05000285/LER-1994-001, :on 940211,safeguards Actuation & Reactor Trip Occurred Due to Relay Failure.Containment Pressure High Signal Relay Replaced & Sent for Investigation of Failure Mechanism
| ML20064J447 | |
| Person / Time | |
|---|---|
| Site: | Fort Calhoun  |
| Issue date: | 03/14/1994 |
| From: | Gates W, Voss K OMAHA PUBLIC POWER DISTRICT |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| LER-94-001, LER-94-1, LIC-94-0061, LIC-94-61, NUDOCS 9403210228 | |
| Download: ML20064J447 (13) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv), System Actuation 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(s)(2)(v) 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(viii)(8) 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 2851994001R00 - NRC Website | |
text
I
=
Omaha Public Power District 444 South 16th Street Mall j
Omaha. Nebraska 68102-2247
)
402/636-2000 March 14, 1994 LIC-94-0061 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Mail Station P1-137 Washington, DC 20555 Reference: Docket No. 50-285 Gentlemen:
Subject:
Licensee Event Report 94-001 for the Fort Calhoun Station Please find attached Licensee Event Report 94-001 dated March 14, 1994.
This submitted pursuant to 10 CFR 50.73(a)(2)(iv),
report is being(2)(i)(B) and 10 CFR 50.73(a)(2)(ii)(B).
If you should have any questions, please contact me.
Sincerely, M. d.
W. G. Gates Vice President WGG/jrg Attachment c:
LeBoeuf, Lamb, Greene & MacRae L. J. Callan, NRC Regional Administrator, Region IV S. D. Biceom, NRC Project Manager R. P. Mullikin, NRC Senior Resident Inspector INPO Records Center RI O fi v a 9403210228 940314 rp DR ADOCK 0500 285 g
45 5124 Emphynen it-h Equal opportun:ty
/
I k I
NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB NO. 315M)1o4
& 821 EXPlRES 5/31/95 ESTIMATED DURDEN PER DESPONSE TO COMPLY WITH THIS LICENSEE EVENT REPORT (LER) g g',%c,7ggo" E llTb 8?O E d u"ETE m'
u AND RECORDS MANAGEMENT BRANCH (MNDB 7714), U.S. NUCLEAR FEOULATORY COMMi$SION, WASHINGTON, DC 20S55 0001, AND TO (See reverse for required number of digits / characters for each block) u 4AnrI. T B
WAS NGT N, FACIUTY NAME (1)
DOCKET NUMBER p)
PAGE p)
Fort Calhoun Station Unit No. 1 05000285 1 oF 12 Tms n Safeguards Actuation and Subsequent Reactor Trip Due to Relay failure EVENT DATE (5)
LER NUMBER (6)
REPORT NUMBER (7)
OTHER FACILTTIES INVOLVED (8)
MONTH DAY YEAR YEAR MONTH DAv YEAR NuMsEn NuMne" 05000 FACILITY NAME DOCVET NUMUER 001 00 03 14 94 05000 02 11 94 94 OPERATING l THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR 8: (Check one or more) (11)
MODE (9) j 20 402(b) 20 405(c)
X 50.73(a)(2)(iv) 73.71(b)
POWER 20 405(a)(1)(i) 50 36(c)(1) 50.73(s)(2)(v) 73.71(c) 100
,' j@j10) 20 40sraninii) 50 aste>m 50 73(a)(2)(vii)
OTHER 20 405(a)(1)(iii)
X 50.73(a)(2)(i) 50.73(a)(2)(viii)(A)
(SpuWy in Abstract 20 405(a)(1)(iv)
X 50 73(a)(2)(b) 50.73(a)(2)(viii)(8) 20.405(a)(1)(v) 50 73(a)(2)(iii) 50 73(a)(2)(x)
UCENSEE CONTACT FOR THIS LER (12)
NAME TELEPHONE N' NUER (include Area Code)
Keith A. Voss, Shift Technual Advisor (402) 533-6931 COMPLETE ONE UNE FOR EACH COMPONENT FAJLURE DESCRIBED IN THIS REPORT (13)
CAUSE
SYSTEM COMPONE N1 MANUFACTUHER
CAUSE
SYSTEM COMPONENT MANUFACT1JRER p g O
X JE 74 G080 Y
M NTH DAY YEAR SUPPLEMENTAL REPORT EXPECTED (14)
EXPECTED Yta SUBMISSION or yes, complem EXPE CTED SUBM:SSION DATE)
X No DATE (15)
ABSTRACT (Umit to 1400 spaces, i.e., aDproximately 15 singte. spaced typewntten knes) (16)
On February 11, 1994 at 0340, an invalid Containment Pressure High Signal (CPHS) occurred.
