ML16210A515: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
(Created page by program invented by StriderTol)
 
(3 intermediate revisions by the same user not shown)
Line 3: Line 3:
| issue date = 07/28/2016
| issue date = 07/28/2016
| title = Bnp Commercial Grade Dedication Issue (Printable)
| title = Bnp Commercial Grade Dedication Issue (Printable)
| author name = Cain L M
| author name = Cain L
| author affiliation = NRC/RGN-II, NRC/RGN-II/DFFI
| author affiliation = NRC/RGN-II, NRC/RGN-II/DFFI
| addressee name =  
| addressee name =  
Line 9: Line 9:
| docket = 05000324, 05000325
| docket = 05000324, 05000325
| license number =  
| license number =  
| contact person = Cain L M
| contact person = Cain L
| package number = ML16010A484
| package number = ML16010A484
| document type = Meeting Briefing Package/Handouts, Slides and Viewgraphs
| document type = Meeting Briefing Package/Handouts, Slides and Viewgraphs
Line 16: Line 16:


=Text=
=Text=
{{#Wiki_filter:ACRS Briefing:Brunswick Nuclear Power Plant Emergency Diesel Generator Commercial Grade Dedication FindingJuly 28, 2016Mike Cain, SRI BWXT Allen Bradley700-RTC Relay2 3Integrated ChipCPLDAllen Bradley 700-RTC Relay Internals
{{#Wiki_filter:ACRS Briefing:
Brunswick Nuclear Power Plant Emergency Diesel Generator Commercial Grade Dedication Finding July 28, 2016 Mike Cain, SRI BWXT


TIMELINE*3/17/15 -Emergency diesel generator (EDG)3 output breaker fails to close during LOOP portion of LOOP/LOCA test*3/18 -New RCR and RCR-X Allen Bradley 700-RTC relays are installed, EDG3 passes LOOP/LOCA test satisfactorily*3/19-21-EDG4 taken out of service for maintenance, RCR relay is proactively replaced . EDG4 LOOP test performed, output breaker attempted to close four times (chattered) before finally closing*3/21 -all 9 Allen Bradley 700-RTC relays in stock were bench tested and all chattered*3/22 -EDG4 original RCR relay reinstalled, no chattering*3/23 -Due to EDG4 issues, EDG3 relay was re-tested and this time failed due to relay chatter. Licensee installed a suppressive diode across the RCR-X relay to prevent electromagnetic interference (EMI) determined to be the cause of the relay chatter. It was later determined that the installation of a recorder across the RCR-X relay had acted as a suppression device, masking EMI and resulting in a SAT test on 3/18 CauseWhat causes the trip of the output breaker -On a LOOP, the RCR relay has a 0.7 second time delay between the time the DG output breaker is tripped and when it can reclose (breaker itself takes longer).The RCR relay energizes first on an emergency diesel start signal, closing the contact to energize the RCR-X relay. The RCR-X relay energizes to close the DG output breaker. DG3 passed the LOOP/LOCA portion of the test where the DG is originally in standby when the output breaker is closed, but failed the subsequent LOOP portion of the test where the DG is running when the output breaker is opened and then recloses. The failure occurred when the breaker closed and reopened several times, causing an anti-pump lockout, and a trip of the output breaker.
Allen Bradley 700-RTC Relay 2
IssueTesting confirmed that the 'new' series of Allen Bradley relays had a complex programmable logic device (CPLD) instead of the old style 16 pin Motorola timing IC chip, and were now susceptible to 'DC Inductive Kick' produced by the downstream RCR-X relay when it de-energizes.5/1/15, Nuclear Logistics Inc. (NLI) issues a Part 21, stating that Allen Bradley 700-RTC relays had undergone an unannounced design change by the manufacturer sometime in the 2009-2010 timeframe. These relays are commercial grade items. Brunswick commercial grade dedication did not detect the vendor design change.A CPLD meets the NEI definition of a 'digital-device' per NEI guidance 01-01 What Happened Next*PI&R follow-up inspection conducted week of June 15*This issue was complex and encompassed several different aspects to include:*Design control
 
