of Events will not be evaluated again here except to point out that each problem or c'oncern that is encountered during this event (or any other) must be addressed by the operators.
The result being a distraction and an increase in the total time it will take to regain plant stability.
I l
l l
l t
VI.
KEY OPERATOR ACTIONS / PLANT PROCEDURES (Continued)
Operator /STA Actions T e opera ors were us ng OP B.3, " Normal Operation" Section 6.0, Power h
t i
Decrease for the power reduction from 40% power to 15% power. The control room operators are trained to take the ICS stations into manual anytime that the plant is unstable and they feel that their actions'in manual control will damp oscjllations. The operators were just entering procedure B.4, Plant Shutdown and Cooldown.
Per Step 4.10 of Operating Procedure 8.4, with the turbine controls in " Operator Auto" and the feedwater loop demands indicating zero demand, the loop demands should be placed in hand'and closed.
This assures that the OTSGs will be controlled on low level limits.
This portion of the procedure was not performed prio'r to placing the turbine controls in Operator Auto, negatively affecting feedwater stability.
On a loss of condenser vacuum, the operators started both hogging air ejectors ch is in accordance with Casualty Procedure C.26, Loss of Condenser Vacuum.
HP gland steam pressure was noticed to be low but HV-30124 (steam seal to 6th point heater regulator bypass) was closed and pressure returned to normal.
When the reactor / turbine tripped on high RCS pressure, the operators
~
automatically performed E.01, "Immediate Actions"; that is, manually tripping the reactor, manually tripping the turbine, reducing letdown to'40 spm, and beginning E.02, Vital System Verification.
"A" HPI injection valve (SFV-23811) was opened per Step 10 of E.02.
f At 01:37:40, 5 minutes after the trip, T was at 542*F and passed outside cold of the post trip window on the SPOS.
This indicated an overcooling event and Emergency Operation Procedure E.05, " Excessive Heat Transfer" was initiated.
i O,
VI.
KEY OPERATOR ACTIONS / PLANT PROCEDURES (Continued)
(
- primary concern of the operators was maintaining pressurizer level and subcooling margin.
Full HPI flow through all four nozzles was manually initiated in ac'cordance with Step 1 of E.05, " Excessive Heat Transfer." The lowest pressurizer level reached was 35" and the lowest RCS pressure reached was 1840 psig.
The open safety valves on the 4A feedwater heater were isolated when pegging steam to the 4th point heaters PV-32453 and PV-32454 were closed.
This occurred at 01:42:30, approximately 5 minutes after passing outside the SPDS post trip window, or - 10 minutes af ter the reactor trip. Tcold "*5 500*F.
The cooldown was essentially terminated at this point, but due to the extremely low decay heat, auxiliary steam loads, AFW and HPI, the momentum of the cooldown carried temperatures to 491*F at 2100 psig where the plant stabilized.
As a precautionary measure, Step 12 of E.05 was performed.
The plant was
,ressurized to below the Interim Brittle Fracture curve (1400 psig) (see Figure 1) for at least three hours.
No heatup or pressurization was allowed and station management was notified.
Tab 9 of the Emergency Plan ( AP.501, Rev. 4, Page 19) was consulted for possibility of declaring an unusual event. An unusual event was not declared.
However, the NRC was notified via the red phone and the Resident NRC Inspector was contacted at home. An Occurrence Description' Report (AP.22) was written.
For any event.being evaluated it is always possible to make a determination of how it could have been handled more effectively. A more rapid isolation of the steam generators in accordance with C.05 Step 3 and throttling of the AFW flows, Rule 3, would have terminated the overcooling sooner.
But, for this event, it is clear that the operator actions were appropriate and resulted in termination of the overcooling in a timely manner (~ 5 minutes) considering l
sequence of events.
The STA was present in the control room prior to and l - -. - --
o VI.
KEY OPERATOR ACTIONS / PLANT PROCEDURES ~ (Continued) ing the event so the ability of the individual to respond to the control room was not an issue.for this event.
It could be a factor for other events just as the immediate presence of any of the participants would be a factor.
The actual hands-on operating experience that the STA's at Rancho Seco have, has without a doubt, enhanced th'eir assessment and evaluation abilities as well as their overall ability to be of assistance during any event.
The performance of the non-licensed equipment operators during this event was noteworthy.
Their response to directions given from the control room was quick and effective in placing the hogging ejectors in-service.
The timely flow of information to the control room regarding' abnormal conditions existing in the' plant during the event, was instrumental in helping the control room personnel terminate the event.
Procedural Concerns:
The plant swinging before and af ter the generator was separated from the grid was a result of the operators not performing Step 4.10 in Procedure B.4 before performing Step 4.11.
The guidance provided in B.3 and B.4 does not allow for a smooth transition from one procedure to another.
The operators responded to the loss of vacuum in accordance with C.26 with effective response.
No mention is made in.C.26 about the possible need to place covers on the MSR relief valve stacks.
The omission of the MSR relief.
sealing steam isolation valve from A.49 was the major contributor to the loss of vacuum as a root cause.
Procedures did not provide guidance regarding AFW actuation.
The fact that AFWp'umpandcontrolvalveactuationwasseparateandtheNfectthismayhave had on system actuation as well as system shutdown was not addressed procedurally.
This was not a significant factor for this event, but it could
(
- been.
l l _ _ _ _ _.
VI.
KEY OPERATOR ACTIONS / PLANT PROCEDURES (Continued)
.s H ocedural Concerns:
(Continued)
Procedural information is not provided to inform the operators that AFW control at 30" on the startup range is actually 30 6 inches. This information would have been of some value during this event.
There were some questions in the minds of the operators about the wording used in E.05 Steps 3.1 and 3.2.
Step 3.1 addresses a situation with steam generator levels near 95% on the operate range with two words underlined to provide 'a disclaimer if high steam generator level is not the problem. High
~
AFW flow rates can be the problem even without high indicated levels.
This was a significant factor in this event.
Throttling AFW is allowed to prevent excessive cooldown rates according to E0P Rule 3, even if normally expected steam generator levels are not evident.
e was concern expressed by the operators about the procedural guidance provided for determination of the RCS cooldown rate used to determine if the Reactor Vessel Thermal Shock Criteria was exce'eded. What initial temperature should be used?
Is a 50*F change in 30 minutes a concern for example? The operators acted conservatively in this event, but this could be a factor in other events.
The major procedural deficiency identified was the omission of the HSR relief gland steam isolation which became the cause for the loss of vacuum by being closed when it should have been open.
The other identified procedural weaknesses were not individually significant contributors to this event, but the accumulative ef fect was to add to the total time taken by the operators to stabilize the plant.
The steam supply to the main feedwater pump turbines from the main steam lines is manually isolated during periods of low feedwater demand.
Stricter edural control is required to assure that this steam supply is available when required. - -
VI.
KEY OPERATOR ACTIONS / PLANT PROCEDURES (Continued)
.. ining
^
Individual system training weaknesses have been identified for the Auxiliary Feedwater System. Sept, rate actuation of pumps and valves and how the AFW level control actually controls.
, For the ICS, training emphasis is weak concerning the need to place FW demands in manual and at zero at any particular time or for a specific set of conditions to hold steam generators on low level limits.
Specific training about overcooling events, and the potentially high cooldown rates possible, does not sufficiently emphasize the need for very quick operator response with the exception of events where tripping the NFW pumps is necessary.
Training emphasis is needed on the effects of different va. lues of the contributing parameters.
Lackoftrainingemphasisonthenehdforeachcrewtoactuallytalkthrough their usage of the E0P's so that roles of individuals are clearly defined and understood ahead of time.
This area has not been identified as a weakness for this event, but could be a contributing factor in any event, particularly overcooling events where rapid operator response is necessary.
I
\\ >
l
(
VII.
INVESTIGATION OF AREAS OF CONCERN Overview Several a'reas of concern were identified during the post trip evaluation. These equipment failures, abnormal plant responses and operator observations were inves'tigates in a formal manner as directed by the Plant Manager.
The troubleshooting and investigative activity was preceded by an event evaluation and analysis to determine probable causes of failure or abno rmal - operation. The evaluation and analysis proceeded with the following direction:
1.
Collect and analyze known information/ operational data for conditions prior to, during and after the transient.
2.
Review relevant maintenance and surveillance / testing history.
3.
Develop a summary of data, including 1 and 2 above, that support any proposed probable cause of failure or abnormal operation.
-4.
8ased on above items, develop a probable root cause(s) of the problem.
5.
Develop plans for testing the probable causes (i.e.,' checks, verification:,' inspections, troubleshooting,.etc.).
In developing inspection and troubleshooting plans, care must be taken to insure, when possible, that the less likely causes remain testable. When planning troubleshooting activity, simulate as closely as practical the actual conditions under which the system or component failed to operate properly. _
e VII.
. INVESTIGATION OF AREAS OF. CONCERN (Continued) 1 Performance of investigations were done so as to not result in the loss of any in' formation due to disturbances of components or systems.
Action plans to accomplish the investigation / repair were prepared and approved prior to work being started.
Quality Assurance monitored the troubleshooting activities.
Quality Control inspected all repairs.
A separate Root Cause investigation was performed and reviewed by the Management Review Team.
Specific items addressed are tabulated below:
Overcooling Section VII-l Trip of Both Main Feedpumps Section VII-2 Loss of Condenser Vacuum Section VII-3 Feedwater/ Condensate Systems Instability Section VII-4 Loss of HPI "A" Flow Indication Section VII-5 m
+ i
1 VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
)
i
.1 Overcooling Summary The ' overcooling transient associated with this trip resulted from an overlap between the' setpoints on the pegging steam control valve to the 4A feedwater heater and the 4A feedwater heater shell side and pegging steam header relief valves.
Other normal post trip steam demands, the operation of the Terry Turbine, introduction of cold auxiliary feedwater into the OTSGs, HPI additions to the RCS and low decay heat all contributed to the cooldown.
The setpoints of relief valves on both 2nd point and 4th point feedwater-heaters were checked.
A relief valve on the 4A feedwater heater was found to be set 9 psi below the nominal setpoint.
The two relief valves were reset to 175 t 5 psig as a short term corrective action.
In the long term, Technical Support and Nuclear s
Engineering will jointly re-evaluate the pegging steam requirements for the 4th and 2nd point feedwater heaters.
The basis for the conclusion that this pegging steam demand was the major contributor to the cooldown is presented in the following.
section titled Heat Balance for Cooldown of 10/02/85 Transient.
An evaluation of the effect of the cooldown on Reactor Coolant System is summarized under Evaluation of the Reactor Vessel Cooldown.
4 VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
Heat Balance for Cooldown of 10/02/85 Transient Subsequent to the Reactor Trip, the temperature decrease of the Nuclear Steam Supply System (NSSS) was greater than normal.
When steam flow through the main turbine decreases to the point
'that insufficient extraction steam flow is available to maintain feedwater inlet temperatures to the steam generators, the pegging steam control valves are automatically enabled.
The pegging' steam lines direct steam from the main steam line to the two second point feedwater heaters and the two fourth point heaters.
The primary cause of the rapid cooldown was steam exhausting from two pressure relief valves on one of the fourth point feedwater heaters.
The setpoints of the relief valves and the heating steam supply regulator to the feedwater heater overlap.
This overlap of the inlet steam setpoint and the relief valve setpoint, resulted in an open pathway between the main steam header and the atmosphere.
This pathway allowed approximately 285,000 lbm/hr of steam to escape from the main steam header.and thus remove heat from the NSSS.
The plant operators entered the Emergency Operating Procedure for overcooling and identified and isolated the pegging steam line, ending the transient.
The normal post trip steam loads are the pegging steam, the condenser air ejectors, the main feedwater pumps and the gland or sealing steam for the turbine seals.
In addition to the normal plant steam loads, several other abnormal steam or heat loads were associated with this reactor trip.
22 7
,,wm-w-y
,--,,.-..,v,--,
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
Heat Balance for Cooldown of 10/02/85 Transient (continued)
The estimated steam loads are listed below:
Main Air Ejectors 1,560 lbm/hr Hogging Air Ejectors 13,800 lbm/hr Gland Steam Condenser 9,600 lbm/hr Auxiliary Feedpump Turbine 32,500 lbm/hr Pegging Steam Condensation 109,000 lbm/hr Pegging Steam Relief Valve 285,000 lbm/hr NOTE:
Actual average pegging steam load was limited to 360,000 lbm/hr by the maximum flow capacity of the pressure control valve on the 4A feedwater heater which is less than the relief valve capacity and condensation rate at main steam pressurees less than 852 psig.
The overall steam load on the NSSS af ter the trip was calculated to be about 417,000 lbm/hr, of which 86% was the pegging steam load.
Without the relief valves opening on the 4A heater, there would not
~
have been a rapid cooldown.
An engineering evaluation verifiea that the estimated steam loads were consistent with the Auxiliary Feedwater flow rate and the Steam Generator level following the transient.
This engineering evaluation also considered the depressurization of the secondary steam system.
This depressurization from 945 psig to 622 psig in seven minutes would indicate a loss of approximately 83,250 lbm/hr from the secondary steam system over the calculatsd steam l
generation rate of 300,000 lbm/hr.
This system has a total volume 3
of approximately 12,500 ft,
t. - -
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
Heat' Balance for Cooldown of 10/02/85 Transierit (Continued)
(
The 'ngineering evaluation also verified that the observed steaming e
rate was consistent with the heat removed from the primary system.
The calculated heat removal rate from the primary system was based on cooling down the RCS, excluding the pressurizer, from 553.4*F to 501.Ol*F in seven minutes.
The principal results of this calculation were:
Average Decay Heat 58 MBtu/hr Pump Heat Input 82 MBtu/hr Net Heat From Coolant 141 MBtu/hr Net Heat From Metal 103 MBtu/hr TOTAL 384 MBtu/hr Average Heat Removed by Letdown 3 MBtu/hr Heat Transfer to OTSGs 381 MBtu/hr P
Evaluation of the Reactor Vessel Cooldown Following the transient of October 2,1985, the ef fect of the rapid cooldown on the Rancho Seco NSSS integrity was analyzed.
The Babcock and Wilcox (B&W) Company, manufacturers of the Rancho Seco NSSS, were contracted to perform the engineering evaluation. Their investigation showed that the structural integrity of the pressure l
boundary components has not been impaired and that they are suitable for continued power operation.
The B&W letter, dated 0:tober 4,1985, is attached to document this analysis.
l l l
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
Evaluation of the Reactor Vessel Cooldown -(Continued)
(
The transient has also been compared to the transient of March 20, 1978. A graphical presentation of RCS temperature data for the two transients is also attached. The results of detailed engineering analyses of this event were submitted to the Commission in LER 78-1.
Post trip reactor coolant temperatures continued to drop from a normal post trip value of - 550*F to 490*F in about 20 minutes.
This cooldown did result in exceeding the 100*F per hour cooldown rate associated with Figure 3.1.2-2 of the Technical Specification for Rancho Seco.
The temperature did not deviate from the acceptable operation region of the figure for any pressure.
This ensures that the requirements of 10CFR50, Appendix G, are met.
It must be understood that immediately following the transient, the Wide Range Cold leg Temperature recorder was used for some of the analyses.
This temperature recorder has since been found to be in error and recalibrated.
The computer compiled data has been determined to be more accurate.
The District, having reviewed the B&W evaluation, has concluded that there is no concern with system integr'ity.
i l
l
7 1
3 P
F
=
P.
R E
T o
0 8
O 49 T
T f3 A
E gW T
Y f
A O
E H
D n
ME a
)
Mp_
N HE A E lT TO I
c O
NT o
0G R FA p
l 4
0 t
PA G E i-l l
fE_
i
~
,A RR DT 3
NX d
.f
~
2E I
i DU A
n S
3 w
D S l
Hl lQ o
E ES
^fQ p
M I
y MlM w(l FRR MAQA.
l 3
ol O
0 egg LA PE I
I 1TE1
} '2 nT 8
P T.
FSP4 4
l M WA
[
l Y
l L
E 9
g,}
T OF 11 A
f3P-SLF 3
E l
l y
l r
TlE bg ylT
/
0AA 4
PW4 3
t 6
1 -
i g
D2 Y
~j(
lE3 E
1 l
3 t
T IE-A 2
- tf 4FE y
[r+
}
f 1
[
l i
l r
R' I
OTE W
I i
n H.
THT O
Tp(i Y
0 L
l t
SoA I
l a
NP W f
T l
C y
Q I
l A
l AliE
(
l l
J i
iTf A
T D5f W
o l
X
)
T 4
u E
p E
g E
U f
[
T f
El L
f w
l -
i L0j N
/
t i
f I
n o
lF4 I
o 0
l T
P K
l 11ML E
~
A T
m l
s A C T
i Y
H T
RE A
t o
i TD f
o A
n.
i l
SN l
l IL A o
Y R
C IXltP E
r r
UAU T
AI -
A LI W
MIXO D
0 UA E
1 T
E A
f(S T
l j
. j,.
l,I)l 1!lll i!ll
v Babcock & Wilcox w=r e.-- om a McCormoe comoeg 3315 Cta Fo,est Rosa
[
P.O. Boa 1C935 Lync.tourt. VA 24506 0935 (804) 345 2000 Cctche: 4, 1985 SMEID-85-222 M.r. R.J. Red =iquar Executive Direc.or, Nuclear Sacra =anto Municipal Utility District 62015 St= eat Sacrasanto, Ca. 95813 Attantion:
.t.
G4c=ge C: vari Ea= agar, Nuclear cperations Subfect:
Ivaluatica cf 10/2'/85' Rancho Sace T.r.' nsient. fcr tn.2cve.= Cpe=arien Re Reference.:
- 1) Rancho Secc Nuclear Ganerating Statien, Unit.1 3&W'- Master Servicas Cent = ct cated Januarf 1, 1984
- 5%CD Cenact 9759- - 3&W centract 532-7165 fasJc 552. - Ivaluatica cf Cctcher 2, 1985 Transient l
at. Rancho Seco l-
- 2) 3&W Latta=
Surka ts.Rcdrigue=,
"~'d tial Ivaluation of 10/2/85 Rancho-Secc Tra.nsian *,
SECC-6 5-217, Cc-"er 3,. 1985 Inclosu=a
- 1) 3&~,7 Dec=ma== ST " M9 20 2.-C Q,. ' Ranchct Sac = 10/2/ E5 Transia== Ivaluatica
- 2) 3&W Dec=mant 51-1139204-00, St= ass. Evaluation *ct' Ra.ncho Seca Transiant (10/2/85)
Daa= M=.
Redriguez:
34*# has pe=ferned. an avaluatics: of' the Reacect Coolant System (RCs) c==penantr..for tha transient which, cc=u==sd. at Rancho Secc Nuclear Ganarating Station. en. Cctcher 2, IS85.
This avaluation was perfc==ed. in. tve-parts:
(1) a brittle fracetre/ther:a1 stec.t e.vr.luatic=. of tha :sactor vesse.l.. (RV) beltline regien ar.d (2) as.
