ML20212E744: Difference between revisions

From kanterella
Jump to navigation Jump to search
(StriderTol Bot insert)
 
(StriderTol Bot change)
Line 16: Line 16:


=Text=
=Text=
{{#Wiki_filter:,  .-_    -.                                                              _ _ _ _ _ _ _            _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ . - _
{{#Wiki_filter:}}
l                                                        .
JAN 2 01987 MEMORANDUM FOR:      Chairman Zech                                          AE0D/C605 Commissioner Roberts Commissioner Asselstine Commissioner Bernthal Consnissioner Carr l
FROM:                Victor Stello, Jr.
Executive Director for Operations L           
 
==SUBJECT:==
CASE STUDY REPORT . OPERATIONAL EXPERIENCE INVOLVING LOSSES OF ELECTRICAL INVERTERS Enclosed for your infomation is a copy of the final AE0D case study report on operational experience involving losses of electrical inverters. The study was initiated based on the observation of a lack of overall industry-wide improvement in the operational performance of these devices and the operational l            data which show that inverter losses can result in plant transients and/or the malfunctioning of safety-related and other important plant equipment. The primary focus of the study was to identify the principal contributing causes for the occurrence of inverter loss events.
l            The enclosed report documents AE00's findings, conclusions, and recommendations l-          resulting from the study and reflects the results of the peer review process.
The AE0D report has been forwarded to NRR and IE for appropriate action, and to RES and the Regions, INPO, and NSAC for infomation.
!            I would be pleased to provide any clarification or further infomation that j            you may desire.
;-                                                      Original signe4 bI Victor Stell.9/        .
Victor Stello, Jr.
Executive Director for Operations
 
==Enclosure:==
 
As stated cc w/ enclosure:                            Distribution:
J. Heltemes SECY                                        RDR.
t            OGC                                        AEOD CF            F. Hebdon ACRS                                        AEOD SF            S. Rubin                                                                f,},h'<
ROAB CF            M. Chiramal                                                            p    l ROAB SF            F. Ashe V. Stello          M. Williams                              /                            p[i go J. Roe              K. Black l
87030g461 g    W ino120 PDR    ,
T. Rehm J. Sniezek W. Lanning                                          /f')6['(  h      i
                                                                                                                                                          /
PDR                                      EDO R/F                                                                                        0 g) 0FC : AEOD:ROAB : AEOD:ROAE      : AE00:ROAB : AE00 DD          :    AEOD:D                  :  E  )0          :
l.....:_.. L At.....:......... w :........____:....          ... :..    (__..._:.                4 ...__...:...........
NAME : FAshe:cg    : MChiramal  : SRubin57??. FHe don          : CJ  ltemes : VS ello                          :
  .....:............:.__.........:....... . %................:............:....                        1.......:._........_
'DATE : I2/ia/86      : 12/M' /86  : 12//T/86    :  12/3 f /86  : 12/11 /86                  : Ilht/857 :
                                                                                                    ~
                                                                                                          ~'
0FFICIAL RECORD COPY
 
AE00/C605 CASE STUDY REPORT
* OPERATIONAL EXPERIENCE INVOLVING LOSSES OF ELECTRICAL INVERTERS December 1986 Prepared by: Frank Ashe Office for Analysis and Evaluation of Operatienal Data U.S. Nuclear Regulatory Commission a
    *This report documents results of a study completed by the Office for Analysis and Evaluation of Operational Data with regard to operational situations. The findings and recomendations contained in this report are provided in support of other ongoing NRC activities and do not represent the position or requirements of the responsible program offices of the Nuclear Regulatory Comission.
                                              - k h f 0)        >          b
 
M                                                .      .
TABLE OF CONTENTS Page EXECUTIVE
 
==SUMMARY==
. . . . . . . . . . . . . . . . . . . . . . . . . . . .      I
 
==1.0 INTRODUCTION==
. . . . . . . . . . . . . . . . . . . . . . . . . . . .        5 1.1 Background    ..........................                            5 1.2 Scope and Objectives      .....................                      5 2.0 DISCUSSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . .        6 2.1 Previous NRC and Industry Activities Relating to Inverters      .. 6 2.2 Inverter Design and Operation          ................              9 2.3 Description of Events . . . . . . . . . . . . . . . . . . . . .      11 2.4 Analysis of Events      ......................                      13 2.4.1 Causes and Contributing Factors          ............      13 2.4.2 Occurrences of Inverter Losses . . . . . . . . . . . . . 16 2.4.3 Plant Technical Specification Requirements . . . . . . . 17 2.4.4 Individually Significant Event Consequences ......          17 2.4.5 Failure Mechanisms and Common Cause Implications . . . . 19 2.4.6 Analysis of 1985 Events . . . . . . . . . . . . . . . .      19 2.5 Numerical Assessment of Risk Significance . . . . . . . . . . . 20 3.0 FINDINGS AND CONCLUSIONS . . . . . . . . . . . . . . . . . . . . . . 24 4.0 RECOMMENDATIONS      ..........................                            28
 
==5.0 REFERENCES==
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
                      /
l l
l l
l l
 
FIGURE                              Page Figure 1 Electrical Intercor.nections Between Load Center, Busses, Battery, Battery Charger and Inverter . . . . . . . . . . . . . 10 TABLES Table A        Inverter Loss Events by Plant Manufacturer and Year . . . . . . 12 Table 8        Contributing Factors and/or Causes for Component Failures . . . 14 Table C        Contributing Factors and/or Causes for Personnel Actions . . . 14 Table 1        Inverter-Related Events and Corrective Actions for 1984 . . . . 31 Table 2        Inverter-Related Events and Corrective Actions for 1983 . . . . 72 Table 3        Inverter-Related Events and Corrective Actions for 1982 . . . . 98 Table 4        Categorization of Inverter-Related Events in Table 1 . . . . . 121 Table 5        Categorization of Inverter-Related Events in Table 2 . . . . . 122 Table 6        Categorization of Inverter-Related Events in Table 3 . . . . . 123 Table 7        Total Losses Attributed to Personnel Actions and Component Failures Which Occurred in 1984 . . . . . . . . . . . 124 Table 8        Total Losses Attributed to Personnel Actions and Component Failures Which Occurred in 1983 . . . . . . . . . . . 125 Table 9        Total Losses Attributed to Personnel Actions and Component Failures Which Occurred in 1982 . . . . . . . . . . . 126 f
I L
 
