ML19330A561

LER 80-053/01T-0:on 800709,meeting Held to Discuss Results of Integrated Safety Features Actuation Sys Test.Some of Logic Modules on Sequencer Steps 2,3,4 & 5 Tripped Before Being Blocked.Caused by Design Deficiency

ML19330A561
Person / Time
Site:	Davis Besse
Issue date:	07/22/1980
From:	Isley T TOLEDO EDISON CO.
To:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
Shared Package
ML19330A554	List: ML19330A553 ML19330A561
References
LER-80-053-01T, LER-80-53-1T, NUDOCS 8007280578
Download: ML19330A561 (3)

Text

- r vi,= .m.

Q.77) ,

LICENSEE EVENT REPORT

.

CONTROL BLOCK: l 1

l l l l l 6

lh (PLEASE PRINT CR TYPE ALL REQUIRED INFCRMATl!N) 7 0 1 8 9 l0lH l D l B l S 14l 1 l@l LICENSEE CODE 15 0 l0 l 0 l LICENSE 0 l 0 NUMdER l 0 l 0 l 0 l0 l0 l250 l@l4 26 l1 l1 l1 l1 l@l57 CAT LICENSE TYPE JO l

68 l@

CCYT

" "'

7 O 1 8

3o RC $l 60 0 l 5 l 0 l-DOCKET 68 l 0 lNUMBER 3 l 4 l6 @l 68 069 l 7 lCVENT 0 l9 DATE l 8 l0 l@l017REPORT 14 75 l2 l DATE 218 l680l@

EVENT DESCRIPTION AND PROBABLE CONSEQUENCES h

[57Tl l (NP-32-80-11) On 7/9/80 a meeting was held to review the results of the Intenrated I o 3 l Safety Features Actuation System (SFAS) Test. The results indicated a problem in thatl o 4 l some of the logic modules on sequencer steps 2, 3, 4, and 5_ tripped before beinn 1 o s i blocked by the sequencer during an SFAS actuation coincident with a loss of offsite I o 6 l power. This could result in an undesired instantaneous loading of the enernency diesell o 7 [ generator and is being reported per T.S. 6.9.1.8.1. There was no danger to the publicl o8 lor station personnel. The logic design deficiency does not affect normal plant opera t ilon.

7 8 9 80 E CODE S BC DE COMPONENT CODE SUSC DE S E 7

o 9 8

lIlB l@ W@ J@ l Il Nl S l Tl R l U l@ W@ W @

9 10 11 12 13 18 19 20

,_ SEQUE NTI AL OCCURRENCE REPORT REVISION LE R/RO EVENTYEAR REPORT NO. CODE TYPE N O.

@ ,atg 8 l 01 si 3l I/l l011l lT I l---J Le_J u

,_ l21810 22 l 23 24 26 27 28 29 30 31 32 KN A 10 ON PL NT ME HOURS 22 S 8 iT FOR1 8. SUPPLl MAN FACTURER lF lggg [5 Zg 33 34 3 ]6@

3 l0l0l0l-l 31 40 g g W g lAl@ lCl5l6l0l@

41 42 43 44 47 CAUSE DESCRIPTION AND CORRECTIVE ACTIONS h iTTF1 IThe cause of the occurrence is a design deficiency. The unlikely combination of eventsl i i lhad not been accounted for in the logic design. The same signal that trips the actua-I

, 7 l tion output modules also starts the sequencer which then tries to block the output l

, 3 l module so that it can load the emergency diesel generator without overloading it with l 1 4 j oimultaneous high starting torques. The controls will be modified during this outage.]

7 8 9 80 ST S  % POWER OTHER STATUS DIS O / RY DISCOVERY DESCRIPTION 32

'

1 s [Hj@ l0l0l0l@l

'

NA l lB[@l Eurveillance Test ST 5031.07 l

' ACTIVITY cOSTENT

f. ELE 4. SED OF RELE ASE AMOUNT OF ACTIVITY LOCATION oF RELE ASE 1 6

' * ,,

[Z j @ '[Zj ,

l NA l l NA - l

'

PER$oNNEL EXPOSURES NUMBER TYPE DESCRIPTION 1 7 l 0 l 0 l 0 l@l Z l@l NA l

' ' * ' 13 80 PERSONNE'L inau' dies NUMBER DESCRIP TION t

7

-4 8 9 l 0 l 0 l 0 l@l12NA 11 l

80 LOSS OF OR DAMAGE TO FACILITY TYPE DESCRIPTION l' 1 9 NA 7 8 9

@l10 l 80

"" "S" "'"

2 o bL iSSuEf81 oESCRiPilon @ '

NA 7280 5 7 7 l l l l l l l l l l l l l l80:}~.

7 8 9 30 68 69 DVR 80-117 NAME OF PREPARER omas IS M NOE fL

,

,

TOLEDO EDISON COMPANY DAVIS-BESSE NUCLEAR POWER STATION UNIT ONE SUPPLEMENTAL INFORMATION FOR LER NP-32-80-11 s

.