*Operability of the other diesels*Past operating experience (North Anna, Diablo Canyon, and Vogtle). Same Brunswick EDG 3 relay chattered in 2013; however, breaker still closed*Duke commercial grade dedication processes
Allen Bradley 700-RTC Relay Internals Integrated Chip          CPLD 3
*Vendor issues for both relay manufacturers and commercial grade dedication entities*Part 21 reporting *Cyber issues with the introduction of digital assets Where We Ended UpRII issued two GREEN, NRC Identified violations to Brunswick for:*Failure to meet requirements of 10CFR50 App. B, Criterion III -Design Control*Failure to meet the requirements of 10CFR50 App. B, Criterion XVI -Corrective Action, more specifically for failure to promptly identify conditions adverse to quality, one of which was significantHQs issued the following generic communications:*"The Operating Experience Note," #008, July 2015 included an article concerning the subject relays*Issued OpECOMM in August 2015 detailing the BNP issue
 
*Issued IN 16-01 and a RISconcerning Commercial Grade Dedication Questions}}
TIMELINE
* 3/17/15 - Emergency diesel generator (EDG)3 output breaker fails to close during LOOP portion of LOOP/LOCA test
* 3/18 - New RCR and RCR-X Allen Bradley 700-RTC relays are installed, EDG3 passes LOOP/LOCA test satisfactorily
* 3/19 EDG4 taken out of service for maintenance, RCR relay is proactively replaced .
EDG4 LOOP test performed, output breaker attempted to close four times (chattered) before finally closing
* 3/21 - all 9 Allen Bradley 700-RTC relays in stock were bench tested and all chattered
* 3/22 - EDG4 original RCR relay reinstalled, no chattering
* 3/23 - Due to EDG4 issues, EDG3 relay was re-tested and this time failed due to relay chatter. Licensee installed a suppressive diode across the RCR-X relay to prevent electromagnetic interference (EMI) determined to be the cause of the relay chatter. It was later determined that the installation of a recorder across the RCR-X relay had acted as a suppression device, masking EMI and resulting in a SAT test on 3/18
 
Cause What causes the trip of the output breaker -
On a LOOP, the RCR relay has a 0.7 second time delay between the time the DG output breaker is tripped and when it can reclose (breaker itself takes longer).
The RCR relay energizes first on an emergency diesel start signal, closing the contact to energize the RCR-X relay.
The RCR-X relay energizes to close the DG output breaker. DG3 passed the LOOP/LOCA portion of the test where the DG is originally in standby when the output breaker is closed, but failed the subsequent LOOP portion of the test where the DG is running when the output breaker is opened and then recloses. The failure occurred when the breaker closed and reopened several times, causing an anti-pump lockout, and a trip of the output breaker.
 
Issue Testing confirmed that the new series of Allen Bradley relays had a complex programmable logic device (CPLD) instead of the old style 16 pin Motorola timing IC chip, and were now susceptible to DC Inductive Kick produced by the downstream RCR-X relay when it de-energizes.
5/1/15, Nuclear Logistics Inc. (NLI) issues a Part 21, stating that Allen Bradley 700-RTC relays had undergone an unannounced design change by the manufacturer sometime in the 2009-2010 timeframe.
These relays are commercial grade items. Brunswick commercial grade dedication did not detect the vendor design change.
A CPLD meets the NEI definition of a digital-device per NEI guidance 01-01
 
What Happened Next
* PI&R follow-up inspection conducted week of June 15
* This issue was complex and encompassed several different aspects to include:
* Design control
* Operability of the other diesels
* Past operating experience (North Anna, Diablo Canyon, and Vogtle). Same Brunswick EDG 3 relay chattered in 2013; however, breaker still closed
* Duke commercial grade dedication processes
* Vendor issues for both relay manufacturers and commercial grade dedication entities
* Part 21 reporting
* Cyber issues with the introduction of digital assets
 
Where We Ended Up RII issued two GREEN, NRC Identified violations to Brunswick for:
* Failure to meet requirements of 10CFR50 App. B, Criterion III -
Design Control
* Failure to meet the requirements of 10CFR50 App. B, Criterion XVI
        - Corrective Action, more specifically for failure to promptly identify conditions adverse to quality, one of which was significant HQs issued the following generic communications:
* The Operating Experience Note, #008, July 2015 included an article concerning the subject relays
* Issued OpE COMM in August 2015 detailing the BNP issue
* Issued IN 16-01 and a RIS concerning Commercial Grade Dedication
 