AS2.~-~ Code, Secticn 22; avalua icn of the pri=a.rf s/ stas coupcnents.
The. brittia ::act:=e/tharmal shock evaluatien was based. en analyses previcusly perfer=ed. for another utilitf.
?e primar/
systam ec=penen:
avaluaticn was based.
en analyses
(
performed. for the. rapid cecidevn transient at Rancho seco en Mar =h 20, 1978.
Based en these evalta:1cns, 3&W has ccncluded that the st=uctural integrity of the pressure bcunda=y compenents bas net been i= paired and tha: they are suitable for centinued pcVer cpera:Acn.
we-+- - - - -
,w,----,-s-+,=-aw,-~
.y,,,-=~,-,,gp.,-.,-,-------e-nom-
,_,,,,,-,,w wee,r,m_
~,-m s-------
l Cn Cc che: 3, 1985, we discussed with Mr. Gec ge Ccvari the need to perform additional frac ure sechanics and fatigue analyses i
es nc:a quantitatively assess the potential i= pact of the cc che 2,
IS 85 tra.nsient.
We planned' to have. this qcantitat!.ve evalua-tien cc=pleted, by Cctcher 18, 1985, and Mr. Ccvard authorised 3&~i to p cceed vi-h: this vc=k A'ter cur initial fatigue avaluation based cm, the. Mare!r 20,,
1978 transient,'va no longe =.
"er.d. the. quantitative fatique evalua*-icn is necessa:7 especi=11y if" !=ture verk is. centa= plated. to relar.the opera *g. envelco.
E'cVever, si=ca the RCs, pressure did nce d:cp in the Cctche= i,.
1985, transient as it did in Mar h. 20, 1978, we f eel the. fract.1==
ner-' >
- d. cs. evalua.icns. tz specifically address. the Cctcher 2.,.
1985 transier.: ahould. still he perec==ed.
Unless yctr direct: u.s ~
c-dervise, we ara p cceeding crt that basis.
!" yeu. have. any questiens er need.=Md tienal support "rcs 3&g, please call ne at (804) 385-2308 in LynctLurg.
7ery - ly ycurs, 3..T. Burke Manaqe= c'.Centrac
?.:.gineerinq m:clea: ?.nq~. sering Services s
n.3/- n.
cc:
"w R.
K.2'*-*9 7.7 McCollLqan.
Secyc-Redeker va.L Lawis
- .7..:a:Ls D
Ahhot:
I.
Iield 9
l t
l t
l l
R x
~~ R 3
CO V DAR SO N Oct. 2,1985 vs Mar. 20,1678 600 4
580 -
l 560 -
1 m
540 -
g O
l J
520 -
I j
m 500 -
~
a
~
d 480 -
O 460 -
g v
i a
440 -
I
~
E 420 -
2 o
400 -
oo i
380 -
l D-3 360 -
l I
w I
340 -
)
320 -
4 300 00:00 15:00 30:0 l
TIME - Minutes from Rx Trip 10/2/85 TRIP 3/20/78 TRIP
O V
O..
.o
- o...
-N I
E
~
- o o..
-r-c LiI
- . t..
E >e H
]N 5
i i
o b
Io E
rr o, c
Eo I i i i--
e o t.a.
- - b~ ' 2 ON e n
.c-e..
-H t:. i-O b
lrl r c
I t
i H
t:
I t:
(f) a E
o J
a p.O 0_t I
t r a.
y CD
\\
- c*
- -: w t
l I
l E
~
c.
E o
- s. #
-o
- c..
I@
i i
e i
i a
a i
i i
i e
i o
o o
o o
o o
o o
o o
o o
o o "-
o a
o b
o c
v n
N r-o m
n 6
o c
c c
c c
c c
c c
c c
+
v
+
+
l
.4 533803G 3MO.!.Yd3dVP'
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
.2 Main Feedwater Pump Trips - Analysis and Findings I
1.
Introduction On October 2, 1985, the day,of the event, a program of detailed investigation into the causes of both Main Feedwater Pumps (MFPs) tripping was initiated.
This effort took advantage of the following sources of information:
Memory Trip Review, computer data showing alarms and logs of selected parameters Operator logs and reports
+
Operator interviews As found calibrations of trip devices Plant design and configuration data Relevant operating procedures
+
Equipment Supplier Field Engineers Nuclear Utility Industry Consultants
+
Plant maintenance history Plant history and reliability data
=
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
[
.2 Main Feedwater Pump Trips - Analysis and Findings (Continued) 1.
(Continued)
Oue to the complex nature o'f the event, which at one time or another included the combined effects of a " Loss of Condenser Vacuum," " Loss of Main Feedwater," and " Rapid Cooldown" events, it Qas necessary to proceed in a number of simultaneous investigations so as to gain a full understanding of the expected behavior of the MFPs and determine the cause of their tripping.
This effort was necessary, and made quite complex, as a result of only one of the potential tripping parameters having been provided with a " seal in" indication requiring a conscious act to reset. That one was the " Turbine Thrust Bearing" trip with the other trips self resetting.
The following report summarizes the activities of the investigating team and presents their findings.
HFP Trips, Interlocks and Alarms The following are automatic MFP Turbine trips which operate throeGh the MFP control scheme:
Setpoint Pump High Discharge Pressure, Instantaneous 1650 10 psig Pump High Discharge Pressure Time Delay 1575 i 5 psig for 5 sec Thrust Bearing Wear, Normal 0.040 ! 0.001 inches
' Thrust Bearing Wear, Reverse 0.007 t 0.001 inches l
Low Lube Oil Pressure 10.5 0.5 psig Manual (Remote, or Local) Pushbutton Contact t
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
.2 Main feedwater Pump Trips - Analysis and Findings (Continued) 2.
(Continued)
The following trips are mechanically operated at the MFP turbine:
5800 20/-100 RPM Overspeed Mechanical Lever All trips function by dumping AUTOSTOP OIL pressure to the reservoir, depriving the stop valves of pressure necessary to hold them open, and
.the governor of the CONTROL OIL pressure necessary to position the governor valves.
There are no condenser vacuum, vibration, or low pump suction pressure trips.
Low pump suction pressure does auto start an additional condensate pump.
Low autostop oil pressure gives the " Tripped" indication, closes the MFP turbine.stop valves, and initiates a reactor anticipatory trip signal.
The ARTS trip is blocked at <20% power. At the time of the trip, the system was designed such that any of the MFP control scheme trips also sent a permissive signal to the ICS allowing automatic control of the auxiliary feedwater control valve's.
Vibration, bearing temperatures, and a number of autostop oil, lube oil system, and control system parameters are alarmed either in the Control Room or on the computer.
3.
Scenarios Considered in MFP Trip Investigation A summary of the major scenarios considered as possibly creating the trip condition follows.
It was always considered a "given" that both MFPs did in fact " trip," and that the trip condition was real.
This was due to
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
.2 Main Feedwater Pump Trips - Analysis and Findings (Continued) 3.
(Continued)
~
the observation that upon trip of the seco5d MFP, i.e 8-MFP, the ICS controlled auxiliary feedwater valves immediately began delivering AFW to the OTSGs.
The only way this signal can be generated is for a trip signal to each MFP's AUT0STOP OIL DUMP solenoid to exist and be " latched" by the in-parallel holding coil, thus both MFPs were " tripped."
a.
MFW Pressure Spikes to > 1575 psig 1.
Main or Startup FW Control or Block Valves movement causing MFW pressure spikes / oscillations.
2.
Water hammer in secondary plant feedwater piping.
)
3.
Cavitation at MFP suction, (inadequate NPSH).
4.
Flashing at HFP due to overheating at 4th Point Feedwater Heaters.
b.
Autostop, Control, Bearing Oil System Pressure Transients 1.
Rapid demand changes in Governor Valve position.
2.
Setpoint overlap and correctness.
l, 3.
" Trip Signal" to Stop Valves without trip of Autostop 011.
4.
A-MFP Trip Investigation
(
A review of each of the trip parameters follows:
a.
Pump / Turbine Overspeed Trip.
=
o VII.
INVESTIGAT:0N OF AREAS OF CONCERN (Continued) l
.2 Main Feedwater Pump Trips - Analysis and Findings (Continued) 4.
a.
(Continued)
Prior to the A-MFP tripping, it had been in manual control maintaining approximately 3450 rpm.
Six minutes prior to the A-MFP trip, the generator OCBs were opened, followed by the loss-of-vacuum event. Within two minutes, vacuum had dropped to approximately 20'
. Hg and the Turbine Bypass Valves locked out. Steam header pressure control transferred to the Atmospheric Dump Valves. Steam header pressure immediately began rising to the correspondingly higher controlling setpoint which resulted in an increase in A-NFP speed of approximately 400 rpm.
This suggests that the steam supply to the A-MFP was at that time coming through nearly full open LP Governor Valves from the Auxiliary Steam System.
Coincident with the shift from bypass to atmospheric valve control of header pressure, the 4A Feedwater Heater shell reliefs had opened releasing approximately 280,000 lbm/hr to atmosphere at a pressure of approximately 150 psig.
The source of this steam was primarily from Main " Pegging" steam, while the auxiliary steam load was carrying the balance of plant steam loads.
Since the LP Governor valves were nearly full open, any change in auxiliary steam pressure would result in a corresponding change in steam available to the A-NFP LP Steam chest. Approximately two and one half minutes after the Bypass / Atmospheric valve transfer, the LP Governor valves were full open and condenser vacuum had further degraded to approximately 15" Hg.
This resulted in a rapid coastdown of the A-MFP Turbine, as it was still under load.
A-MFP delivery of feedwater to the OTSGs had dropped to zero by the time the A-MFP Turbine tripp'ed at 01:32:01.
At the time the A-NFP Turbine tripped, its speed had decayed to approximately 2500 rpm.
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
{
.2 Main Feedwater Pump Trips - Analysis and Findings (Continued) 4.
a.
-(Continued)
Review of the MFP control scheme also shows that the overspeed trip of the MFP does not initiate a trip of the autostop oil trip solenoid, thus the signal to the ICS permitting automatic control of the Auxiliary Feedwater Control Valves is not operated.
For the above reasons, it is concluded that the A-NFP did not trip on overspeed.
b.
Instantaneous Pump Discharge Pressure > 1650 psig At the time of the A-MFP trip, the feedpump was delivering water at a pressure less than that necessary to inject water into the OTSGs.
I OTSG Steam Header pressure was approximately 925 psig at this time.
During the preceding minutes, in which there had been sizeable feedwater flow oscillations, the feedwater control valves had seen differential pressure of as much as 300 psi.
If an allowance for OTSG and piping losses of 75 psi is added, the maximum possible feedwater header pressure would not have exceeded 1300 psig, well below the 1650 1 10 psig trip setpoint. With the pump speed down to approximately 2500 rpm, it is not possible for the' pump to generate pressure of this magnitude.
Alternative events were considered, specifically, water hammer caused by rapid closure of the FW control valves, or block valves, cavitation or flashing at the pump suction, and instrument failures.
I ~~
l asiatnetne zu LOSS OF ICS POWER TRIP REPORT NO. 75 k
i 3
EFIC IMPLEMENTATION i
8y letter dated August 15, 1980, the NRC identified a situation where failure of I
power supplies to NNI or ICS could result in ADVs opening to 50% open position. The
]
District concurred with this scenario in its October 6,1980 submittal. The District proposed to correct this ADV response as part of its EFIC (Emergency l
Feedwater Initiation ar.d Control) AFW system upgrade. The design concept was l
presented to the NRC at a September 4,1980 meeting.
~
Equipment delivery for EFIC was originally estimated to be in early 1982. When actually signed, the contract specified equipment delivery for April 1983. During the initial design review process, additional improvements to EFIC were identified.
As a result of these design changes, the deliver schedule was adjusted to May 1984.
l 1
NUREG 0737 required AFW automatic initiation and flow indication (II.E.1.2.1 and
]
II.E.1.2.2).
The NRC issued Safety Evaluation Reports in January and September In October 1982, the District indicated that it would install interim safety 1982.
grade AFW modifications and that EFIC was separate and beyond the AFW upgrade l
requirements of NUREG 0737. The District also submitted a new schedule for EFIC implementation showing completion by Cycle 7.
This schedule was confirmed by the District in December 1982.
The District informed the NRC in April 1983 that the installation was tied to Control Room Design Review (CROR) and RG 1.97 modifications. This was based on the 4
need for an EFIC control panel in the Control Room that was compatible with the CRDR l
effort. Part of EFIC are the associated RG'l.97 instrumentation commitments for j
Rancho Seco; as a result it was necessary that EFIC be rescheduled for Cycle 8 l
(i.e., the next scheduled refueling).
I In late 1983, the District implemented an Integrated Living Schedule to better l
control resources, scheduling of modifications, and enhanced operations at Rancho Seco. Since the AFW requirements of NUREG 0737 were previously completed, EFIC was-considered a plant betterment. Using the Living Schedule, to prioritize the use of District resources, the District scheduled EFIC to be installed in two phases--Cycle
}
8 and Cycle 9.
The Living Schedule process determined that other NUREG 0737 modifications,10CFR50.49 - Environmental Qualification of Electrical Equipment, Appendix R - Fire Protection, Generic Letter 83-28 ATWS, and NUREG 0737 Supplement 1, items receive high priority which resulted in heavy commitment of District resources during the Cycle 7 outage.
ATTACHMENT 20 LOSS OF ICS POWER TRIP REPORT NO. 75 I
i It became clear in meeting the requirements of NUREG 0737, that the number of modifications imposed in Rancho Seco would exceed the electrical capacity of its i
existing emergency diefel generators. The District decided in 1980-81 to purchase two additional diesel generators to augment the existing system. The District originally planned the installation of these new generators during the Cycle 7 refueling outage. This schedule was compatible with the installation of the majority of the TMI modifications, as well as the implementation of EFIC. The diesels purchased were made by TDI and the District, as well as several other utilities, were forced into a major TDI generator requalification program as a result of design problems discovered on the Shoreham plant diesels. This requalification program required both time-(several years) and resources to complete. The current schedule will have the diesels operational during the Cycle 8 refueling outage.
Since EFIC, and several other modifications, were tied to the installation of the diesels, the District was forced to defer implementation of EFIC. This delay also af forded the District time to take a closer look at EFIC as installed at CR-3 and ANO-1.
Because of some initial startup and operational difficulties at these installations, the District decided on installing the indication portions of EFIC during Cycle 8.
This would allow the operators to gain familiarity with the system i
during an operating cycle. Likewise, the District has been interfacing with the staff of ANO-1 to minimize any operational problems and benefit from the ANO experience, as the District's EFIC will closely resemble the ANO EFIC.
j
/
In October 1985, the District committed to accelerate implementation of EFIC. The District outlined the specifics of the EFIC implementation in a letter to the NRC dated January 17, 1986. This implementation will result in the majority of the EFIC l
actuation and control functions being operational at the completion of the Cycle 8
{
refueling outage.
i
O VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
(
.2 Main Feedwater Pump Trips - Analysis and Findings (Continued) 4.
b.
1.
Itapid Closure of FW Control or Block Valves At reactor power.of approximately'15%,'the'ICS will transition from the Main to Startup FW Control Valves, and close the Main Block Valve.
For the three minutes prior to the A-MFP failing to develop flow into the OTSGs, a relatively smooth increase in FW flow was observed.
This suggests that the main to startup transition had already occurred and that there were no significant oscillatio..t occurring, certainly none which could be categorized as " water hammer" due to control valve transients; secondly, as a result of the low MFP discharge pressure at the time of the trip, the NFPs were " isolated" from the control valves by the discharge check valves.
Since this pressure switch is located on the open cross-tie between the A and 8 MFPs, downstream of the MFP Check Valves, and the B-MFP did not experience a coincident trip, pressure spikes could not have caused the trip.
2.
Cavitation or steam flashing events likewise could have caused pressure spikes, but for the reasons above, these did not trip the MFPs.
Independently, the A-MFP suction temperature was observed to increase from a value of approximately 205"F fifteen minutes before the A-NFP trip to a steady 360'F at the time of the trip.
At this temperature, 160 psia is required to maintain subcooled saturated water.
Also, about 40 psia is required to assure NPSH requirements for the pump.
The system is provided with an autostart of a condensate pump at a low MFP suction pressure of 230 psig.
Neither of the standby condensate pumps VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
.2 Main Feedwater Pump Trips - Analysis and Findings (Continued) 4.
b.
2.
(Continued) autostarted; hence, it is concluded that adequate suction pressure existed to preclude flashing or steam binding as a source of pressure spikes.
Furthermore', operators and engineers present in the turbine building and MFP vicinity, did not observe water hammer or unusual noises other than those expected for the existing conditions.
3.
Instrumentation Following the event, several calibration checks were performed on the A-MFP high dishr)arge pressure (instantaneous) pressure switch and all were within specification.
Later, in the process of installation of trip parameter contact monitoring devices, it was noted that the pressure switch which developed this signal was in a " tripped" condition.
At the time, the A-MFP was on clearance for control system troubleshooting.
Investigating the cause of the intermittent switch condition determined that corrosion was present at the terminals of the pressure switch assembly.
This could have provided a path for the 125 vdc power to bypass the actual bourdon tube actuated microswitch.
The initial failure was random although the combined vibrations from nearby relief valve operations probably accounted for the A-NFP trip on an " apparent" instantaneous high discharge pressure.
(
-. =.
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
-(
.2 Main Feedwater Pump Trips - Analysis and Findings (Continued) 4.
c.
Time Delayed High Discharge HFP Pressure All of the factors and events imparting the. likelihood of the instantaneous high discharge pressure are appropriate to this trip pa rameter.
They are located adjacent to each other and sense the same source of pressure.
This switch was found to have similar corrosion, although there is no indication that a trip signal was generated by this device.
This parameter was not considered to be a I
source of the~ trip.
i d.
Low Lube Oil Pressure i
Several hours following the A-MFP trip, it was noticed that both the lead and backup AC Lube Oil Pumps were operating.
A single pump is normally sufficient to provide the autostop, control, and bearing lube oil requirements.
Queries to the operators determined that the second pump was not manually initiated.
Since the low lube oil
~
pressure trip of the A-HFP is associated, a detailed investigation was pursued to determine if this was a likely source of the actual A-MFP trip.
By comparing these actuations to the diverse alarms or i
actuations which actually occurred, it is po'ssible to determine whether or not this was the source of the trip. Note'that a check of the setpoints of these devices found them to be in specification.
The backup lube oil pump starts on autostop oil pressure decreasing I
to 160 2.5 psig.
Efforts to simulate rapid governor valve motion did create oil pressure fluctuations which were sufficient to autostart the backup oil pump.
This condition has been observed in other facilities with similar arrangements.
Given the comp,lexity of events preceding the A-MFP trip, it is likely that the backup pump did autostart as a result of rapid governor valve motion and not as a result of the failure of the lead pump. I i
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
(
.2 Main Feedwater Pump Trips - Analysis and Findings (Continued) 4.
d.
