IR 05000304/1986024

Insp Rept 50-304/86-24 on 860811-1010.Violation Noted: Failure to Ensure That Latest Rev of Electrical Prints Used. Post-mod Testing Program Concerns Also Identified.Diesel Generator O Electrical Scheme & Breaker Cycle Chart Encl

ML20214F618
Person / Time
Site:	Zion File:ZionSolutions icon.png
Issue date:	11/18/1986
From:	Burgess B NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20214F571	List: IR 05000304/1986024 ML20214F569 ML20214F593
References
50-304-86-24, NUDOCS 8611250370
Download: ML20214F618 (11)

Text

~

U.S. NUCLEAR REGULATORY COMMISSION

.

REGION III

Report No. 50-304/86024(DRP) '

Docket No. 50-304 License No. DPR-48 Licensee: Commonwealth Edison Company P. O. Box 767 Chicago, IL 60690 Facility Name: Zion Nuclear Power Station, Unit 2 Inspection At: Zion, IL Inspection Conducted: August 11 through October 10, 1986 Inspectors: M. M. Holzmer J. Bauer Approved By:

fY B. L. Burgess, Chief //// TG Reactor Projects Section 2A Date Inspection Summary Inspection on August 11 through October 10, 1986 (Report No. 50-304/36024(DRP)) .

Areas Inspected: Special, unannounced region based and resident inspection of l potential for asynchronous closure of Unit 2 diesel generators onto loaded engineered safety feature (ESF) buses.

, Results: One violation and no deviations were identified (failure to follow document control procedures). In addition, concerns were identified relative

, to the licensee's post modification testing program, that it may not adequately j provide for testing to assure that modifications do not reduce the safety of l operations per the licensee's commitment to Paragraph 6.5 of ANSI N18.7, and

to the length of time taken by operators to resolve unsatisfactory test result :

i G

/4 DOCK O [

• a - -a A,-- 1-

- +- --- _ -. x

'

DETAILS

. Persons Contacted

• G. Plim1, Station Manager

• E. Fuerst, Superintendent, Production

• T. Rieck, Superintendent, Services W. Kurth, Assistant Station Superintendent, Operations N. Valos, Unit 2 Operating Engineer

• R Cascarano, Technical Staff Supervisor

• C. Schultz, Regulatory Assurance Administrator

• G. Fanning, Engineering Assistant, Technical Staff W. Stone, Quality Assurance Supervisor

• C. Sprandel, Quality Assurance Staff

• Indicates persons present at exit intervie . Licensee Action On Previous Inspection Findings (Closed) Unresolved Item (304/86018-03): Engineered safety feature (ESF)

bus breaker interlock installed improperl This item was unresolved pending a determination by Region III of appropriate level of enforcement. A meeting was held in the Region III office on October 9,

'

1986 regarding this issue, the results of which are contained in Paragraph 3 of this report. This item is considered close . ESF Bus Breaker Interlock Problem On July 27, 1986, while performing Periodic Test (PT) 10, Safeguards

.

Actuation, Unit 2, en operator observed what he thought to be improper operation of an ESF bus electrical breake Further investigation by the licensee identified that during certain testing sequences, the potential existed for the asynchronous closure of the emergency diesel generator onto a loaded bus. If the electric phase angle of the emergency DG differed from the phase angle of the decaying electric field of one or more motors on the bus, the potential would exist for damage to the motors and the resultant unavailability of ESF components. A modification (83-20), which was installed during the September 5, 1985

through January 27, 1986 refueling and maintenance outage, was the cause t

of the potentially improper breaker operation. This modification affected Diesels 2A, 2B and 0 (common).

^ Event Chronology September 1985 through January 1986 Refueling Modification 83-20 was completed prior to the Unit 2 startup on January 27, 1986. This modification added an electrical interlock i

.

..- - - , _ - --. --. --

"

botween the two series feeder breakers, 2424 and 2471 (see Attachment 1), from Bus 242 to 247 such that if 2424 opens for any reason, a "b" contact would send a signal to trip open 247 Prior to this modification, if Breaker 2424 opened, Breaker 2471 would not open automatically until a 72% bus undervoltage on Bus 247 occurre The modification was intended to " gang" the operation of these two breakers to make the design similar to other CECO facilitie The design basis for Modification 83-20 depended partly on the false assumption that a previous modification (81-09) was already installed. Modification 81-09 proposed to add a 2 second time delay interlock to the closing logic of the DG output Breaker 2473. After the installation of Modification 81-09, the DG output breaker would close two seconds after the bus 247 undervoltage condition occurre Modification 81-09 was not installed because site personnel questioned its value and decided it required further review. The Station Electrical Engineering Department (SEED), who designed Modification 83-20, used an uncontrolled drawing which showed Modification 81-09 drawn in by hand (indicating that it was installed)

