Information Notice 1986-70, Potential Failure of All Emergency Diesel Generators: Difference between revisions
StriderTol (talk | contribs) (Created page by program invented by StriderTol) |
StriderTol (talk | contribs) (Created page by program invented by StriderTol) |
||
Line 23: | Line 23: | ||
==Description of Circumstances== | ==Description of Circumstances== | ||
:On June 10, 1986, in accordance with 10 CFR Part 21, Florida Power & Light(FP&L) reported the results of a failure modes and effects analysis (FMEA).This analysis identified multiple design deficiencies in the Turkey PointUnits 3 and 4 vital ac power system that could potentially result in the lossof both EDGs due to overloading. In addition, one deficiency was identifiedthat could result in the loss of all ac power to Unit 4. Turkey Point Units 3and 4 share two EDGs. Simplified diagrams of part of the Turkey Point 3 & 4electrical distribution system are provided as Figures 1 and 2.One design deficiency involved a "swing bus." As shown on Figure 1, 480 voltMCC "D" is normally supplied from EDG "B" but will shift its power supply toEDG "A" if needed. MCC "D" also feeds a non-safety stub bus through a singlecircuit breaker. This breaker is normally opened by the 48 load sequencer toisolate the non-safety loads from MCC "D" when the 48 4160V bus is loaded onEDG "B". A single failure in that circuit breaker would leave the non-safetyloads connected to MCC "D". During safety injection for one unit, the addi-tional non-safety loads could overload EDG "B", possibly resulting in a tripof this EDG. MCC "D" would then transfer its power supply and could overloadEDG "A" as well.8608130578 IN 86-70August 18, 1986 In addition to the above design deficiency, five deficiencies in the EDG loadevaluation were found, each of which could contribute to an overloading of bothEDGs. Both EDGs could be overloaded in the event of a safety injection on oneunit and a loss of offsite power to both units. In some cases this could occurwithout a single failure. These deficiencies are as follows:0 The post-TMI Emergency Operating Procedures require an additional chargingpump and high head safety injection pump in the 1-30 minute and 30-60minute EDG load interval, respectively.o In the event of a single failure of one EDG, actual testing of componentcooling water and intake cooling water showed that pump loads (KW) werehigher than expected. Under this condition, the cooling water pumps provideflow to parallel hydraulic trains. Since the flow resistance is lower,the pump flow rate is greater and the pump motor horsepower would increase.This in turn may increase the load on the EDG to an unacceptable value.o Recent environmental qualification evaluations per 10 CFR 50.49 assumedthat the emergency containment coolers operate longer than previouslyassumed.0 Load center transformer losses had not been accounted for in prior EDGload evaluations.o Some nonsafety loads that are auto-start enabled when the safety injectionsignal is reset could result in EDG overloading. These loads would notalways immediately start, but would auto-start when their start setpointswere reached after the reset.In addition to the overloading deficiencies above, a design deficiency. was foundthat could result in the loss of one EDG, and at the same time could result inthe loss of all ac power to Unit 4 as mentioned earlier. In the event of asingle failure of the 4A battery or the 4A load sequencer subsequent to a lossof off-site power, the 4A 4160V bus shown in Figure 2 would be prevented fromautomatically loading onto the "A" EDG. It would also prevent the transfer ofthe 4A MCC swing bus from 4A load center to 4B load center. The "B" EDG has aself-contained supply of fuel oil that lasts about one hour. After that time,fuel must be gravity supplied by the day tank via a solenoid operated valve.However, this valve is powered from MCC 4A. Therefore, the above mentionedsingle failure would also cause the loss of the "B" EDG and the loss of all acpower to Unit 4. The Unit 3 3B 4160V bus would also be deenergized, along withthree of the four high head safety injection pumps and the control roomair-conditioning.Discussion:The single failure vulnerability of the non-safety stub bus discussed above mayhave been evaluated during the licensing review and the loads on the EDGs foundto be low enough so that