(Cont'inued)
The DC Lube Oil Pump was not found to be inservice.
It autostarts at 10.5 psig and insures that the turbine bearings are not damaged due to insufficient lubrication. There is an alarm on the Lube Oil
. System at 15 psig.
It was not received.
It is concluded that there was no failure of the AC Lube Oil Pumps.
The operators observed the A-MFP " Trip" light illuminated at'their Control Room panel.
This was recorded by the computer alarm monitor as was the coincident event of all four ARTS trip switches signaling their respective Reactor Protection System channels.
The A-MFP Low Lube Oil Trip occurs at 10.5 ! 0.5 psig.
The alarm on Low Lube Oil Pressure was not observed by the computer, nor was the DC Lube Oil Pump autostarted.
From this, it is concluded that there were pressure fluctuations in the autostop oil system sufficient to autostart the backup AC Lube Oil Pump, but that the A-MFP trip occurred prior to any Low Lube Oil Alarm, or condition, which would autostart the DC Lube Oil Pump.
The A-MFP did not trip on Low Lube Oil Pressure.
e.
Thrust Bearing Wear, Normal or Reverse Direction The degrading vacuum condition on the A-NFP turbine exhaust would cause a shift in thrust as seen at the thrust bearing, compounded by the changes in steam flow, and supply pressures, and the balancing thrust generated by the main feedwater pump itself..
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
.2 Main Feedwater Pump Trips - Analysis and Findings (Continued)
[
4.
e.
(Continued)
Thrust bearing trips are the only trips which have a " seal-in" feature requiring operator. action prior to allowing the NFPs to be reset. No such operator action was required in this event. While this precluded a thrust bearing trip, an investigation was carried out to determine the thrust bearing condition and the viability of the " seal-in" feature.
Disassembly of the thrust bearing housing sufficient to allow inspection and thrust bearing " trip" verification was done.
Operation was as expected,.although the as found settings of the trip probes were found to require adjustment.
This did not change the observation that a valid trip had not, nor should not have occurred, nor that if one had, it would " seal-in."
Thrust bearing wear did not cause the A-MFP to trip during the event.
f.
Manual Trip The A-MFP Autostop Oil System can be electrically tripped from the Control Room or from the local control panel.
It can also be tripped by manually actuating the overspeed trip device on the NFP Turbine.
Interviews with both licensed and non-licensed operators and observers confirm that the A-MFP was not manually' tripped, g.
A-NFP Seal Water Several minutes prior to the A-MFP trip, an operator called the Control Room and reported that the A-MFP was blowthg " steam" from its bearing glands.
The Control Room Operator imediately began increasing B-MFP speed in preparation for placing the 8-MFP in service and tripping the A-MFP.
This was not completed prior to the actual A-MFP trip; thus, when the trip came, the B-MFP was still at
.. ~
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
.2 Main Feedwater Pump Trips - Analisis and Findings (Continued) 4 4.
g.
(Cont'inued) idle speed.
Prompt action by maintenance personnel repaired the i
seal water regulator control linkage which had lost a pivot pin.
Pins were checked on all similar valves.
This incident complicated the overall event, but did not damage the pump or impact the outcome, i
5.
8-MFP Trip Investigation 1
d A review of each of the trip parameters follows:
a.
Pump / Turbine Overspeed Trip Seven minutes prior to the Hain Generator being taken off-line, l
adjustments were made in in attempt to increase the B-MFP turbine g
speed.
These adjustments were not ef fective in increasing the l
unit's speed, which continued at a nominal 2450 rpm, and seemed to be matched to parallel changes in the steady state speed of the 4
A-MFP.
It is likely that these changes in speed are the result of changes in the auxiliary steam supply pressure which was being driven by concurrent changes in the main steam header pressure.
At the time of the A-MFP trip, the B-HFP speed began to decrease below its idle speed. Attempts by the operator to increase its speed had not produced observable results, although the LP governor valve was caused to drive full open by the speed demand.
8-MFP tripped l
approximately 30 seconds after the.A-MFP. Both _ pumps show a fairly extended coastdown to turning gear speed which is attributed to leakage past the stop valves.
a I
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
(-
.2 Main Feedwater Pump Trips - Analysis and Findings (Continued) 5.
a.
(Continued)
There was insufficient, energy available to the B-MFP to accelerate it above its idle speed at the time of its trip. The 8-MFP did not trip on overspeed.
b.
Instantaneous Pump Discharge Pressure > 1650 psig The discussion in 4.b above, applicable to the A-MFP, is directly applicable to the B-NFP with the exception that no problems have been found in its pressure switches.
In addition, since the pump was at only idle speed, it could not have generated overspeed conditions commensurate with a high discharge pressure trip.
c.
Time Delayed High Discharge NFP Pressure As discussed above-, this trip could not be generated by the pump.
Only instrumentation problems, which were not observed, could cause this parameter to trip. Based upon this analysis, the 8-MFP did not trip as a result of this parameter.
d.
Low Lube Oil Pressure Only one lube oil pump was in service and neither the AC or DC backup pumps were found on.
Likewise, there were no pressure alarms received prior to the trip.
The instruments were found to be properly calibrated.
The investigations into the autostop, control, and lube oil systems done on the A-MFP are applicable to the 8-NFP and support the conclusion that the 8-MFP did not trip on low lube oil pressure during the event on October 2.
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
.2 Main Feedwater Pump Trips - Analysis and Findings (Continued) f 5.
e.
Thrus't Bearing Wear, Normal or Reverse Direction The 8-MFP turbine exha~ust steam discharges into the >ame condenser
~
vacuum as does the'A-MFP turbine.
If the significant degradation of vacuum (increase in backpressure) caused the i.r'p, then it would be expected to have caused the trips on both units. Although the trips
. occurred only 30 seconds apart, the fact that a detailed inspection of the A-MFP Thrust Bearing and its associated trip device did not suggest the generation of a thrust bearing wear trip, this trip can likewise be excluded from having occurred on the B-MFP.
In addition, the operators did not reset any thrust bearing trips in their ef forts to reset the B-MFP following its trip on October 2.
Finally, the running speed and degraded steam supply at the time of the trip were such as to preclude significant thrust loads of the^
nature which would be necessary to cause a thrust bearing wear trip.
f.
Several minutes prior to the MFP trips, the operators had faced sevaral episodes of main feedwater oscillations, followed by a call from a plant operator that the A-MFP was blowing steam from its gland seals.
The operators were attempting to bring the speed of the 8-MFP up to the point where it could supply feedwater to the OTSGs in preparation to tripping the A-MFF. Several relief valves in the secondary plant were noisily blowing, the main generator had been manually tripped, and condenser vacuum was rapidly decreasing.
At this point, the A-MFP tripped and the operator noted that both Auxiliary Feedwater Pumps had autostarted (on Main Feedwater Header Pressure < 850 psig) and that OTSG levels were rapidly falling in response to the large steam loads then existing (the main turbine VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
(
.2 Main feedwater Pump Trips - Analysis and Findings (Continued) 5.
f.
(Continued) had not tripped on low-vacuum) an.d the reactor was still at a nominal 15% FP.
The 8-MFP was not responding to operator inputs to increaseitsspeedandaReactor/Turbinetrihthenoccurred.
Operator training in ICS operation tells them that 4pon tripping of both MFPs, or all four Reactor Coolant Pumps, the ICS controlled auxiliary feedwater control valves will operate to maintain OTSG 1evel. With an immediate need to provide feedwater to the OTSGs, with the knowledge that both Auxiliary Feedwater Pumps are operating, and prior training that tripping both MFPs will provide auxiliary feedwater to the OTSGs, the operator probably tripped the 8-MFP manually from the Control Room.
Post trip discussions with the operators did not get a definitive
...I tripped 'the B-MFP..." response.
Rather it was
"...I may have tripped the B-MFP..."
Subsequently, the operator said that,
"...I probably trihped the S-HFP..."
This lack of clear memory is not considered to be inappropriate.
At the point when the 8-MFP tripped, there was a lot happening in the plant with the immediate need being to get feedwater 'into the OTSGs.
It is in such situations that the benefit of training is most important, and immediate action to trip the recalcitrant 8-MFP and obtain the needed feedwater from an available, and diverse, auxiliary feedwater system is entirely appropriate.
In fact, a similar situation is a part of the operator training syllabus on the plant simulator.
Manually tripping the 8-MFP was not a " memorable" action, it was a trained response to the conditions the operator faced.
I l l
VII.
' INVESTIGATION OF AREAS OF CONCERN (Continued)
.2 Main feedwater Pump Trips - Analysis and Findings (Continued) g 5.
f.
(Continued) 6.
Auxiliary Steam Supply Each of the MFP Turbines are provided with two sodrces of driving steam, identified as to the steam chest they supply, the LP (Low Pressure) and HP (High Pressure) steam chests.
LP steam is the perferred source.
It is used during startups and for operation up to the normal full load, as each MFP is rated for about
" half capacity" of plant demand. Should only a single NFP be available, it can supply feedwater demands up to at least 80% full power by the addition of steam from the HP chest.
HP steam is taken directly from the main steam lines at a nominal 885 psig and admitted through the HP governor to the MFP.
As HP steam is highly valued economically.
generating considerable revenue when expanded in the main turbine, the HP chest is not intended for use during normal operation.
l LP steam comes from the auxiliary steam header during startups, shutdowns, and during periods of lower power operation. When the main turbine / generator is on-line, hot reheat. steam is drawn from the moisture separator reheaters and routed to the MFP Turbine LP steam' chest. A pressure regulator reduces the demand for auxiliary steam as the hot reheat steam pressure increases with main turbine load.
At about 40%
full power, hot reheat steam is entirely sufficient to provide the demands of the MFPs and the use of auxiliary steam is curtailed. Upon power reductions, the auxiliary steam regulator will open to maintain the supply to the LP chests between 150 to 250 psig as set by the operator.
( __
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
.2 Main feedwater Pump Trips - Analysis and Findings (Continued) 6.
(Continued)
During the October 2 event,. the HP steam chest's steam supplies were manually isolated.
This cor,Jition had existed since plant heatup the week before as a method for minimizing leakage th' rough the HP stop valves and thereby enabling the plant to sustain a " Hot Shutdown" condition. As described above', the HP steam would not have been needed until the plant was to be escalated above 50% FP.
The supply of auxiliary steam was coming from one of the main steam headers via a pressure reducing and desuperheating station, Normal auxiliary steam header pressure is 250 psig.
Although no actual data is available on auxiliary steam pressure up to the time of the MFP trips, there were no low pressure alarms so it can be assumed that adequate steam was available, at least up to the controller to the MFPs.
From this review it is apparent that the MFP LP Governor Valves were properly responding by stroking full open just prior to the MFP trips, and that the MFP Turbines were not able to develop accelerating torque in the existing conditions.
7.
Effect of Resetting a MFP Turbine Trip Following the MFP trips, the operators attempted to reset the trip. The efforts were unsuccessful until about twenty minutes later when the B-MFP was reset and immediately, the auxiliary feedwater valves closed.
l Investigation into these two conditions showed that both were appropriate and could have becn anticipated.
i l l
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
.2 Main Feedwater Pump Trips - Analysis and Findings (Continued)
(
7.
(Continued)
The MFPs will not reset unless both of the governor steam stop valves are closed, and there is no " demand" signal to the governor which would cause it to be open when steam is again supplied.
After several attempts to
" reset," the operator drove the speed " demand" to zero and the reset was subsequently effective.
The demand signal was that which had existed at the time the MFP had tripped.
A successful " reset" removes from the ICS the indication that the MFPs are tripped, thus returning the auxiliary feedwater control valves to "zero" or closed.
This requires the operator to take the valves in
" manual," which was done, and appropriate feedwater flow continued.
Prior to plant restart, the AFW control logic will be modified to initiate ICS control of AFW valves on the same parameter as that which initiates AFW pumps, low MFP discharge pressure.
8.
ICS Performance Several of the occurrences during the transient initially suggested that the Integrated Control System (ICS) may have been a source of the problems observed.
Those modules which were suspect were ' checked and found to be properly calibrated and serviceable. Analysis shows that, as a system, the ICS performed as expected, including its interface with the MFPs through the Lovejoy controllers.
Likewise, the investigation into the operation of the Lovejoy controls verified that they operated correctly.
! y r
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
(
(Continued)
A recommendation coming from this investigation is that during power escalation, a program to " tune" the ICS/MFPs be implemented to validate the interface and improve. operator confidence in automatic control of the MFPs.
9.
Conclusions a.
The A-MFP trip was caused by a defective High Discharge Pressure Switch.
Switch actuation coincident with the event was probably the result of vibrations due to the transients in progress, b.
The most probable cause of the B-MFP trip was an operator manual trip so as to obtain auxiliary feedwater flow to the OTSGs during a period when the secondary plant was in a complex upset condition.
c.
-The MFPs, their controls and operator training, are adequate to support power operation.
d.
The addition of trip monitoring circuitry to the MFPs will significantly enhance future ef forts to investigate MFP trips.
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
(
.3 Loss of Condenser Vacuum 5 Early in the October 2,1985 transient, a sudden loss of condenser vacuum was observed.
The control room alarm typer printed out an indication of turbine' trip due to loss of vacuum.
Tie" immedia'te
~
response of the operators was to valve the hogging air ejectors in, which produced a partial recovery of vacuum". A subsequent decline in vacuum was reversed by making an adjustment to the steam supply to the hogging air ejectors.
A third decline in vacuum was reversed by placing the stack covers on the moisture separator reheater (HSR) safety valve discharge stacks.
Refer to the sequence of events and the attached strip chart recording for details of the vacuum conditions during the entire transient.
Later evaluation of all trip data revealed that a' turbine trip did not occur due to the loss of condenser vacuum even though the trip device is set at 19" vacuum and the condenser reached approximately 12" vacuum.
A thorough evaluation of all equipment affecting condenser vacuum was performed and the cause can clearly be attributed to failing to valve-in the sealing steam supply to the moisture se'parator reheater safety valves.
f Without sealing steam to the HSR pressure safety valves (PSVs), the valves, by design, do not seat properly during MSR shell vacuum conditions and the vacuum can actually drive the valves open. _-.
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued) f
(
.3 (Continued)
At some point in time, with increasing MSR shell vacuum conditions during the October 2,1985 power ramp down, one or more of the HSR safety relief valves ' drifted open.
The actual length of time after
'the vacuum is established and before a valve opens is a function of the leak tightness of the seals in the valves and would be random.
The opening of a valve resulted in a sudden loss of condenser vacuum. The subsequent oscillations of vacuum can be attributed to additional valves drif ting open. The following sequence of events support the above conclusion:
1.
In past plant startups, a single hogging air ejector has been suf ficient to establish acceptable condenser vacuum.
During this startup, it was necessary to have both hoggers operable to attain adequate vacuum.
This situation can be attributed to the actual vacuum boundary being the relief valve stack covers which would leak far more than the normal boundary of the relief valve seat in the closed position.
2.
In order to do the turbine overspeed trip test on October 2, power was ramped down to approximately 15% and the generator was separated from the grid. Shortly after, there was a sudden loss of condenser vacuum.
3.
Partial recovery of vacuum was obtained by placing the hogging air ejectors in service. With condenser vacuum still degrading due to additional valves drifting open, plant operators decided to place the covers on to the HSR PSV-outlets.
The MSR PSV vacuum leak path was so great through PSV-30233 that a cover was actually pulled out of an operator's hands.
That size of vacuum leak could have occurred only by having the valve plug off the seat and the valve essentially open.
All eight PSVs had vacuum leak paths. - _ _..
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
(C'ntinued)
(
.3 o
- fter the MSR PSV outlets were covered, condenser vacuum was 4.
A re-established imediately.
5.
On October 2,1985, the swing shif t supervisor checked the HSR PSV sealing steam isolation valve (now' identified as GSC-524).
It was found in the closed position and was returned to the open position.
This admitted sealing steam to the header supplying steam to the HSR safety valves. After re-establishing the sealing steam, the hoggers were shut down and vacuum was maintained on the normal air ejectors.
The sealing steam inlet to the safety valves was originally installed as a vacuum breaker to allow atmospheric pressure to assist in sealing the valve against vacuum' conditions in the MSRs.
Steam from the gland steam system was piped into the
" vacuum breaker" to provide a few psi additional pressure load for sealing against vacuum conditions and to reduce condenser air inleakage through the valve pilot operating system.
When this sealing steam is isolated, not only is this steam pressure unavailable to assist' sealing of the valves but the atmospheric pressure is not available due to the closed system supplying steam.
l
(
6.
Per WR #96743, the outlet cover seals were checked for vacuum leaks on October 3, 1985.
All covers were closed, not being held in place by a vacuum leak condition exchpt H5R "C" PSV-30233 and HSR "0" PSV-30236.
The sealing steam system was found to be operating normally.
( -
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
(
.3 (Continued)
The entire gland sealing steam system was walked'down to assure proper lineup and all instruments and controls were verified to be operating normally.
It was, therefore, concluded that the gland sealing system did not contribute to the loss of condenser vacuum.
As noted above, the control room alarm typer printed out a message indicating a turbine trip due to loss of condenser vacuum.
However, such a trip did not occur.
The turbine trip actually followed a short time later and was the direct result of the reactor trip.
Our investigation into this problem reveals that the instrument providing the signal to the control room alarm typer is a pressure switch monitoring condenser vacuum.
It is. set to actuate at the same pressure as the turbine yacuum trip device.
The pressure switch functioned properly and provided the alarm.
However, the vacuum trip device did not actuate as designed.
(The separate pressure switch is necessary to dif ferentiate which of the four trip mechanical devices actually caused a turbine trip.)
The design of the turbine protective devices includes four separate trips on a single direct acting hydraulic-mechanical device.
Refer to the attached drawing for a schematic representation of the turbine protective devices.
A review of maintenance history showed that the turbine protective l
device control block which contains the turbine vacuum trip was completely disassembled and rebuilt during the 1985 outage.
Prior to plant startup the trip devices were properly adiusted.
l l
. I
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
.3 (Continued)~
During initial turbine rolls plant operating procedures require verification of correct operation of the four turbine trip mechanisms in the con. trol block.
During post-outage startup it was found that the vacuum trip was not actuatin'g at the proper level.
An adjustment was made to obtain a proper setpoint.
It was tested three times before proceeding with the startup evolution.
An investigation into the failure to obtain a turbine trip identified an assembly error of a component contained on the control block.
The assembly error consisted of improperly locating one spherical washer that is normally seated in a spherical seat on the trip plate (refer to attached diagram).
The proper assembly of the components assures that the spherical washer is always captive in the spherical seat and the misassembly allowed a misorientation of the spherical washer. When the spherical washer was correctly aligned with its spherical seat the setpoint of the vacuum trip mechanism would be approximately 10" of vacuum. When the spherical washer was misaligned so that the top of the spherical washer contacted the flat bottom of the trip plate a trip setting of 19" per specification is obtained.
(Refer to attached diagram.)
