ML20210L488
| ML20210L488 | |
| Person / Time | |
|---|---|
| Issue date: | 03/14/1986 |
| From: | Leeds E NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | |
| Shared Package | |
| ML20210L468 | List: |
| References | |
| TASK-AE, TASK-E604 AEOD-E604, NUDOCS 8604290352 | |
| Download: ML20210L488 (22) | |
Text
/
- ,, 4 AE00 ENGINEERING EVALUATION REPORT 1/
UNIT: Multiple BWRs EE REPORT N0.: AE0D/E604 DOCKET N0.: Multiple BWRs DATE: March 14, 1986
- LICENSEE
- Multiple BWRs EVALUATOR / CONTACT: E. Leeds
SUBJECT:
SPURIOUS SYSTEM ISOLATIONS CAUSED BY THE PANALARM MODEL 86 THERM 0 COUPLE MONITOR
SUMMARY
Recent events involving spurious system isolations at various nuclear power plants were collected and reviewed. The system isolations were comonly caused by spurious trips of the Model 86 thermocouple monitor manufactured by the Panalarm Division of the Ametek Company. The study found that the elevated sensitivity of the Model 86 thermocouple monitor makes the instrument hiply susceptible to spurious trips caused by momentary disturbances to the electr-ical circuitry. The spurious system isolations caused by the instruments are undesirable because of the potentially adverse impacts on system reliability, isolation valve operability, and the distractions presented to the plant operating personnel. A design modification to the leak detection system trip circuitry at the Duane Arnold Energy Center has proven successful in preventing i spurious system isolations. The study suggests that the Office of Inspection and Enforcement consider issuing an information notice which discusses the spurious system isolations caused by the Model 86 thermocouple monitor and describes the design modification implemented at Duane Arnold as a possible corrective action.
INTRODUCTION Recently, a number of events have been reported which involve the spurious actuation of various nuclear power plants isolation systems. The cause of the :
reported isolations was frequently attributed to a spurious trip of a thermo-couple monitor manufactured by the Panalarm Division of the Amatek Company.
The thermocouple involved in these events is widely used in leak detection systems at boiling water reactors (BWRs). As a result of the recent events, a study was initiated to collect and review these and all similar events. The ,
purpose of the study was to assess the extent to which such events have occurred, their underlying cause(s) and the corrective action (s) which might be taken to prevent recurrences. The study discusses the Panalarm Model 86 thermocouple monitor and evaluates the potential adverse effects of spurious system isolations attributed to the instrument. The study also evaluates a design modification
, implemented at the Duane Arnold Energy Center which has proven effective in i preventing spurious system isolations caused by the thermocouple monitor installed at the Duane Arnold plant.
l 1/ This docurent supports ongoing AE0D and NRC activities and does not !
represent the position or requirements of the responsible NRC program I office.
l 8604290352 860314 NEXD PDR ORG
- _ . - _ _ .--~ _ _ ,_ - - - - ~ _ _, ._ ~ .- -
~
DISCUSSION Operational Data To perform the study, a search of the Sequence Coding and Search System (SCSS)
Licensing Event Report (LER) data base was conducted. The LER data base was searched for spurious system isolations involving the Ametek Panalarm Division Model 86 thermocouple monitor used in a BWR leak detection systems. Prior manufacturers or distributors of the Model 86 thermocouple monitor, such as the Scam Instrument Corporation anci Riley Panalarm Company, were also included in the data search.
A summary of each of the events collected from this search is presented in Appendix A. The summary information for each event includes the plant name, the event date, the system involved and a brief description of the event. The event description includes the event cause, the system response and the corrective actions taken to prevent recurrence.
Analysis of Events The Model 86 themocouple monitor consists of three major components: (1) a point module, which contains the appropriate thermocouple for each area monitored; (2) an optional meter module, which permits reading the actual temperatures monitored; and (3) a thermocouple monitor, which amplifies the output of the thermocouple (s). Thermocouple amplification is sufficient to perform either or both of two functions: (a) produce a visual output (i.e.,
illuminate an indicatina lamp) any time the temperature being monitored is in analarmconditionand(b)closerelaycontactswheninanalarmcondition.
The monitoring function is performed continuously and is independent of the operation of any controls. The indication depends upon the operation of a
" READ / SET" switch which causes the outputs of each point module to be indicated by the respective meter module.
Thirty-one LERs involving a spurious actuation of an isolation system at an operating BWR were found and evaluated for this study. Only events from 1984 and 1985 were found, even though the LER search included LERs as far back as 1981. This result was attributed to the change in LER reporting requirements which took effect on January 1, 1984. Prior to 1984, events involving a safety system actuation (e.g., a system isolation) did not have to Se renorted if the system (or component) fulfilled its safety function. The new LER rule requires that all safety system actuations be reported. Thus, the recent data was taken
'to be representative of earlier operating experience rather than a trend involving increasing frequency of events over time.