although it had not yet been installed in the fiel A post modification test of Modification 83-20 was successfully conducted. The scope of the test was to verify whether the modification performed as designed. There were no provisions to test for adverse system interactions, such as were observed later during PT-10 testin July 27, 1986 During the performance of PT-10, " Safeguards Actuation - Unit 2,"

the operator noticed that Breaker 2474 did not cycle as required by the procedure. Breaker 2474 should trip when Bus 247 is stripped due to the bus undervoltage condition caused by opening Breaker 2424, and it should subsequently reclose from a signal from the blackout timer after the DG output breaker closes, restoring power to the bu After discussion, it was the conclusion of the Shift Control Room Engineer (SCRE) that the breaker had cycled, but, due to the expected rapid breaker reclosure, the indicator light simply was not able to change state fast enoug The discrepancy was noted in the comments section of PT-1 July 28, 1986 PT-10 was performed on the remaining two safeguards trains. The same operator again noticed that the equivalent breakers to 2474 (2484 & 2494) did not appear to cycle per procedure. The supervisor on shift (SOS) reviewed the electrical print (which included Modification 83-20) and concluded that Breaker 2474 should not cycle under the test conditions due to the recent modification and that the procedure was therefore in error . The discrepancies were again noted in the comments section of PT-10.

,

'

August 4, 1986

,

The July 27 and 28 discrepancies were noted by a shift foreman who was reviewing the status of PT-10 in order to schedule additional operators that week. He immediately requested the assistance of the Technical Staff in order to resolve the difference between the test results and the procedur August 5, 1986 After a review by the Technical Staff, the interlock problem between Breakers 2424 and 2471 was identified and the "b" contact interlock was removed using the licensee's lifted lead procedure. The same chcnge was made for the other two safeguards buse August 27, 1986 The licensee completed their analysis of the ESF breaker cycle times. The analysis concluded that ESF bus load stripping and resetting of the safety injection (SI) sequence timer would occur a minimum of 10 cycles (166.7 milliseconds) prior to the diesel output breaker closing (see Attachment 2). The safeguards loads would then properly resequence on after power was restored to the bus, b. Technical Analysis Frequent reference to Attachment I, " Zion Diesel Generator 0 Electrical Schematic," will be necessary during the following discussion. For purposes of this discussion only the "0" diesel and its respective electrical system will be referenced; however, similar circumstances are applicable to the 2A and 2B DG (1) 4160 V power is supplied to ESF Bus 247 through either:

- Breaker 2471, normal feeder breaker from non-vital 4160 V Bus 242,

- Breaker 2472, reserve feeder breaker from Unit 1, or

- Breaker 2473, "0" DG output breake (2) Breaker 2424 is in series with Breaker 247 (3) Breaker 2474 supplies the 4160/480 V transformer (aux transformer 237) for 480 volt ESF load (4) The following conditions will trip the following breakers (this list includes only those trips of significance to the discussion):

'

2424 72% undervoltage on Bus 242

. 2471 2424 open (installed by Mod 83-20), or "0" DG at rated voltage and frequency and 72% undervoltage on Bus 247 (from relay 427XI)

2474 72% undervoltage on Bus 247 (from Relay 427X2, which operates in parallel with 427X1)

(5) The following conditions will shut the following breakers (this list includes only those closures of significance to the discussion):

2473 2471 open, and "0" DG at rated voitage and frequency 2474 72% undervoltage on Bus 247 (from Relay 427X3 which is energized when 427X2 [ mentioned above]

is energized) and SI signal present (or simulated as in PT-10).

(6) Several ir.iportant sequences of operation which were revealed by the licensee's analysis are discussed below:

(a) If a simultaneous safety injection (SI) and loss of offsite electrical AC power would have occurred prior to the installation of Modification 83-20, the DG output breaker (2473) would not shut until Bus 247 was stripped and the DG was ready to carry the electrical load It takes the DG about 10 seconds to be ready to accept load, so Bus 247 would have ample time to strip its load (b) If a simultaneous SI and loss of offsite AC were to occur after the installation of Modification 83-20, the outcome would have remained essentially the same, except that Breaker 2471 would open when Breaker 2424 opened. Bus stripping, 2473 shutting, and load sequencing still remain the same and were unaffected by the modificatio (c) If an SI occurred, followed sometime later by loss of offsite AC (before Modification 83-20), Breaker 2473 would not shut until about 10 cycles (166.7 milliseconds)

following Breaker 2471 opening. Bus stripping occurs at the same time as 2471 opening, since the signals come from the same relay. Therefora, the DG would not close onto a loaded bu ESF loads would then be sequenced onto Bus 247 by its blackout time (d) If an SI occurred, followed sometime later by loss of cffsite AC (after Modification 83-20) the same sequence would occur, except that Breaker 2471 opens immediately after Breaker 2424 opens. Attachment 2 shows relay actuation times and includes tolerances for the Bus 242 and 247 undervoltage

-.