M                      -
1 EXECUTIVE
 
==SUMMARY==
 
This report provides a study on operatioaal experience involving losses of electrical inverters. The report principally contains (1) a review of previous activities in this area by both the U.S. NRC and industry groups; (2) an analysis and evaluation of inverter loss events which occurred during 1982, 1983, and 1984; and (3) recommendations that were discernible from these events. In addition, this report contains a brief analysis and evaluation of inverter loss events which occurred during 1985. The primar information for this study was Licensee Event Reports (LERs)y source of The major findings and conclusions of this study are:        ,
(1) The number of events involving inverter losses per reactor-year shows little or no improvement in each calendar year. The number of events involving inverter losses which were described in LERs, increased for each consecutive calendar year in the three year period included in the study.
The number of events involving inverter losses which are occurring each calendar year are at least in the range of 50 to 60. This overall lack of improvement has occurred in spite of a number of previously recomended corrective actions.
(2) Events involving inverters illustrate that a loss of power from the output of an inverter often results in a loss of power for the bus which it was supplying. The loss of bus power causes connected electrical loads to de-energize and this results in a number of undesirable plant conditions and/or actions. Among these conditions and/or actions are:
Severe system transients, including reactor cooling transients.
Challenges to plant operators and remaining functional equipment.
Unnecessary actuations of safety systems including reactor protection and safety injection systems.
Improper control system responses including systems provided for feedwater and steam generator level control, Degradation in redundency for safety-related instrumentation channels and power supplies, Loss of indicators which provide information concerning plant and safety system status, Loss of function for safety-related equipment and in some cases safety-related systems, and Damage to mechanical equipment.
In general more than one of the above listed conditions and/or actions usually occur simultaneously, however, each bus power loss does not lead to all of the listed conditions and/or actions. Nevertheless, these
 
2 resulting undesirable situations, in conjunction with the number of events involving inverter losses, suggest that measures leading to a decrease in the number of such events are warranted.
(3) The dominant cause of the inverter loss events was attributed to component failures. Such components include diodes, fuses, silicon control rectifiers, capacitors, transistors, resistors, printed circuit boards, transformers and inductors. The review indicates that a major contributing factor for these component failures is incompatibility between actual plant service conditions and design service conditions (i.e., actual plant service conditions are more severe than that assumed in the design of inverters). Specifically, the data analysis showed that:
High ambient temperature and/or humidity within inverter enclosures and electrical disturbances at inverter terminals contribute to or cause in excess of 50 percent of the events attributed to component failures.
In addition, three events were explicitly identified in which dust and dirt in inverter enclosure and on internal components contributed to incompatible service conditions.
Operation of plant switchgear and other electrical equipment can                              '
result in the generation of voltage spikes and perturbations which either cause or contribute to occurrences of events involving inverter losses. This occurs because many of the plant electrical loads which are energized or de-energized during plant evolutions have inductive characteristics.
This report identifies three potential failure mechanisms for inverters.
These three mechanisms involve:                              (1) high ambient temperature and/or  ,
humidity witt in inverter enclosures; (2) electrical interconnections and physical arrangements of components which form the inverter circuitry;'and (3)voltagespikesandperturbationsatinverterinputsandoutputsin conjunction with relatively rapid response time of solid state devices.
The two failure mechanisms involving service conditions, (i.e., ambient temperature / humidity and voltage spikes) have common cause implications.
These mechanisms potentially can cause the simultaneous loss of redundant inverter-powered buses.
(4) The second largest cause of events involving inverter losses was personnel actions. These include: opening incorrect circuit breakers; connecting faulty test equipment to an inverter (or attendant circuitry); causing short circuits during maintenance and testing activities; improperly transferring power sources for a bus; and removing the wrong inverter unit from service. Some of these actions result in damaged and/or failed components within an inverter unit. Others result in simply de-energizing a functioning unit. Principal contributing factors to such actions are inadequate maintenance and testing procedures and deficient practices.
Inadequate planning, training and verification for related maintenance and                    -
testing activities are also contributing factors.
(5) Two specific areas of circuitry design which involve inverter units warrant further consideration.
l
: a. One of these areas involves the RCS pressure instrumentation channels associated with PWR RHR system isolation valves. Th?re are rormally two pressure instrumentation channels with each channel providing a closure signal to one of the two motor-operated isolation valves installed in the RHR system suction line. A loss of power to either of these two instrumentation channels as a result of a single inverter loss causes a loss of shutdown cooling.
: b. The other area involves the circuitry which monitors the position of circuit breakers for reactor coolant pump (RCP) motors. This item appears to be limited to Westinghouse plants which use the Solid
* StateProtectionSystem(SSPS). Upon loss of power output from an inverter unit, this circuitry de-energizes, thus indicating to the SSPS that a circuit breaker for an RCP motor is open when in actuality it is not. Above a certain reactor power level, the SSPS causes a trip of the reactor with an attendant plant transient. Eight events at three plants involving spurious reactor trips with attendant plant transients are identified in this report.
(6) Plant technical specification operating restrictions (e.g., action statements) for an inoperable inverter, or the unavailability of one of two input power sources for inverters with dual power inputs, are not consistent for comparable plant designs. At multiple unit sites inconsistencies in the technical specifications between plant units can contribute to plant personnel errors. This may cause inappropriate personnel actions which result in the plant not being operated in accordance with its technical specifications.
The recomendations provided in this report are as follows:
(1) The Office of Inspection & Enforcement (IE) should issue an infomation notice which addresses events involving inverter losses. The infomation notice should address two areas.
First, the information notice should suggest that licensees review the compatibility between actual plant service conditions and design service conditions for installed inverters. Such reviews should consider evaluating the need for continuous or regular monitoring of temperature and humidity internal to inverter enclosures. Also, the need for monitoring inverter input and output voltages for both steady state and transient (electrical) conditions should be evaluated during such reviews. Further, measures which prevent accumulation of dust and dirt on components internal to inverter enclosures should be considered.
Second, to minimize the number of inverter loss events resulting from personnel actions, licensees should consider reviewing related maintenance and testing procedures and practices for inverters. To the extent possible,
,      these reviews should be directed toward identifying the appropriate j      sequence of steps required for inverter maintenance and testing activities. To the extent possible, such reviews should include planning l
 