The CPHS initiated Engineered Safeguards actuations including safety injection actuation, containment isolation actuation, steam generator isolation, and starting of emergency diesel generators.
Steam generator isolation also resulted in a turbine / reactor trip.
The cause of the event was a coil-shorting failure of a supervisory relay, resulting in actuation of the CPHS lockout relay.
Post-event investigation determined that if a coil-shorting failure of certain other supervisory relays were to occur coincident with certain design basis accidents, the result could involve premature actuation of lockout relays associated with the Recirculation Actuation Signal (RAS).
It was concluded that these concerns represented conditions outside the design basis of the plant.
The cause of the design basis concerns was determined to be failure of the original plant design to anticipate a potential failure mode.
The failed CPHS supervisory relay was replaced, and will be sent off-site for investigation of the failure mechanism.
An engineering analysis was performed with respect to engineered safeguards supervisory relays.
Eight supervisory relays have been disconnected to address the design basis concerns identified by the engineering analysis.
NRC FORM 30tl(S 9?)
NRC FORM SOSA U3. NUCLEdGULATORY COMMISSION APPROVED BY OMB NO. 315o4104 mas EXPIRES 5/31/96 LICENSEE EVENT REPORT (LER)
TON S
@W TEXT CONTINUATION cNEuSNNea"nN uNNucb$
7 A
VORK E
(350-004 FICE MANAGEMENT AND BUDGET. WASHINGTON, DC 20$03, FAOUTY NAME (1)
DomET NUMBER R LER NUMBER R PAGE R
" Tu 7u*la$
- a N
a Fort Calhoun Station Unit No. 1 05000285 94
-- 001 --
00 wxt cir,,. -. o.% -
o, mc - cm BACKGROUND This LER discusses an event involving an invalid Containment Pressure High Signal (CPHS)
(an Engineered Safeguards initiation signal), followed by a reactor trip.
The Fort Calhoun Station (FCS) has two redundant trains ('A' and 'B') of Engineered Safeguards Controls and Instrumentation.
Each train includes a panel that houses the relays, valve and pump controls, two sequencer panels, and an emergency diesel generator panel.
When a measured parameter reaches the setpoint for initiation of a safeguards signal on the required number of instrument channels (ordinarily two out of four), the initiating signal lockout relay trips, actuating the associated safeguards functions.
Examples of safeguardsinitiatingsignalsincludeCPHS,PressurizerPressureLowSignal(PPLS),and Safety Injection and Refueling Water Tank Low Signal (STLS).
The initiating signal lockout relay must be manually reset after the initiating logic has cleared.
Each Engineered Safeguards Controls and Instrumentation train includes prime initiation relays, prime actuation relays, derived initiation relays and derived actuation relays.
To improve system reliability, the engineered safeguards prime initiation signals are designed to initiate a derived initiation signal on the opposite train.
As a result, a prime initiction signal on either train results in actuation of both trains.
The derived signal to the opposite train may be blocked by using the derived signal cutoff switch for the train that is generating the prime signal.
Means are ided to supervise the operability of the safeguards initiation / actuation
. circuits (provsee Figure 1).A supervisory relay is provided to monitor each initiation / actuation signal lockout relay circuit.
The supervisory relay will become de-energized and actuate a trouble annunciator in the event of an open circuit, a loss of power, or completion of initiation logic without a corresponding lockout relay trip.
Safeguards actuation signals are generated from logical combinations of initiation signals. A CPHS results in generation of several safeguards actuation signals.
Specifically, a CPHS initiates a Steam Generator Isolation Signal (SGIS), a Safety Injection Actuation Signal (SIAS), a Containment Isolation Actuation Signal (CIAS),
auto-starting of the Emergency Diesel Generators, and sequential starting of engineered safeguards equipment.
SGIS closes valves to isolate main steam flow from, and main feedwater flow to the steam generators, to reduce an uncontrolled cooldown of the Reactor' Coolant System (RCS).
SGIS will close the main steam isolation valves (MSIVs), the main steam bypass valves, and the main feedwater isolation valves.