,

i l

I

"

devices at the least conservative ends of their respective tolerances. Summing the respective paths reveals that the

, bus will strip at least 10 cycles prior to 2473 shuttin (e) If Breaker 2424 were to be opened during PT-10 (after Modification 83-20), the DG could be allowed to energize a partially loaded bu In this condition, the DG is ready to accept load, and ESF loads are removed from Bus 247 by operators prior to the test to prevent transients on systems such as charging, service water, component cooling, or containment fan coolers. After 2424 is opened manually by the operator, 2471 opens immediately (5 cycles) due to the

"b" contact added by Modification 83-20. Ten cycles after 2471 opens, 2473 shuts since the DG is at rated voltage and frequency. No load shed occurs, since load shed depends on the actuation of the Bus 247 undervoltage device, and the urdervoltsge device on Bus 247 needs about 48 cycles to actuat (7) In summary, the design objective is. met for all sequences except (6)(e), which is not an accident sequence. If operators do not unload the ESF bus prior to PT-10 testing, equipment damage could occur because the DG phase angle may not match the phase angle of the decaying electrical field of any motors on the bu c. Root Cause Analysis The following are root causes or contributors to the event:

(1) Modification / drawing control:

-

The CECO Station Electrical Engineering Department (SEED)

designed Modification 81-09 and sent the preliminary drawings to site for review on September 30, 1986. SEED was never informed that the modification was not installe SEED designed Modification 83-20 working from an uncontrolled, hand marked electrical print which had Modification 81-09 drawn on i It was therefore assumed that 81-09 was installe Lengthy delays exist from the time a print is given to Sargent and Lundy for a drawing revision until the revised prints are issue (2) The SEED design engineer was aware of the interrelationship between Mods 81-09 and 83-20, but the relationship apparently was not discussed with site personnel. Site personnel were not aware of this relationship during the site review of Modification 83-2 _

~

(3) The post modification test for Modification 83-20 failed to determine whether the modification would have reduced the

, safety of operations (e.g. produce unsafe system interactions).

(4) Procedure (PT-10) documentation of the cycling of Breaker 2474 should be improved by requiring a separate signoff. This may have improved the ability of operators to detect the proble d. Other Inspector Concerns Operations personnel were slow to involve the Technical Staff in resolving the perceived PT-10 test procedure deficiencies. One reason is that both shifts involved erroneously concluded that PT-10 was at fault. The other is that both shifts incorrectly assumed that the Technical Staff would become involved in resolving the problem

without the shift communicating that need to either management or the technical staff. (Once the technical staff became involved, their response appeared sufficiently prompt.)

e. Immediate Corrective Actions (1) The interlock between Breakers 2424 and 2471, installed by l

Modification 83-20, was removed on August 5, 198 , (2) The applicability of the issue in question was analyzed at all other CECO sites. No other diesels were found to have a similar proble (3) A decision was made by August 22, 1986 to install both Modification 81-09 and 83-2 f. Long Term Corrective Actions (1) A complete revision of the modification process is being conducted for the entire CECO Syste (2) The Station Electrical Engineering Department (SEED) will no longer be involved in safety related modifications. All safety related modification design review will be done by the Station Nuclear Engineering Department (SNED).

(3) All pending safety related modifications designed by SEED will be re-reviewed for adequate design by SNE g. Safety Significance FSAR Section 8.1, " Electrical System Design Basis," states: "In ,

the event of total loss of auxiliary power from off-site sources, auxiliary power required for safe shutdown will be supplied from diesel generators located on the site."

II

- - . -_

Technical Specifications Section 3.15, " Bases," further states: "Any two of the three diesel generators can provide the emergency

, onsite power required to safely shutdown the reactor and remove decay heat..."