failure of the stub bus breaker would not overload thediesel. Subsequent to initial operation, however, additional loads have been | :On June 10, 1986, in accordance with 10 CFR Part 21, Florida Power & Light(FP&L) reported the results of a failure modes and effects analysis (FMEA).This analysis identified multiple design deficiencies in the Turkey PointUnits 3 and 4 vital ac power system that could potentially result in the lossof both EDGs due to overloading. In addition, one deficiency was identifiedthat could result in the loss of all ac power to Unit 4. Turkey Point Units 3and 4 share two EDGs. Simplified diagrams of part of the Turkey Point 3 & 4electrical distribution system are provided as Figures 1 and 2.One design deficiency involved a "swing bus." As shown on Figure 1, 480 voltMCC "D" is normally supplied from EDG "B" but will shift its power supply toEDG "A" if needed. MCC "D" also feeds a non-safety stub bus through a singlecircuit breaker. This breaker is normally opened by the 48 load sequencer toisolate the non-safety loads from MCC "D" when the 48 4160V bus is loaded onEDG "B". A single failure in that circuit breaker would leave the non-safetyloads connected to MCC "D". During safety injection for one unit, the addi-tional non-safety loads could overload EDG "B", possibly resulting in a tripof this EDG. MCC "D" would then transfer its power supply and could overloadEDG "A" as well.8608130578 IN 86-70August 18, 1986 In addition to the above design deficiency, five deficiencies in the EDG loadevaluation were found, each of which could contribute to an overloading of bothEDGs. Both EDGs could be overloaded in the event of a safety injection on oneunit and a loss of offsite power to both units. In some cases this could occurwithout a single failure. These deficiencies are as follows:0 The post-TMI Emergency Operating Procedures require an additional chargingpump and high head safety injection pump in the 1-30 minute and 30-60minute EDG load interval, respectively.o In the event of a single failure of one EDG, actual testing of componentcooling water and intake cooling water showed that pump loads (KW) werehigher than expected. Under this condition, the cooling water pumps provideflow to parallel hydraulic trains. Since the flow resistance is lower,the pump flow rate is greater and the pump motor horsepower would increase.This in turn may increase the load on the EDG to an unacceptable value.o Recent environmental qualification evaluations per 10 CFR 50.49 assumedthat the emergency containment coolers operate longer than previouslyassumed.0 Load center transformer losses had not been accounted for in prior EDGload evaluations.o Some nonsafety loads that are auto-start enabled when the safety injectionsignal is reset could result in EDG overloading. These loads would notalways immediately start, but would auto-start when their start setpointswere reached after the reset.In addition to the overloading deficiencies above, a design deficiency. was foundthat could result in the loss of one EDG, and at the same time could result inthe loss of all ac power to Unit 4 as mentioned earlier. In the event of asingle failure of the 4A battery or the 4A load sequencer subsequent to a lossof off-site power, the 4A 4160V bus shown in Figure 2 would be prevented fromautomatically loading onto the "A" EDG. It would also prevent the transfer ofthe 4A MCC swing bus from 4A load center to 4B load center. The "B" EDG has aself-contained supply of fuel oil that lasts about one hour. After that time,fuel must be gravity supplied by the day tank via a solenoid operated valve.However, this valve is powered from MCC 4A. Therefore, the above mentionedsingle failure would also cause the loss of the "B" EDG and the loss of all acpower to Unit 4. The Unit 3 3B 4160V bus would also be deenergized, along withthree of the four high head safety injection pumps and the control roomair-conditioning.Discussion:The single failure vulnerability of the non-safety stub bus discussed above mayhave been evaluated during the licensing review and the loads on the EDGs foundto be low enough so that failure of the stub bus breaker would not overload thediesel. Subsequent to initial operation, however, additional loads have been | ||