The initial assembly during the refueling outage was performed by contract personnel under the direction of a Westinghouse service engineer.
There are no strict procedural controls in place to assure that contract service engineers working on Class 2 or 3 equipment correctly execute their assigned duties.
A review of the manufacturer's drawings' indicates that all four trip devices have identical spherical washers, referenced by identical part numbers. One of the four washers is, in actual -
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
.3 (Continued) fact,"different than the other three and is required to ua different to obtain satisfactory operation from the control block.
It is suspected that this was a field modification made during original turbine erection performed under the direction of Westinghouse.
There is no SMUD documentation of the change.
The cause for the lack of turbine trip on loss of vacuum is clearly the result of an assembly error which could have been attributed to drawings that do not correcity reflect the as-built equipment.
The root cause for the loss of condenser vacuum was the fact that the sealing steam valve for the HSR safeties was not shown on the plant P& ids nor was it covered in the plant operating procedures.
Therefore, there was no assurance that the valve was being properly aligned for plant operation.
The entire sealing steam system has been walked down and the plant drawings and operating procedures have been updated to reflect the actual configuration of the plant.
The indication of a turbine trip on the control room alarm typer when such a trip did not occur will be corrected by revising the alarm typer message.
It will indicate the turbine trip vacuum level has been reached rather than stating that a turbine trip has occurred,' as it currently does.
The assembly error on the vacuum trip device is attributed to documents that do not correctly reflect the equipment.
The vendor manual will be corrected and appropriate notations added to assure that on future overhauls a proper assembly will be achieved.
l i
l 1
r
.s.
~
P...
.-,+. _.1.
-y;-.
-=
.:m:!.4.---
..,,.,'.-- 2 W::. a
. c 'd ':,$.
..,A' Q. f. -t..'is. 7;
, m.m%.. E hM.
'.;;:i':l i'!'. I:. E.;3._J hSO U " p.si:= ymtme:;:: e
.:_ W -.i.. = p.._:.: u.
g y
%g.r:p';.
- ...v..?,.5U,..
h't
,.y.d.
I -
. '!M We@!" -
1 ~~ o
- "i: -
g ;w. n" 5.2-
. i~dDE W
kbkbNf@%%
7.D.'2.'3 :-
Y i;'!i!.::l;;* I
- ' :. I',,,dliOAdIN!!N'I i CSE!bUdE. [!**# '.".b.:.:
..t:
hi!UiS@i'lEIIl b b 6hN b N M N w.J!p!Sthw mwwww mms pa. m%.
%7.cw.w:,M&m b.%
ar.,:
46.,4.y. ~ %.. '~.u.u. s, wwmiwwwM,
&.e.%.w.,,:.
b...wv.
.w.,.:,...
,g v
@ %@ s % $:M W W m nc'4.M_03 M..* W.
gg,%;,_.m.mq"M&w; j, E
M gm@g :.im.o.,- 43 2;
- er u
. w ;f w e:.ie "mg.
.w..? o r:t.m o.o:.1I:;.t.,:nra.
.. ;d'
[ c!... m.
.&..e:u,.,r, ; -d :n,,....N.
c s.'t.'A.-ar...,.
eo to:,;
- o:nC: r e Pie
,mnNik. in,1!ib %:, gray..sp_.x'.p.,.
'gtty!
N o
u-* w " m.5f 3 $.;m g.
T M_.Mh. -SfM:iif.i.h.'i.l,ijk 1,
.i.i'.i,!3,1H $ id.",i M I M I C... M.
.cw-n,
-F. x m o e := -
p-2 M.. : N d.--.,.
.v!. Y _e
~
k.pa,~m-~~. t >,a}.,.,ty. %...
,'i.].. t.Rw c.
~".
u.m r
<... w. ~
w:.w. v.
2.3,.Cc.. a; _
r:...:
o
. #, m
.g.j.. ;.;,-;,.s
,..,, = =
- , 3
..%.,9 f.
YW$
SYh h.=5l!h Y.h$k5h?k
{h
=
$r W.g @.u.#...W.h
'. -iw % M,.:= mM,
-h
- %' & Y $ $
. MM?W. s n'" 4 i W G M. M.inLM..W S
%h N ht.!N}*!kf!b.3.k
_h N.h.,k' M h,h.* Nilk h M.
Y
,A
,kb[.N.bh."Y j
f h
i
.f.M
,h. b :2 h
N.N, "Mih5k h i'h. h $f..
--R
...Nhk,.[.c.<l'hr l
A.
.n h.,.
l_..... p..li_!. m g N. ::a? p.... r,,.g,,sp.p. g.
- t _;
. e..r N.. m..N* <.7..;.v. u,.,-$~
w
. w.... i : oj;.
- U.a_,
- u.. r.,.o.
- a. 7-: ;,' :. ~_.3...,e.
,..._s o
3-a E
m.
! W.s.. TA-M MIl*![.].e l
I S
b$
1,.-
T
- $.. ' 'T"Ma !. f'N ' g
- 8 ' H.:u so s n *
- \\ g;g... fla *U g t " st.ig:L'j'd O T
1 tod t
- ....'" _.2
- C.
-:. Q =n :rd ~:
.: c.
s.
.r g.. r.
o g
s-.
,.,t..,.,t-.
.i-. ?..::. =, a., g.....J,, '-'i & se ey.,*L.. %., % o~-d...
1,,Opl,
- c. :-- c,.
.i,, *a. l ip.,.,.... T"M.
,g,...J
.g
=
. D'M..: p; ax,u__ ; _
., *p *.
- a. 3 J., A
.:N;g ".
-w m.... g.
.2.,,.-.,m,.u:sm.. -.:.a c.,. g........ o L -f c,. x
.,.........,. E.
._ct..
. $y_$.,
ce t.
3.m:u-
.,c
.m
- 3 yh8 Mil $1[.l $i"Qii.!.W.'l.@Y,ili@im..'.
$7M;.
[I~~~'. M{
'(-'[..
g..
i toi
'J
<.. ' _f..
',.Jy
- r.t j
/,' i p4.r M..w: m g:l,g t;i.,:;p..n di.ii.j;l!'n.t.:.c.i..e,,; g.p.iP sim_s::.c, r+y
. v.,
7
_.c
. -..n e. e e_ e.
.,. 4
> co _.
.N....
..o., o s,, o,, n, - y,, ;, g.,,,,
,,,%,, y
_e, g :=
g,.a.
, j... j.
,.3 p,,, g.,..., y..-s l
- q. :, a T.25WM%M.ezWK@i%4mM
- n.. n*,?.T ::-
. a 3,-
m,..~.
-u..,..,,.
.,.1 3.
v, ;.y. - e 1...) p.m..
d y* ;c'g W
. '. '.'nj m'. ;"Wst:
a.,. N'ach!.hpv cxu,.
7.
' sof':!ym' u. wag m.et
- i. 2.
- -itv>:.
-./ y32.' : y: ! gF:.c,..m::.m a.
n; q
..' f.I, ~ fW f,I ~
'.. ':t%.E!
';.Bli:HMiilliili!!!M.iid'I.]!.U Jhik::2t-510AMd.'
no t.
... o. _.e u~ 9.
W'~iO
..,.; a.',.
- .;g..g,..c,;.' M.3,-
2,.,.Mu.yc=.w.pwm<::i s h
g,.,A.: ".m:l.am. v.g.,:c c,N.:.r.e,u.<;w.aa.gh".u.nr.,jp-P.:
e ysmy
?.
.p n m, m
a
.'[
n
.~c,:..., a. w..s;...
... ' 3.!
i
- .... ' '..7 T Dti
- h.
-.-.e s
.,,a.:. _j.,
- v,3..;"'9p:
., s: ;h,n.y8 ml.......... w,....a m,....c.m u.n m.w <.n..; q. m,
d v.
a.
.r
. w,x em g[p.-f.m. P::i
, ';;rt h,,i:t"idt:.t!-. i-!I+m M!..w. s.gc,~....cm.-.
. r.h h'-
'k.s.h. s.
f:^.I {
l't.t j h +i:@dNMj@!@ @hiME b 6 Mini.
-3
-n
- .g
.k. n :14.w-M...% ::% ~
>:-g,-.b, 5 %.
a:
~~. :.o,....
. ;m.t.ur.i~. 8:ffjl.d: m1:8tt!P2. Elf.
a 0:.n-
.:?c, W
?
e v
.r r--
m~
(th [ h lhj.h_h hikjibg$'"g %,, [. ~g-[N '['N N[k Y h 5
'7
h.
h
.y> M
'I
,h.5 dhII!d}jU_lf.
rh!
. ItMME.MN kkJ.k'N
~$ N,$
N.
h-D N$NW,NUE. '.'I N iijiiNIINN N T M '.ifE N E
.WRMH!MrEr.micir:iP,eM=Me2WWf %6M4e c.V:G.E w.'.M D.:
,..1.u. t.,.... n., n.. n..c h...c...l...,; n. Fat,;ln.. dm, nl:l:.. :q, W" 'o' ',. h,. r.#.. c%. 'h. '2..e -. '# '..<.b. 'I. >.'.'l '. ' @
M ;;'.
.l'
.,w.'O, m :. !..i..,l n,
- 0. 4.. n.
. ;., M.e r
W'.. v,,Q=.;.k...n. 4. Mi:n M.:. t -.p J a.:..,.y.,,Higi!ig;.tp @;;.m.pSli@ iip.;$,?. 4. ; qg$.
n-.+
b:h,.
a.. n,..
r.M;.*e
. s. --
W'i....?. G."..-y. vf'
'u u-
- -::G=G U
.~
--g
.-;.m,.4.m. - e. m. c.,.-
.. e. u. -,:....
t
..e.
....a-g. ___-. _4r i.
.e
. ',3,.c.5
..g.
f..
..co.G _ v.e "n.
i:. w.-
. c-
.. : c.. ~
c,:.n.L.. o ; prze.. ".t...g g..
er 's.
owy
.f. 3 c.~,
o".:
a.
.:.;cL. o,... o s o,:. n u....
"c r -r
- 3. s.-
c< : n..... -
'. f.'..v.
." p:Mhicuntrut,1P'
- .1
,a F f.:l,. n..,h. v
..m O.- ~@
< ' r!.,:l a
, f.'. c..
2
.!'"!;v,
li...m - ;-- j- ---"- :;- E n.,... c; C M,'t..
..n
-F
-]:-" --'.:"'
e
/gd. b.4;.. l.. {...B..... l.. ", C -l L.,... _.......
M, K,Y, -y'...-{ '.,
3 M' w.
.h:
t i[-a 1:..
,; c e q
.......... i....t.. 1 :
- i..
as.
-l a.. -,.. I... g.
- q. ""..',...
i
,,g
[
.g f.e
.g s,
&l
' '. - -.i.; -:P. :._ T.. - - " 1 '.; i -
1
.: f
~
s.
..... ~._.................... -.... -
_,;42.5, l a
I s
3,
p uw=.=sruse w---..
7.,--.
-P i, _ _. _.. _..
,,m
- 3..
s,
. h.:y..
..~I
-- w
..w
- q. %'- ~. w...
m
[,.... @{..e p pw s:
1.c# '.
... a........ @. 'd"h~Qf-;(,
,. s. 4. :.M.., P'*t/...
.,3. *. * ;, C*... e.,
.s1,.
- t. gF
~.
-.....o......a....i.. ;,i.. im.,.. m...... o............ r.f. g*i}@y %
f iiQ.L(.
r 41.'.o$......d..... ' d,5..PQ:o ;F@FrCnK 7%ea..s O M.
7*,,'v S
6
- 'm c
" " *. = t e
' d-
!,;;;cl.
-. 4 ', - *5:+*
~ ~,M.'. '..#
o W;3.;.
3 a
i...M.,,..l.e_::* : m,, #,...:s...
a.......... -..
r.L f.7 :Q.
. h.
J.
,g. %.
' " j". - le. U.
... c.- !.'it. l '.. :p'.,
Iim..
"ps.
.,g;.,.t,.-? rW*-. *~ '... '
..[.
fi. ' - -
[J r.- i; 3-2 *. -
. ' ;;. r :..f..'.!.*
ti',jt';Plt..- ; ' g e
w....r.-
. n! g. i.
..g
,e.
...t
.,e
. L. r H..U'J,i,',y.L.. h..
- '.d e a
- .ij l h !.;.4,t h.O o
...t. k.. i.s.
6-e..e.
a.
.a ls..
.t s
w.
g a.I. j:~~ 3. W ;,..,, s.." ". ::
..:; s.
1 O [L::e'.w H,<y. V..e., 7~;'-...,.?; y
,;,... - q:: w..:, e.e b1.;.
l.:*n%q !
% a. ~.
- g.. :m". t- -'i y o
- 4
.;*%. I n
gg....~.:, ~. u. #. W d.
ts
... 79 /d' ".:
q.
.s 5h '.:.]llo'M. i"-[.p 4 4
,'";n. i,flf e,.... *. :.
- i..,;;;..
..*".-f.--
w.m, r t.
..2j/ PT.r ps. M &,. W C.$" %
u..p a.lc..p e.
4@"'t. 7,l.r.3. " M i
~._s,.
l.....,.
.::l DMfd7M.dty.l.$p$$
ti::- :
T e.-
-?
a.-
o, W j w.,s
...., 4..,. h. p,:..,s..r]#... :........., $....,.- 0:!
o m,$'Y;,.w.,2cs.
.;re e._ +: pN'e' s.
..I', t..
d m,-
... n. u.
~,_
w-N D5
.,7; (:, ,-Q'J '
b ;-
i.
.g.
...... -.._d-.
. :,.... l.. i.....
c. !.% L; (19.4 a.:7...... @: im=.1.i
.,.2..
--D. -.-
N'm.
p y,.;....s...,..
, m..:..
n Mgr.f.M, : \\* a Pj 'E 4 @.
.g.,i,,E' }.gal.Theis{3 ' ;d.CY.w 5-a-.l. A 98. 3."11M..a.,dl!1bi.I.SI::.Lo!,f,'"'* CMC.'i{.f.;;O.',L E 9-$
- t..--- 7' -
o I. b. M I
@*;ylf.
.M:..l..;,l..s. m e
!ll?;, -
bhD
.NO
. J t:.h.p y.3..'.U. ;;,;
a
.n4w
. - - -p..-.
m 047 h:P. g#. : ~W. es,s.w W...
mM
.f
. t gf 7 aN
- $f((ft!$;lJi
,%.u%c t.Q.etV'j dW"o O,$
g:C g ' O.;;,.1 tW fijNld';i[iNiNl!!!h. t. :t
- f. D u.............. %g*~ S s
- g,g< S4 im.%i ga f [Qj php W
C *et..y
- f. ddD'<
IL
.uw. --.-N.. - k-....wlm. W43W.rL:;.:h/; s
.m *'.-. gg yjg$g?. d l,h Y.[-
a..uii atF!t\\!
W*s.:.".9, C
$$!Myl;H!y;@5. '/7oh,n..q@p.se s; Tfh.w
. M.%g,q.Q..k y
- h. T. M N-;lMiipnl.d@4:-:
~y 4.M X J
W:
t.
.t:W GMkW@i@l0y'd12ffp.y,o?
7
- s..2
- 1-lWliW m
N g"'.r Midi-a~dF.d@i
@lMi Q
~
m
.t.gg g-, e v.-u' y NJ S'-@-J.M!p!)di.-.-{s; nrm. -lipij$,'.*.a.y:F.3.g:y. l.r i c. N. '...
J' c.p J:
dIOM/Mli'M n~
w-
- M'.4. ; Mud!%e.--t-M.@...j 9 d
.q@lM, ;&jd9W-i. w.Am...t
,{... a.sv.,:n:s.
i;.yiM:lr--
-u 1
- 1 *ii:i,?-
l..
. r, D.g O
J
'6
~. e,...d.. ( @..........p6.. -
"9
.o
.:rr.
69$
i-e ~%o = ec p%o- --
--o o V 2..;3. '~.@W :i3 ~!*
- h. :h. 5. (s.Q I,'.j@%&
+*
.:@W
,% y.. p... a.. % w,w.glp: port.,e.o.n:r.a-':
....n.
o, m. o.,. m,o.a
,.,4.,
,..,s..
N k"!!p'!hldiT 'd:rNh3kN'h n
@:~
.~
-o cqr.h;.o; :Wilrifth!.jW'.U.Ctruiii*"$[% :c b :[, o' N WM..:_:
I!?
w a r-....
.s :.h./.ta-3 p'q g3.N. %; J...:nm. I..w?-g&f hW
- "' W.=- h : "*i.:
y. 'n.,:.. "np f'NiP,@@* -K@SMMh.r@- %..%,
n n...
w.-
n.
m.
4',
,:.s
-.. n m.c M N. 4. c;n-I m..us. SM. W
.@6nwm. v..w:.ms-0::
~2 6.
p w.i.= :m..;,,m,;n ".
- p,p.,n...
,.*'.s.. v s.q.. w.,,,l.t.~%2 W....i
. ~.. e... -. ': u LJ.* s.R*W:;.'.?., h O$W, O.
Ri:q.Dc@m-.A.-w,.g:$.;g,.pg...p..w.
Q ' 2W43?i@:iWR.W3, Rie.l...d 9
. e.; g ? 3*:; g.p.'--.: g..F.N g?..,.
-..o..:
-x..
.r 9 g?$ q6.
,w.
- m. : * : r.H M.
N M L*%"4 S
8#EW45sWs:
3-p_ 4 M-e..
. e. -,....d e,.
KWg
.,W g
eij i:m;&. n...:,,r....w y r.;;p..g,,,..d:r pJh.Hl t.
kjfT.sMW @M@S.qs.G v
2
.g 3 ;
y pg "m? 3.&......".cm. pg'.
.g..c:g... --t-tr-d?pg.%.. gjejgl -
24,l. ;e,. -l....
g.H q!!g.
82$.$
y r
wr
.y 7 LQ girg2d M::wiggec si $ y% Fw S 5'4 @. % $Mg2 @ $if M pi c
' Mi3@.
M S $f4l
.....y u... -. s.... m.. +..
i.?
@N 4$y.4.&.&'@45@
m@,t W..
h).
... m..i.. 3 h:
-e..,m..
-2 6 hI aM MFAMdini&fG8AMF s % g..?g; v
y g/x.mW-q,_m,,,
3.c.;. g
.n..n..l:...s, Q ','+'EM@#S@.
e r..t.r.h.. q..m.p..d3..,p"%....e.r.T-:t.
-:r:.,
i.
e-n
-n g.
. - ~
w g=:.d.g1
.Pi%e. *:.:n e
-r-e...v y
,,- c.
g s g h n o p ;'? h h..
Y n.r m.o.. a...J.~.
.-]...q ESE._s....
e 5. S
.$$.(.g m> h.. n..* ;p.
. g....I,p.Y :b?&.a"J;p;.t..:h;.:.m. :q
. e-- r ;- 4,. 3.
,[ :.:o..
e.
- .:c.;
... ;q. ;u -
vd w.Y 1,.; r..,,. a.