for specific inverter maintenance and testing activities. Specialized training and practice sessions with involved plant personnel, and verification of the identified appropriate sequence of steps to achieve these activities should also be considered. Following the completion of such reviews, appropriate follow-up actions should be performed by licensees. Also, it is suggested that any modifications resulting from such actions be identified and addressed in routine regional inspection reports.
(2) Eight events at three pisnts involving spurious reactor trips with atten-dant plant transients are identified in this report. These events are attributed to the circuitry which monitors the position of the circuit breakers for reactor coolant pump motors. In view of this operating experience and to prevent a single failure of a safety-related component from causing an unnecessary plant transient the as-installed arrangement for this circuitry should be reassessed by NRR. Two out of four coincident logic for this circuitry could be considered for implementation. Operating experience indicates that this item applies to Westinghouse units with the SSPS.
(3) Technical specifications which specifically address inverters and/or attendant buses for comparable plant designs should be reviewed to ensure that action statements addressing plant operating restrictions are                                                                  '
consistent. Inconsistent action statements identified during such reviews should be modified accordingly or at least technical bases established for such inconsistency. Such reviews should include special consideration for inverter units with dual power inputs. It is suggested that NRR consider this aspect during resolution of Generic Issue 128 " Electrical Power Reliability."
f
 
==1.0 INTRODUCTION==
 
===1.1 Background===
Inverters in nuclear plants provide uninterruptible vital ac electrical power to safety and nonsafety-related instrumentation and control systems. In general, inverter losses result in some type of undesirable system conditions and/or plant transients. These conditions and/or transients include:
unnecessary actuation of safety systems, including the reactor protection and safety injection systems; loss of indicators which provide plant status information; severe system disturbances, including reactor coolant system transients; improper response of the feedwater and steam generator level control systems; loss of safety-related electrical equipment functions; damage to mechanical equipment; and challenges to operators and the remaining functional equipment. Such conditions and/or transient's clearly have significant safety implications, since they result in a challenge to safety equipment and plant operations, and/or a degradation of plant equipment for some period of time.
This study was initiated based primarily on information contained in preliminary notifications which addressed a number of the operating experiences involving losses of electrical inverters. Events of this type were identified and reviewed by IE personnel during the latter part of 1984. Subsequently, AE00 conducted searches of data base systems for information relating to similar
    . events involving losses of electrical inverters. After initial review of the information, and following discussions between IE and AE00 personnel, it was concluded that further AE00 study of these events was warranted.
1.2 Scope and Objectives The study which was initiated includes 94 LERs which provide information concerning 107 events involving losses of electrical inverters. These LERs were identified as a result of information obtained from the RECON and Sequence CodingandSearchSystem(SCSS) databases. The identified LERs provide descriptive and other information concerning events involving inverter losses which occurred during the calendar years of 1982, 1983, and 1984 Thirty-five additional events which occurred during these years were found in the Nuclear PlantReliabilityDataSystem(NPROS).
The study provides a review, an analysis and an evaluation of events involving a loss of an electrical inverter. It primarily addresses events which occurred during 1982, 198',, and 1984. The review and analysis were directed towards identifying the major contributing factors and/or the causes of these events.
The information provided in Tables 1, 2, and 3 at the back of this report was reviewed in detail, since this is the primary information used for identifying such factors and/or causes. This study also reviewed information resulting from past activities by both the NRC and industry groups. Finally, actions which could lead to a reduction in the number of these events as well as an improve-ment in the overall operation of electrical inverters, were also identified where possible.
 
2.0 O!SCUSSION 2.1 Previous NRC and Industry Activities Relating to inverters Past operating events involving losses of electrical inverters have resulted in a number of follow-up activities by both the NRC and industry groups. Since January 1979, NRC activities relating to electrical inverters have resulted in the Office of Inspection and Enforcement issuing one bulletin, one circular and two information notices. During this period, industry groups issued approximately 14 reports related to inverter losses. In October 1982, AE00 issued a report which also addressed events involving inverter losses. A brief description of the information contained in these documents and other related information is provided in the following paragraphs..
IE Circular 79-02, " Failure of 120 Volt Vital AC Power Supplies" was' issued on 16, 1979. This circular addressed an event at Arkansas Nuclear One January Unit 2 (ANO-2) involving a loss of at least two 120 Vac inverters. Although not specifically identified, the cause of this event appeared to be related to a degradation of both offsite power sources. As documented in the circular, subsequent investigation identified problems in three areas associated with the inverters. The areas identified were: low input voltage and the time delay circuitry, the setting of the taps on the 480 Vac-to-120 Vac three phase input transformers, and the actuation setpoint for transferring electrical loads from the inverter to an alternate source for inverter output overcurrent or          '
undervoltage conditions. The circular recommended that determination and verification of the proper setpoints, time delays and transformer tap scttings be considered after reviewing the ANO-2 event.
IE Information Notice 79-29, " Loss of Nonsafety-Related Reactor Coolant System Instrumentation During Operation" was issued on November 16, 1979. This infonnation notice discussed an event at Oconee Unit 3 in which a static transfer switch failed to automatically transfer its loads from the inverter to the associated regulated ac power source. The inverter associated with the static transfer switch tripped due to blown fuses. The inverter loss and associated switch failure resulted in a loss of power to several instrument channels associated with certain control systems, indicators and recorders.
The main control room indicators and recorders involved displayed information associated with several reactor coolant system (RCS) process variables. During the event, the RCS cooldown rate was exceeded due to the resulting response of the feedwater control system. Although the root cause of the loss of the inverter was not identified, it appeared to be related to the tripping of the main condensate p, umps. For corrective action a redundant electro-mechanical transfer switch was installed between the loads and the regulated supply. This    ,
switch was to actuate and power the loads from the regulated supply should the originalstatjeswitchfailtotransfer.
IE Bulletin 79-27, " Loss of Non-Class 1E Instrumentation and Control Power System Bas During Operation" was issued on November 30, 1979. The bulletin provided additional information relating to the Oconec event addressed in IE Information Notice 79-29. The bulletin contained specific action items to be
 
