ML20214S788
| ML20214S788 | |
| Person / Time | |
|---|---|
| Site: | Mcguire |
| Issue date: | 06/03/1987 |
| From: | Tucker H DUKE POWER CO. |
| To: | NRC OFFICE OF ADMINISTRATION & RESOURCES MANAGEMENT (ARM) |
| References | |
| NUDOCS 8706090417 | |
| Download: ML20214S788 (6) | |
Text
e DUKE POWER COMPAhT P.O. HOx 33189 oHARLOTTE, N.o. 28242 HAL H. TUCKER TELEPHONE vnom ressapearr (704) 373-4531 FUCLEA A eBUDt!CTION June 3, 1987 U.S. Nuclear Regulatory Commission O, Document;ControltDesk*
J~,,
Washington, D.C.
20555'
Subject:
McGuire Nuclear Station Docket No. 50-370 Technical Specification 3.8.1.1 and 6.9.2 Gentlemen:
Please find attached a special report submitted pursuant to Technical Speci-fication (T.S.) 6.9.2 as specified by T.S. 3.8.1.1.
The report concerns an invalid failure and a valid failure which occurred on May 5, and May 6, 1987 respectively. Both failures involved Diesel Generator 2B.
This event is considered to be of no significance with respect to the health and safety of the public.
Very truly yours, a
Hal B. Tucker SEL/67/jgm Attachment xc:
Dr. J. Nelson Grace INPO Records Center Regional Administrator, Region II 1820 Water Place U.S. Nuclear Regulatory Commission Atlanta, Ga 30339 101 Marietta St., NW, Suite 2900 Atlanta, GA 30323 Mr. Darl Hood Mr. W.T. Orders U.S. Nuclear Regulatory Commission NRC Resident Inspector
%p Office of Nuclear Reactor Regulation McGuire Nuclear Station Washington, D.C.
20555
/ h '\\\\
{
/
8706090417 B70603
~
PDR ADOCK 05000370 S
DUKE POWER COMPANY DIESEL GENERATOR REPORT Diesel Generator _2B Experienced Invalid And Valid Failures During Engineered Safety Features Testing Due To An Unknown Cause And A Mechanical Failure In The Governor / Actuator INTRODUCTION:
On May 5,1987, at 0005, Diesel Generator 2B : tripped during the adjustment of the generator output to the level required for the Engineered Safety Features
-Periodic Test which was in progress. Diesel Generator 2B was restarted and operated satisfactorily entil the actuation of the Train B section of the Engineered Safety Features Periodic Test. At 0647 on May 6, 1987, Diesel Generator 2B tripped on an Overspeed Trip signal due to a malfunction in the Governor / Actuator. An automatic start had been initiated by the Safety Injection / Black-out signal from the Solid State Protection System which was initiated for the Engineered Safety Features Periodic Test. The Diesel Generator 2B Governor / Actuator was found to be defective and was replaced.
Diesel Generator 2B was then successfully retested and declared operable again by 0533 on May 7, 1987.
Unit 2 was in Mode 5, Cold Shutdown, at the time of these occurrences.
The root cause of the first diesel generator trip' could not be positively identified.' The second diesel generator trip was due to the malfunction of the Governor / Actuator.
EVALUATION:
Background
Each unit at McGuire Nuclear Station has two independent Diesel Generators (D/Gs). As part of the Essential Power System, they provide standby AC power I
to the equipment required to safely shut down the reactor in the event of the loss of normal power. The D/Gs also supply power to the safeguards equipment as required during a major accident coincident with a loss of normal power (blackout).
The Engineered Safety Features Periodic Test (ESFPT), PT/2/A/4200/09A, is an 18 month interval test which is conducted during each refueling outage. The unit is aligned in such a way that almost all the components in the Engineered Safety Features (ESF) system can be actuated by means of a manual ESF actuation. There are several combinations of accident conditions which are simulated for the actuations which cause an automatic start of the D/Gs. The Technical Specifications (TSs) criteria for this test include a requirement to operate the D/Gs at their rated capacity for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> prior to initiating the systems portion of the test. The criteria further specify that the appropriate ESF systems be activated within 5 minutes of shutting the D/G down at the end of the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> run.
A multi-pen chart recorder is connected to the D/G during the ESFPT to record f
.the D/G response to the sequential loading that occurs during the testing.
Voltage, frequency, and output circuit breaker position are among the
-parameters monitored.
= -.
