ML19345D320

LER 80-053/01T-1:on 800709,logic Modules on Sequencer Steps 2-5 Tripped Before Being Blocked by Sequencer.Caused by Design Deficiency.Design of Controls Has Been Modified

ML19345D320
Person / Time
Site:	Davis Besse
Issue date:	07/22/1980
From:	Isley T TOLEDO EDISON CO.
To:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
Shared Package
ML19345D319	List: ML19345D318 ML19345D320
References
LER-80-053-01T, LER-80-53-1T, NUDOCS 8012120496
Download: ML19345D320 (3)

Text

NRC Fonfi 30G U.S NUCLEAR REGUL ATORY COMkilSSION (7 f t)

LICENSEE EVENT REPORT CCNTROL BLOCK: l l l l l l l (PLEASE PRINT OR TYPE ALL REQUIRED INFORMATION) i o R l 0& 9l H l LICkNSEE i

D l B CODE l S l 1 l@l 0 l0 l 0 l 0LICLNSE le Ib l0 l 0NwVoEH l 0 l 0 l0 l0 l 046 l@l4 20 l1 l1 l1 l1 l@lbl 4AI LICENSE TVPE JJ l

bd lg CON'T 8

101:1 3{,] l L j@l 0 l 5 l 0 l - l 0 l 3 l 4 l 6 l@l 0 l 7 l 0 l 9 l 8 l 0 l@l0 l 7 l 2 12 l 8 l 080l@

i 8 60 61 DOC A ET NUVSE R bd 69 EVENT DATE 14 75 REPOR T O AT E EVENT DESCRIPTION AND PROBABLE CONSEQUENCES h lO12l l (NP-32-80-11) On 7/9/80 a meeting was held to review the results of the Intenrated I l o la l ISafety Features Actuation System (SFAS) Test. The results indicated a problem in thatl lo14l lsome of ti.a logic modules on sequencer steps 2, 3, 4, and 5_ tripped before beinn l l

lo isl I blocked by the sequencer during an SFAS actuation coincident with a loss of offsite 1 l l

@ l power. This could result in an undesired instantaneous loading of the energency diesell lTlT] l generator and is being reported per T.S. 6.9.1.8.i. There was no danner t._.the publicI l ioggl l or station personnel. The logic design deficiency does not affect normal plant operation.

7 8 9 80 SYSTEM CAUSE CAUSE COMP. VALVE CODE CODE SU8 CODE COMPONENT CODE SUSCODE SUSCODE lol91 lI l B l@ y@ l Al@ l Il Nl S l T l R l U l@ W@ W @ 20 r 7 8 9 to 11 12 IJ 18 19 SEQUE NTI A L OCCURRENCE REPORT REVi$lON EVENT YE AR REPORT NO, CODE TYPE N O.

1l b ,"LE u'[.Ud l R RO 8l 0l l_l l gl 5l 3l y l0l1l {30

[ _J W 22 L_2i 22 22 24 2. 27 28 29 ai NEEN '"CIYEN A

OYltNT 'UUTE" *OURS 22 #* *E"TE POR5"S e.

SUS ""'uNLi7 S uNT[OCTURER lF lgl34Z lg [,_Zjg 33 lM Zl@ l 0l 0l 0l JJ l [ Q 41 lNlg lAl@ lCl5l6l0l@

33 40 42 43 44 41 CAUSE DESCRIPTION AND CORRECTIVE ACTIONS l3lol]The cause of the occurrence is a design deficiency. The unlikely combination of eventsi i i lhad not been accounted for in the logie design. The same signal that trips the actun-1 i, ,,, l tion output modules also starts the sequencer which then tries to block the output i

,,3gl module so that it can load the emergency diesel generator without overloading it with l 1(E lsimultaneous high starting torques. The controls were modified by FCR 80-181. t 8 9 80 STAWS  % POAER OTHER STATUS 015 O RY DISCOVERY DESCRIPTION 32 NA l i 11151 [H JQ l 0] 0l 0l@l l lB[@l Surveillance Test ST 5031.07 A TivlTY CO TENT RETE 4 SED OrRELEASe LOCATION OF RELEASE

()_[_ l [Z j h ]gl NA Av0VNT OP "ACTiviTv l NA @ l l

' ' _ PERSONS'Et ExPOSMES NUU8ER TYPE NA M

10 ' '

l 0 l 0 lhbhl DESCRIPTION l PERSoNNE t lNJURIES NUMB E R QESCRIPTION@

l li lul8 101010 7 9 l@l NA 11 12 80 LOSS OP OR DAMAGE TO FACillTY TYPE D ESCRl* TION y l Z l@l NA l 7 8 9 to 80 ESCRiPTION 2 o te,5UEf@l

[3_ NA l lllllllIIIII!1 68 69 7 8 9 10 h 419-259-5000, Ext. 230 80 5 DVR 80-117 NA. t o ne En Thoman Isley PuoNE: g

TOLEDO EDISON COMPANY DAVIS-BESSE NUCLEAR POWER STATION UNIT ONE SUPPLEMENTAL INFORMATION FOR LER NP- M-80-11 f

DATE OF OCCURRENCE: July 9, 1980 FACILITY: Davis-Besse Unit 1 IDENTIFICATION OF OCCURRENCE: Design deficiency in the Safety Features Actuation System (SFAS) Sequencer Conditions Prior to Occurrence: The unit was in Mode 6, with Power (MRT) = 0 and Load (Gross MWE) = 0.