SGIS can also indirectly initiate a turbine / reactor trip. When both MSIVs are on their closed seats, a turbine trip is initiated to protect the turbine from the effect of motoring the generator. When a turbine trip is initiated, a reactor trip is also initiated.
wormu =Aism
.U.S. NUCLEAR REGULATORY COMMISSION APPRO ED BY OMB NO. 31504104 pea EXPIRES 5/31/95 ESTIMATED BURDEN PER RESPONSE TO COMPLY WITH THIS LICENSEE EVENT REPORT (LER) g,%^
"LC"EurEN Es'bE f0 TH7iNrETE g
TEXT CONTINUATION g y s y g ENT AANCHfND N
g 1"o'0= = = #4. = "*"'
FACEJTY NAME (1)
DOGET NUMBER p)
LER NUMDER R PAGE R SLQUENTIAL REVISION g
NUMDER NUMDER Fort Calhoun Station Unit No. 1 05000285 3 oF 12 94
-- 001 --
00 TExr pr,...-. i.,.w,.d. u addWonal copies of NHC Form 306A) (17)
SIAS automatically actuates safety injection in the event of a Loss of Coolant Accident (LOCA), a Main Steam Line Break (MSLB), or a Steam Generator Tube Rupture (SGTR).
This signal will open the High Pressure Safety injection (HPSI) and Low Pressure Safety Injection (LPSI) loop injection valves, close the safety injection leakage cooler outlet pressure control valves, trip the Ventilation Isolation Actuation Signal (VIAS) lockout relays, and initiate load shedding of certain non-essential loads.
SIAS also realigns certain Component Cooling Water (CCW) valves for the Safety Injection pumps and opens the CCW inlet and outlet valves for the Raw Water /CCW heat exchangers.
SIAS provides additional signals that did not impact this event.
CIAS closes the containment isolation valves for flow paths that are not required to control or mitigate the event, opens valves to allow cooling water to the containment coolers to limit the pressure transient, and secures CCW flow to unnecessary heat loads.
Some of the control functions CIAS performs include: isolating letdown, opening the CCW valves to the containment coolers, and isolating CCW flow to the Reactor Coolant Pump (RCP) seal and oil coolers (HCV-438A/B/C/D) if CCW pressure drops below 60 psig (which can occur during load sequencing).
The CIAS signal can be overridden using a test switch on the CIAS panels.
The emergency diesel generator start signal will start the diesel generators to ensure a power supply to vital loads is available.
The diesel generator breaker protection is overridden under emergency conditions.
When load sequencing is initiated, the sequencers start safeguards pumps and fans sequentially to allow acceleration of loads on the off-site power source or the diesel pumps, the Auxiliary Feedwater (y the sequencers include:AFW) pumps, the LPSI pumps, a The generators.
The loads started b the raw water pumps, the CCW sequencers send a start signal to the components at the appropriate time.
T1is emergency start signal will stay in place until the safeguards signal is reset or the appropriate control switch is taken to pull out.
VIAS initiates closing of the containment pressure relief, air sample and purge system valves, if open, to minimize the potential for release of radioactivity from th(.
containment.
The safety injection leakage cooler outlet. pressure control valves (PCV-2909, 2929, 2949 and 2969) function to control pressure due to RCS leakage to the leakage coolers.
During normal operation the system is designed so that a PCV will open at approximately 400 psig, discharging RCS leakage from an accumulator to the Reactor Coolant Drain Tank (RCOT).
However, when a SIAS is present, the leakage cooler PCVs remain shut.
me rOnu :maA sea
RC FORM 366A U.8. NUCLEAR REoULATORV COMMISSION APPROVED BY OMB NO. 31600104 m
EXPIRES 5/31/95 ESTIMATED DUHDEN PER RESPONSE TO COMPT 3 WTYH THIS LICENSEE EVENT REPORT (LER) g % g g g j y g l,8po,gfa 1, =
N ""^"
Mu"Am"#3s"="M" '2R"0%
' E i" M o"u'$ E Tl N o E,E W " *' "
f FAQUTY NAME (1)
DOCKET NUMBER R LEM NUMBER M PAGE R SEQUENDAL ACVISION g
NUMBER NUMDER Fort Calhoun Station Unit No. 1 05000285 94
-- 001 --
00 mro...-.
.#.o
.. enee-m m n FCS has two steam generators that provide steam to the turbine via a main steam header.
Each header, one per steam generator, has five spring loaded safety valves located between the containment penetration and the MSIV.
The safety valves are each set to progressively open between 1000 and 1050 psia, to relieve main steam header pressure.
As header 3ressure increases, additional safety valves will lift to relieve the pressure and allow leat to be removed from the RCS.
Each header has one safety valve (MS-291 and MS-292) that has a pneumatic operator that also allows the valve to be manually opened from the Control Room, in addition to its automatic function which is pressure controlled.
This allows the steam generators to be used to control RCS temperature if the MSIVs are closed or the condensers are not available.