.~
l
- T Each diesel engine is controlled by a Woodward EG-B35 Governor / Actuator (G/A),
serial No. 967468.. There are two separate sections to the governor. One is a j
standard fly-weight type speed sensor which modulates a hydraulic pilot valve and the other is an electrically operated pilot valve which responds to signals from an electronic package which measures engine speed and power.
The l
pilot. valves in each section operate small hydraulic cylinders which are in turn connected to their respective ends of a lever.
The middle of the lever is connected to another pilot valve which modulates an output hydraulic cylinder. This last hydraulic cylinder acts as a hydraulic amplifier and is connected to the fuel rack (throttle). This arrangement allows either or both of the governing sections to control the output to the fuel rack.
Each of the two sections of the governor has its own independent speed setpoint and the electrical section is adjusted and set by means of a procedure. The nominal setpoint for the mechanical section is equivalent to 63 Hz and the setpoint for the electrical section is equivalent to 59.5 Hz (60 Hz is equivalent to 514 RPM). During steady state operation, the electrical section dominates and controls the engine power output with the mechanical section functioning as a backup. During an engine startup however, control is shared between the two sections.
Each section dominates and controls at different points in the startup.
4 I
During steady state operation the output of the D/G is controlled through the electrical section by means of Raise and Lower push buttons located on the Control Boards in the Control Room and on the local Diesel Control Panel.
These buttons adjust the setpoint of the electrical section to the desired output level. When the diesel is shut down an automatic circuit readjusts the setpoint to 59.5 Hz so the G/A is properly set for the next startup.
The mechanical setpoint is ad'asted by means of a knob on the G/A itself and is not used except during maintenance and troubleshooting activities.
An independent speed sensing device on each diesel engine is connected to an i
j overspeed trip circuit. This circuit is designed to protect the engine from an
~
overspeed if the C/A fails and is set by an approved procedure to within a bard of 64.2 to 66.5 Hz (565 -15,+5 RPM). When the overspeed trip actuates, a j
lockout circuit is energized which must be reset my means of a reset push i
button on the Control Board in the Control Room, or on the local Diesel Control Panel before the diesel can be started again. The overspeed protection circuits are not bypassed during an ESF initiated automatic start.
Description of Event Both Unit 2 D/Gs were being operated as part of the ESFPT. The Train A portion of the test was in progress and D/G 2A was functioning normally. D/G 2B was 4
started at 2306 on May 4,1987, to beF'a its 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> run for the Train B portion of the test. Because of fluc*aations in the system electrical load, D/G 2B required frequent adjustment to its output in order to maintain the load level required by the test. At 0005, Operator A attempted to lower the output of D/G 2B, but it tripped just as he pressed what he thought was the Lower push button on the Control Board. The Lower push button and the normal Stop push button are right beside each other on the panel. Operator A initially felt sure that he had depressed the Lower push button but after further reflection, agreed that he may have pressed the Stop button. There were no alarms and no
- other indications of a protective or fault trip of any sort, and all the available information indicated that the diesel had experienced a completely normal shutdown initiated by the normal shutdown circuits. The D/G and its controls were examined in detail both before and after the subsequent restart without finding any discrepancies.
Start No. 570 was thus determined to be an invalid failure.
D/G 2B was started again, loaded to the prescriLed level, and functioned normally for the duration of the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> run. D/G 2B vas manually shutdown at 0645 on May 6,1987, as preecribed in the ESFFT and a Safety Injection with a Blackout signal was generate d at 0647. D/G 2B auto-started and then tripped on an overspe2d trip signal approximately 12 seconds later (Start No. 522, Valid Failure). An immediate evaluation of the event was performed and it was determined that there was a minimal risk in attempting another diesel start.
Therefore, the appropriate reset buttons were actuated and the test initiation l
was repeated within the requisite 5 minute tine constraint. D/G 2B l
auto-started again, loaded in the prescribed manner, and functioned as required during the remainder of the test.
It should be noted that the ESFPT required two more auto-starts of D/G 2B and bath were successful.
After the L3FPT was completed and the chart recorder traces were available, a follow-up tavestigation was initiated to further evaluate the overspeed trip.
Based on iP.e information revealed by the recorder traces, two more troubleshooting diesel startups on D/G 2B were performed which demonstrated that the r.echanical section of the G/A was not functioning. A work request was writtan and the G/A was replaced. The D/G iB Governor & Voltage Regulator Benchmark Comparison Test, PT/2/A/4350/19B, was performed to verify the operation of the G/A. Then, Diesel Generator "2B" Operability Test, PT/2/A/4350/02B, was successfully completed (start No. 530, Valid Success) to verify D/G 2B operability.