IN 86-70August 18, 1986 added on the diesels. Prior to November, 1985, there was the potential forloading the EDGs to 3544 kw in the 1-30 minute period and 3451 in the 30-60minute period following a LOCA in one unit with a loss of offsite power in bothunits. These load levels exceed the highest FSAR value (1/2 hour exceptionalrating) of 3050 Kw by a substantial margin. With the EDGs overloaded, thepotential exists that safety-related loads would not start or would not operateat design ratings. Under these conditions, the EDG engines could stall anddamage to the generator and/or engine could occur. There are no test dataavailable to demonstrate that the EDGs could accept the above load levels.As an interim solution to the above design deficiencies, FP&L disabled theautomatic transfer between EDGs and established a dedicated operator to takecorrective action (i.e., manipulate appropriate breakers) as necessary. Thelicensee has now modified EDG loads, loading sequences and plant procedures.This example illustrates the importance of reviewing EDG load limits under allpossible operating configurations for a range of design basis accident condi-tions. FP&L, through an FMEA, system testing, and evaluation of EDG load limits,found design deficiencies that may have prevented one or both EDG's fromperforming their required function.No specific action or written response is required by this information notice.If you have any questions about this matter, please contact the RegionalAdministrator of the appropriate regional office or this office.Jordan, DirectorDivisi of Emergency Preparednessand Engineering ResponseOffice of Inspection and EnforcementTechnical Contacts: Henry Bailey, IE(301) 492-9006Joseph Giitter, IE(301) 492-9001Attachments:1. Figures 1 and 2, Turkey Point -Units 3 & 4*2. List of Recently Issued IE Information Notices | |||
1. Figures 1 and 2, Turkey Point -Units 3 & 4*2. List of Recently Issued IE Information Notices Attachment 1IN 86-70August 18, 1986 FIGURE 1TURKEY POINT -UNITS 3 E 4EDG "B"I)LOAD CENTERS480V 4C3D 480V* hN.C.N.C.480VMCC DNON-SAFETYSAFETYUNIT 3UNIT 4'Simplified Diagram of Portion of Electrical Distribution | |||
Attachment 1IN 86-70August 18, 1986 FIGURE 1TURKEY POINT -UNITS 3 E 4EDG "B"I)LOAD CENTERS480V 4C3D 480V* hN.C.N.C.480VMCC DNON-SAFETYSAFETYUNIT 3UNIT 4'Simplified Diagram of Portion of Electrical Distribution System. | |||
Attachment 1IN 86-70August 18, 1986 FIGURE 2TURKEY POINT -UNITSIf3 & 4*EDG "'A"/-\ 4160V 3A3B 4160VEDG 'B"4160V 4A4B 4160VI)I3SSiCl38Si4ASi4BSiLOAD CENTERS480V 4A4D 480VN.O.N.O.480VNON-SAFETYSAFETY"B1 EDGAUXILIARIES'Simplified Diagram of Portion of Electrical Distribution System. | |||
Attachment 2IN 86-70August 18, 1986LIST OF RECENTLY ISSUEDIE INFORMATION NOTICESInformation Date ofNotice No. Subject Issue Issued to86-6986-6886-6786-6686-65Scram Solenoid Pilot Valve 8/18/86(SSPV) Rebuild Kit ProblemsStuck Control Rod 8/15/86Portable Moisture/Density 8/15/86Gauges: Recent Incidents -AndCommon Violations Of Require-ments For Use, Transportation,And StoragePotential For Failure Of 8/15/86Replacement AC Coils SuppliedBy The Westinghouse ElectricCorporation For Use In ClasslE Motor Starters AndContractorsMalfunctions Of ITT Barton 8/14/86Model 580 Series SwitchesDuring Requalification TestingDeficiencies In Upgrade 8/14/86Programs For Plant EmergencyOperating ProceduresLoss Of Safety Injection 8/6/86CapabilityPotential Problems In West- 7/31/86inghouse Molded Case CircuitBreakers Equipped With AShunt TripFailure Of Auxiliary Feed- 7/28/86water Manual Isolated ValveAll BWR facilitiesholding an OL or CPAll BWRholdingAll NRC licenseesauthorized to possess,use, transport, andstore sealed sourcesAll power reactorfacilities holdingan OL or CPAll power reactorfacilities holdingan OL or CPAll power reactorfacilities holdingan OL or CPAll PWR facilitiesholding an OL or CPAll power reactorfacilities holdingan OL or CPAll power reactorfacilities holdinga CPfacilitiesan OL or CP86-6486-6386-6286-61OL = OperatinG LicenseCP = Construction Permit | |||
}} | |||
{{Information notice-Nav}} | {{Information notice-Nav}} |
Revision as of 18:41, 6 April 2018
SSINS No.: 6835IN 86-70UNITED STATESNUCLEAR REGULATORY COMMISSIONOFFICE OF INSPECTION AND ENFORCEMENTWASHINGTON, D.C. 20555August 18, 1986IE INFORMATION NOTICE NO. 86-70: POTENTIAL FAILURE OF ALL EMERGENCYDIESEL GENERATORS
Addressees
- All nuclear power reactor facilities holding an operating license or aconstruction permit.