EVENT DESCRIPTION
At 0330 on February 11, 1994, with the plant at 100% power, Operations personnel in the Cont nl Room smelled an acrid odor apparently originating in the vicinity of the engineered safeguards panels.
A visual inspection of the panels was performed and no smoke or physical abnormalities were observed.
At 0340, CPHS lockout relay 86B/CPHS actuated.
This, in turn, initiated SIAS, CIAS, VIAS, SGIS and starting of the emergency diesel generators. As a result of the SGIS, the MSIVs closed, initiating a turbine trip, which in turn generated a reactor trip.
The Control Room operators saw that containment pressure was indicated as approximately 0.6 psig (compared to the Technical Specification setting limit of 5 psig for CPHS
!nitiation) and determined that the CPHS was not valid.
The operating crew entered Emergency Operating Procedure E0P-00, ' Standard Post-Trip Actions.'
At 0342, the Assistant Plant Manager-0perations was notified of the event.
At 0343, CCW was restored to the Reactor Coolant Pump Lube Oil and Seal Coolers by opening valves HCV-438A/B/C/D.
Since the SGIS had isolated main feedwater to the Steam Generators, AFW flow was manually initiated at 0347 using Motor Driven AFW Pump FW-6 which was already running at this time.
(The minimum Steam Generator level reached during the event was approximately 61% of wide range level.) At 0349, with letdown isolated by the safeguards actuation and pressurizer level increasing, the operators took manual control of pressurizer level and secured two charging pumps, as allowed by E0P-00.
At 0350, the crew transitioned to E0P-01, ' Reactor Trip Recovery,' after diagnostics indicated that an uncomplicated reactor trip had occurred.
The crew also entered Abnormal Operating Procedure A0P-23, ' Reset of Engineered Safeguards,' in order to reset engineered safeguards initiated by the invalid CPHS.
The operators attempted to reset CPHS lockout relay 86B/CPHS in accordance with A0P-23, but it would not stay reset; therefore the invalid CPHS persisted.
,e ronuaeaA m
NRG FORM So6A U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB NO. 3150 o104
- 8a EXPIRES 5/31/95 IN UCENSEE EVENT REPORT (LER)
N M
ORW EU CONTINUATION E c E E a7MSEe N N Em E E P S T
(3 Soc
)
F E MANAGEMENT AND DVDGE"T, WASHINGTON, DC 20503.
FACUTY NAME (1)
DOCKET NUMBER p) 1.ER NUMBER pq PAGE$5 SEQUEAT1AL HEV:SION NUMBER NUMBER Fort Calhoun Station Unit No. 1 05000285 94 001 --
00 T m e
..-.,,,m..o.u
, %... Nncr - 3,MA)py
~
At 0354, a low level alarm for the Emergency Feedwater Storage Tank (EFWST) was received due to AFW flow to the steam generators.
Technical Specification (TS) 2.0.1 was entered when EFWST level dropped below the amount specified in TS 2.5(2) (i.e., 55,000 gallons).
At 0359, with pressurizer level at approximately 75%, the last charging pump was secured.
At 0400, the Shift Supervisor declared a Notification of Unusual Event (NOUE) based on Emergency Plan Implementing Procedure EPIP-0SC-1, Emergency Action Level 11.6 (i.e.,
Plant Conditions Warrant Increased Awareness by Plant Staff or Government Authorities).
At 0406, the NRC Senior Resident Inspector was notified of the event.
At approximately 0412, following discussions between the Senior Reactor Operator and the Shift Supervisor, the operators deviated from the guidance provided in A0P-23 by taking the derived signal cutoff switch (CS-B1/SP-B) to 0FF and the CIAS Test Switch (01-Al-438) to TEST.
This action was taken in order to allow the operators to begin to reset 'A' train engineered safeguards and restore letdown flow, even though they were not able to reset the 'B' train CPHS lockout relay.
The operators then began resetting
'A' train lockout relays.
Based on operator discussions, it was decided that one particular relay, 8681/ VIAS, did not need to be reset at that time.
However, the other
'A' train derived signal lockout relays were reset.
Removal of the 'A' train SIAS allowed Safety Injection Leakage Cooler Outlet Pressure Control Valves PCV-2909 and PCV-2949, which receive a close signal from SIAS, to return to normal operation.
These valves subsequently opened and began to discharge water from the HPSI header to the RCOT header.
At 0413, the Control Room Communicator notified the State of Iowa and the counties of Harrison, Pottawattamie and Washington.
The State of Nebraska did not respond to the Conference Operations (COP) network call.
(Post event investigation showed that a problem with the C0P network did not allow the call to be completed.
See Corrective Actions for the resolution of this issue.)