Description of Occurrence: On July 9, 1980, a meeting was held to review the results of the Integrated SFAS Test, ST 5031.07. Those present were the SEAS vendor, the architect / engineer, and Toledo Edison. It was determined that during the conduct of a portion of the test, involving an SFAS trip coincident with a loss of offsite power that some of the logic modules on sequence steps 2, 3, 4, and 5 tripped before being blocked by the sequencer. This would have allowed some valves to operate to their safety position before their correspor. ding sequence step. It was the premature valve actuations that alerted I&C personnel to the potential malfunction in this logic.

This similarly observed actuation in some original system testing was erroneously ex-plained at that time as due to automatic valve control. It could have niso allowed an undesired instantaneous loading of the diesel generator. It is important that during this unusual set of circumstances thc sequencer block the output module trips initially so that all of tha possible safety loads do not try to start at the same time and ovar-load the emergency diesel generator (EDC) (with high starting torques). The sec.uencer then removes the blocks one at a time and allows the loads to start in their turn which allows the EDG to handle the full load.

This finding is being reported per Technical Specification 6.9.1.8.1 as the discovery of conditions not considered in the safety analysis report that require corrective measures to prevent the existence of an unsafe condition. Luis Reyes, NRC Resident Inspector, was informed at 1500 hours0.0174 days <br />0.417 hours <br />0.00248 weeks <br />5.7075e-4 months <br /> on July 9, 1980. The confirming telecopy to the Region III Office was sent at 0820 hours0.00949 days <br />0.228 hours <br />0.00136 weeks <br />3.1201e-4 months <br /> on July 10, 1980.

Designation of Apparent Cause of Occurrence: The cause of the occurrence is a design deficiency. This unlikely combination of events had not been accounted for in the logic design. On a loss of offsite power, the EDG breaker closes on the bus in approxi-mately 10 seconds. Forty ceconds later, component cooling water (unless it was running) 1l and service water pumps are started on the bus. In the event of a loss of offsite power with SEAS actuation, the major safety equipment is loaded by the sequencer onto the EDG in addition to component cooling water and service water pumpa; high pressure injection pump (600 HP), decay heat pump (400 HP), containment spray pump (200 HP), and contain-ment air cooler (half speed - 40 HP). It can be postulated that during a loss of offsite power with a subsequent trip of SEAS incident level 2 (since the logic modules on sequence step 2 would trip before it could be blocked by the sequencer) that the-high pressure injection pump, containment air cooler, component cooling water pump, and service water pump would start simultaneously resulting in an instantaneous loading of 1640 HP on the EDG. Similarly, in the case of an incident levels 1, 2, and 3 trip, the EDG could experience an instantaneous loading of 2040 HP. In the even more unlikely LER #80-053.

~

m

TOLEDO EDISON COMPANY DAVIS-BESSE NUCLEAR POWER STATION UNIT ONE PAGE 2 SUPPLEMENTAL INFORMATION FOR LER NP-32-80-11 event that all SFAS incident levels trip simultanecusly with an untimely sequencer blocking, the EDG could be instantaneously loaded with 2240 HP. The above loads are the running loads. The starting loads would be as much as two to three times the running loads. Since the EDG is rated at 3600 HP, it would be overloaded if it had to start these loads simultaneously.

When the SFAS incident level conditions are sensed, the same signal that trips the actuation output modules also starts the sequencer. The sequencer then has to in turn block the output modules so that it can load the EDG in a designed orderly manner and prevent a potentially unsafe condition. However, during this approxi-mately 30 millisecond turnaround, these output modules rould already be tripped be-fore they could be blocked which would result in the undesired instantaneous loading.

Analysis of Occurrence: There was no danger to the health and safety of the public or to station personnel. This logic design deficiency does not affect normal plant operation. It would only be of consequence during the most unusual set of circum-stances. It should be emphasized that in real life situations, it is highly improba-ble to experience an incident level 3 trip without prior receipt of an incident level Similarly it is highly unlikely to trip all incident levels simultaneously.

~

2 trip.

Therefore, severe loading of the EDG as identified above is unlikely.

Corrective Action: A Facility Change Request (FCR 80-181) has been implemented which 1 added a 45 to 82 millisecond time delay-to ensure SFAS output logic modules on sequence steps 2, 3, 4 and 5 are properly blocked by the sequencer and do not trip simultaneously during a loss of offsite power. The sequencer will then unblock the trip logic modules and allow the equipment to be loaded on the EDG in the designed order and not create a potentially unsafe overload.

1 Failure Data: There have been no previous reports of this type of sequencer design deficiency.

LER #80-053 f

t f

6 I

• 9

• . g 9

9

) -

'i