3e
.c.
b, w.g,.~,;, p. ;.fs~.,.,.g.yc
.r
- r,,
... ! yud.
.Rr
.,n
- a.
.u w pr.v. 1 l w h3 '
, g;;j..
- <.w 5, O-k [%
- M' $ g e-s cs g..~g m;q e
.g
- g. 0".4 {'.5-m
-nr.....- ----
. Y.r.
v-I $.,Wi. f g."% q'.g~;o{,[ *rg,.,e,7p.g,p}p;j..$.c-b y,,,4.y_ g g, f bp $ ng gm*
g 6 6..
.ag Y$ $.A.+.;
1
_ dlIP* *o.
.o...... r8.t"r *i.t ;. 51N.f*.kr.*e mmCr.h.G.b l.M:m. d, v
.Mt"I %!
e psM's:..+qaQg c#g
- i..".,3. f*I fW&:
W.g .E.,o.,0$, ?WL"*. MMM'W#,mpedsppqs,4
- 0.,*W qcm f,y3K.$%.m~m..pm 1
i' h l
v
- ,.ts moh.._%%@F M6:mp;N6AMQ ff,
@Q ("UpL. m.4.*a :i fiji W 4 nw.w.w:a:
Q%
& P W Ww y..n.,.M.p" +a m._.i.i= m,J W4:o,iM.W. c...>.a..z.c Qhp[.Gs%,,iM::r8. ii%.
b M W t. W m iIMWM t
?f@v.Q q.1."
k WiiiiU..T.i.J:tr.e q.%p10g.I q1::*0< d.p0 : !'Q0s.L';2 g'g... w,. :.:(i,p.f W din..A v...
~
t
. -... %.r rt.
g W'stf: ria.:::'1 o
m.ye 4.1 g
W-
.u-
+.p r Q,.W: k}@lM4n,.}: Q:t.:o-q g
- spQQ,g.;",g.
. s. *iN b. 6...%.. n.. :g.m #-'.e.:....,t.. ;,
.c *
.e m
f c.r m,....j sh-
^
O
...... ".. n....1,,;s.,s,.gy !,
v N.. %.... ;.,
~ ~., a.-... o. --
. *m
.,r e
y '-'-
s, m. '
- g. i:gjD.kM*MMJ
?
- U
[th.'
t
- a
{;gcW5f-Cl%EkM, E,r."'he{Mtigiphagggr
^
a.s__ w,,.h.a m s' p.Iiw ms h
~
i s
E
. IthwilJhb NkEU.h M
TWQWM d @f[@ M Mh3
,. $ Mac. k'm',.b w we%:MMM
- ~
T g
C
$ bf aliW MMiGW@M@Inshl2
'h b
TT
@?51MjO d!0iid % % 2' W W M IMI MIMM'I
$3ff!'
54I iI (E-Ir k
.h. sa, hNb.hh.k. Y.h
- by if
~
4
- 3 hhu. rh M.
p.
s a-gTT*:es
~am-Y.
h ghp. yf K Q,N b
i p
M f$
.i MhTi, Heli 4%igSiitii1@I2MR
'N!Dn W
IIDJItMIflE@$a k i h 4 #.='3 M I MM !A LA' M.3%W4$6P*#
fd
~
Y Y
9'
?.
3
.C' r
h - h. ik.h
,,a..
h IlthN.]
h E.k HW W T %.3 /p 3 ;:.;,. s F 1
'r %'.:S!:
l lP'P r-&.,'lhy tri10*1.",9 y:E H og.f,;khaQG4".i.dIQP!:::::dg:'!t."}tgjd
(*..$
e lth MJHp ggg 2.%%
ch.
._.cgc : ::3.id M?.D %.Q+%:
f t't,r; M P s h $ $ 3 b d L% j & W u
- f. k E M s'
f de" 5 i
)"* [ 1 'M.
d' 2/
=(.
W.V.7.ME'cr@#,SM 5t
]
h,.
.1-
~~J.
C r"$ s,W sums $1.wcWGMMMPJim.Mi@W
/
W. 2,. i
- E.2 n ii,,a.
Y*
ihIEh. M;'kN! Nil.iMdiiiHRWfdiK3'Sl@l DPM ~
n-N*,
YY;Y?
~
A 2 W@Mi(@Y.5d Y
Y Yb$?.Yih Y Y$$h
- i..
- c. -Ra :n Y
a' %. %.i
~e
%..ll
- "l$m'7 sis MF9iR M E99#sE5W.
i
=. >..
,u e.3 % m.--.. ~ u r,sn m~
.m
- s. mn
- q.. D bo.
.a,w-y%.wk u..
as u
N.
k E Y
^O
~' M 5 1(. l[;Qft' r g, ~,. 7 N'
N.M.'~,N$Off@N.T h.I'.- @
kke f-h
.m>.M!
$iid!M MENFE MA..smMW i
NT'd" iM$ RE! Smim mss esTi e
i hhud5iThemis*Mm1wase sig gpyjenqwgj
@@? *y e; % e u m l
WNMi2MMX' W:dWMM
- @M J M e il.4i W M W M MilsgGM$injd'#$g's
% w w...e{plM N RMiNWGT%W4, p i n w u w w 1M4' @1.aMg%.c,-W 'l MWMr%:
=
h" %
. Q -. -.~
%,@"%,F ;g_ *6,4ilqtt!.;. h...
- ...i..s
.i, F
9 4.,:..
., : c.
1y
.w. : g
. l(tligd,g k
.'t.,NeMit "q4'ibl$,n..'ld N.P*E Nid in" ;piity,v'Gl*v-d p
g
.\\h';rh..b
.?-
..). om
,e e
e.
e
.v h.
'fl((.Y. f a
l
...'.x..
N I
I. ;
[# b[ ' [' I' Mbh !,! Y'h ',.;.*.Wl.,!N_N.,.h,Nf h. g f
.p s,.
D C!N6 [$
hhNh3b
.$ 'd... J-),*
I' I.
0~ -
)
'S g
. c.,,
l i
A. hC'd.'#:s.,'.. W ',!!U,,i. D(!t.t. m.r[
b.;.;,.J.N +{.NNJ x,-
1 T ~ i-'.'e.
%MU "d.
l
/
.v' a,,
. u"n'~.,~p,;;g.,Jl. ;I.::;p'y:,j!j !:p!,,.. -.. m
.^g.
h.mt ' 2 - -
,~<,iw 2
.'.a*.".,
.[
h* #
,.c, ;, 4 }-,h p ?
l
..r-w.
p.
- - )..... og
@Eo~dR o9 bd.,,-
w
,'.!g,; )....:...--}- ::;-- g-]telt:k: :glye u r
'.6 aic
' ' N bM. l** b
. n ;. w t..'.l.
..u."**1:*:lr';. I;ifh%l.s..# :.. t 6-N J l'hi.7t!}i.$
, ' i y. e.
,,s.
- m. _,,,,,.
,-rs@... M.m...
..s
.s
..Mg.. -".6 e.
l..
- y
.s M
n V
Ae
- h2.....e :. g _.e -
e
^""""'M wyp.
---T-
- ""N-wm-,___.
~
T< c
(
e d
- g S E ALING STEAM l
J, SUPPLYy
'.]
j I
'l G
/
/ Y.
// /// /
/
/
f g
/
/(
/ / / // /// /
U/////
v1/
MOISTURE SEPARATOR REHEATER PRESSURE SAFETY VALVE 9k l305}
i l
L OP lE I
I iG O
.R O.U G A G.
R.
R G R
S D
OM N
WE T
R Oi Of WS WA l
I S W O S P
R D O IO TA N C E i LD N
O I
S' AR D
Q'se s
uha eTP' I
9Iy\\'.
I s
D S R UTM
'Q I
I O P R R
.NI li GA E R E
.s TRL LT p s\\N G
U DA O
S A
}
\\
Gb
{'
\\
t
' 'N L
T T
S.
V-
?
G
.o U RP R
I o
Q[5 g
DR h
l i
T
~
T
/-
N s.
's M
bV
~'N.
U md
/
U
,x k,A
C w
A i
V U
x cN#
i T
s O
I m
1 N
s M
R
\\
h IA
&m
\\.
/
N d ;
hs'.s_
I
/ %
/
h- (% x d
/
N L
//
/
[o
/
\\
\\,
N
[
I
\\
A k
R D
E VL l
H A
S M C V
l UPT
~
UIA P
CRL IR ATE T
V R
-s O
4
e e
\\\\T\\u y
q-a
.I
~ \\\\
\\\\\\
9 N
s i
s s
g-x b
\\
r=
m xamam ANNN1g
- -i IP 1
.n...a.a.-.n,.
a
~
l f
a 1\\ \\
t
,m
.r ms-m s
) --\\
~
g #.n)t k l
e'43' l
.. p v
8 g
y 6%m%k\\ N A
3 emer-l'lI~7%5(d
= m.// =/ _
.l, _ sd_ \\_
//
=Eg
$05
!E!
l M
s w
~
4 1
W
6 VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
.4 Feedwater/ Condensate Systems Instability g
Prior to the reactor trip ~ on October 2,1985, the plant experienced feedwater flow oscillations. They occurred due to fluctuations in steam header pressure when the pegging steam valves came open',' wh'en"t6e """"--- ~
turbine / generator was separated from the grid and when loss of condenser vacuum caused the turbine bypass valves to close.
The feedwater flow
, response was normal for the imposed conditions and automatic / manual settings.
At the initiation of the event, the operators were preparing to take the turbine off line and had placed the turbine in " Operator Auto" to reduce turbine load, while holding reactor power at 15%.
At 01:17, turbine' load was reduced to the point where the pegging steam valves opened causing.a step increase in steam load.
If the turbine was in "ICS Auto " the turbine governor valves would close down to control steam header pressure.
However, in " Operator Auto" the governor valves control generator output and the steam generator / reactor control stations control header pressure.
Thus when the pegging steam valves opened, steam pressure dropped.
Feedwater flow and reactor power increased in response.
During the next six minutes, four feedwater flow oscillations occurred (see Figure 1), before the plant stabilized at approximately 12% power.
During this time the turbine and reactor were put int'o manual.
The magnitude of the oscillaticns caused by the onset of pegging steam was apparently made more severe by an open relief valve on feedwater heater 4A.
Following three minutes of relatively stable conditions, the generator output breakers were opened at 01:26.
This caused a perturbation as the governor valves closed and steam header pressure rose to the turbine bypass valve setpoint.
Two minutes later, the bypass valves closed due l '
r
o-o VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
.4 (Continued) g to the loss of condenser vacuum and header pressure increased again to the atmospheric dump valve setpoint.
The plant quickly stabilized and was holding steady for over two minutes when main feed pump "A" suddenly tripped.
The overall feedwater response was acceptable in that RCS pressure was controlled between 2080 and 2210 psi.
There was, however, a difference in the relative response of loops "A" and "B".
This may be explained by one or the other being on low level limits.
The feedwater valve control circuitry and positioners will be checked during ICS check-out.
The feedwater flow oscillations were a normal response to the steam header pressure fluctuations.
The largest surge was caused by initiation of pegging steam with the turbine in " Operator Auto".
This oscillating flow condition in and of itself did not cause the main feedwater pumps to trip.
VII.
INVESTIGATION OF AREAS OF CONCER;. (Continued)
.5 Loss o'f HPI "A" Flow Indicatico As priscribed by plant operating procedures for pressurizer level decreasing below 100 inches, the operator started the High Pressure Injection (HPI) pump (P-2388), lined up the borated water storage tank and opened loop "A" HPI valve. The loop "A" nozzle is also the path for normal additions necessary to maintain pressdrizer level. Although the above actions increased flow to the reactor coolant system (RCS). the pressurizer level continued to decrease.
The operator opened the remaining three loop HPI valves, allowing HPI flow through all four paths to the RCS. At this point, he observed "zero" flow on the "A" HPI flow indicator. To further augment the HPI supply, he started the third HPI pump and the loop "A" HPI flow increased to about 80 gpm. Subsequent analysis of plant computer data verified this phenomenon and showed a recovery of flow indication in about 30 seconds, coincident with start of the third HPI pump.
The District has performed an exhaustive investigation consisting of system flow testing, non-destructive examination and formal analysis.
This investigation led us to the rcat cause; a shift in the zero point of the flow transmitter.
This shift occurs as the device is calibrated with the system depressurized and then brought to system operating pressure.
In the case of these transmitters, this shift can result in' no flow indication with as much as 75 gpm of actusi flow.
Note that, although this problem creates imprecise indication to the operator, it did not affect the ability of the HPI system to perform its safety function.
Hydraulic calculation showed that, for the period of "zero" flow l
indication, the expected loop "A" HPI flow would be nearly identical to the measured zero shif t.
The nature of the identified error is that the HPI flow transmitters i
(Rosemount Model ll53HB6) have a particular characteristic which affects the zero setting as the process pressure changes.
Per Rosemount literature, this can be as much as
.66% of full range per 1000 psi. l-
VII.
INVESTIGATION OF AREAS OF CONCERN (Continued) 5 (Continued) j Since'the normal procedure is to calibrate at ambient pressure, the maximum error for this application could be 6.6" H O out of 1000" 2
H O range. Although t.he amount of shif t differs for each transmitter, 2the error is repeatable (within the limits of their repeatability specification), and causes a constant dp offset over the range. The net effect then is to introduce a large error at low flows, the flow error diminishing as flow increases as a function of the square root of the error.
1 The High Pressure Injection system is designed as a fully automatic system.
During a Safety Features Actuation, the pump starts, injection valve throttling and makeup and miniflow isolation all occur without operator actions.
Thus, successful mitigation of the accident does not depend on flow indication.
In addition, for the entire range of Small Break LOCAs, that is, any loss of RCS inventory that would result in RCS pressure dropping below 1600 psig, causing automatic initiation of Safety Features. The flow produced by a single HPI pump through each of the four nozzles would be greater than 100 spm..resulting in flow indication that is in the linear range and conservative.
The design criteria for the HPI system is defined as follows:
>1600 psig, in the RCS, balanced flow is not required; i
at 11600 psig, a single HPI pump provides a' nominal 400 gpm, which provides 100 gpm per nozzle meaning that each flowmeter is in its linear range; l
o VII.
INVESTIGATION OF AREAS OF CONCERN (Continued)
.5 (Continued) f a't any pressure SFAS initiation (auto or manual) will balance flows without operator action; at 600 psig, acceptable flow is 100 to 150 gpm in each line, with total flow >450 gpm, but not to exceed 525 gpm from a single pump per SBLOCA analysis.
Thus, low range inaccuracies are of concern only because they may be distracting to the operator during a transient.
Based on the District's analyses, the following action will be performed:
Operators will be informed of the characteristic of the flow indication.
Each of the flow (aP) transmitters has been calibrated such that, with the worst case zero shift, the actual flow will be greater than the indicated flow.
o -
VIII.
CORRECTIVE ACTIONS AND ADDITIONAL RECOMMENDATIONS boirective Actions were tracked on the attached Action List as they were identified.
Additional Recomendations resulting from the investigations detailed in this report are attached.
0 l
I I
s i '
y-
., + - - -
p m
e I
i I
O V
60 -
9
..pa,.
e c
I I
i I
l 61 -
- -, ~. -. - -,
,-,_.y_
-.--.-w___.
y g
h 4
t f
l 0
6 i
j k
l a
l i. _.
r t
e E
1
):
I
{
l f
63 -
a,
4 4.-
s l
E l
) !.
IX.
CONCLUSION T '. event consisted of a reactor trip caused by the loss' of main feedwater.
\\..severityofthetripwascompoundedbylossofcondenservacuum, minimal core decay heat; and excessive steam demand due to open safety valves on'the 4A feedwater heater. An erratic flow indication on one HPI line and failure of "A" Main Feedwater Pump seal water regulator were distractions to the operator in responding to the transient.
The "A" Main Feedwater Pump was tripped by a corroded high discharge pressure switch. 'The "B" Main Feedwater Pump was tripped by operator action.
The loss of condenser vacuum was through the MSR safety valves which did not have the required sealing steam.
Post trip investigations revealed that the isolation valve for sealing steam was not shown on plant drawings or listed in operating procedures.
The AFW System with ICS control responded properly to re-establish reactor
[
ing.
The operators acted swif tly and correctly in response to the actual reactor trip as well as the other equipment malfunctions that occurred simultaneously.
Appropriate procedures were referenced and followed.
Initial concerns of pressurized thermal shock were unfounded; however, a ictigue usage analysis is being performed.
e s
TRANSIENT ASSESSMENT PROGRAM REPORT e
ON i
RANCHO SECO REACTOR TRIP ON MARCH 19,'1984 TAP NUMBER RS-84-02 t
I i
4 Transient Assessment Program 12-1151105-00
\\
- ~.... -.., _. -..
.....,, _ _ ~...., _ _. -. -.,.
~
TRIP REPORT NO. 69 RANCHO SECO NUCLEAR GENERATING STATION NO. 1 REACTOR TRIP OF MARCH 19, 1984 PREPARED BY:
G. R. SIMMONS
--SMUD L. B. PRITCHETT--SMUD D. J. BURDA
--SMUD WM. BOJDUJ
--B&W WM. E. WILSON
--B&W REVISION 1 -- 4/10/84 R. W. WINKS
--B&W
TABLE OF CONTENTS I.
EXECUTIVE SUNIARY A.
' PLANT DATA 1
B.
SUMMARY
OF EVENT 1-2 C.
PERFORMANCE ANOMALIES 2
II.
SEQUENCE OF EVENTS 3-7 III.
PRE-TRIP OPERATION 8
IV.
POST-TRIP PLANT RESPONSE A.
PLANT RESPONSE IMMEDIATELY FOLLOWING REACTOR TRIP 8-9 B.
PLANT RESPONSE DURING LOSS OF NNI X POWER 10 V.
GENERATOR EXCITER EXPLOSION AND FIRE 11-22 VI.
LOSS OF NNI X DC POWER 23-28 VII.
OPERATOR ACTIONS AND OPERATING PROCEDURE ADEQUACY 28-32 VIII.- EERGENCY PLAN RFS.?CNSE 32-35 IX.
SAFETY CONSIDERATIONS 35 X.
RECOPfENDATIONS 36-40
-. a.
I.
EXECUTIVE SlMARY A.
Plant:
Rancho Seco Nuclear Generating Station No. 1 Date:
March 19, 1984
~
Time of Trip: 2151:05 Hours Power Level Prior to Event: 92%
859 MW(E)
B.
Sumary of Event The plant was operating at 92%. The Westinghouse main generator side pump had been off for one hour hydrogen seal oil system H2 due to secondary plant electrical bus problems. Operation at full load is parmitted in this condition. Due to seal oil system problems, high defcaming tank and hydrogen side drain regulator tank levels occurred which required the operators to take manual control of drain regulator tank level.
Hydrogen seal oil pressure, decreased allowing hydrogen to escape from the generator, resulting in an explosion and fire. The turbine / generator was manual.ly tripped and the reactor tripoed on anticipatory trip from the turbine.