'

DATE OF OCCORRENCE: July 9, 1980 FACILITY: Davis-Besse Unit 1 IDENTIFICATION OF OCCURRENCE: Design deficiency in the Safety Features Actuation System (SEAS) Sequencer Conditions Prior to Occurrence: The unit was in Mode 6, with Power (MWT) = 0 and Load (Gross MWE) = 0.

Description of Occurrence: On July 9, 1980, a reeting was held to review the results of the Integrated SFAS Test, ST 5031.07. Those present were the SFAS vendor, the architect / engineer, and Toledo Edison. It was determined that during the conduct of a portion of the test, involving an SFAS trip coincident with a loss of offsite power that some of the logic modules on sequence steps 2, 3, 4, and 5 tripped before being blocked by the sequencer. This would have allowed some valves to operate to their safety pos'ition before their corresponding se' uence q step. It was the premature valve actuations that alerted I&C personnel to the potential malfunction in this logic.

This similarly observed actuation in some original system testing was erroneously ex-plained at that time as due to automatic valve control. It could have also allowed an undesired instantaneous loading of the diesel generator. It is important that during this unusual set of circumstances the sequencer block the output module trips initially so that all of the possible safety loads do not try to start at the same time and over-load the emergency diesel generator (EDS) (with high starting torques). The sequencer then removes the blocks one at a time and allows the loads to start in their turn which allows the EDG to handle the full load.

This finding is being reported per Technical Specification 6.9.1.8.1 as the discovery of conditions not considered in the safety analysis report that require corrective measures to prevent the existence of an unsafe conditf.an. Luis Reyes, NRC Resident Inspector, was informed at 1500 hours0.0174 days <br />0.417 hours <br />0.00248 weeks <br />5.7075e-4 months <br /> on July 9, 1980. The confirming telecopy to the Region III Office was sent at 0820 hours0.00949 days <br />0.228 hours <br />0.00136 weeks <br />3.1201e-4 months <br /> on July 10, 1980.

Designation of Apparent Cause pf Occurrence: The cause of the occurrence is a design deficiency. This unlikely combination of events had not been accounted for in the logic design. On a loss of offsite power, the EDG breaker closes on the bus in approxi-mately 10 seconds. Forty seconds later, component cooling water (unless it was running) and service water pumps are started on the bus (with or without an SEAS trip). In the event of a loss of offsite power with SEAS actuation, the major safety equipment is loaded by the sequencer onto the EDG in addition to component cooling water and service water pumps; high pressure injection pump (600 HP), decay heat pump (400 HP), contain-ment spray pump (200 HP), and containment air cooler (half speed - 40 HP). It can be postulated that during a loss of offsite power with a subsequent trip of SFAS incident level 2 (since the logic modules on sequence step 2 would trip before it could be blocked by the sequencer) that the high pressure injection pump, containment air cooler, component cooling water pump, and service water pump would start simultaneously resulting in an instantaneous loading of 1640 HP on the EDG. Similarly..in the case cf an incident levels 1, 2,.and 3 trip, the EDG could experience an instantaneous

'

LER #80-053

-~

= .-.

e

.

• TOLEDO EDISON COMPANY DAVIS-BESSE NUCLEAR POWER STATION UNIT ONE SUPPLEMENTAL INFORMATION FOR LER NP-32-80-11 PAGE 2 a

,

1cading of 2040 HP. In the even more unlikely event that all SEAS incident levcis trip simultaneously with an untimely. sequencer blocking, the EDG could be instan-t neously loaded with 2240 HP. The above loads are the running loads. The start-ing loads would be as much as two to three times the running loads. Since the EDG is rated at 3600 HP, it would be overloaded if it had to start these loads simul-taneously.

When the SFAS incident level conditions are sensed, the same signal that trips the cctuation output modules also starts the sequencer. The sequencer then has to in turn block the output modules so that it can load the EDG in a designed orderly manner and prevent a potentially unsafe condition. However, during this approxi-mately 20 millisecond turnaround, these output modules would already be tripped be- ,

fcre they could be blocked which would result in the undesired instantaneous loading.

Analysis of Occurrence: There was no danger to the health and safety of the public "

or to station personnel. This logic design deficiency dces not affect normal plant cperation. It would only be of consequence during the most unusual set of circum-ctances. It should be emphasized that in real life situations, it is highly improba-ble to experience an incident level 3 trip without prior receipt of an incidcnt level 2 trip. Similarly, it is highly unlikely to trip all incident levels simultaneously.

Therefore, severe loading of the EDG as identified above is unlikely.

Corrective Action: A Facility Change Request (FCR 80-181) has been initiated to add

,

a 25 millisecond time delay to ensure SEAS output logic modules on sequence steps 2, 3, 4, and 5 are properly blocked by the sequencer and do not trip simultaneously during a loss of offsite power. The sequencer will then unblock the trip logic

modules and allow the equipment to be loaded on the EDG in the designed order and not create a potentially unsafe overload. The sequencers circuitry was declared  !-

,

'

inoperable and will be modified during this refueling outage prior to entry into Hbde 4.

Failure Data: There have been no previous reports of this type of sequencer design d2ficiency.

.

LER #80-053 l

l

.

e

"