Following a loss of outside AC with a subsequent safety injection (LOCA), the diesels would be called upon to start and carry the safeguards loads to safely shutdown the plant. As previously discussed, the 2A, 2B and "0" (common) diesels would have been able to perform that function as designed, whether the loss of offsite AC power (undervoltage) occurred at the time of the SI or subsequent to i The possibility exists that during a test (such as PT-10) or the opening of Breaker 2424 for reasons other than undervoltage, if the DG is at rated speed and voltage, the DG could experience asynchronous closure onto the ESF bus. In such circumstances, the bus may or may not be loaded. During PT-10 testing the bus is normally unloaded to prevent loss of needed components. These types of events appear to be both infrequent and, in most cases, inconsequentia Drawing control and design control at the corporate engineering level was not sufficient to prevent adverse system interactions when implementing this modification. Furthermore, there seems to have been insufficient consideration of adverse system interactions in this post-modification testing. ANS 3.2 (ANSI N18.7-1972), Section 6.5, " Tests and Inspections after Plant Modifications or Procedure Changes," states that tests or inspections shall be conducted to confirm that modifications do not reduce safety of operations. While the Commonwealth Edison Company QA program commits the licensee to comply with this ANSI standard, the program appears to have failed to provide measures to ensure that tests or inspections were performed to confirm that the installation of Modification 83-20 did not reduce the safety of operations. These modifications created the potential for the Unit 2 and common emergency DGs to asynchronously close onto a live, loaded bus during periodic testing. Review of the licensee's QA program to determine compliance with their commitment to section of ANSI N18.7-1972 is considered an Unresolved Item (50-304/86024-01).

The Operations department request for resolution of test discrepancies was too slow. This appears to have resulted from i assumptions on the part of shift management (SCRE's) that the

! Technical Staff would somehow get involved in resolving the perceived procedural problems without the operators initiating it.

,

h. Enforcement l

l The CECO Quality Assurance Manual, Quality Procedure 6-1,

" Distribution of Design Documents," Step 4.3.1 requires that each receiving office or area shall have a controlled method for checking receipt of new or revised documents, and assuring that the latest l 8

revised document is in use. During the design of Modification M22-1(2)-83-20 in 1983, the Station Electrical Engineering

, Department (SEED), used a hand marked electrical print to design and issue Modification 83-20, which was not the latest revision of that prin Failure to comply with the requirements of Quality Procedure 6-1 is a violation of 10 CFR Part 50, Appendix B, Criterion V (50-304/86024-02). Unresolved Items Unresolved items are matters about which more information is required in order to ascertain whether they are acceptable items, items of noncompliance or deviations. One unresolved item disclosed during this inspection is discussed in Paragraph . Exit Interview The inspectors met with licensee representatives (denoted in Paragraph 1)

throughout the inspection period and at the conclusion of the inspection on October 10, 1986 to summarize the scope and findings of the inspection activities. The licensee acknowledged the inspectors' comments. The inspectors also discussed the likely informational content of the inspection report with regard to documents o processes reviewed by the inspectors during the inspection. The licensee did not identify any such documents or processes as proprietar Attachments: Zion Diesel Generator "0" Electrical Schematic Breaker Cycle Times

-. .

. _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _

Attactuent 1 Zion Diesel Generator 'O' Electrical Schematic

-

~

-

.

F .

G '

,1 6 G

-

-

'C /

q

<)

4160V Bus 242 i

2424 / nterlock installed by N0D 83-20 UV - 5 - . m ... .........g Diesel Generator d:vice U i f b contact

- "0"

(72%)

) , interlock

{

{* Reserve Feedeg

,___-. _____y 4160V Bus U/1

'

I 4 I i l

,-- ( l,___3 C

2471 e 2473 2472 4160V ESF Bus 247

. ,

_

'

,

l 4160V ESF Bus 247

-

-h-h --- 1--, ._ .-

-- 2474 UV device (72%) wA 4160V/480V Safeguards "w Trans 237 Loads -

i 480V ESF Bus 237 l mcc 2371 l r 480V/120V Trans T'

120V Bus SI Sequence Timer l

.

'

.

Attachment 2

.

BLACK 0UT v

b &

Service Bus 242 NOTE: Conservatively assume that ESF Bus 247 UV Relay Bus 242 UV device will actuate UV Relay 48 cycles f early and Bus 247 UV device 48 cycles * will actuate lat u a Slave Relay Slave Relay 427x1 Path 1 427x1 5 cycles 5 cycles

'

?? u Breaker 2424 ESF Breakers opens open 5 cycles ev Path 2 5 cycles

'

v Breaker 2471 opens 5 cycles

_

u D/G Breaker 2473 closes 10 cycles D/G Breaker Closing Times ESF Load Shed Time Path 1 Path 2 5 l 4 .4 5 5 5 60 T cycles i 5 5 5 10 10 70 T cycles 703 cycles 70.4 cycles - 60.4 cycles = 10 cycles = 166.67 millisecond Therefore, ESF load shedding will always occur a minimum of 166.67 ms before the D/G output breaker close . - _ _