The fire was extinguished system.
A turbine bypass by automatic operation of the CO2 valve stuck open on the trip resulting in slight RCS cooling, but was isolated quickly.
Approximately one hour after the reactor trip, a partial loss of NNI power (NNI X 24 VDC) occurred for four minutes. While inves-t.igating low 120 VAC bus "J" voltage, the J inver'ter was turned off which de-eneraized half of the NNI 24 VOC power supplies j
(Figure 15A and B). All NNI 24 VDC should have been maintained l
through an auctioneer circuit from redundant power supplies powered from the 0 120 VAC bus; however, the redundant NNI XI -24 VDC power supply f ailed causing loss of -24 VDC. The power monitor then tripped the input breaker 52 resulting in loss of all NNI X DC power. The J bus and thus NNI X was restored in four minutes.
SFAS was manually initiated by procedure. HPI was then controlled and eventually terminated. During the resultant RCS pressure tran-
~
sient, a primary code safety valve lifted low (at 2360 psig)
-J-
4 and reseated properly. HPI was operated for less than five minutes. An atmospheric dump valve opened due to loss of NNI, but was immediately closed. The momentary partial loss of NNI did not result in a significant RCS pressure or tenperature transient.
l Operator actions were exemplary during the explosion / fire /
plant trip and the partial loss of NNI events. Their prompt and
~
deliberate response assured safety of the plant and personnel.
C.
Performance Anomalies 1.
The hydrogen seal oil system did not maintain proper de-foaming tank and hydrogen drain regulator tank levels when operating with the hydrogen side pump off.
2.
One turbine bypass valve stuck open on the reactor trip and had to be manually isolated.
3.
The NNI X1 -24 VDC power supply blew an output fuse whe'n attempting to pick up NNI loads. This resulted in loss of NNI X 24VOC power.
The exact cause is not known, but it is suspected that the overvoltage trip setpoint on this j
supply drifted low.
l k
--g
.s.
II., SEQUENCE OF EVENTS e
Initial Conditions: 92% power, 859 MW(E), Main Generator Gas Pressure 69 psig, Seal. Oil Backup Regulator from Main Turbine Shaft Driven Pump to Air
, Sid.e Valved out.
Time Event 2030 Gland steam exhauster A trips on overload (2E108).
2044 Gland steam exhauster A reset and restarted.
2050 Gland steam exhauster A trips on ground fault, rer_ches back, and trips entire 2E1 bus (3E14) H2 side seal oil pump stops.
It is powered from 2E1. Gland Steam exhauster A is turned off locally.
~2053 Gland steam exhauster B start is attempted.
It immediately trips on overload.
2100 Attempts to reclose 3E14 fail.
It is nechanically bound.
Electrical forman is called. 2El bus including H2 seal oil pump is de-energized.
~2i10 Equipment Attendant (EA #1) is sent to check seal oil system skid and defcaming tank levels (.found out of sight high) and generator moisture detectors (found dry).
~2120 EA #1 is sent again to check defoaming tank levels (found out of sight high) and generator moisture' detectors (found significant moisture and oil)
~2130 EA #1 instructed to gas generator to 75 psig and gag seal oil drain regulator tank.
Gagging the regulator tank consists of fully opening the reject needle valve and fully closing the makeup needle valve.
Automatic level control is~ defeated. Lower regulating tank ievel should decrease defoaming tank level.
When l
reject was first begun, drain regulator tank was indicating slightly I
. greater than 3/4 full.
(One-half full is' normal.)
Increasing generator gas pressure will speed reject from the regulator tank.
(Note: Time indicated with a ~ are estimates based on operators statements, observed sequence of events and estimated time to carry out some actions i
l
-. 3 -
4 Time Event
~2140 EA #1 obtains help from EA #2. Generator gassing ~(by EA #2) &
regulator tank gagging (by EA #1) began.
~2145 EA #1 has completed gagging the regulator tank valves, briefly monitored the tank level gauge and noted a slight, slow decrease.
I lie left for the nearby EA office to obtain help monitoring the seal oil unit.
~2147 At about this. time, EA #1 leaves to check defoaming tank levels and the EA's #3 & #4 go to the seal oil system skid. The seal 1
oil skid has been unattended for about two minutes.
2148:02 Received generator vapor exti actor high pressure computer alarm.
This could be due to air side seal oil pressure decreasing below generator gas pressure and H2 gas pressurizing the air side, bearing oil drain system. This alarm did not clear until three minutes after the major explosion.
~2148:10 EA #2 gassing the generator notes oil dripping on him from over-head and informs EA's #3 & #4 at the seal oil skid. The oil probably came from air side oil being blown out of the generator exciter end shaft seals from the 73 psig H2 pressure.
2148:36 Received main turbine lube oil vapor extractor high pressure alarm.
This alarm came in and out repeatedly, finally clearing 1-1/2 minutes after the major explosion. This is thought to be due to H pressure in the bearing drain tank blowing out the 2
loop seal and H2 gas traveling to the main lube oil reservoir.
~2148:40 DC air side backup pump autostart noted by EA #3 & #4 locally.
This pump autostarts when the difference between air side and generator H2 pressure reaches 8 psi.
EA #3 & #4 at the seal oil skid note differential pressure gauges go from pegged air-side-high to 5" air-side-high and stay there.
~2149:35 EA's #3 & #4 at the seal oil skid note that drain regulator tank level is low and prepare to ungag the reject and feed valves.
~2149:39 EA #1 checking defoaming tank level on the turbine deck notes a " strange smell" and mist in the generators turbine end (bearing #7) area. Upon exiting, the door is blown back open by a small explosion.
f-
Time Event
~2149:50 EA #1 on the turbine deck calls the control room and reports the small explosion, then goes into control room.
2150 Commencing down power at maximum rate. Transferring site loads.
~2150:15 Major explosion on turbine deck. Automatic actuation of C0 dis-2 charge into Zones 50 and 51, exciter & turning gear ends of generator.
~2151:02 Plant Superintendent and an Auxiliary Operator (AO) enter control room and report exciter on fire.
2151:05 Turbine 15 tripped manually. Reactor immediately trips on low auto stop til anticipatory trip. Trip from 85%. Generator field breaker and OCB's remain closed, as per design, for 45 seconds.
2151:16 B HPI pump is started.
"A" HPI inject valve SFV-23811 is partially opened.
2151:50 OCB 220 and 230 open. Generator trips (45 second delay after manual turbine trip).
2152:20 SFV-23811 is fully opened. Pressurizer level has decreased to 20 t
inches due to overcooling caused by stuck open Turbine Bypass Valve (TBV) on A side.
~2153 Unusual Event. declared.
-2154:51 Stirted A HPI pump and opened BWST suction valve on A side (SFV-25003) to provide additional makeup.
~2155 Called Hr. ald Fire Department.
l1 2157 Stuck ope.n Turbine Bypass Valve (TBV),found and isolated.
2158:07 Tripped C RCP. T,yg ~5204.
t 2158:38 Pressurizer level recovering at 50 inches. RCS pressure increasing.
Secured A HPI pump and closed BWST suction valve.
2200 NRC, s; ate, counties notified of Unusual Event.
-2202:32 Securtd B HPI pump. Pressurizer level at 80 inches. RCS pressure at 2133 psig.
~2204 Operator log entry noted fire to be reported out.
CO Zones 50 and 2
51 continue to discharge for remainder of 36 minute timed discharge.
~2206 Began venting H off generator. Started at 64 psig.
2 j
2210 Herald Fire Department on site.
~2215 Firing small aux bir (E-365).
i l
Time Event 2217:46 Restarted C RCP. This is done to heat up RCS (T,yg = 523*F) and provide extra heat input to the RCS which is supplying all aux steam loads.
2218 Breaker 3E14 replaced with 3E06. Power returned to bus 2El.
H side seal oil pump starts.
2
~2220 small aux bir (E-365) up to pressure.
l1 2221 H in generator reduced to 4 psig.
2 2225 CO tank level checked and found to be empty. Without CO, the 2
2 generator cannot be purged of residual H "
2
~2230 J Inverter trouble annunciator when control power to large aux 51r turned on. Small aux blr trips. Loss of NNI X and NNI Y and Z annunciators received and then clear.
2234 Security instructed to post continuous fire watch on all CO2 zones.
~2240 J Inverter problem investigated. Thought to be tripped since volt-meter pegged low at <90 volts. Was probably operating at reduced voltage.
i 2255:47 Opened all J inverter breakers in accordance with inverter restart procedure. Loss of input power to X2, Y2, Z2 NNI-0C power supplies.
2255:49 NNI XI -24_VDC power supply output fuse blows. Complete loss of NNI X DC power.
2257:33 Trip B main feedwater pump (FW pump) (A FW Pump.already tripped) in accordance with C.45, Complete Loss of NNI Casualty Procedure.
Auxiliary Feedwater (AFW) P-318 and P-319 autostart.
2257:38 '
Manually initiated SFAS Channels lA,1B (HPI, RP isolation, emer-gency diesels).
~2258:20 B OTSG pressure noted low. Found B Atmospheric Dump Valve (ADV) full open demand in auto. Placed control in manual and closed it from control room.
2258:45 B Pressurizer Code Safety PSV-21507 lifts at approximately 2360 psi, blows down 100 psi, and reseats.
~2259:00 Closing HPI inject valves.
~2259:10 B Pressurizer Code Safety lifts again and reseats.
~
2259:39 Operators restart J inverter, operating at 92 volts with all load breakers open.
Closed breakers to ICS NNI X, NNI Y.
All NNI power restored except 24 VOC XI which has input circuit breaker 52 open.
- f-
7 Time Event 2300:08 All control room instrumentation on main consoles and panels now operating. There is a group of instrumentation which is independent of NNI and duplicates the remote shutdown panel, located in the control room. This instrumentation continued to operate throughout transient and was used by the operators.
2300:10 A and B HPI pumps secured.
2302 NRC notified of NNI status.
2304 Unusual Event upgraded to Alert.
2305 State OES notified of Alert Status.
2307:56 Reset trip on B MFW pump.
2312 Alert downgraded to Unusual Event. NRC notified.
2314 Counties notified of Alert and return to Unusual Event in same phone call.
2314:15
. Main FW to OTSG's operational.
2316 State notified of return to Unusual Event.
2321 Secured AFW pumps.
2330 EA sent for status of seal oil system. Finds all three pumps side. Secures running: Air side, DC backup air side and P2 DC and H side pumps. Finds drain regulator tank level slightly 2
above normal.
0040 Partial loss of NNI X 120 VAC.
D Inverter supply to XI (1007) manually tripped while trouble shooting NNI XI. Automatic bus transfer (ABT) did not transfer to J bus due to low J bus voltage. Lost NNI X AC loads.
0045 Reclosed 1007, restored NNI X power.
0100 Full voltage restored to "J" 120 VAC DC bus from "F" bus, 1l 0138 Secured C RCP. Comenced cooldown.
0300 CO truck on site. Counties & state notified.
1l 2
storage tank.
Secured continuous fire 0328 Completed filling CO2 II watches.
0500 Secured Herald Fire Department from on-site standby.
1J 0559 Completed C02 purge of generator.
0600 Secured from Unusual Event.
Starting notifying offsite agencies.
0624 Informed NRC, state, counties: out of Unusual Event.
-q-
8 III. PRE-TRIP OPERATION Rancho Seco was operating at 92% power and generating about 859 MW when MCC 2El became de-energized when its supply breaker froin the 3E l
bus tripped on a ground fault. This supply breaker could not be reclosed. The loss of MCC 2El resulted in a loss of the H side seal 2
oil pump. The loss of this pump resulted in main generator seal oil problems which eventually resu'lted in the escape of H from the 2
1 generator and subsequent explosions. The problems with the seal oil system are detailed in another section of this report.
Following the release of some H, an operator was checking the level 2
of the turbine end defoaming tank. When entering the turning gear area enclosure he noticed a strange smell. He closed the door and a small explosion blew it back open. He imediately exited the area and notified the control room by phone, then went to the control room. A reduction in power was initiated at a maximum rate of 99 MW/ min. Shortly after, a large. explosion occurred at the generator /
exciter. The Shift Supervisor was notified that the exciter was on fire. He immediately tripped the turbine which, in turn, tripped the reactor through the anticipatory trip circuit. Reactor power had
~
been reduced from 92% to 85% prior to the trip.
IV. POST-TRIP PLANT RESPONSE The post-trip response of the plant can be effectively divided into two separate areas: The response imediately following the trip and the response during the partial loss of NNI power which occurred I
approximately one hour after the trip. Figures 5 through 10 display control room strip chart recorder data (throughout this transient).
A.
Plant Response Inunediately Following Reactor Trip
.The plant response following the reactor trip was basically as expected with'the exception that a Turbine Bypass Valve (TBV) on the "A" loop stuck open. The failure of the TBV to reclose resulted in a reduction in the "A" OTSG pressure and a subsequent 4
I l
l 1
- /s -
9 overcooling of the RCS.
(See Figures 1-3.) The control room operators quickly observed the lower-than-normal reduction in T,yg following the trip and correctly diagnosed the cause as an overcooling event. The stuck open TBV was found and manually isolated approximately six minutes after the trip.
The overcooling which was experienced resulted in a corresponding decrease in pressurizer level and RCS pressure.
(See Figure 2A.)
Pressurizer level reached a minimum of about 71 feet above the bottom (this is 15 inches indicated due to location of the level 1
taps). To minimize pressurizer level decrease, the "B" HPI pump, which was lined up to the BWST, was started and run for approxi-mately 11 minutes.
In addition, the "A" HPI pump was run for approximately four minutes with its BWST valve also open. Both pumps were secured when pressurizer level had stabilized at around 100 inches. Primary pressure reached a minimum of 1794 psig and then recovered back to normal post-trip pressure of about 2160 psig.
The overcooling resulted in a T decrease to approximately avg 505'F. When T,yg decreased to 520*F, the "C" RCP was secured as per procedure. Approximately 19 minutes later, this RCP was restarted to aid in RCS heatup (T
= 523*F at this time) as 3yg the RCS heat output was supplyirg all the aux steam loads.
Post-trip OTSG level control exhibited a slight difference be-l tween the two OTSG's.
(See Figure 4.) The "A" OTSG level decreased to about 27 inches on the startup range then controlled there on low level limits throughout the plant recovery. The "B" OTSG level initially dropped to 11 inches on the startup range and then recovered to control at 19 inches on low level limits.
Process Standards setpoint for the low level limit setpoint is 20"+4".
Both OTSG's were therefore being controlled slightly outside this limit. This slight deviation in level setpoint i
had no impact on plant response.
- // -
8.
Plant Response During Loss of N'NI X Power When NNI X DC power was lost, it was diagnosed as a total loss of NNI based on control room indications. Casualty Procedure C.45 " Complete Loss of NNI Power" was then followed. This procedure required, among other things, manual initiation of SFAS Channels lA and 18. This resulted in both the "A" and "8" HPI pumps starting and the HPI inject valves opening.
Due to HPI injection, RCS pressure began to increase. At a pressure of approximately 2360 psig, pressurizer code safety valve PSV-21507 lifted prematurely and blew down RCS-pressure 100 psig and then reseated. Pressure began to increase again and the code safety again lifts then reseats. During the second lifting of the code safety valve, the HPI inject valves are being throttled based on pressure / temperature indications from instru-mentation on a special panel which were unaffected by the loss of NNI X.
RCS pressure and pressurizer level are then restored to normal values as NNI X DC power is restored after 4 minutes.
(See Figure 11.)~
Casualty Procedure C.45 required the tripping of any running MFW pumps. The "B" MFW Pump was tripped which started the AFW pumps. AFW flow was manually controll.ed to prevent an over-cooling of the RCS.
The loss of NNI X caused a "B" loop ADV to receive *a full-open signal. This was observed by the control room operators shortly after the loss of NN! X and the valve controller placed in l
manual and closed. There was no excessive overcooling as a l
result.
(See Figures 12 and 13.)
Upon restoration of NNI X DC power, the SFAS actuated components were secured and the plant stabilized on normal pressurizer level and pressure control. At 0138, a plant cooldown/
cepressurization to cold shutdown conditions was commenced.
l
~ /1 ~
\\
k
11_
V.
GENERATOR EXCITER EXPLOSION AND FIRE The exciter explosion resulted from ign.ition of escaping hydrogen gas from the generator. The gas escaped when seal oil pressure dropped below hydrogen pressure.
It appears low seal oil pressure problems bsgan two minutes prior to the explosion and existed for three minutes following the explosion. The fire following the explosion was fueled mainly by H and entrained oil which was 2
I escaping through the seals.
A.
Seal Oil System Initial Conditions 1.
High pressure turbine lube oil backup regulator had been valved out for several days due to erratic operation.
2.
Pressure switch to autostart air side DC backup pump raised to 8 psi air side to hydrogen gas differential
.due to valving out backup regulator.
3.
The Component Cooling Water (CCW) controller of air side seal oil cooler was not controlling seal oil temperature adequately. The controller Vias isolated and a manual bypass valve was throttled to provide a seal oil temperature of 105'F to the seals. See Figure 16.
B.
Detailed Seouence of Events
~
The 2E1 bus lost power when a gland steam exhauster fan ground faulted and tripped the 480 volt breaker supplying the bus.
Efforts to reset this breaker failed. Among the equipment lost was the hydrogen side seal oil puno. Our procedures and the Westinghouse Tech Manual allow full load operation with this pump shut down. Hydrogen side seal oil is supplied by the air side pump. The oil that flows to the hydrogen seals ends up in the drain regulator tank and is rejected to the suction of the air side pump.
(See Figure 14.)
The swing shift-logs were taken before the hydrogen side pumo stopped. At this time, the defcaming tank levels were normal.
~/3-
Shortly after the pump stopped, seal oil pressures were as expected for the hydrogen side out: Differential pressures (air to hydrogen side) were pegged toward the air side and air side discharge pressure was 14 psi greater than H2 gas pressure. EA #1 was sent to assess the condition of the seal oil system. He found defoaming
- tank levels.out of sight high and no moisture in the generator moisture detector level switches.
Later, he checked again and found levels still out of sight high and I
a significant amount of oil drained from the moisture detectors. The regulator drain tank level indicator was found just above 3/4 full.
A full tank would be indicated by just below " full" if the float is not affected by flow in the tank. One-half full is normal.
The operator reported these facts to the control room and was in-structed to gag the drain tank and gas the generator. Gagging the drain tank consists of full closing the makeup valve and fully opening the reject valve. Gassing the generator increases the pressure in the drain regulator tank and speeds the reject rate.
Approximately two minutes before the exciter explosion, another operator (EA #2) gassing the generator (now 'at about 74 psig) reported oil dripping from underneath the exciter to two operators heading toward the seal oil skid. About the same time, the control room began receiving generator bearing oil tank vapor extractor high pressure alarms. Excessive H2 gas appears to'have been getting into the bearing oil tank through either the bearing oil drain from gas escaping the seals or the reject-line from the-drain regulator tank which would have no oil in it.