l taken by licensees. Licensees were to review the Class 1E and Non-Class 1E buses supplying power to safety and nonsafety-related instrumentation and con-                                  l trol systems which could affect the ability to achieve a cold shutdown condition. For each bus identified, the licensees were to review the control                                    l room alarm and/or indications which alerted the operator to the loss of power                                  I to the bus. Additionally, the instrumentation and control system loads con-                                    l nected to the bus were to be identified and an evaluation of the effects of                                    l loss of power to these loads were to be provided. Proposed design modifications resulting from these reviews and evaluations were also required.
Another action item included preparing or reviewing emergency procedures (including procedures required to achieve a cold shutdown condition), to be used by control room operators, for a loss of power to each Class IE and Non-Clacs 1E bus supplying power to safety and nonsafety-related instrumentation and control systems. The emergency procedures were to include diagnostics, alarms, indicators and symptoms when a bus is lost. The                                            .
procedures were to address the use of alternate indication and/or control                                      l circuits which may be powered from other Non-Class 1E or Class 1E instrumentation and control buses. The procedures were also to include methods for restoring power to the bus. Proposed design modifications or administrative controls implemented as a result of these reviews were to be described. The remaining action item expanded the scope of IE Circular 79-02 to include both Class 1E and Non-Class 1E safety-related power supply inverters. Proposed design modifications or administrative controls to be implemented as a result of these re-reviews were to be described. It should be noted that the NRC Incident Investigation Team for the loss of integrated control system power and overcooling transient event which occurred at Rancho Seco on Occomber 26, 1985 found that no design modifications or event oriented procedures were actually implemented at the Rancho Seco plant as a result of this bulletin (Reference 4). However, this finding is limited to Rancho Seco, and as such should not be used to conclude what might have been implemented at other plants as a result of this bulletin.
IE Infomation Notice 84-80, " Plant Transients Induced by Failure of Non-Nuclear Instrumentation Power" was issued on November 8, 1984 This information notice described two events, one at Rancho Seco and another at Crystal River Unit 3, involving lost power supplies for non-nuclear instrumentation. Both events involved significant plant transients. The event at Rancho Seco involved an inverter which was supplying power to non-nuclear instrumentation. Althcugh not specifically identified, the cause for the degradation in the electrical output of the inverter was believed to be related to equipment damage which occurred during a fire and explosion. It was believed that the, fire and explosion caused several grounds in the 125 Vdc supply bus which provided the input to the inverter. Near term corrective actions which were taken by the licensee included readjusting the overvoltage and undervoltage trip setpoints for the direct current power supplies. The information notice also contained a number of long term corrective actions which were identified by the licensee.
Reference 6 is a report which was issued by AE00 on October 21, 1982. This report identifies 66 events involving losses of electrical inverters which occurred during 1980, 1981, and 1982. This report clearly indicated that the 1
I
 
8-number of events which were occurring each calendar year was not decreasing.
The report also described several of the under.irable consequences of these events. In addition, the report presented five recomendations which resulted from an industry group study which was issued in late-1981. In view of these specific recomendations, along with other information, the AE0D report concluded that the recomendations provided by the industry group would, if properly implemented, lead to a reduction in the number of events involving inverter losses. The report also suggested that further actions be taken if there was no reduction in the number of these events.
The industry group reports addressed approximately 28 events involving losses of electrical inverters. The events involved: unnecessary safety system actuations (including reactor protection and safety injection systems), loss of safety-related equipment, loss of indicators providing information concerning plant status, and improper control system responses. As a result of the review, analysis and evaluation of these events, corrective actions were suggested in the areas of design, procurement, maintenance, procedures, operations, and training. Suggestions related to design and procurement included upgrading component purchase specifications to ensure that components certified for higher than expected temperatures, voltages and other service conditions would be used. It was also suggested that the electrical protection coordination of the inverter feeder, inverter supplied bus, and associated branch circuits be analyzed and, if necessary, improved. Suggestions related to maintenance and procedures included establishing preventive maintenance programs to periodically replace capacitors, printed circuit boards, and other components as recomended by manufacturers. It was also suggested that the maintenance procedures for testing and troubleshooting inverters include sufficient guidance to preclude damage to internal components due to human errors. In addition, it was suggested that procedures or guidelines be developed to assist in the investigation of fuse failures and to control fuse replacement. Suggestions in the area of operations included the development of a procedure or an approved listing that would indicate which critical components, instruments, indicators, and annunciators are powered from vital power supply buses and inverters. It was also suggested that operator training provide a clear understanding of inverter operation, power supply arrangements, backup computer readings and alanns, techniques for identification of failed inverters, and inverter failure recovery actions.
The data to be presented in this study clearly suggests that (on an industry wide basis) the previous activities have not resulted in a significant decrease in the inverter loss events per reactor year in each consecutive calendar year. Inadequate recomendations and/or inadequate or improper implementation of the previous recommendations may be the cause. Although some of the recommended corrective actions to be suggested in this report are similar to previous recomendations, the actions to be suggested should, if properly implemented, result in a reduction in the frequency of inverter losses.
For example, hardening of components which form the inverter circuitry, to withstand higher temperatures, voltages, and currents, has previously been recomended to obtain compatibility between actual plant service conditions and i
 