Although the spurious isolations occurred at different plants and involved different systems, the event reports contained a number of similarities in the circumstances leading to the spurious system isolations. In general, the event reports described four different kinds of scenarios involving monitor trips which led to a spurious system isolation. They.were:
Trips caused by operation of the monitor's " READ / SET" switch (13 events).
~
Trips caused by isolation signals generated when working on nearby equipment (5 events).
Trips caused by ' electrical spikes' or ' noise' in the circuit (4 events).
Trips caused for unknown or unidentified reasons (8 events).
In addition, one event, a spurious isolation of the Reactor Water Cleanup (RWCU) system at laSalle-2 was attributed to an actual high differential temperature condition in a RWCU system pump room. It was believed that the high differential temperature was caused by heat from an operating RWCU system pump in combination with cool outside air entering the pump room. This was the only valid trip of the thermocouple monitor found by the data search.
Commonwealth Edison, the licensee for LaSalle-2, subsequently submitted a technical specification change involving the deletion 'of the requirement for local ambient temperature leak detection in the RWCU system pump rooms.
The most frequent cause reported for spurious isolation of the Reactor Core Isolation Cooling (RCIC) system and the RWCU system was an isolation signal generated when the position of the thermocouple monitor's READ / SET selector switch was changed. The READ / SET selector switch allows the actual and trip set temperatures to be displayed on a meter. This is accomplished by placing the switch in the " READ" or the " SET" position. At the plants reporting isolations, authorized personnel routinely use this switch to take ambient and differential temperature readings in the RCIC and RWCU system equipment rooms.
At two of the four plants that experienced this problem [i.e., Grand Gulf and Washington Public Power Supply Unit 2 (WPPS-2)), the licensees' corrective actions consisted of revising the operating procedures involved so as to require bypassing the trip logic when taking temperature readings. However, spurious isolations which occurred subsequent to these procedural changes led the licensee to initiate actions to find a suitable replacement for the Model 86 thermocouple monitor. Spurious RWCU system isolations during position changes of the READ / SET selector switch has also been reported at LaSalle-2 and River Bend-1. However, the root cause of the spurious isolations at both plants is still under investigation.
Several isolations of the RWCU system at Limerick-1 and LaSalle-2 were attributed to a thermocouple monitor spurious trip signal generated while msintenance personnel were performing surveillance tests on equipment mounted in the same cabinet as the thermocouple monitors. One of the LaSalle-2 events was attributed to an electrical ' spike' which was generated when a RWCU leak detection system thermocouple wire w n moved by an instrument mechanic while attaching test leads for adjacent equipment. In each of the other four similar events reported (two at Limerick and two at LaSalle), no specific cause of the system isolation was cited. However, it was observed and reported in the LERs j that the surveillance testing was being performed on equipment located in the
. .. -s . ,
- Trips caused by operation of the monitor's " READ / SET" switch (13 events).
- Trips caused by isolation signals generated when working on nearby equipment (5 events).
Trips caused by ' electrical spikes' or ' noise' in the circuit (4 events).
Trips caused for unknown or unidentified reasons (8 events).
In addition, one event, a spurious isolation of the Reactor Water Cleanup (RWCU) system at LaSalle-2 was attributed to an actual high differential temperature condition in a RWCU system pump room. It was believed that the high differential temperature was caused by heat from an operating RWCU system pump in combination with cool outside air entering the pump room. This was the only valid trip of the thermocouple monitor found by the data search.
Commonwealth Edison, the licensee for LaSalle-2, subsequently submitted a technical specification change involving the deletion of the requirement for local ambient temperature leak detection in the RWCU system pump rooms.
The most frequent cause reported for spurious isolation of the Reactor Core Isolation Cooling (RCIC) system and the RWCU system was an isolation signal generated when the position of the thermocouple monitor's READ / SET selector switch was changed. The READ / SET selector switch allows the actual ard trip set temperatures to be displayed on a meter. This is accomplished by placing the switch in the " READ" or the " SET" position. At the plants reporting isolations, authorized personnel routinely use this switch to take ambient and differential temperature readings in the RCIC and RWCU svstem equipment rooms.
At two of the four plants that experienced this problem li.e., Grand Gulf and Washington Public Power Supply Unit 2 (WPPS-2), the licensees' corrective actions consisted of revising the operating procedures involved so as to require bypassing the trip logic when taking temperature readings. However, spurious isolations which occurred subsequent to these procedural changes led the licensee to initiate actions to find a suitable replacement for the Model 86 thermocouple monitor. Spurious RWCU system isolations during position changes of the READ / SET selector switch has also been reported at LaSalle-2 and River Band-1. However, the root cause of the spurious isolations at both plants is still under investigation.