D/G 2B had been declared inoperable at 0300 on May 6,1987, during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> test run because the normal operability test could not be run to meet the required surveillance interval. It remained inoperable until after the G/A had been replaced and D/G 2B was verified operable. D/G 2B was declared operable at 0533 on May 7,1987.
Conclusion This incident resulted in one invalid failure and one valid failure of D/G 2B.
Unit 2 D/Gs presently have had five valid failures in the last one hundred valid starts. The test frequency at the time of these failures was every three days and this frequency did not change as a result of these failures.
The first trip was determined to be an invalid failure most likely caused by Operator A pressing the Stop button instead of the Lower button. After the trip, station personnel evaluated all the available information to determine the cause. There had been no alarms and no abnormal indications. The diesel was started again and closely observed but no abnormalities were detected.
Discussions were held with Operator A and based on his recollections and all other evidence, it was very probable that he pressed the wrong button, especially since the Stop and Lower buttons are very close to one another on the Control Board, in spite of their being clearly marked.
~~.
_4-The second trip was determined to have been caused by a malfunction in the G/A.
The exact nature of the malfunction internal to the G/A is not known; however, it appears that the mechanical section is stuck in the full-open-throttle position. While evaluating the engine operation after the first trip mentioned
. above, the G/A manual setpoint knob was adjusted full open aad then returned to the 63 Hz position. Whether this action caused the G/A malfunction or not will be determined during the failure analysis by the manufacturer. A work request has been written to return'the G/A to the manufacturer for a failure analysis and refurbishment. A failure analysis report is to be furnished to Duke Power Company upon completion of the analysis.
While evaluating why D/G 2B failed on one start and operated successfully on the next start, it became apparent that the interaction between the two sections of the G/A and the diesel engine itself become very complex at the point where the engine RPM begins to approach the steady state level. During the normal RPM overshoot and return to steady state, the two sections trade dominant control. The peak of the overshoot is very close to the trip j
setpoint for the independent overspeed protection circuits and only a few RPM can make the difference in whether the diesel trips or not.
If the mechanical section of the G/A fails the electrical section can still control the engine, but less effectively during the startup. Thus, with one section of the G/A inoperable the probability of an overspeed trip is greatly increased.
A review of past diesel reports indicates there was one other failure of a diesel generator G/A on D/G 2A where metal filings jammed the pilot valves.
The corrective action was to replace the G/A.
There were no reports related to diesel generator malfunctions caused by inadvertent operation of control buttons.
The failure of the G/A in this incident is Nuclear Plant Reliability Data System (NPRDS) reportable. A search of the NPRDS did not reveal any reports I
(out of thirty on file) with a failure of the same nature.
CORRECTIVE ACTIONS:
a Immediate:
The D/G 2B start failures were evaluated and the D/G was restarted.
I Subsequent:
The D/G 2B G/A was replaced, i
i Planned:
Station personnel will evaluate the need for and originate procedures and/or administrative controls for the adjustment of the D/G Governor / Actuators.
SAFETY ANALYSIS:
With respect to the first D/G trip which was probably caused by actuating the wrong button, the D/G was never inoperable. This is apparent from the fact that it restarted without incident. Had the D/G been needed, the auto-start circuits would have functioned as required. Therefore, this trip has no safety significance.
O
' With respect to the second D/G trip caused by a failure in the G/A, Train B of the emergency AC power system was momentarily inoperable. Unit 2 meets the requirements of General Design Criterion 17 of Appendix A to 10 CFR 50, in that adequate AC power is available to mitigate any accident evaluated in the Safety Analysis with one train inoperable. Train A had just been demonstrated to be completely operable by completion of the Train A portion of the ESFPT;' thus, required safety systems were available.
It should be noted that D/G 2B functioned normally after being reset. While credit is not taken for systems that require an operator action, Train B was available after being reset and should have functioned had it been needed.
Additionally, the unit was in M'de 5, Cold Shutdown, where the impact of one o
emergency power train being inoperable is minimal.
There were no personnel injuries, radiation overexposures, or releases of radioactive material as a result of this incident.
This incident is considered to be of no significance with respect to the health and safety of the public.
q l
l
.. -, - = -
... -.. -.