9 design cervice conditions. However, the suggestions in this report for obtaining compatibility, permits other measures to be taken. These include modifying inverter enclosures and/or installing fans within these enclosures.
Further, the ventilation systems which service areas where inverters are located could be modified. These measures could be taken as appropriate to lower ambient temperatures within inverter enclosures. Minimizing switchirig operations which result in electrical disturbances at inverter terminals could also be implemented as a means of reducing inverter damage or loss due to voltage spikes. Such additional optional corrective actions could be used individually or in combination to achieve the desired results. Second, with regard to human performance deficiencies which result in inverter losses during maintenance and testing activities, it is to be suggested that additional specific steps and actions relating to these activities be identified and verified (as appropriate) prior to actual implementation. Thus, by defining more accomplished clearly)and priorintomore detail what conducting      is to be and maintenance    performed    (and howthe testing activities, it is to be number of inverter loss events attributed to human actions should decrease.
Finally, it is to be suggested in this report that appropriate follow-up actions be taken by licensees and monitored by NRC inspectors. This approach should ensure that adequate corrective actions will be taken for recurring events involving inverter losses.
2.2 Inverter Design and Operation Figure 1 is a single line diagram which shows the electrical interconnections between a 460 Vac load center, 120 Vac bus, 125 Vdc bus, battery, battery charger, and inverter. These components form an electrical division for a 120 Vac uninterruptible power supply (UPS). At specific operating nuclear plants such an electrical division may consist of various combinations of the components shown in Figure 1. This figure also shows an alternate supply to the 120 Vac bus which is provided by a 480/120 Vac step down and regulating transformer. A typical nuclear unit has two or more of these electrical divisions with (in general) each division providing power to one 120 Vac bus.
As indicated on the diagram, the basic function of an inverter unit is to take a direct current (de) input and transform it into a high quality uninterruptiblealternatingcurrent(ac) output. The quality of the output depends on the value of the voltage amplitude, the frequency in cycles per second and wave-form shape. High output quality is required for optimum functional performance of the electrical loads which are powered by the inverter unit. Within limits, the inverter unit also can maintain a stable output over a range of input voltages and load variations. In addition to the battery bus input', some plants have inverter units with an additional input provided by an ac bus. As shown in Figure 1, this input is changed to de by a rectifier. The output of the rectifier is auctioneered with the de source provided by the battery bus. The higher of the two de voltage sources is provided as the input to the inverter.            In most plants with this arrangement, the rectifier output provides the normal input source for the unit. However, if problems occur with this input, the design is such that an automatic transfer to the backu) input (provided by the battery bus) should occur without any interruption of tio de input to the inverter unit. At some operating plants, the output of the inverter unit is connected to a 120 Vac bus by way of a static transfer switch and interconnecting wiring. At other operating plants l
 
400 VAC LOAD CENTER A                                                                  A
                                                                                          /N                                                                  /\
El                                                                  El 440 VAC SUS BATTERY CHARGER a  A                                                                                                -
[3 400/120 VAC 7m                                                                                                        .
125 VDC SUS STE P.DOWN                                                                                                              ,
AND REGULATING TRANSFORMER
[]                          []
(TYPICAll
                                                                                                                                                -      125 VDC BATTERY llN SOME PLANTSI 1  P
                                                                                                                                                    ~
tJ N      AUCTIONEER CIRCulT INVERTER rm LJ        STATIC BWITCH U
(ALTERNATEl m                                                                                                                    g e                                                                                                            ELECTRO MECHANICAL TRANSFER SWITCH 120 VAC SUS Figure 1 Diagram illustrating Electricalinterconnections Between f.osd Center. Busses, Bettery, Bettery Charget, and inverter.
 
inverter units are not equipped with a static transfer switch, and the inverter output directly supplies the 110 Vac bus. The static transfer switch (in inverter units with this design feature) is designed such that the downstream 120 Vac bus will automatically transfer from the inverter to the alternate source (without loss of power to the bus) if a condition resulting in inverter output overcurrent and/or undervoltage occurs. The rectifier, inverter components, static transfer switch, and interconnecting wiring are normally physically located within the enclosure for a single inverter unit.
An electro-mechanical transfer switch is generally provided to ensure a source of power to the 120 Vac bus during maintenance of the inverter.
The 120 Vac bus and inverter arrangement referred to above generally provides uninterruptible power to a number of important electrical loads. These loads include:
* Instrumentation, controls, and control circuitry for protection systems; Controllersandattendantcontrolcircuitry)forcontrolsystems(e.g.,
steam generator level and feedwater control ;
* Instrumentation, controls, and control circuitry associated with engineered safety features; and
* Indicators which provide information relating to both plant and safety system status.
Many of the inverter loss events identified in this report were attributed to failures of components which form a part of the inverter circuitry. Contribu-ting factors or causas for some of these events were ambient temperature and humidity within inverter enclosures and/or voltage spikes and perturbations at inverter terminals. For inverter units equipped with a static transfer switch, these service condition parameters may also affect the operation of this switch. In such units the static transfer switch is an integral part of the Inverter unit, and the inverter circuitry and static transfer switch circuitry are not independent. Accordingly, for those events involving this type of unit (in which a loss of the inverter results in the loss of the attendant bus) the inability of the transfer switch to transfer to the alternate source of power may be viewed as a consequential or dependent failure. For such a situation, the inability of the transfer switch to transfer the attendant bus to the alternate source should not be viewed as an addittoral or independent failure.
Most of the events addressed in this report involved loss of an inverter with a resulting loss of' power to an attendant ac bus. The loss of bus power generally causes important electrical loads to be de-energized which results in undesirable p1, ant transients and/or conditions.
2.3 Description of Events Tables 1, 2, and 3 in this report provide descriptive and other information concerning events involving losses of electrical inverters which occurred during 1984, 1983, and 1982, respectively. These tables identify 94 LERs which
 