In either case, this is confirma-tion that the seal pressure was low allowing oil and hydrogen to be blown out of both ends of the generator shaft.
At this point, and at other times, there should have been local H2 comon alarm panel alarms; however, none were received until the major explosion. This alarm panel appears to have been malfunctioning.
(
-i/-
4
After operating the gags on the drain regulator tank, EA'#1 ob-served tank level momentarily, noted a slight decrease, then left for about a minute to obtain the assistance of two other operators, EA #3 and #4. As the two operators approached the seal oil skid, they heard the DC backup pump start and observed the air side to hydrogen side differeni!ial pressure decrease to 5" air side high.
Since hydrogen side would be at machine pressures, this indi-cates air side pressure was only 5" above H2 pressure, but 3 psi is required to maintain an oil seal if the hydrogen side pump is not running. About the same time, the control room received com-puter alarms on main turbine lube oil reservoir vapor extractor high pressure. Evidently, the loop seal between the bearing oil tank had been blown or percolated and hydrogen gas had traveled to the main reservoir. Large amounts of hydrogen gas must have been escaping at this time, enough to overwhelm the smaller bearing drain tank vapor extracr.or and pressurize the bearing oil tank, blowing the loop seal. The operators at the skid, EA #3 and #4, observed drain regulator tank level in'dicator just slightly above " LOW" and prepared to ungag the reject and feed valves. Before they accomplished this action,,the major explosion occurred. They left the tank valves gagged as is.
While the operators at the skid were ob' serving the DC pump start, EA #1 was observing defoaming tank levels. The exciter end was out of sight high. While investigating the turbine end defoam-ing tank level inside the turning gear area enclosure, the opera-tor noted a strange smell and a " heavy" atmosphere. He closed the enclosure door and a small explosion blew it back open. He immediately called the control room, then went to the control room. Twenty seconds later the major explosion occurred.
1he explosion ignited the oil that had been forced out of the seals on both ends of the generator. According to witnesses, the fire was fueled by the oil rather than by hydrogen gas. Much of the damage done by the explosion and
- /S~~
-14a-did not clear until 3 minutes after the explosion. During this time, it is postulated the seals tried to re-establish themselves and puffs of H2 gas escaped.
It appears that 3 minutes after the explosion, the seals were re-established.
Generator pressure remained at 64 psig (it started at ~73 psig) until it was manually vented off reaching 4.psig 40 minutes later.
Approximately an hour and a half after the explosion, an opera-tor checked the seal oil system. He found all 3 pumps running:
side (2El was restored half an Air side, DC backup, and H2 hour after the explosion and since the H side pump was never 2
turned off, it started when the bus was re-energized). He checked drain regulator tank level and found it slightly above normal. Reject valve was still :agged fully open and feed valve was still gagged fully closed.
C.
Discussion of Failure Modes There are numerous ways the seal oil system can fail to supply the seals with adequate pressure. Two of the most probable causes are:
Loss of oil to the air side pump suction and failure of the air side main regulating valve.
1.
Loss of Suction to Air side Pamp The most probable way to lose suction to the pump is dis-placement of oil with hydrogen gas. There are two possible sources of H2 gas: The generator bearing drain lines and the drain regulator tank reject line. Both of these sources flow to the bearing drain tank and. loop seal. The vapor extractor alarms on this tank confirm hydrogen was getting into the tank.
-/ 4 -
,r,-,
~m
,,_,-,s
---m
14
- f. ire was superficial. Some exciter and generator bearing instrumentation must be replaced. Generator housing lower skirting was thrown into Reheaters C and D extraction steam coil drain tanks. Two large handwheels were. broken along with some small test valves and level instruments.
Following the large explosion, the fire burned with a yellow flame for an estimated five to eight minutes and smoldered for a few more minutes.
It was reported to be out 14 minutes after the explosion. The fire was concentrated in the area of the exciter to generator housing interface on the outside of the housings. The fire probably went out shortly after H ceased 2
escaping from the generator. All exciter doors were blown open or off, CO was observed emanating from all door openings, 2
no fire was noted inside the exciter or on the turning gear end of the generator. An operator noted a small fire on scaffold-ing at the exciter end below the H seal area which he extinguished 2
with a portable CO extinguisher.
2 The fire appears to have been fueled mainly by H with a small 2
amount of entrained seal oil which is ejected as a mist with the H when seal oil pressure falls below H2 pressure. Post fire 2
examination indicated that there was little oil burned since there were not heavy carbon deposits which would be expected if oil was the primary fuel. Examination of the scaffolding planking also did not show evidence of that significant oil had burned there.. Fire damage was limited to overheated gaskets, burned and blistered paint and local instrumentation wiring damage. There was no fire damage to the generator or exciter.
l The main turbine lube oil vapor extractor high pressure alarm cleared approximately 1 minute after the explosion. At the same time, hydrogen gas was probably escaping the seals and helping to fuel the fire.
The bearing oil drain vapor' extractors
-/7-
For the bearing drain line to be the source of H, the air 2
side seals would have had to have been leaking badly.
This is possible only 'if a problem occurred to the air side pump discharge pressure in the first place and is not seen as an initiating condition.
4 For the drain regulator tank reject line to be the soc.ce of H, the tank must be empty. The following scenario 2
is assumed and explains all observed conditions except the systems oil levels noted about an hour after the l1 explosion.
It is postulated that the reject float valve was janned partially open by a foreign object.
(This is possible since, upon disassembly, although operating freely, damage to the valve seat and disc indicated that something hard had been janined in the valve at one time.)
Another possibility is that the gag that closes the reject valve.could have been partially operated which would allow only partial opening of the valve. flormal operation would side pump running, there is usually occur, since with the H2
~
some small reject flow. Loss of the H side pump caused H2 2
seals to receive oil from the air side.
Since the H side 2
pump was no longer taking a suction on the drain regulator tank, all H side oil must be rejected through the reject 2
float valve to the air side.
If' the reject valve were stuck or its full opening restricted, increased reject would not occur and the H side would fill resulting in high drain 2
regulator tank level, out of sight high defoaming tank level l1 and oil spill over into the generator, all of which were observed. Over 150 gallons of oil were removed from the generator.
(The drain regulator tank was indicated just over 3/4 full; however, fluid movement in a full tank could cause movement of the rotary float indicator. Less than 45' rotation and 1/2 inch vertical float displacement would be required for the indicator to show just over 3/4 I
whenthedankisinfactfull.)
i
-//-
16-In an effort to decrease defcaming tank and drain regulator tank levels, the operators operated the hand jacks to open the reject and close the supply float valves. Again, it is postulated that operating the jacks freed the reject valve. This is supported by the fact t, hat the hand jacks will not open t.he reject valve any further than will the float and thus will have no effect unless the floats are stuck or one of the hand jacks was initially mispositioned.
Level decrease was, in fact, noted so apparently the jack affected the valve.
The operators also gassed the generator in order to raise its pressure.
This pressure is also felt by the drain regulator tank and will speed the reject. The operator (EA #1) at the seal oil skid watched the level briefly, then went to obtain help in watching the seal oil unit while he checked defcaming tan,k levels. Before he left, he saw the level gauge decrease slightly. This may have been induced by the increased flow through the tank.
If the H side was 2
sol,id oil to the defcaming tanks, the regulating tank would
^
not see a level decrease for a long period of time, then would quickly empty as the oil level dropped below the top of the tank. As it emptied, alternate slugs of H 2 gas and oil would travel out the reject line. At first,
.the H2 gas would rise to the bearing oil drain tank and oil would sink to the air side pumps suction.
This would give the bearing oil tank vapor extractor computer alarms which were obstrved.
-/9'-
l 3 -
As more oil drained out of the regulator drain tank, H2 pressure woul.d tend to pressurize the refect line, air side suction line, and bearing oil tank.
It would blow out the bearing oil tanks loop seal and cause high pressure in the main turbine 1,ube oil reservoir which would cause the main lube oil tank vapor extractor computer alarms which were observed.
Slugs of H and oil reaching the suction of the air side 2
pump would cause the discharge pressure of the pump to drop and seal pressure would be lost momentarily. The hydrogen gas would force itself as well as seal oil out the hydrogen and air side seals. The operator gassing the generator noted the oil dripping from the exciter end.
In a few more seconds, the discharge of the air side pump becomes low enough for a long enough period that the DC oil pump autostarts.
It would remove the last bit of' available oil out of its suction line and also gas bind.
As the operators observed, the AP between air side and H2 gas would decrease markedly. Large volumes of H2 gas would now escape the generator and ignite.
Just prior to the explosion, EA's #3 and #4 at the seal oil skid observed the drain regulator tank between low and a quarter full. When the system was drained down follow-ing shutdown, it was found that slightly above the low mark on the gauge is indeed empty.
If a low level was in the tank, the low level alarm and attendant air horn alarm should have come in on the H2 panel. No alarm was i
l l
-ao-1
(
I
~
' side seal oil received for this condition, loss of H2 pump earlier, or high defoaming tank levels. The first time the operators recall hearing the alarm was coincident with the major explosion. It is concluded the H alarm 2
panel was inoperative.
Within 3 minutes following the explosion, the' seal oil system appeared to have recovered. The computer vapor extractor alarms cleared and generator H2 pressure was stable at 64 psig. The rapid return of the seal oil system is not completely understood or explainable under this scenario. The reduction in generator hydrogen pressure would decrease the rejection rate from the drain regulator tank. Perhaps this was enough of a reduction so supply from the defoaming tanks slightly exceeded the reject.
Generator bearing oil would replenish the loop seal and along with oil from the drain regulator tank, would refill the suction line of the air side pumps once again.
As hydrogen pressure is vented off the generator, the flow-rate out of the reject line would decrease. The H side 2
pump started about 30 minutes after the explosion. When the operator investigated an hour later, the drain regulator tank level was just about normal. Perhaps, by chance, the air side flow, reject rate, time of genera' tor pressure reduction and time of H side pump restart worked out so 2
the tank was about half full when generator pressure approached zero. If the tank was at normal levels at this point, it would stay at that level because of the closed-system side nature of the H side seal oil system once the H2 2
pump is restarted.
- ?/ -
. 2.
Failure of Air Side Main Regulating Valve This valve controls the amount of oil recirculated from the two air side pumps back to the suction of the pumps.
The flow it permits is based on the differential pressure between air side pump discharge pressure and generator hydr' ogen gas pressure. It maintains the discharge of the pump 12 psi above gas pressure.
side pump It is first conjectured that, subsequent to H2 loss, this regulator fails in the closed position. This would increase air side pump discharge pressure so that excessive oil flow was being injected into the seals.
This would result in high defcaming tank. levels if the 5" drainline and difference in height between defoaming tanks and receiver tank is insufficient to handle all the seal flow. Eventually, the high defcaming tank level spills into the generator. The.high pressure squirts oil out the air side seals into the exciter and turning gear area, although this is improoable since the bearing oil drain should retain this oil. The excess oil in the defoaming tank also leads to the high drain regulator tank level observed.
The regulator having seen it is controlling at,too high a AP opens up and greatly overshoots. Air side pump dis-charge pressure falls and the DC backup pump autostarts.
The controller continues to open until air side pressure is equalized with gas pressure and hydrogen and oil are shot out of the seals. This vents a small amount of H2 out and generator gas pressure decreases incrementally.
Now the oil pressure is sufficiently high to reflood the seal. These H2 puffs start 2 minutes before the major explosion. Some of the gas travels down the generator bear-ing drain line to the bearing oil tank vapor extractor
-?.2-o
. and brings in the high suction pressure alarm on the vapor extractor. The controller continues to oscillate allowing more puffs out of the seals. One large puff pressurizes '
the bearing oil tank sufficiently to blow out the loop seal. The regulator now fails ope'n further and allows
,large volumes of hydrogen to escape. The main turbine lube oil reservoir vapor extractor goes into high suction pressure alarm. Hydrogen builds up to sufficient concentra-tions to the exciter area and ignites.
The explosion shocks the regulator and it now begins to close down. The seals again alternate between oil solid and blowing small puffs of hydrogen. A minute or so after the explosion enough bearing oil has returned to the bearing oil tank to refill the loop seal and the ' main vapor extractor alarm clears. Three minutes after the explosion, the reguia-tor has closed sufficiently to stop all hydrogen puffs from the seals and the bearing oil vapor extractor alarm clears.
The regulator returns to controlling the air side 12 psi above gas pressure.
This scenario does not include draining the drain regulator tank dry even though the reject was gagged full open.
There is some question as to whether this tank was empty or just low just prior to the explosion.
D.
Conclusion Both scenarios have deficiencies. Draining the regulator tank dry can explain mcst of the events prior to the ex-plosion easily with the exception of the high defoaming tank levels which were reported seconds before the explo-sion.
If the regulator drain tank was blown dry, the defoaming tank levels should have gravity drained to the receiver tank.
It is conjectured that the defoaming tanks
,73 -
c
. levels were actually out of sight low in the bulls eyes but the operator mistakenly thought the levels were out of sight high. Several experienced operators stated that it is very difficult to tell if the bulls eyes are full or empty if there is not a visible level. It is noted that with t.he system shut down, the oil. level is several inches below the bulls eye. An alternate explanation is that it may be possible for the drain regulator tank to blow down faster than the defoaming tank can gravity drain to the receiver tank.
This scenario also does not adequately explain how the seal oil system " healed itself" with the regulator drain tank in full reject with 64 psig of gas pressure behind it.
The tank should have ce tinued to blow dry until generator hydrog:n pressure had been reduced some fifteen minutes later.
In the second scenario, failure of the pressure regulator first high, then low, then return back to normal, seems unlikely.
It would be more believable if it failed just one way, but this will not support the events as witnessed.
The significance of having the turbine oil backup regula-tor valved out depends on which scenario is assumed.
Assuming failure of the main regulator, the backup regulator may have prevented hydrogen leakage if it were able to respond fast enough to the swings in the main regulator.
Assuming a stuck reject valve, the backup regulator action would have probably put more oil into the generator but from entering the probably would not have prevented H2 air side pumps and main lube oil tank. The ability of
(
~ 2 f-~
a
. the regulator to react fast enough to maintain seal, oil j
pressure with gas binding of the air side pumps is un-I known. _In either scenario, it is possible that the backup regulator could have prevented the large hydrogen leak, although its main purpose is to supply oil in a steady state fashion upon total failure of the air side pumps which is not what occurred. Operation with the backup regulator valved out should be minimized but it does not seem warranted to require unit shutdown or changes to operat-ing procedures.
l B
f I
l
.7[-
VI. LOSS OF NNI X DC POWER Shortly after the reactor trip, two Equipment Attendants (EA) pre-ceeded to the auxiliary boilers to fire them as is usual following a trip. The auxiliary boilers'are needed to supply steam for the auxiliary steam loads. The small boiler E-365 was successfully fired. While attempting to fire the big boiler E-350 at approxi-mately 2230, the control power for the big boiTer was turned on locally. At that same instant the small boiler tripped off. Several attempts were made over the next half hour to restart either boiler, but were unsuccessful. The EA's on the boilers remarked that the Bailey controls on the boiler control panel behaved erratically during this time. At approximately 2257, all control power to the boilers was lost.'
At approximately the same time as the small boiler tripped, the control room received several annunciators: "NNI or Fan X Pwr Failure", and "NN! or Fan Y Pwr Failure" on panel H2PSA and "Non-Vital Power Bus lE/lF/lJ Trouble" on panel H2ES. The NNI alarms quickly cleared, but the non-vital power trouble annunciator remained in' alarm. The NNI system in the computer room was evaluated for prcper operation and found to be operating normally. Operators were sent to the West 480V Switchgear room to evaluate the condition of 120 VAC buses lE,1F and 10.
No problems were found on the lE or IF buses, however the 'J' inverter l
was found in what appeared to be a deenergized state. All input and output breakers were found closed, however both the inverter output and bus voltmeters located on the inverter panel were found pegged low.
(These voltmeters indicate 90-130 volts.) Based on these voltmeter indications, the operators reported back to the control room and told the Shift Supervisor that the 'J' inverter was deenergized. They were instructed to return to the
'J' inverter with the operating procedure for inverter startup (OP A.62, Section 4.4) and attempt to reenergize the
'J' inverter.
The initial conditions fo'r inverter startup require all load breakers and inverter input /cutput breakers to be opened. The operators at
~ yl -
c
24 the
'J' inverter opened all the breakers and attempted a restart of i
the inverter. On the first attempt, the,0C input breaker would not close. During the second attempt, the control room notified the operators at the
'J' inverter that~a loss of NNI power had occurred.
.The 'J' inverter was successfully restarted on the second attempt, but output and bus voltage only increased to =92 volts. The load-breake s to NNI X, NNI Y and NNI ICS were reclosed. When the load breaker to the auxiliary boiler control panel was reclosed, the bus voltage again pegged low.. This load breaker was imediately re-opened and bus voltage returned to 92 volts. The decision was made not to attempt to close any other load breakers on the inverter for fear of losing the inverter.
The control room indications a.1d response for the partial loss of NNI were as follows. Shortly after the plant operators left the control room to restart the 'J' inverter, the control room received the following annunciators: "NNI or Fan X Pwr Failure" and "NNI or Fan Y Pwr Failure." The Shift Supervisor and Control Room Operator both noticed numerous meter indications had failed to midscale. The Shift Supervisor also quickly viewed the red " Power On" lights located on the top of the NNI cabinets in the computer room and from his vantage point observed that all the lights appeared off. Based on these indica-l tions, Casualty Procedure C.45 " Complete Loss of NNI Power" was implemented and SFAS Channels lA and 1B were manually initiated.
Approximately four minutes after the loss of NNI X DC power, it was Vestored and thE pla'nt was stabilized. Plant response during
~ -
this loss of NNI is detailed in another section of this report.
The following is a discussion of the most probable cause of the partial loss of NNI power. Following the restoration of NNI power and plant
.? ? -
j
. stabilization, the 'J'-120 VAC bus was transferred to its alternate supply which is the 'F' 120 VAC bus. This restored 120 VAC to the
'J' bus.. An electrical technician then investigated the cause of the low voltage condition on the 'J' inverter output and found one of two main bridge fuses blown. Subsequent checkout of the inverter also turned up two bad SCR's and one bad diode.' These failed com-ponents resulted in the inverter output voltage to drop to a value less than 90 volts which was the lowest the inverter voltmeter would indicate. The
'J' inserter in the past has blown fuses during routine testing. It is strongly felt that the components on the
'J' inverter failed when the control power for the big boiler was energized which increased the loading on the inverter. At this same time there existed several grounds on the 'E' 125 VDC bus as a result of the H2 explosion and fire. The 'E' 125 VDC bus supplies the 'J'. inverter.
The combination of erratic input DC voltage to the inverter and in-creased loading is felt to have caused the component failures. The
'J' inverter has subsequently been repaired and tested satisfactorily.