Purpose
- This notice informs recipients of multiple design deficiencies in a vital acpower system that could potentially result in the loss of all emergency dieselgenerators (EDGs). It is expected that recipients will review the informationfor applicability to their facilities and consider actions, if appropriate, topreclude a similar problem occurring at their facilities. However, suggestionscontained in this information notice do not constitute NRC requirements; there-fore, no specific action or written response is required.
Description of Circumstances
- On June 10, 1986, in accordance with 10 CFR Part 21, Florida Power & Light(FP&L) reported the results of a failure modes and effects analysis (FMEA).This analysis identified multiple design deficiencies in the Turkey PointUnits 3 and 4 vital ac power system that could potentially result in the lossof both EDGs due to overloading. In addition, one deficiency was identifiedthat could result in the loss of all ac power to Unit 4. Turkey Point Units 3and 4 share two EDGs. Simplified diagrams of part of the Turkey Point 3 & 4electrical distribution system are provided as Figures 1 and 2.One design deficiency involved a "swing bus." As shown on Figure 1, 480 voltMCC "D" is normally supplied from EDG "B" but will shift its power supply toEDG "A" if needed. MCC "D" also feeds a non-safety stub bus through a singlecircuit breaker. This breaker is normally opened by the 48 load sequencer toisolate the non-safety loads from MCC "D" when the 48 4160V bus is loaded onEDG "B". A single failure in that circuit breaker would leave the non-safetyloads connected to MCC "D". During safety injection for one unit, the addi-tional non-safety loads could overload EDG "B", possibly resulting in a tripof this EDG. MCC "D" would then transfer its power supply and could overloadEDG "A" as well.8608130578 IN 86-70August 18, 1986 In addition to the above design deficiency, five deficiencies in the EDG loadevaluation were found, each of which could contribute to an overloading of bothEDGs. Both EDGs could be overloaded in the event of a safety injection on oneunit and a loss of offsite power to both units. In some cases this could occurwithout a single failure. These deficiencies are as follows:0 The post-TMI Emergency Operating Procedures require an additional chargingpump and high head safety injection pump in the 1-30 minute and 30-60minute EDG load interval, respectively.o In the event of a single failure of one EDG, actual testing of componentcooling water and intake cooling water showed that pump loads (KW) werehigher than expected. Under this condition, the cooling water pumps provideflow to parallel hydraulic trains. Since the flow resistance is lower,the pump flow rate is greater and the pump motor horsepower would increase.This in turn may increase the load on the EDG to an unacceptable value.o Recent environmental qualification evaluations per 10 CFR 50.49 assumedthat the emergency containment coolers operate longer than previouslyassumed.0 Load center transformer losses had not been accounted for in prior EDGload evaluations.o Some nonsafety loads that are auto-start enabled when the safety injectionsignal is reset could result in EDG overloading. These loads would notalways immediately start, but would auto-start when their start setpointswere reached after the reset.In addition to the overloading deficiencies above, a design deficiency. was foundthat could result in the loss of one EDG, and at the same time could result inthe loss of all ac power to Unit 4 as mentioned earlier. In the event of asingle failure of the 4A battery or the 4A load sequencer subsequent to a lossof off-site power, the 4A 4160V bus shown in Figure 2 would be prevented fromautomatically loading onto the "A" EDG. It would also prevent the transfer ofthe 4A MCC swing bus from 4A load center to 4B load center. The "B" EDG has aself-contained supply of fuel oil that lasts about one hour. After that time,fuel must be gravity supplied by the day tank via a solenoid operated valve.However, this valve is powered from MCC 4A. Therefore, the above mentionedsingle failure would also cause the loss of the "B" EDG and the loss of all acpower to Unit 4. The Unit 3 3B 4160V bus would also be deenergized, along withthree of the four high head safety injection pumps and the control roomair-conditioning.Discussion:The single failure vulnerability of the non-safety stub bus discussed above mayhave been evaluated during the licensing review and the loads on the EDGs foundto be low enough so that failure of the stub bus breaker would not overload thediesel. Subsequent to initial operation, however, additional loads have been