At 0414, letdown flow from the RCS was restored, and at 0415, a charging pump was restarted. Also at 0415, alarms were received indicating high water level in the containment sump.
Initially the source of the water was thought to be lifting of a CCW relief valve.
Further investigation ruled out CCW as the source of the water.
Following another unsuccessful attempt to notify the State of Nebraska via the C0P network, at 0427, the State of Nebraska was successfully notified of the NOVE via the backup method, using a commercial telephone line. At 0428, the Assistant Plant Manager
- - Operations notified the NRC Operations Center of the NOUE, pursuant to 10 CFR 50.72(a)(1)(i).
NRC FORM 3064 592)
.U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB NO. 3150 o104
&82)
EXPIRES 5/31/95 ESTIMATED BURDEN PER RESPONSE TO COMPLY WfTH THIS LICENSEE EVENT REPORT (LER) go" c&o%"TlL,"fo Q,,,angg o
TEXT CONTINUATION AmygsgNgENT D, Ng7g U N
ZZTA"#lS.%""ELER "" '
FACRJTY NAME (1)
DOCS (ET NUMBER A LER NUMBER (14 PAGE (3)
BEQUENTIAL PEVISION g
NUMBER NUMOER Fort Calhoun Station Unit No. 1 05000285 001 --
00 94 TEXT pf more space a requued, use modtfu)fml copies of NHC Form 366A) (17)
At 0429, the sequencer mode switch (43-1/S2-1) was taken to 0FF to allow various pumps which had been started by the sequencers, to be secured.
Also the operators placed the
'B' channel 480V load shed switch in override and began resetting affected loads. At approximately 0440, valves PCV-2909 and PCV-2949 were closed from the Control Room and the control switch was placed in manual. At 0441, the Control Room crew began to secure loads which had been started by the sequencers.
At 0503, two HPSI pumps were secured.
At 0510, the crew transitioned from E0P-01 to E0P-20, ' Functional Recovery Procedure.'
This transition was performed oecause procedural guidance in E0P-01 did not address resetting of Engineered Safeguards, and the guidance provided in AOP-23 assumed that the lockout relay that caused the invalid actuation could be reset.
Main Steam Safety Valves MS-291 and MS-292 were being used to provide a heat removal path with the MSIVs closed.
The Shift Supervisor, Licensed Senior Operator and E0P Coordinator determined that guidance in E0P-20 could be used to establish a more controlled heat removal path using the Atmospheric Dump Valve and the Steam Dump and Bypass Valves.
At 0515, the last HPSI pump was secured.
The containment Hydrogen Analyzers were placed in service at 0529, due to E0P-20 guidance associated with an abnormal increase in containment sump level.
Meanwhile, System Engineering personnel in the Technical Support Center were investigating possible causes of the tripping of the CPHS lockout relay and the inability to reset it.
Their investigation indicated that the supervisory relay for the CPHS lockout relay may have failed. At 0530, after being briefed by System Engineering, the Shift Supervisor authorized the lifting cf leads associated with the supervisory relay for 868/CPHS.
At 0540, the main feedwater valves were switched to override so that the main feedwater regulating bypass valves could be opened to restore feedwater to the steam generators via the main feed ring.
Feedwater flow through the main feed ring was re-established at 0608.
At 0613, the Shift Supervisor briefed Control Room personnel that the leads to the supervisory relay associated with 86B/CPHS had been lifted.
Relay 868/CPHS was then reset, and the remaining tripped lockout relays were subsequently reset.
The MSIV bypass valves were opened at 0625, and the MSIVs were opened at 0648.
At 0745, level in the EFWST had recovered enough to exit Technical Specification 2.0.1.
The NOUE was terminated at 0747.
I99U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB NO. 3150 o104 peal EXPIRES 5/31/95 l
ESTNATED BURDEN PER RESPONSE TO COMPLY WITH THIS LICENSEE EVENT REPORT (LER) g"g hcouE,g g l8,Lffo Q,Lo"*g no TEXT CONTINUATION g y g s g NAgE g
ND 7 4
.N M /8 E 7 0 aUo %a " As % 'EE E W " '
FACILRY NAME 0)
DOCKET NUMBER R LER NUMBER (tg PAGE R sEouanL REVISON NUMBER NUMBER Fort Calhoun Station Unit No. 1 05000285 7 OF 12 94
-- 001 --
00 itxT,.. -..a.
.ao n..
o, m e,m m o n With respect to the water in the containment sump, post-event review determined that the water originated in the Safety Injection and Refueling Water Tank (SIRWT). When the
'A' train SIAS was removed, PCV-2909 and PCV-2949, which had remained shut with the SIAS signal present, were allowed to cycle to relieve pressure.