Several isolations of the RWCU system at Limerick-1 and LaSalle-2 were attributed to a thermocouple monitor spurious trip signal generated while maintenance personnel were performing surveillance tests on equipment mounted in the same cabinet as the thermocouple monitors. One of the LaSalle-2 events was attributed to an electrical ' spike' which was generated when a RWCU leak detection system thermocouple wire was moved by an instrument mechanic while attaching test leads for adjacent equipment. In each of the other four similar events reported (two at Limerick and two at LaSalle), no specific cause of the system isolation was cited. However, it was observed and reported in the LERs that the surveillance testing was being perfonned on equipment located in the
- same cabinet as the thermocouple monitors. Furthermore, for the Limerick events, it was specifically stated that the electrical circuit being tested was not connected to the RWCU system leak detection system logic circuitry. ,
However, the root cause of the spurious system isolations at both LaSalle and Limerick remain unresolved.
At Duane Arnold, three spurious isolations involving the High Pressure Coolant Injection (HPCI) system and the RWCU system, were attributed to noise or an electrical spike generated by the thermocouple monite . In two of the events, the root cause of the electrical spike could not be c termined. Similarly, at Fermi-2, a spurious RWCU system isolation was also attributed to an electrical' i spike generated by the instrument. However, the root cause for this event also could not be determined.
ROOT CAUSE ANALYSIS 3 On July 14, 1984, with the Duane Arnold reactor in the startup mode, a degraded voltage condition on the offsite power grid resulted in an automatic switchover of the essential buses from offsite to onsite power. As designed, the reactor protection system (RPS) logic de-energized initiating a scram. All required i systems operated as designed and the two diesel generators picked up the essential loads. During the event, the HPCI system inboard steam supply valve unexpectedly closed on a spurious isolation signal from the steam leak detection system (SLDS). ,
The Iowa Electric Power and Light Company (the licensee), using special ,
diagnostic testing equipment, initiated a thorough investigation of the event in an attempt to pinpoint the root cause of the HPCI isolation. The discussion, which follows, provides a description of the results of the investigation and the corrective actions which were taken to prevent recurrence. The discussion begins with a description of the Duane Arnold HPCI steam leak detection system design and operation.
At Duane Arnold, the HPCI SLDS logic has two essentially identical (' A' and :
'B') logic trains (see Fig.1). The 'A' logic train initiates closure of the inboard steam supply isolation valve and the 'B' logic train initiates closure of the outboard isolation valve. Each looic train contains two ambient tempera-ture switches and two differential temperature switches which are wired in parallel and located in two separate areas of the reactor building. Each switch acts as a permissive for energizing the downstream K4 relay. Half of each logic train consists of a HPCI equipment room differential temperature switch (TDS-2260A or B) wired in parallel with a HPCI equipment room ambient tempera-ture switch (TS-2261A or B). The other half of each logic train consists of a suppression pool area ambient temperature switch (TS-2526C or D) wired in parallel with a suppression pool area differential temperature switch (TDS-2521 C or D). This results in a one-out-of-four logic for each train.
The K4 relay closes contacts in the HPCI isolation logic, which energizes another relay (not shown) that in turn results in the sealing-in of the close signal for the associated HPCI steam supply containment isolation valve.
Momentary closure of a temperature switch or a differential temperature switch '
in the HPCI equipment room energizes the K4 rela y.~ which results in closure pf
K2h q --
Spurious isolation A Signal Source on Power-Up Annunciator in Control Room
- Suppression Pool i Area High T & dT HPCI Equipment Room TDS-2521 High T & dT TS- E C or D TS-2261 TDS-2260 A or B A or B 120 VAC New K2 Relay Changed i 60 hr Contacts Out to Agastat ui Essential Buses [
- Added 15 Minute With One Second
- ,,. Timer Time Delay e
Relay to HPCI K4 isolation Logic With Downstream Seal In (Existing)
FIGURE 1: HPCI STEAM LEAK DETECTION SYSTEM - Following Design Change (A and B Sides Are identical)
4 the associated HFCI steam supply containment isolation valve. A 15-minute timer is installed in the logic circuit in series with.the suppression pool area switches. As a result, either a temperature switch or differential temperature switch must stay closed for at least 15 minutes before the K4 relay will j i energize. Due to this significant time delay, these suppression pool area l instruments were eliminated as the cause of the spurious HPCI isolation event which occurred on July 14, 1985.
! In contrast to the RPS, the HPCI steam leak detection system requires. .