provide infomation concerning 107 events. Selected information which may be derived from these tables combined with similar information which may be derived from the NPR05 is provided in Table A below.
Table A Inverter loss Events by Plant Manufacturer and Year Plant Manufacturer      1982          1983          1984            Total Westinghouse              14            23            31                68
  -      Combustion Engineering 12                7            13                32 General Electric          4            14              9              27 Babcock & Wilcox          4            6              4              14 General Atomic            0            1              0                1 Totals:    34            51            57              142 The above table lists the 142 inverter loss events included in this study.
This listing provides the identified number of inverter loss events which occurred during the indicated calendar year. The 142 events occurred at 51 distinct plants consisting of 26 Westinghouse, 11 General Electric, 9 Combustion Engineering, 4 Babcock & Wilcox, and 1 General Atomic. One-hundred                        .
twelve events occurred at 39 plants with comerical operating dates before January 1982. The remaining 30 events occurred at 12 plants with comerical operating dates after December 1981. This data indicates that some events involving inverter losses are random with certain plants having more events than others. The total number of events for each of the three years as provided in Table A along with the number of reactor units which were operating during each of these years is sumarized below.
Parameter                        1982  1983  1984 Operating Reactor Units
* 7      7      7 Inverter Loss Events                    34    51      57 Losses / Operating Reactor              47    .69      70 The information in the above sumary, clearly shows that there was little or no decrease in the number of losses or losses / operating reactor which were reported during the three calendar years.
the infomation contained in Tables 1, 2, and 3 at the As backstated of thispreviously,llustrate report i            that the loss of an inverter of ten results in the loss of the corresponding ac bus. It is the loss of the bus which results                          -
in a number of undesirable plant transients and/or conditions.        These include:
* Severe system transients including reactor cooling transients.
* Challenges to plant operators and remaining functional equipment.
* Unnecessary actuations of safety systems including the reactor protection and safety injection systems.
    *See References 7, 8, and 9.
 
Improper control system responses including those provided for feedwater and steam generator level control.
Degradation in redundancy for safety-related instrumentation channels and power supplies.
* Loss of indicaters which provide information concerning plant and safety system status.
Loss of function for safety-related equipment and in some cases safety-related systems, and
* Damage to mechanical equipment.
Each of the above listed items usually occurs in conjunction with at least another, however, each bus power loss does not lead to all of the listed items.
The preceding tables, together with other information contained in previous reports (Section 2.1), show that the )reviously recommended corrective actions have not resulted in a reduction in tie frequency of inverter loss events.
2.4 Analysis of Events The events described in this report were analyzed in five general areas. The areas are: (1) causes and contributing factors for inverter losses, (21 frequency of inverter losses, (3) inconsistencies in plant technical specifica-tions for inverters for similar plant designs, (4) individually significant event consequences and (5) failure mechanisms and common cause implications.
In addition, a brief analysis and evaluation of events which occurred in calendar year 1985 is provided. The subsections below address each of these areas.
2.4.1 Causes and Contributing Factors Tables 4, 5, and 6 at the back of this report categorize the events identified in Tables 1, 2, and 3 respectively. The events were categorized for each plant on the basis of attributed causes for the occurrences of inverter losses as discussed in the LERs and related discussions with licensees. The occurrences of inverter losses were assigned to one of two causes; component failures or personnel actions. The term " component failures" as used in this report refers to the failure of components which are internal to the inverter enclosure and form a part of its circuitry. Such components include fuses, capacitors, silicon control rectifiers, transistors, printed circuit boards, diodes, resistors, inductors and transformers. The term " personnel actions" refers to actions which'aro performed by plant personnel on installed equipment. This term includes actions necessary to open circuit breakers, actions involving connecting test equipment to installed inverters or associated circuitry, and actions performed on plant equipment during maintenance activities. It is noted that personnel actions can result in a failure of inverter components or can result in de-energizing a functioning inverter unit. Tables 7, 8, and 9 at
 
the back of this report provide a similar categorization of the 142 events included in this study. These tables provide a categorization of these events in terms of th) two fundamental causes identified atove. These two basic causes are further divided in terms of contributing factors and/or causes which may be attributed to plant specific problems involving these factors and/or causes.
Events attributed to component failures are also grouped into one of three areas relating to contri)uting factors and/or causes. These groupings are:
temperature and/or humidity, electrical disturbances, and unknown (or unclear) factors. Events attributed to personnel actions are grouped into one of three areas related to contributing factors and/or causes. These groupings are:
inadequate procedures, inappropriate personnel actions, and unknown (or unclear) factors. Tables B and C below group the events included in this report by the calendar year in which the events occurred and the contributing factors and/or causes.
Table O Contributing Factors and/or Causes for Component failures Temperature and/or Year        Humidity            Electrical Disturbance        Unknown                              _To tal 1984              11                      5                    17                                  33 1983                8                    14                    16                                  38 1982                1                      9                    12                                  22 Totals T                        '7T                    T                                  Y Table C Contributing Factors and/or Causes for Personnel Actions Inappropriate Year _    Inadequate Procedures      Personnel Actions        Unknown                              Total 1984            8                            11                  5                                  24 1983            4                            7                  2                                  13 1982            6                            6                  0                                  12 Totals  Tr                          T                    T                                  T The above tables and Tables 4, 5, and 6 indicate that inverter losses are most often caused by component failures. The previous tables. (along with the descriptive and o'ther information contained in Tables 1, 2, and 3 and related information obtained from NPROS) Strongly suggest that incompatibility between the actual inplant service conditions for the inverter and its design service conditions is a major contributing factor for those occurrences. Service condition parameters which appear to be important contributors to component failures are: temperature and/or humidity within inverter enclosures, and voltage spikes and perturbations at inputs and outputs of inverters. These service condition parameters can result in damage or failure of components which form a part of the inverter circuitry and/or cause the inverter to trip.
 