With the HPSI header pressurized by the running HPSI pumps, these valves opened and passed sufficient flow to the RCDT header to result in water backing up through the RCP vapor seal drain line (which also discharges to the RCDT header).
The water then came out the top of the annulus area above the RCP vapor seals, onto the floor, and then to the containment sump. The flow to the sump was stopped by closing PCV-2909 and PCV-2949.
During the event, operators noted an equipment issue involving Main Steam Safety Valves MS-291 and MS-292.
These valves responded appropriately to the pressure transient resulting from closure of the MSIVs, but did not function as expected when operated manually later in the event.
Post-event investigation indicated that 0-rings and seals associated with the pneumatic operators had hardened with age.
The safety function of MS-291 and MS-292 was not found to have been impacted by this condition.
CONCLUSIONS The February 11, 1994 event was caused by the failure of relay 86B/CPHSS. This relay is a normally-energized supervisory relay for lockout relay 86B/CPHS.
The supervisory relay experienced a short circuit across its coil which resulted in the invalid j
actuation of 86B/CPHS (see Figure 1).
The actuation of 86B/CPHS initiated safeguards actuations and resulted in a turbine / reactor trip.
The relay that failed was a General Electric model number 12HGA17C52G, and is used in a number of applications within the Engineered Safeguards circuitry, as a power supply and continuity supervising relay. After the plant trip occurred, Design Engineering initiated a review to determine the potential consequences of invalid actuations of Reactor Protective System (RPS) or Engineered Safeguards initiation / actuation lockout relays, due to coil-shorting failure of an associated supervisory relay. This review considered such failures during normal plant operation and during design basis accidents.
The intent of the review was to determine whether or not this type of failure was appropriately considered in the design of these circuits.
This review is documented in Engineering Analysis EA-FC-94-008.
Two design basis concerns were identified.
une rOsw 3e:A we2i
i NRC FORM 306A U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB NO. 31504104 pea EXPIRES 5/39/95 ESTIMATED DURDEN PER RESPONSE TO COMPLY WITH THIS UCENSEE EVENT REPORT (LER) gggcto"unESrbE !O METE l
TEXT CONENUATION goyoggNT gNB0M w
M ME D
ASH TON.
FAcafrY NAME 0) 000 MET NUMBER R LER NUMBER M PAGE R SEQUENTIAL HEVISON J
g NUMBER NUMBER Fort Calhoun Station Unit No. 1 05000285 8 OF 12 l
94
-- 001 --
00 l
mr 9, mo.......
.aon.on., cop. o, une ro, m n n Initial investigation identified a concern involving a postulated premature actuation of either of two STLS lockout relays (i.e., 86A/STLS or 86B/STLS), due to a coil-shorting failure of a supervisory relay (see Figure 2).
If such a failure were to occur coincident with certain accidents (i.e., a LOCA, a SGTR, or a MSLB), a premature Recirculation Actuation Signal (RAS) could be generated.
Such a premature RAS could i
result in loss of water to the HPSI, LPSI and, if in service, the Containment Spray pumps, due to the realignment of the suction header from the SIRWT to the containment sump.
On February 18, 1994 at 1007, it was concluded that this concern represented a condition outside the design basis of the plant.
NRC was notified _of this determination on February 18, 1994 at.101, pursuant to 10 CFR 50.72(b)(1)(ii)(B).
Immediate action was taken (via Temporary Modification 94-014), to disconnect.the supervisory relays associated with 86A/STLS and 86B/STLS, in order to eliminate the possibility of such an occurrence.
The safety function of the lockout relays was not compromised by disconnecting the associated supervisory relays.
The alarm function provided by the l
supervisory relays is not available with the relays disconnected, however, indicator lights are available to provide an alternate method of monitoring the circuits (see Figure 1).
An additional concern was identified regarding the minimum recirculation header for the safety injection pumps. This header has two isolation valves in series (HCV-385 and HCV-386) that receive a signal to close in the event of a RAS.
The concern related to a postulated premature actuation of any of eight STLS or RAS lockout relays (i.e.,
i 86A/STLS, 86B/STLS, 86AX/ RAS, 86BX/ RAS, 86AIX/ RAS, 86B1X/ RAS, 86A1/STLS and 86B1/STLS) resulting in closure of HCV-385 and/or HCV-386 (see Figure 2).
Two of these relays were also associated with the previously identified concern.
Conservative action was taken i
on February 19, 1994 (via Temporary Modification 94-015), prior to completion of the t
engineering evaluation, to disconnect the six additional supervisory relays associated with this concern.