L electrical power for operability since the circuits are energized on a trip
- condition. The power is provided by separate AC essential buses for each SLDS train. A loss and restoration of power to the trip system should not, in and j of itself, cause a trip of the actuation circuitry. However, it was determined
, that the trip signal may have originated in either one or both of the two j differential temperature switches in the SLDS logic, i Following the July 14 event, plant personnel developed a special test procedure j to evaluate the response of the thermocouple monitors for the HPCI SLDS 'A' j logic train. The special test was conducted on October 15, 1984,.while the-1 reactor was shutdown for a planned maintenance outage. At the time of the j test, reactor vessel pressure was below the pressure at which the HPCI system j is required to be operable by technical. specifications. By procedure, test i
personnel de-energized the instruments in the 'A' logic train (which controls the inboard HPCI system steamline isolation valve) and restored power 4
approximately 10 seconds later. This sequence was intended to simulate the conditions of the spurious HPCI isolation event which occurred on July 14, j 1984. Three runs of the test were performed. On the first and third trials, '
- the suspected switches (TS-2261A and TDS-2260A) closed upon restoration of 1
power but then quickly reopened. The momentary closure of switches with the i circuit energized resulted in a short duration isolation signal which was sealed in by the HPCI SLDS. The second test produced no isolation signal, i however.
I j The licensee concluded that the test results clearly showed that an isolation signal would likely be generated by the HPCI SLDS temperature; instruments upon .
re-energizing the SLDS circuit after a loss of power. The licensee also
~ ~ ~~
i
- concluded that the instruments in the 'B' logic train did not trip during the-July 14, 1985 loss of offsite power event due to the random nature of the i spurious isolation signal. Information obtained by the licensee from the manufacturer also supported their conclusion that a short duration isolation signal upon re-energizing the circuit could be expected due-to the internal.
j design of these instruments, i
l To prevent future HPCI system spurious isolations, which could be caused by a l loss of offsite power, a design change was implemented for both the ' A' and the -
- 'n' trains of the HPCI SLDS logic. Prior to the design change, the K2A or K2B
- power monitor relay, connected in parallel to the HPCI SLDS ~ instruments,
- activated a control room annunciator on loss of logic power. The design change
! (see Figs. 1 and 2)' involved: (1) replacing the-K2A'(or KZC) power monitor relay with an Agastat relay (K2) with time pickup controls -(2) retaining the
~
annunciator contacts and, (3) adding an additional set of closed-when-energized- .
l l
l
- p. g , , - m-.,-,,m ,-ey,., --,-.,-m y---.e,cm,.m, s . - w,_,,. ---,,,,.,4
--,m,c .- .-r-a--
-W-- e- -v--.-v,
l t
HPCI HPCI Eqt. HPCI Eqt. Supp.P1 i Logic Supp.P1 HPCI Eqt.
High T High dT High T High dT High T A Side Annunciator Only i
' 120 VAC Fuse Fuse 60 hz F2.. F4" Essential Buses #
- l l
' h Pulled During First Test . 10/15/84
" Pulled During Second Test - 10/21/84 l
i
! FIGURE 2:
! HPCI STEAM LEAK DETECTION SYSTEM - Power Supplies (No Design Change)
A or B Sides
~
l
i contacts in series with the two thermocouple monitors. This design change resulted in the following SLDS operating characteristics: (1) with offsite power available, there is no time delay in the SLDS logic, and (2) with a loss and restoration of offsite power, the logic and instruments are de-energized but a spurious isolation signal is prevented from energizing the downstream K4 relay by the open contact controlled by the K2 power monitor relay. The design change thereby effectively introduced a 1-second time delay in the logic circuitry. Accordingly, a trip condition would have to be sustained for at least 1 second before the channel would trip.
Surveillance tests at Duane Arnold have measured the closure times of the HPCI steam supply containment isolation valves at less than 11 seconds for the inboard valve and about 8 seconds for the outboard valve. The maximum closure time allowed by technical specifications for these valves is 13 seconds. The channel response time for the primary containment isolation system is not specified in the Duane Arnold technical specifications, however. The licensee has determined that the addition of a 1-second time delay to the existing logic response time upon the loss of essential AC bus power would not reduce the plant safety margins. Additionally, the licensee believes that the design change results in an increase in HPCI system reliability at Duane Arnold.
On October 21, 1984, plant personnel at Duane Arnold conducted a second series of tests which were a revised version of the special tests performed on October 15. The new tests were intended to determine the effectiveness of the HPCI SLDS logic design modification. For the second series of tests, the power supply for each train of the HPCI SLDS logic and instrumentation was removed and then restored approximately 10 seconds later. A total of twenty four test trials were performed for each train. During each trial, the control room annunciator panel indicated that an isolation signal (trip condition) had occurred on both the 'A' and the 'B' logic trains. However, during these tests, no system isolation actually occurred. The test results showed that the additional K2 power monitor relay could prevent unwanted HPCI isolations caused by the re-energization of the HPCI SLDS instruments. This conclusion has been reinforced by maintenance and routine operability testing experience as well as ncrmal operating experiences accumulated since the additional relay was installed.
Because the HPCI SLDS design modification has proven effective in preventing spurious HPCI system isolations, the licensee has implemented a similar 1-second time delay for the RWCU leak detection logic. However, unlike the HPCI SLDS modification, the RWCU steam leak detection system logic modification does not alter the response time of the system following a loss of offsite power. The 1-second time delay implemented for the RWCU system is continuous and does not pass any signal from the thermocouple monitors of less than a 1-second duration.