A similar concern relating to degradation or damage to instrumentation and control er,uipment due to high ambient temperature is addressed in the AE00 Case Study terort: " Effects of Ambient Temperature on Electronic Er.uipment in Safety-Related Instrumentation and Control Systems" dated December 1986 (Reference 10). In addition to the above service conditions, three events were explicitly identified in which dust and dirt in inverter enclosures and on internal components contributed to incompatible service conditions.
TableB(whichrelatestocomponentfailures)appearstosuggestthat electrical disturbances are a dominant contributor to the occurrences of these events. However, this table should not necessarily be viewed in this manner since many of the events in the unknown grouping were at least influenced by one or both of the other factors. That is, the information relating to such events was not explicit enough to identify the specific contributing factor and/or cause. For these reasons, the numbers provided under the unknown column for any one calendar year should not be viewed alone or as absolute, but rather the totals shown viewed collectively.
Approximately 65 percent of the events were attributed to component failures.
High ambient temperature and/or humidity within inverter enclosures, and electrical disturbances at inverter terminals contributed to or caused over 50 percent of these events. In addition, the information provided in Tables 1, 2, and 3 strongly suggests that the operation of plant switchgear and other electrical equipment can result in the generation of voltage spikes and per-turbations which either can cause or contribute to such events. This would          .
suggest that measures, such as changing the actual plant service conditions and/or changing the rated service conditions (which would result in obtaining compttibility between the actual plant service conditions for inverters and their design service conditions) should lead to a reduction in the number of events involving inverter losses.
The second largest cause of these events was personnel actions. Thirty-five percent of the events were attributed to personnel actions. Some of these actions resulted in damaged and/or failed components which form a part of the inverter circuitry. Others resulted in simply de-energizing a functioning unit. Contributing factors included inadequate maintenance and testing pro-cedures and deficient practices. Also, inadequate planning, training, and verification for related maintenance and testing activities were contributing factors.
From 'able C, the contributing factors attributed to personnel actions are inadequate maintenance and testing procedures, and practices. Other contributing factors are inadequacies in planning, training, and verification for actions to be performed during maintenance and testing activities.
Specific areas relating to maintenance or testing practices involve procedures for charging Class 1E batteries or on-line testing of inverters, respectively.
Deficiencies found involved a lack of:
Explicit instructions to monitor and adjust battery charger output voltage as needed to avoid excessively high inverter input voltage (i.e., ensure that the voltage is below the inverter high input voltage protective trip) prior to placing the battery charger on equalizing charge.
 
Explicit instructions to (functionally) verify prepar operation of all te:t equipment prior to connecting the equipment to an on-Ifne inverter.
Other specific deficiencies found include:
Inadequate verification that maintenance procedures include provisions to ensure either a functional test is performed on related eq11pment in which leads are Ilfted during maintenance or to record the initial and final position of all leads.
* Inadequate verification that maintenance procedures and actual practices (i.e., the manner in which procedures are practically implemented) prevent maintenance activities on more than one vital instrument inverter unit at the same time.
* Inadequate verification that applicable o?vrating procedures prohibit an inverter unit or single power source from supplying power to more than one vital bus during plant operating conditio.is above cold shutdown except in emergency conditions.
These deficiencies would suggest that further measures leading to improvements in maintenance and testing activities for inverters are warranted.
Further support for the above suggestion is provided in the Phase 1 report,
" Operating Experience and Aging Seismic Assessment of Battery Chargers and Inverters dated June 1986 (Reference 11). This rc.n9rt was issued during the same time period (i.e., June 1986) as a draft of this case .tudy was issued for peer review coments. One of the conclusions contained is this report was
: that,
    " Personnel errors in the design, manufacture, operatirn, and maintenance of battery chargers and inverters account for a large parceritane of documented failure ( 15%). It may be concluded that improvemints H maintenance and operating personnel training would improve overall performatce levels considerably."
2.4.2 Occurrences of Inverter Losses As previously indicated. Tables 7, 8, and 9 contain additioviel inverter loss events which occurred during 1984,1983, and 1982, resper.tivdy. The additional events were identified as a result of a revf=w of Infmwation obtained from the,NPROS. It should be noted that the w,nbor of LfRs involving inverter losses attributed to component failures, ha decrento as a result of the new LER rule (10 CFR 50.73) which went into offs:t on Janaary 1, 1984.
However, it appears that in 1983, there was an increase in the number of events being entered into the NPROS involving inverter losses attributed to component failures.
The number of inverter losses wnich are occurring per calerdar year is at leut in the range of 50 to 60 events. Additionally, based uron the conbined LU< and NPROS data and the number of plants in comercial operation in each of tht
 
three calendar years, it may be concluded that the number of inverter loss events which were reported per reactor-year shows no meaningful decrease over each consecutive calendar fear.
2.4.3 Plant Technical Specification Requirements The information provided in Tables 1, 2, and 3 clearly show inconsistencies in the plant technical specifications which address restrictions relating to electrical inverters. That is, for comparable plant designs technical I    t e cifications result in different operating restrictions for inverter losses or unavailabilities. In addition to a lack of uniformity in operating restric-tions and/or action statements, inconsistencies for inverter units with dual inputs (one de input and one ac input) were evident. Some plants are not required by technical specifications to restrict plant operations within a certain time period if one of the two inputs to an inverter is lost or removed from v rvica. However, the technical specifications of other similar plant designs do contain plant restrictions. At multiple unit sites, such inconsis-tencies can contribute to plant personnel errors that result in the plant being operated not in accordance with its technical specifications. A similar conu rn was identified in a previous memorandum, " Operational Restrictions for Class 1E 120 Vac Vital Instrumont Bus" from Carlyle Michelson to Harold Denton 15 1980(Reference 12). Reference 12 suggested that when an dated inverterJuly (sour,ce of uninterruptible power) is lost and its associated 120 Vac bus is being powered by an alternate source (normal ac power), plant operating restrictiu s should be 1pplicable and contained in plant technical 50actfh.etions.
The &ve discu',sion suggests that technical specifications which address failed or inoperable inverters (and/or attendant buses) for comparable plant designs should be reviewed to ensure action statements addressing plant operating restrictions are consistent. Action statements which are inconsistent should be modified as necessary or at least technical bases estellshed for such inconsistency. These reviews should include special consideration for inverter units with dual power inputs.
To further support this conclusion, Section 5.3 " Technical Specifications" in Reference 11 provides a discussion which addresses limiting conditions for coert, tion (LCOs) for sital ac buses (inverters) at Westinghouse, General Electric, Combustion Engineering, and Babcock & Wilcox plants. This section providesthespecificLCOs(actionstatements)forinoperablevitalac buses /fnverters as stated in the Standard Technical Specifications for each of these Hur types pf plants. In addition, stated in this section is that, "Other selected PWR technical specifications revealed more stringent requirements including requiring bus restoration within 2 hours and proceeding to a hot standby status in the next 6 hours. Selected BWR technical specifications revealed no LCO for inverters."
s  2.4.4    Individually Significant Event Consequences Two areas involving plant electrical circuitry normally supplied by the l'nurter buses 6.ith the potential for causing undesirable conditions or actions b
 