On March 3, 1994 at 0945, it was concluded that this concern had also represented a condition outside the design basis of the plant.
Specifically, premature closure of HCV-385 ar.d/or HCV-386 (due to a coil-shorting failure of a supervisory relay associated with any of the eight identified STLS/ RAS lockout relays), coincider,t with certain MSLB, SGM or small-break LOCA conditions, could result in dead-heading of HPSI pumps and the i
potential for pump damage.
Depending on the specific relay failure, one, two or all three HP5! pumps may also not have suction available, but regardless of which relay i
failed, none of the pumps would have a minimum recirculation flow path available.
The NRC was notified of this determination on March 3, 1994 at 1033, pursuant to i
'{
N8tC FORM 366A @ 94
..U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB NO. 3150Lolo4
+
oA EXPIRES 5/31/95 ESTlMATED BURDEN PCR RESPONSE TO COMPLY WITH THIS LICENSEE EVENT REPORT (LER) g" g g gg h"gllk g fo @, g,^s' N N"A"
&"#s?b"Of!s"'
"J"s" 'an"2'%
^
a
'"Ela*EE EED 8UEcTTASfS.$ E " "
j u
rany waut n oOcar wuuacn a trn wuusen m r4as m SEQUENTIAL HEVISION g
NUMBER NUMBER Fort Calhoun Station Unit No. 1 05000285 9 OF 12 94
-- 001 --
00 Tm pt mo<e space e requued, use addmonal copees o, NHC F orm 3Wy 07)
The design of the STLS/ RAS lockout relay supervisory circuits was part of the original plant design, and as such, was developed over twenty years ago. An investigation determined that the potential for a coil-shorting failure of a supervisory relay was considered at the time of the original design, but was apparently not found to be a credible failure mode.
As a result, it has been concluded that the root cause of this problem was failure to anticipate a potential failure mode in the original design of Engineered Safeguards initiation / actuation circuitry.
This LER is being submitted pursuant to:
1 10 CFR 50.73(a)(2)(iv) due to the actuation of several engineered safety features and the RPS actuation that occurred on February 11, 1994, 10 CFR 50.73(a)(2)(i)(B) due to the entry into TS 2.0.1 that occurred during the February 11, 1994 event, and 10 CFR 50.73(a)(2)(ii)(B) due to the concerns identified regarding the potential for premature STLS/ RAS lockout relay actuation coincident with certain accidents, i
SAFETY ASSESSMENT
The plant response to the February 11, 1994 event was bounded by the Loss of Load analysis in Section 14.9 of the FCS Updated Safety Analysis Report (USAR).
No safety injection flow into the RCS occurred during the event.
Main Steam Safety Valves opened as required following the closure of the Main Steam Isolation valves.
This event did not result in releases of radioactive or hazardous material, or personnel injuries.
The safety significance of the identified supervisory relay / design basis concerns was also reviewed.
The scenarios associated with both of the design basis issues require occurrence of certain design basis accidents coincident with a coil-shorting failure of one of the identified STLS/ RAS supervisory relays.
No scenario was identified in which a common cause relay failure would both initiate an event requiring safety injection and result in safety injection failure due to premature RAS.
A review of the Probabilistic j
Risk Assessment (PRA) model for FCS has determined that the probability of a coil-shorting failure of any of the eight identified supervisory relays, coincident with an event requiring safety injection, is extremely low.
As previously noted, the potential for such an occurrence has been eliminated by disconnecting the identified STLS/ RAS supervisory relays.
1 Nneranu = m
NnC FORM 306A U.S. NUCLE /d REGULATORY COMMISSION APPROVED BY OMB NO. 3150-o104 PM EXPIRES 5/31/95 ESTIMATED DunDEN PER HEBPONSE TO COMPLY WITH THIS LICENSEE EVENT REPORT (LER) gggEEUE*ls'kEfo EEa'*
m NMEN Aggegysy,N i
.t 7 N
MH N N
c r
E [a E E o"UooS*w" E E S.$ U $? " " "
a'*
FACUTY NAME (1)
DOOMET NUMUEM pl5 LIR NUWGER M PAGE M SEQUENTIAL HEVISION yg NUMBER NUMBER Fort Calhoun Station Unit No. 1 05000285 94
-- 001 --
00 uxT,...-.,.. o
.oomo,.
. o, Nec ro,m a.,o, c,13
CORRECTIVE ACTIONS
The following corrective actions have been or will be completed:
1.
The supervisory relay that failed (86B/CPHSS) was replaced and the replacement relay was tested on February 12, 1994.
The failed relay will be sent off-site for investigation of the failure mechanism.