Except for Duane Arnold, none of the licensees which have reported spurious system isolations caused by the SLDS have identified the root cause of the isolations. Although the LERs submitted for these other isolation events implied that the cause.of the events might in some way be attributed to.the
thermocouple monitors, none of the LERs spe. o identified the thermocouple monitor as the probable or def1.. " cause. Nevertheless, for the events in which no specific cause was idei.r eo, it is evident from the event descriptions that the spurious signals were caused by a ' disturbance' in the instrument circuitry. For example, in several of the events reviewed, the disturbance was likely caused by the operation of the thermocouple monitor READ / SET switch. In several other events, the disturbance was induced by personnel perfoming surveillance tests on adjacent equipment.
The resident inspectors for two of the involved plants were contacted to discuss a number of the events appearing in Appendix A. From these conver-sations, it was apparent that both resident inspectors believe that the therm-ocouple monitors are extremely sensitive devices which are highly-susceptible to minor disturbances (Refs. 3 and 4). This view appears to be shared by operating staff members for at least two of the plants that have experienced spurious system isolations due to the thermocouple monitors. Representatives for both the Iowa Electric Light and Power Company (the licensee for Duane '
Arnold) and the Washington Public Power Supply System (the licensee for WPPS-2) have also expressed the opinion that the inherent design of the instruments makes them very susceptible to trips caused by external signals (Refs. 5 and 6).
Spurious system isolations caused by the Model 86 thermocouple monitor was also the subject of a General Electric (GE) company service information letter (SIL). The SIL, which was issued in early 1985, indicated that a number of BWR ,
licensees had reported several inadvertent RCIC and HPCI system isolations caused by the Panalarm Model 86 thermocouple monitor. The SIL also identified the potential for the thermocouple monitor to cause a momentary spurious isolation signal when AC power was restored to the instrument following an initial loss of power. However, the SIL did not cite the susceptibility of this instrument to spurious trips due to: (1) " READ / SET" switch operation, '
(2) untraceable electrical " spikes" or " noise" in the circuit, or (3) isolation signals generated during maintenance on nearby equipment. Additionally, while the SIL identified the instrument's application to HPCI and RCIC leak detection systems, it did not note its additional application in MSIV and RWCU leak i detection systems. The SIL was only addressed to (CWR/4) owners / operators and the LaSalle units (BWR/5s). However, operating experience also shows that spurious system isolations caused by the thermocouple monitor can occur at BWR/6s (e.g., Grand Gulf and River Bend). The SIL recommended a number of possible corrective actions including the type of modification made at Duane Arnold.
Eleven events involving spurious system isolations caused by this instrument have been reported at various BWRs since the publication of the SIL. Further-more, most of the licensees reporting these spurious isolations indicate that they are investigating the possible causes of the events and the corrective actions which might be taken to prevent recurrence. It would appear, therefore, that the GE SIL has not been fully effective in communicating to all affected licensees either the cause of the problem or the appropriate corrective actions. -
POTENTIAL SAFETY IMPLICATIONS
~
There are several potential adverse effects which can result from spurious system isolations caused by the thermocouple monitor. Although the RWCU system is not safety-related, spurious isolations of the RWCU system are unwanted events that reduce the system's availability and impact on safety by presenting an unnecessary distraction for the operating staff. Spurious isolations, of .
the HPCI and RCIC systems, however, have a potentially more significant and '
direct impact on reactor safety because of the importance of these systems, as -
emergency high pressure make-up supplies for the reactor coolant system. A spurious isolation of these systems can lead to their unavailability, thereby placing unnecessary reliance for safe shutdown on the cutomatic depressuriza-tion system (ADS) and low pressure core cooling systems. Besides the direct impact on immediate system availability, spurious HPCI and RCIC system isolation valves. Repetitive cycling of the isolation valves increases the wear and tear on the motor operator and the valve itself and increases the possibility of future valve failure. It is also undesirable to experience a spurious HPCI
- and/or RCIC system isolation in an on-demand situation that takes the
- operator's attention away from responding to the cause of the system (s) l i initiation.
In a worst case scenario, the spurious isolation of the HPCI and RCIC systems potentially could result in a complete and lenghthy loss of all decay heat removal systems. This might occur in the event of a station black-out in which the emergency diesel generator (EDG) supplying one of the SLDS logic trains starts and loads but then shuts down a short time later due to an undefined equipment malfunction. Normally, for such a scenario, it wocid be assumed that all of the low pressure core cooling systems would be unavailable due to a lack of AC power. For such a scenario, it also would normally be assumed that the HPCI and/or RCIC systems, together with the ADS and suppression pool inventory, would prove adequate core cooling for at least one hour. After an hour, it is usually assumed that appropriate operator actions can be taken to either restore off-site AC power (i.e., from the grid) or restore on-site emergency AC power (i.e., via an EDG). However, in the event that EDG power were lost and briefly recovered as described above, it could be argued that the RCIC and/or HPCI systems could sustain a SLDS isolation signal for the same reasons involved at Duane Arnold. With emergency AC power briefly available, the HPCI and/or RCIC system steam supply isolation valves motor operators would have power available long enough to close the valves, rendering these systems inoperable. If the EDG's were to malfunction and shutdown at this time, the isolation valve motors would not have power available for re-opening. In such a case all emergency high pressure and low pressure make-up systems would be unavailable until the AC operated steam supply isolation valve could be opened.