Following the failure of components in the
'J' inverter, it still continued to produce an output voltage--only degraded to some value less than 90 volts. This is based on the facts that the auxiliary boilers still had control power, although erratic, and the NNI control room alarms cleared. If the
'J' inverter was deenergized as was suspected, based on voltmeter readings, the NNI control room annunci-ators would not have cleared as the NNI power supplies fed by the
'J' inverter would be dead. (See figures 15A and 8~.)
When the operators attempted to restart the
'J' inverter, they opened all the load breakers which deenergized the
'J' bus supplies to NNI X, NNI Y and Z, ICS and the auxiliary boilers. When this occurred, the
' 0$
. control room received the NNI Pow'er Failure alarms. It is important to note that the
'J' bus is the alternate supply to NNI with the 'D' inverter as the main power supply. When the 'J' bus breakers to NNI were opened, the 224 VDC NNI power supplies fed from the 'D' inverter had to pick up the load that was being carried by the 224 VDC power supplies fed from the
'J' inverter. When this occurred,'it is very probable the overvoltage protection circuit on the X1 -24 VDC power supply actuated which caused the output fuse on this power supply to blow.
This caused a total loss of -24 VDC in NNI X.
A power monitor which 24 VDC bus voltage, actuated on low bus voltage (<22 Volts) senses to shunt trip the input breaker (52) to the X1 power supply from the
'D' inverter. This action resulted in a total loss of NNI X power until the
'J' inverter was restored which then reenergized the X2 power supplies and restored NNI X power. This loss of NNI X power lasted approximately four minutes based on alarm typer printouts and strip chart recordings. The power monitor would normally have also shunt tripped the 51 breaker on low -24 VOC bus voltage but the shunt trip power is supplied by the respective inverter and'i'i this case the
'J' inverter load breakers were open. Thus, the Si t'reaker had no shunt trip power.
NNI Y and Z power was never lost throughout this transient. For that to have occurred, the 'D' inverter would have had to have beU de-j energized at the same time the
'J' inverter was off..A thorough review of the alarm typer printout revealed that no alarms were received that would be indicative of a 'D' inverter failure such as RPS bistable trips and/or RPS Power Supply trouble. In addition, no breakers were f
found open on the 'D' inverter, or NNI Y cabinets.
It is therefore concluded that the 'D' inverter operated normally throughout this I
entire event.
l
-d 9 -
-27 The cause of the failure of the output fuse in the X1 -24 VDC power supply is concluded to be the actuation ~of the over-voltage protection
" crowbar" circuit. This crowbar circuit will short out the.DC output of the power supply and thus blow the fuse on a high output voltage to protect the power supply and duwnstream components. This conclusion is based on the subsequent testing and repair of the X1 power supply.
Following the loss and recovery of NNI X power, an I&C Technician on site replaced the blown output fuse and reenergized the -24 VDC X1 power supply. The fuse promptly blew again. A temporary 120 VAC power supply from a lighting bus was then connected to NNI X to allow removal of the X1 power supply for testing in the.I&C shop. When connecting the temporary supply, the 'D' inverter load breaker (1007) to NNI X had to be opened. This caused a loss of NNI X power for approximately five minutes. This occurred due to the fact that the
'J' inverter output was only 92 volts and thus the ABT was interlocked out of transferring from the 'D' bus to the
'J' bus. Breaker 1D07 was reclosed. No plant transient resulted from this.
The testing of the X1 power supply proceeded as follows. An integrated circuit (IC) w'lich is used to measure output voltage for the crowbar circuit was suspected of possibly failing. The identical IC from the +24 VDC power supply was removed and placed in the -24 VDC power supply. The -24 VDC power supply _was then able to be reenergized and loaded. This led the I&C Tech. to believe the problem was in the orig-inal -24 VDC IC. A new IC was obtained from the warehouse and placed in the -24 VDC power supply. When the -24 VDC power supply was re-energized, the output fuse blew again. The I&C Tech. then adjusted the over-voltage setpoint and reenergized the -24 VDC power supp1y and l
the fuse did not blow and the power supply worked fine. No "as-found" readings of the over-voltage setpoint were obtained then. The X1 power supply was then replaced in the NNI X cabinet.
Subsequent testing has-been unable to definitely ascertain why the over-voltage setpoint crowbar circuit actuated on the night of the trip. Several tests were run where different -24 VDC power supplies
-c7o -
~
were de-energized while recording the output voltage of the'other auctioneered -24 VDC supply. No change in output voltage was noted.
The "As-Found" overvoltage protection setpoints of all the other power supplies were obtained several days after the transient and were found to have drifted as much as 2.3 volts closer to the normal operating voltage. The overvoltage protection setpoint testing also found that two of the eight supplies would not trip at the highest voltage attainable with the power supply. It was shown that the overvoltage setpoints have drifted over' time (there is no recalibra-tion schedule for them at the present time) and it is felt that the
$ VDC s'etpoint may have drifted down to a value just above the X
running voltage of the power supply and thus any small ripple on its outp't voltage could have actuated the crowbar circiut. There u
is no way now of knowing for certain.
VII.. OPERATOR ACTIONS AND OPERATING PROCEDURE ADEQUACY At 2050 on 3-19-84, the gland st'eam condenser exhauster ACB-2E108 tripped on overload. This tripped 3E14 the supply breaker to MCC2El on a ground fault. The fault was cleared, but the supply breaker would not reclose due to mechanical binding caused by dirt and other contaminants.
(The MCC alarm also annunciated.)
This led the operators into Casualty Procedure C.32 " Loss of 480 volt MCC2El" which identified the loads on the MCC and operator j
response to the loss of certain equipment. When the operators I
followed this procedure step by step, they discovered the H2 side seal oil pump P-832 (ACB-2E133) was affected.
Although C.32 states no immediate response for the loss of this load, the operators initiated C.7 " Generator Seal Oil System Failure." (Loss of the H2 side seal oil pump should also activate a local alarm; however, it was inoperative.) Casualty Procedure C.7 identifies several conditions that can cause the loss of shaft sealing ability and necessary actions to regain shaft sealing.
The operators must determine by local inspection the condition of the seal oil system. When this was done, the defoaming tank
-3/-
29 level and hydrogen side drain regulator tank level were reported to be high (Steps 2.1.1 and 2.1.4).
As per prececure, the H2 side drain regulator tank was gagged which consists of manually closing the makeup valve and opening the reject valve. Lowering the regulator tank level'should decrease the defcaming tank level.
At approximately the same time, the main generator was being gassed
~
per operating procedure A.42 " Generator Hydrogen System" Section 5.0 " Normal Operations." Increasing generator gas pressure will regulator tank. At approximately 2149, speed reject from the H2 regulator tank level the operators visually observed that the H2 returned to a low level and they prepared to ungag the reject and feed valres in accordance with C.7 Section 2.1.4.5, while another operator was checking the defcaming tank level on the turbine deck. The turning gear enclosure door was blown back open by a small explosion which was quickly reported to the control room. Control room operators comenced down power maneuvering at a maximum rate of 99 MW/ min. per Operating Procedure OP 8.3 Section 6.0, " Power Decrease."' At approximately 2151, a major explosion occurred on the turbine deck and the exciter was reported on fire. The fire pre-plans were activated and the fire brigade was dispatched per Tab 17 of the Emergency Plan. The reactor / turbine was imediately tripped which initiated Emergency Procedure 0.2
" Reactor / Turbine Trip." All steps were followed.
Pressurizer level was difficult to maintain due to a stuck open turbine bypass valve (Step 6.5.4).
Step 6.6 states if all relief valves are not properly seated, proceed to Emergency Procedure 0.13,." Steam Line/ Feed Line Rupture," which provides the actions to be taken in the event of a steam line/ feed line rupture to place the plant in a stable condition. The imediate operator actions were performed. Step 5.3 instructs the operators to close the affected turbine bypass valve and verify unaffected steam header pressure is controlled by its bypass valves. The affected bypass valve was discovered and isolated within
- g -.
approximately 6 minutes following the reactor trip. This over-cooling caused a low RCS T,yg, of approximately 518'F; therefore, the "C" RCP was secured.at 2157 per Operating Procedure B.4, " Plant Shutdown and Cooldown" Section 3.11 and Operating Procedure A.2, Section 6.0, "RCP Shutdown." At approximately 2206, operations from the main generator per Procedure A.42, j
began venting H2
" Generator, Hydrogen System." The "C" RCP was res-tarted per A.2, Section 4.0, " Reactor Coolant Pump Startup" to provide extra heat input to the RCS which was supplying all auxiliary steam loads.
At approximately 2256, " Loss of NNI-X, NNI-Y and NNI-Z" annun-ciators were received in the control room and the operators observed numerous control room indications were midscale. This initiated C.45, " Complete Loss of NNI Power." At this time, RCS pressure was.2155 psig, RCS T was 528'F, and steam header pressure was avg 800 psig. Operators quickly followed the response actions. The reactor / turbine was already tripped, all pressurizer heaters were turned off, the running main feed pump was tripped, auxiliary FWP's auto start was verified, TBV's and ADV's were manually closed, the pressurizer spray block valve was manually closed, SFAS Channels lA and B were manually initiated, the auxiliary feedwater (AFW)
Bailey control valves were manually closed and the AFW SFAS control valves were used to manually control OTSG feed rate. The operators were in the process of placing parameters not affected by the loss of NNI on the computer trend recorders when NNI X OC power was re-gained several minutes later. The A and B HPI pumps were secured
~
and letdown reestablished per A.15, " Makeup, Purification and Let-down System," Section 4.2, within minutes after regaining NNI X DC power. At 2321, the "B" main feed pump was restarted per A.50, " Main Feedwater Pump System," Section 4.3, and both auxiliary feed pumps were secured per A.51, " Auxiliary Feedwater System," Section 7.3.
-- y -.
G
At 0130, RCS cooldown was begun per B.4, " Plant Shutdown and Cooldown." Cold shutdown was achieved at 1830 on 3-20-84.
It is noted that SFAS Channels 2A and 2B were not manually initiated as required by Casualty Procedure C.45, " Complete Loss of NNI Power." The operators indicated that it.was an overcight and not a deliberate decision to not initiate these channels. The casualty procedure was taken out and read aloud; however, the step which manually initiates SFAS Channels'1A/lB and 2A/2B was either not read completely or not totally heard. Only Channels lA/lB were manually initiated.
The omission of 2A/28 manual initiation did not reduce the degree of safety of plant operation. These channels initiate low pressure injection (LPI) and Auxiliary Feedwater (AFW). LPI is not necessary for this event, being designed for large break LOCA's. AFW is needed for OTSG heat removal and is the. reason for initiating 2A/2B; however, a prior step causes the AFW pumps to auto start independent of 2A/2B and that step also requires verification of pump start which was done.
Initiation of 2A/2B fully opens the two AFW motor operated OTSG feed valves.resulting in maximum AFW flow to both OTSG's.
If these are not manually throttled soon after 2A/2B initiation, an RCS overcool-ing will result. The operators are well trained in this and, upon any SFAS initiation, they rapidly manually control these valves to obtain the desired RCS heat removal rate. In this incident, the control room operators imediately proceeded to these valve controls. The valves were found shut (2A/2B had not been initiated) but were manually operated to control OTSG level in accordance with other steps in the same casualty procedure. It is a credit ta the operators that, in spite of missing a specific part of one step of one procedure, they were fully aware of the intent of the procedure; that is to provide adequate and controlled core cooling, and they rapidly and smoothly achieved that goal.
k
,5W -
\\
The procedures used for this event were reviewed and were found to be prcper for safely controlling the reactor and the plant.
VIII. 04ERGENCY PLAN RESPONSE A.
Description The Emergency Plan was implemented at 2153 on March 19, 1984 The initiating event was an H explosion followed by a fire in 2
the generator exciter. An Unusual Event was declared per AP.501,
" Recognition and Classification of Emergency" based on Tab 17
" Fire," Tab 20 "Onsite Hazards" (ob:crvation of explosion) and Tab 22 " Loss of Safety or Fire Protection Equipment"'(loss of CO tank level which occurred about 30 minutes later).
Immediately 2
following the declaration of an Unusual Event, Precedures AP.502
" Notification of Unusual Event," AP.506 " Notification / Communication,"
and AP.520 " Fire" were also implemented. At approximately 2302, an Alert was declared due to a partial loss of NNI power based on Tab 13 " Loss of Instrumentation" of AP.501 and AP.503 " Alert" was initiated. The Alert was downgraded to an Unusual Event at 2312 when it was determined that NNI power was restored. All calls to the required government agencies were made within the 15 minute time limit.
jf-
The county and state agencies experienced no problems in notifying their appropriate personnel. San Joaquin County personnel. stated tha,t there was only five minutes from the Rancho Seco call to the county to when the County Comunications Officer was notified at his home. Since the Alert was downgraded within minutes of declara-tion, there.were no deployments of emergency teams; however, all appropriate personnel were notified. The California Office of Emergency Services noted that their ECCS alarm actuated when SFAS
^
was manually initiated. Upon actuation, the individual on duty contacted the control room to confirm the alarm as per procedure.
He was informed that the alarm was valid.
In addition, the control l1 room comunicator also contacted the OES following the SFAS actuation.
The Herald Fire Department was on site within 15 minutes of request with seven fire / emergency vehicles. Two Sacramento Hazardous Materials trucks were on site about one hour later at the request of the Herald Fire Department. The Galt Fire Department was also on site as part of a courtesy agreement with Herald.
The Rancho Seco Security Special Agent and Supervising Special Agent were notified and on site about 40 minutes after the initial explosion. They notified the Sacramento County Sheriffs Office as per procedure. The Sheriffs Department responded promptly.
California Highway Patrol and Sacramento County Sheriffs helicopters also responded. They were in the area at the time due to separate events.
The' state and' county agencies were notified five separate times during the events, and the NRC was notified at least four times.
The state and county emergency offices were contacted the next day and asked for their coments concerning comunications.
-86"
B.
Discussion Some problems with our Emergency Plan were noted. Attach, ment 7.E of Ap.506 has not been updated t'o include SMUD's present Public Information (FI) representative. Alternative PI repre-sentatives are listed, but their telephone numbers are not listed in the control roan nor with the site switchboard operator as the attachment states. The control room shift connunicator requested their phone numbers from the downtown SMUD operator who refused the request. The operator rang their numbers, but got only busy signals. The District Systems Dispatcher was not contacted for this information.
The two-digit phone number for Amador County Office of Emergency Services was inoperable. They recently moved their facility to a new location and are in the process of regaining :he dedi-cated phone-line. Calls were made promptly on regular commer-cial lines.
The definition of an Alert status is based upon events that cause an actual (egradation of the nuclear safety level of the facility (AP.501, Attachment 7.1); however, under the_ Alert status of Tab 20 (Onsite Hazards), there are no references to nuclear ' safety for an aircraft crash, missile impacts or a known explosion. There is also no guidance for what is con-sidered major damage. These examples of Alert classifications are not as precise as they should be and are left open to-various interpretations.
The Unusual Event status (AP.502) is the only emergency classi-fication that does not indicate the ability to initiate perscnnel assembly and accountability. Also, in the immediate actions of AP.502, direction is given to make an announcement of the declara-tion of an Unusual Event.
In the announcement, all personnel are directed to proceed with their normal duties. It may not always be desirable for personnel to continue normal duties during abnormal events.
-J7-i
It was noted that public address announcements and site siren actuation were not made when the Unusual Event and Alerts were declared. In the case of the Alert, the duration of the Alert was so brief (10 minutes) that the decision to downgrade was made be. fore the announcements could be made. It was an oversight that the unusual Event PA announcement was not made.
IX. SAFETY CONSIDERATIONS The decrease in T,yg following the reactor trip was responsible for the subcooling margin of the reactor coolant system being greater than 75'F at five minutes and increasing toward 100'F a few minutes later.
The stuck open turbine bypass valve was responsible for depressuriz-ing the Loop A steam generator to a minimum pressure of 650 psig rather than 1000 psig about five minutes after reactor trip. The pressure in the Loop B steam generator decreased to 750 psig in the same time interval and the Loop B startup level reached a minimum of 11 inches which may have approached a dried out steam generator. After that time, Loop B startup level increased to approximately 20 inches and that level was maintained after the reactor tr'ip.
The rea.ctor was tripped'immediately after the control room opera-tors were inforned about the hydrogen fire at the generator.
fire prevention system was extinguish-Thus, during the time the CO2 ing and controllling tha fire, the reactor had sufficient negative shutdown margin.
l About an hour after reactor trip, NNI X 124 VOC was lost for approx-
~
mately four minutes.
In initiating the SFAS manually, full HPI flow increased RC pressure sufficiently to open a pressurizer code safety valve. That valve momentarily opened at approximately 2360
~
psig, rather than 2500 psig.
M8 ~
l i.
O O -
1 r
J l
0 0
37-O w
w"
L 4
w v
Y t
e 4
38-f.
f i
i i
i
{
l I
h
6 S
l
d.
f I
(
LIST OF FIGURES 1
Post-Trip P-T Diagram 2A Post-Trip Pressurizer Level, RCS Pressure, T,yg vs. Time 2B Post-Trip Loop A and B T vs. Time c
3 Post-Trip OTSG Pressure vs. Time 4
Post-Trip OTSG Level vs. Time 5
Pressurizer Level Strip Chart 6
RCS Pressure Strip Chart - Loop A, RPS B 7
RCS Pressure Strip Chart - Loop B, RPS A 8
RCS T,yg Strip Chart 9
Wide Range T Strip Chart c
10 Steam Header Pressure Strip Chart 11 RCS Pressure & Pressurizer Level vs. Time During Loss of NNI-X 12 Loop T vs. Time During Loss of NNI-X c
13 OTSG Pressure vs. Time During Loss of NNI-X 14 Simplified Diagram of H Seal Oil System 2
15A NNI-X Power Supply ISB NNI-Y & Z Power Supply 16 H Seal Oil Temperature vs. Time 2
I
~
e g g gers 1 POST TRIP P-T DIAGRAM J
.\\
\\
,./
1
/
l
/
i
/
,/2000 k
e e'
/'
POST TRIP 2400 glN005 l
/
2200
~ ~ ~
3 1g_a M, t
M t_l
_a is i
~
no SUPERNEAT 2000 sygC00 LEO I _[,
REGION REGION s " ~~~
1000 8
1 I
1600 O
1400
@ END POINT POST TRIP (3
FORCED CIRCUL ATION < THOT STEAs PRESSURE r4 g TCOLO) AND FOR NATURAL 1200
- g Llulf CIRCULATION iIgggg)
--~~~~
NORMAL OPERATING POINT. POWER OPERATICN e THOT) 800 0
SATURATION F~'
E.MO POINT POST TRIP flTH
/
[,j NATURAL CIRCUL ATION i Tygyi 300
/- SUIC00 LEO 400 MARGIN LINE
's 0
t I
400 450 500 5
600 650 700 i
Reactor Coolant ana steam Outlet Tenestature. F
/.
\\
,/
s x
The number next to each data point represents the time in minutes after the reactor trip.
.