This investigation will be completed by August 31, 1994.
2.
a.
An Engineering Analysis was performed to assess the potential significance of short-circuit coil failures of supervisory relays in Engineered Safeguards and Reactor Protective System circuitry.
Based on this evaluation, eight supervisory relays were identified as having the potential to cause unacceptable performance of plant safety systems during a design basis accident.
b.
Temporary modifications were implemented on February 18, 1994 and February 19, 1994 to eliminate the identified concerns, by disconnecting the eight supervisory relays.
c.
The temporary modifications will be removed and a permanent resolution of the design basis concerns implemented, by the end of the 1995 Refueling Outage.
3.
The problem experienced during the event with the C0P network has been addressed.
A modem was replaced on February 11, 1994, and the C0P network was successfully tested on February 14, 1994.
4.
With respect to the difficulties with the use of the manual operators for MS-291 and MS-292 during the event, the operator seals and 0-rings were replaced on February 11, 1994.
Also, a Preventive Maintenance Order (PM0) will be developed to periodically replace the operator seals and 0-rings.
The development of this PM0 will be completed by the start of the 1995 Refueling Outage.
PREVIOUS SIMILAR EVENTS
No previous similar events were identified involving initiation of engineered safeguards due to coil-shorting failure of a supervisory relay.
Nncronu =A e m
NRC FORM 306A U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB NO. 31504104 weal EXPIRES 5/31/96 ESTIMATED BURDEN PER RESPONSE TO COMPLY WITH THis LICENSEE EVENT REPORT (LER)
L*u^'yN g$
"w^'
RE N
0 p
TEXT CONTINUATION AND RECMDS MANAGEMENT BRANCH #NBB MH). U.S NUCUM REGULATORY COMMISSON, WASHINGTON. DC205650001, AND TO THE PAPERWORK REDUCTON PRCUECT (31504104). OFFCE OF j
MANAGEMENT AND BUDGET, WASHINGTON. DC 20603.
l l
rAauimuE m oocxET uuusm a tan uuumen m emsn YEAR NUMBER NUMBER Fort Calhoun Station Unit No. 1 05000285 11 OF 12 sm, m. -.
o, Nnc co,,,, m on i
l Figure 1 Supervisory Circuit Example 1I II l
'A'
'd 7
u@
uo B
li II II II II II
'A'
'd T
G u
u B
C I I II II II Ii 4i TEST SWITCH
(+)
as H
Ep I,
INITIATING l
l RELAY 86
4 3UPERVISORY I
RELAY l
i Nrc ronu acca Sea j
.I
NRC FORM 388A U.S. NUCLEAR REGULATORY COMMIS8lON APPROVED BY OMB NO. 31504104 A
EXPlRES 5/31/96 ESTIMATED BURDEN PER RESPONSE TO COMPLY WfTH THis
~
LICENSEE EVENT REPORT (LER)
INFORMATON COLUECTION FtEQUEST:
60.0 HRS.
FORWARD COMMENTS REGARDING BURDEN ESTIMATE TO THE INFORMATON TEXT CONTINUATION AND RECORDS MAfdQEMENT BRANCH (MNBB me) U.S. NUCLEAR REGULATORY COMMISSON, WASHINGTON, DC 2C6064001, AND TO THC PAPERWORK REDUCTION IVCJECT (31604104), OFFICE OF MANAGEMENT AND DVDGET, WASHINGTON, DC 20503.
noun saME m txx*rr u - a temuman m mea SEQUENTIAL REVISON yg NUMBER NUMBER Fort Calhoun Station Unit No. 1 05000285 12 oF 12 94
-- 001 --
00 Text m -. s-.
.s of NC Form 3ulLA) (17)
Figure 2 STLS/ RAS Logic TRAIN *A* LOOlc TRAIN *B* LOGIC 86A 868 STLS STLS i
l 8681 86A1 STLS STLS I
I 86AX 8681X 86A 8681 86BX 86A1X 868 86A1 RAS RAS RAS RAS RAS RAS RAS RAS I
i [myd MCV481 ort N L_ = m*
- I HCV450 dMM tev4a3 a HCV 484 OPth LCV4811 HCW40s oPEN ctost i =--== w I clott L= _- -- E Hov.3a3 3 HCW-383 4 onN Iwi
,c I
OPrN l W % u-a I as. ia sois imm l
=. = 1 Tsurf I =<= 1 tocaout Mcvass tocaout Hevass ctost clost i
i NOTE: LOGIC ASSUMES A DBA 6,e, a PPLS ce e CPHS signal present).
NRC FORM 306A @92) n