FINDINGS AND CONCLUSIONS The analysis and evaluation of the recent isolation events caused by the Panalann thermocouple monitor has resulted in several significant findings and conclusions. These findings and conclusions are'as follows:
. _ , . . ~ . _ ._ _ _
y ;
l (1) Operational data indicates that spurious _ HPCI, RCIC and RWCU systefa.
isolations at various BWRs have been caused by the Panalarm Model 86 thermocouple monitor.
(2) The inherent sensitivity designed into the thermocouple monitor appears to make the instrument highly susceptible to minor external electrical dis-turbances which can result in spurious isolation signals.
- (3) Spurious system isolations can' adversely impact plant safety in several ways
- Spurious isolations present unnecessary operator distractions
- Repeated cycling increases the rate of wear on the isolation valve and its operator which potentially reduces the time to equipment
~
failure.
!
, ability of these systems. A loss of these high pressure make-up systems places unnecessary reliance on the. low pressure systems for safe shutdown when emergency AC power is available.
The loss of these high pressure make-up systems due to a spurious isolation can also result in a loss of all qualified make-up sources
, when emergency AC power is not available (i.e.,~ station black-out).
, (4) The addition of a 1-second time delay relay to the HPCI SLDS logic j circuitry at Duane' Arnold has proven to be an effective and accep. table' corrective action in preventing spurious system isolations caused by the j Model 86 thermocouple monitor. The 1-second delay in the logic response
- time has not caused the isolation valve closure time to exceed the maximum time allowed by technical specification.
- (5) Based on the most recent operating experience, it appears that the GE SIL concerning the Podel 86 thermocouple monitor has not been fully effective in communicating to all licensees either the cause of the problem or the appropriate corrective actions needed to prevent recurrence.
SUGGESTION It is suggested that the Office of Inspection and ' Enforcement (IE) consider issuing an IE information notice to all BWR licensees concerning the spurious ~-
system isolations caused by the Model 86 thermocouple monitor manufactured by.
the Panalarm Division of the Ametek Ccmpany. -The-information notice should-discuss the plant operating experience, the potential safety concerns and the 1-second time delay modification incorporated in to the HPCI SLDS logic circuitry at Duane Arnold. Any information notice issued on this subject. .
should mention that the Model 86 thermocouple monitor was previously distributed by both the Panalarm Division of the Riley Company and the Scram Instrument.
Corporation.
. REFERENCES 1.
Iowa Electric Report Light and Power Company, Docket No. 50-331, Licensee Event 84-028-01.
, 2.
Iowa Electric Light and Power Company, Docket No. 50-331, Licensee Event Report 84-028-01. '
3.
Telecommunications between E. Leeds (AE00) and Paul Byron (Resident i Inspector, Fermi-2), September 24, 1985.
4.
Telecommunications between E. Leeds (AE0D) and Ron Kopriva (Resident '
Inspector, LaSalle), November 5,1985.
5.
Iowa Electric Report 85-023.Light and Power Company, Docket No. 50-331, Licensee Event i 6.
) Washington Report 85-017. Public Power Supply Service, Docket No. 50-397, Licensee Event '
f l
+
t t
k
e .
i . .
APPENDIX A ,
t
-i Plant Operating Experience ,,
. LER No. System No. Plant Name Event Date Affected Event Description
, 02/04/84 signal from the SLDS. The cause was traced to an electrical spike from the differential temperature switch. The logic .
circuit was reset and the valve was reopened. However, the temperature switch was tested and found to be operating normally.
.2.. Duane Arnold 84-028 HPCI The HPCI inboard steam supply valve closed on a spurious 07/14/84 signal from the SLDS.following loss of offsite power and subsequent scram. Testing revealed that a spurious isolation
signal .of short duration can be expected from the temperature -
instruments upon restoration of power. The logic circuit was reset and the valve was reopened. Permanent corrective action was to introduce a 1-second time delay to the SLDS logic j trains. See. Discussion section.for details.
3 .- Duane' Arnold 85-023 RWCU. The RWCU system isolated on a spurious signal from the leak ;
, 07/02/85 ~ detection signal. The cause was attributed to the sensitive design of-the leak detection system. ~The logic circuit was i
. .~: '4-
^
2 .