Questions}}

Latest revision as of 16:59, 30 October 2019

Bnp Commercial Grade Dedication Issue (Printable)
ML16210A515
Person / Time
Site: Brunswick  Duke Energy icon.png
Issue date: 07/28/2016
From: Cain L
NRC/RGN-II, NRC/RGN-II/DFFI
To:
Cain L
Shared Package
ML16010A484 List:
References
Download: ML16210A515 (11)


Text

ACRS Briefing:

Brunswick Nuclear Power Plant Emergency Diesel Generator Commercial Grade Dedication Finding July 28, 2016 Mike Cain, SRI BWXT

Allen Bradley 700-RTC Relay 2

Allen Bradley 700-RTC Relay Internals Integrated Chip CPLD 3

TIMELINE

  • 3/18 - New RCR and RCR-X Allen Bradley 700-RTC relays are installed, EDG3 passes LOOP/LOCA test satisfactorily
  • 3/19 EDG4 taken out of service for maintenance, RCR relay is proactively replaced .

EDG4 LOOP test performed, output breaker attempted to close four times (chattered) before finally closing

  • 3/21 - all 9 Allen Bradley 700-RTC relays in stock were bench tested and all chattered
  • 3/22 - EDG4 original RCR relay reinstalled, no chattering
  • 3/23 - Due to EDG4 issues, EDG3 relay was re-tested and this time failed due to relay chatter. Licensee installed a suppressive diode across the RCR-X relay to prevent electromagnetic interference (EMI) determined to be the cause of the relay chatter. It was later determined that the installation of a recorder across the RCR-X relay had acted as a suppression device, masking EMI and resulting in a SAT test on 3/18

Cause What causes the trip of the output breaker -

On a LOOP, the RCR relay has a 0.7 second time delay between the time the DG output breaker is tripped and when it can reclose (breaker itself takes longer).

The RCR relay energizes first on an emergency diesel start signal, closing the contact to energize the RCR-X relay.

The RCR-X relay energizes to close the DG output breaker. DG3 passed the LOOP/LOCA portion of the test where the DG is originally in standby when the output breaker is closed, but failed the subsequent LOOP portion of the test where the DG is running when the output breaker is opened and then recloses. The failure occurred when the breaker closed and reopened several times, causing an anti-pump lockout, and a trip of the output breaker.

Issue Testing confirmed that the new series of Allen Bradley relays had a complex programmable logic device (CPLD) instead of the old style 16 pin Motorola timing IC chip, and were now susceptible to DC Inductive Kick produced by the downstream RCR-X relay when it de-energizes.

5/1/15, Nuclear Logistics Inc. (NLI) issues a Part 21, stating that Allen Bradley 700-RTC relays had undergone an unannounced design change by the manufacturer sometime in the 2009-2010 timeframe.

These relays are commercial grade items. Brunswick commercial grade dedication did not detect the vendor design change.

A CPLD meets the NEI definition of a digital-device per NEI guidance 01-01

What Happened Next

  • PI&R follow-up inspection conducted week of June 15
  • This issue was complex and encompassed several different aspects to include:
  • Design control
  • Operability of the other diesels
  • Past operating experience (North Anna, Diablo Canyon, and Vogtle). Same Brunswick EDG 3 relay chattered in 2013; however, breaker still closed
  • Part 21 reporting
  • Cyber issues with the introduction of digital assets

Where We Ended Up RII issued two GREEN, NRC Identified violations to Brunswick for:

  • Failure to meet requirements of 10CFR50 App. B, Criterion III -

Design Control

  • Failure to meet the requirements of 10CFR50 App. B, Criterion XVI

- Corrective Action, more specifically for failure to promptly identify conditions adverse to quality, one of which was significant HQs issued the following generic communications:

  • The Operating Experience Note, #008, July 2015 included an article concerning the subject relays
  • Issued OpE COMM in August 2015 detailing the BNP issue

Questions