IN 86-70August 18, 1986 added on the diesels. Prior to November, 1985, there was the potential forloading the EDGs to 3544 kw in the 1-30 minute period and 3451 in the 30-60minute period following a LOCA in one unit with a loss of offsite power in bothunits. These load levels exceed the highest FSAR value (1/2 hour exceptionalrating) of 3050 Kw by a substantial margin. With the EDGs overloaded, thepotential exists that safety-related loads would not start or would not operateat design ratings. Under these conditions, the EDG engines could stall anddamage to the generator and/or engine could occur. There are no test dataavailable to demonstrate that the EDGs could accept the above load levels.As an interim solution to the above design deficiencies, FP&L disabled theautomatic transfer between EDGs and established a dedicated operator to takecorrective action (i.e., manipulate appropriate breakers) as necessary. Thelicensee has now modified EDG loads, loading sequences and plant procedures.This example illustrates the importance of reviewing EDG load limits under allpossible operating configurations for a range of design basis accident condi-tions. FP&L, through an FMEA, system testing, and evaluation of EDG load limits,found design deficiencies that may have prevented one or both EDG's fromperforming their required function.No specific action or written response is required by this information notice.If you have any questions about this matter, please contact the RegionalAdministrator of the appropriate regional office or this office.Jordan, DirectorDivisi of Emergency Preparednessand Engineering ResponseOffice of Inspection and EnforcementTechnical Contacts: Henry Bailey, IE(301) 492-9006Joseph Giitter, IE(301) 492-9001Attachments:1. Figures 1 and 2, Turkey Point -Units 3 & 4*2. List of Recently Issued IE Information Notices
Attachment 1IN 86-70August 18, 1986 FIGURE 1TURKEY POINT -UNITS 3 E 4EDG "B"I)LOAD CENTERS480V 4C3D 480V* hN.C.N.C.480VMCC DNON-SAFETYSAFETYUNIT 3UNIT 4'Simplified Diagram of Portion of Electrical Distribution System.
Attachment 1IN 86-70August 18, 1986 FIGURE 2TURKEY POINT -UNITSIf3 & 4*EDG "'A"/-\ 4160V 3A3B 4160VEDG 'B"4160V 4A4B 4160VI)I3SSiCl38Si4ASi4BSiLOAD CENTERS480V 4A4D 480VN.O.N.O.480VNON-SAFETYSAFETY"B1 EDGAUXILIARIES'Simplified Diagram of Portion of Electrical Distribution System.
Attachment 2IN 86-70August 18, 1986LIST OF RECENTLY ISSUEDIE INFORMATION NOTICESInformation Date ofNotice No. Subject Issue Issued to86-6986-6886-6786-6686-65Scram Solenoid Pilot Valve 8/18/86(SSPV) Rebuild Kit ProblemsStuck Control Rod 8/15/86Portable Moisture/Density 8/15/86Gauges: Recent Incidents -AndCommon Violations Of Require-ments For Use, Transportation,And StoragePotential For Failure Of 8/15/86Replacement AC Coils SuppliedBy The Westinghouse ElectricCorporation For Use In ClasslE Motor Starters AndContractorsMalfunctions Of ITT Barton 8/14/86Model 580 Series SwitchesDuring Requalification TestingDeficiencies In Upgrade 8/14/86Programs For Plant EmergencyOperating ProceduresLoss Of Safety Injection 8/6/86CapabilityPotential Problems In West- 7/31/86inghouse Molded Case CircuitBreakers Equipped With AShunt TripFailure Of Auxiliary Feed- 7/28/86water Manual Isolated ValveAll BWR facilitiesholding an OL or CPAll BWRholdingAll NRC licenseesauthorized to possess,use, transport, andstore sealed sourcesAll power reactorfacilities holdingan OL or CPAll power reactorfacilities holdingan OL or CPAll power reactorfacilities holdingan OL or CPAll PWR facilitiesholding an OL or CPAll power reactorfacilities holdingan OL or CPAll power reactorfacilities holdinga CPfacilitiesan OL or CP86-6486-6386-6286-61OL = OperatinG LicenseCP = Construction Permit