LER No. System No. Plant Name Event Date Affected Event Description -
reset and the system was returned to normal service. A design change, as described in LER 84-028-01 for the HPCI system SLDS, was implemented.
- 4. Fermi-2 85-0?5-01 RWCU A isolation of the RWCU system occurred on a spurious I 06/14/85 signal from the SLDS. The cause was attributed to spurious electrical signals generated when the power fuses were rein-stalled in the SLDS circuitry after a system modification. A design change package that will add a short time delay relay, as per Duane Arnold LER 84-028-01, is being considered.
, 06/17/85 remains unknown. The valve will close on either a leak detection or differential flow isolation signal. The circuit logic was reset and the system returned to service.
- 6. Fermi-2 85-028 RWCU The RWCU inboard isolation valve closed on a spurious leak 06/27/85 detection :ignal. The cause of the isolation signal remains unknown. The circuit logic was reset and the system returned -
to service.
4 4
l
{
r .3 ,-
LER No. System
- No. Plant Name Event Date Affected Event Description ,
- 7. Grand Gulf-1 84-022 RWCU A spurious RWCU system isolation occurred when the RWCU 04/20/84 equipment area differential temperature READ / SET switch was placed in the ' READ' position for a required reading. The isolation was reset and the system was returned to service.
The surveillance procedure was revised to allow bypassing the temperature trip logic when taking the readings.
l l 8. Grand Gulf-1 85-022 RWCU A spurious RWCU system isolation occurred when the area 06/05/85 differential temperature READ / SET switch was pSced in the
' SET' position. The isolation was reset and the system was
( returned to service. The surveillance procedure was revised to allow bypassing the temperature trip logic when taking the readings.
l 9.. LaSalle-1 84-028 RCIC The RCIC inboard steam supply valve closed on a spurious i 05/13/84 steamline high temperature signal. A spurious signal from one i
of four ambient or differential temperature switches caused the isolation. The isolation was reset and the supply valve reopened. A recorder was connected to the temperature switches fortwow$eksbuttherewasnorecurrenceoftheevent.
l
4 ,-
LER No. System No. , Plant Name Event Date Affected Event Description
- 10. LaSalle-2 84-016 RWCU The RWCU system isolated on a spurious high ambient tempera-04/23/84 ture isolation signal. It is believed to have been caused by taking one or more temperature switches to the ' READ' position. The isolation was reset and the system returned to service. A caution card was placed by the switches stating to place the switches in the " TEST' position before reading temperatures.
06/09/84 The exact cause remains unknown. The isolation was reset and the system returned to service. An investigation of the leak ,
detection system is being conducted.
- 12. LaSalle-?84-028 RWCU The RWCU inboard isolation valve closed on a spurious high 06/17/84 ambient temperature isolation signal. The exact cause remains unknown. The isolation was reset and the system returned to service. Investigation of the leak detection system is continuing. -
- 13. LaSalle-2 84-031 RWCU A spurious RWCU system isolation occurred while the system 06/22/84 was being examined by plant personnel and vendor repre-sentatives from the manufacturer of the thermocouple monitors.
. . - . . ._ - - _ = _ . _ . - - .. .. .- = _ - .
5
- LER No. System No. Plant Name Event Date Affected Event Description .
The exact cause remains unknown. The isolation occurred several minutes after two temperature switches had been moved from the ' READ' position to the ' SET' position. The isolation was reset and the system returned to service. Investigation is continuing.
- 14. LaSa11e-2 84-032 RWCU The RWCU system isolated on a spurious high differential 06/26/84 temperature isolation signal. It is believed that the l
isolation signal was inadvertently induced by maintenance l
personnel performing a functional test of the RCIC leak l detection system which is located in the same cabinet as the I-RWCU leak detection system. The isolation was reset and the _
system returned to service. Investigation is continuing.
1 LaSalle-2 84-046 RWCU The RWCU inboard isolation valve closed on a spurious high 15.
08/05/84 ambient temperature-isolation signal. The exact cause remains unknown. The isolation was reset and the system returned to service. Investigation is continuing.
l
! The RWCU inhoard isolation valve isolated on a spurious high
! 08/77/84 unknown. The isolation was reset and the system returned to Investigation is continuing.
~ ~ ~
j service.
l .
'f 6 -
LER No. System No. Plant Name Event Date Affected Event Description -
- 17. LaSalle-2 84-065 RWCU The RWCU system isolated on a spurious high differential 09/13/84 temperature isolation signal. It is believed'that the isolation signal was inadvertently induced by maintenance personnel performing a functional test of the RCIC leak detection system which is located in the same cabinet as the RWCU leak detection system. The isolation was reset and the system returned to service. Investigation is continuing.
- 18. LaSalle-2 84-067 RWCU The RWCU inboard isolation valve closed on a spurious high-09/18/84 differential temperature isolation signal. It is believed that the heat given off by the operating pump combined with the cool outside air entering the rooms resulted in reaching the differential temperature setpoint. The isolation was reset and the system returned to service. A technical specification change was submitted requesting the deletion of the requirement for temperature leak detection in the RWCU '\,
pump rooms because the rooms are part of the coldwater portion of the system.
- 19. LaSalle-2 84-074 RWCU The RWCU system isolated on a spurious high ambient temerpa-11/16/84 ture isolation signal. A spurious voltage spike was apparently generated when an instrument mechanic moved a thermocouple wire in order to attach test equipment leads to
q i
7 .
LER No. System Event Description Affected No. Plant Name Event Date an adjacent leak detection module for a functional test. The isolation was reset and the system returned to service.
~ ~
- 20. Limerick-1 84-012 RWCU The RWCU outboard isolation valve closed on a spurious'high 12/15/84 differential temperature isolation signal. It is believed that setting the thermocouple monitor switch to the ' READ' position caused the isolation. The isolation was reset and the system returned to service. A modification to the ' READ' circuit is being investigated.
- 21. Limerick-1 84-026 RWCU The RWCU outboard isolation valve closed on a spurious high 12/16/84 differential temperature isolation signal. It is believed that setting the thermocouple monitor sw' itch to the ' READ' ,
position caused the isolation. The isolation was reset and the system returned to service. A modification to the ' READ' circuit is being investigated.
- 22. Limerick-1 84-034 RWCU The RWCU outboard isolation valve closed on a spurious 12/12/84 high differential temperature isolation signal. It is believed that setting the thermocouple monitor switch to the ' READ' position caused the isolation. The isolation was reset and the-system returned to service. A modification to the ' READ' circuit is being investigated.
8 .
l LER No. System l
Event Date Affected Event Description .
! No. Plant Name
(84-035 RWCU The RWCU outboard isolation valve closed on a spurious high
- 23. Limerick-1 differential temperature isolation signal. It is believed 12/16/84 that the isolation was caused by the use of the RWCU ' READ' switch. The isolation was reset and the system returned to service. A modification to the ' READ' circuit is being investigated.
l l
l 84-036 RWCU The RWCU outboard isolation valve closed on a spurious high
- 24. Limerick-1 differential temperature isolation signal. It is believed
' 12/17/84 that the isolation was caused by the use of the RWCU ' READ' switch. The isolation was reset and the system returned to service. A modification to the ' READ' circuit is being
' investigated.85-035 RWCU The RWCU system spuriously isolated while personnel were l 25. ' Limerick-1 03/23/85 performing a main steam line tunnel temperature-high f
surveillance test. Although the main steam leak detection system and the RWCU leak detection system temperature switches f are mounted in the same panel, the systems' logic circuitry is
' not connected. The isolation was reset and the system returned to service. The cause of the isolation is under nem'*
investigation.
l
9 .
LER No. System Event Description .
Plant Name Event Date Affected No.
RWCU The RWCU system spuriously isolated while personnel were
- 26. Limerick-1 85-055 performing a main steam line tunnel temperature-high 05/29/85 surveillance test. Although the main steam leak detection-system and the RWCU leak detection system temperature switches are mounted in the same panel, the systems' logic circuitry is not connected. The isolation was reset and the system returned to service. The cause of the isolation is under investigation.
RWCU A spurious RWCU system isolatien occurred when the
- 27. ' River Bend-1 85-037 temperature READ / SET switch was placed in the ' READ' 11/15/85 position. The isolation was reset and the system was returned to service. A design change is being investigated 4
to prevent recurrence.
RWCU A spurious RWCU system isolation occurred when the temperature
- 28. River Bend-1 85-009 READ / SET switch was placed in the ' READ' position. The 09/26/85 isolation was reset and the system was returned to service.
A design modification is beino investigated to prevent recurrence.
+.
9 10 .
, LER No. System No. Plant Name Event Date Affected Event Description (
\
T
- 29. ' River Bend-1 85-046 MSIV A spurious Main Steam Isolation Valve (MSIV) containment 11/28/85 isolation occurred when the temperature READ / SET switch was placed in the ' READ' position. Reactor power was rapidly reduced to prevent a reactor scram and overpressurization.
When plant conditions stabilized at 1.5% power, the isolation was reset and the MSIVs were reopened. A maintenance work . . _ .
request has been initiated to change out and/or inspect for modification all Riley temperature modules.
- 30. WPPSS-2 84-099 RWCU The RCIC system isolated on a spurious high area temperature 09/28/84 signal. It was determined that instrument meter movement overdeflection during selector switch operation caused the isolation. Placing the selector switches in the ' TEST' position will prevent instrument overdeflection from causing a spurious isolation. The procedure will be modified.to prevent recurrence. The isolation was reset and the system restored -
to its normal line-up.
02/14/85 differential temperature signal. The cause remains unknown.
The isolation was reset and the system returned to service.
Action has been initiated to find a suitable replacement for the existing temperature switches which will be less susceptible to external signal noise.
_