were identified for special review, analysis, and evaluation. These areas were identified based on the number of events involving these circuits, and the undesirable conditions or the potential consequences which might occur.
One area involves PWR reactor coolant system.(RCS) pressure instrumentation channel circuitry provided for the motor-operated valves in the residual heat removal (RHR) system. Most operating PWRs have two motor-operated isolation valves connected in series in a single suction line. In this arrangement one of the RCS hot legs is connected to the suction side of the RHR pumps. An isolation valve will close on a signal from its associate pressure instru-mentation channel. Either of the instrument channels and attendant circuitry will close its associated valve to protect the low pressure piping of the RHR system from being overpressurized. Power for these circuits are normally provided by an inve.rter. When the RHR system is in operation and power to one of these pressure instrumentation channels is lost (which may occur when an inverter is lost), the associated pressure. instrument channel and attendant circuitry signals the associated motor-operated valve to close. When the valve closes, fluid flow from the RCS hot leg to the suction side of the RHR pumps will be ? cst, resulting in a loss of RHR system function. In order for the operuor to open this valve by remote manual actions, either power to the instrument channel must be restored or the output signal from the instrument chennel (which is provided to the control circuitry for the valve) must be j opered out. Thus an inverter loss in this situation may result in an          .
extended loss of decay heat removal capability. This specific concern was addressed by a more general concern relating to this area in the AE0D Case Study Report: " Decay Heat Removal Problems at U.S. Pressurized Water Reactors" dated December 23, 1985 (Ref. 13) and, as such, will not be addressed further in this study.
The other concern involves the circuitry which monitors the position of the circuit breakers for the reactor coolant pump (RCP) motors. Based on the operating experiences contained in this report, this concern appears to be limited to Westinghouse plants which use the Solid State Protection System (SSPS). As illustrated by operating experience, relay circuitry which is normally energized during plant operation provide signals to the SSPS that indicate the position of circuit breakers for RCP motors. Following a loss of output power from an inverter and a consequential loss of the corresponding 120 Vac bus, the attendant relay circuitry will provide a false signal to the SSPS indicating that a circuit breaker for a RCP motor is open. Above a certain reactor power level the SSPS wiH process this signal and cause a reactor trip from a relatively high power level. Eight events in Tables 1 and 2 involve thi.s circuitry. As these events illustrate, such occurrences are followed by plant transients. Operating experience shows that an actual inadvertent opening of a circuit breaker for a RCP motor is rare. In fact, a review of operational data did not uncover any event.
The above information suggests that a reassessment of this circuitry in Westinghouse plants with SSPS is warranted. To further support this action, two stations, Donald C. Cook and Diablo Canyon have proposed for implementation two-aut-of-four coincident logic for this circuitry. In both of these cases, the basis provided wu to prevent a single failure from causing an unnecessary 5.lant transient.
 
2.4.5 Failure Mechanisms and Common Cause Implications A review and analysis of the events addressed in this report has resulted in the identification of three potential failure mechanisms for inverters. One of these involves relatively high ambient temperature and/or humidity within inverter enclosures. This condition appears to result in accelerated aging of components which form a part of the inverter circuitry. This accelerated aging apparently causes a significant reduction in component life expectancy which results in inverter losses that may be attributed to component failures.
Another mechanism involves the electrical interconnecting and physical arrange-ments for the inverter circuitry components. For some inverters, these arrangements appear to be such that when certain components fail, other com-ponents may also fail or degrade. However, such degraded components are generally not easily identifiable (in some cases degraded components can be identified by visual inspection). Therefore, all of the failed components may not be identified and replaced at the time of the initial component failure.
Such components potentially contribute to or cause subsequent inverter failures. Component failure trending can be utilized as a means of identifying potentially degraded components or recurring component failures.
The last failure mechanism involves voltages spikes and perturbations. Many of the electrical loads in a plant have inductive characteristics. As such, during plant operations which involve energizing and de-energizing these loads, voltage spikes and perturbations are generated. The solid state devices in the inverter circuitry appear to sense these voltage spikes and perturbations. In many cases, the response for these devices appear to cause increased current flow which, in turn, results in component failures and attendant inverter losses. Additionally, incremental degradation due to voltage spikes and perturbations can be cumulative, and with time can lead to component failures.
Furthermore, secondary voltage perturbations (e.g., caused by lightning or switching surges), can affect the electrical distribution system of a unit and may result in the simultaneous loss of redundant inverter-powered buses.
The failure mechanisms involving service condition parameters (i.e., ambient temperature and/or humidity, and voltage spikes and perturbations) clearly have common cause implications. However, none of the 107 events identified in Tables 1, 2, and 3 involved the simultaneous loss of redundant inverter-powered buses. This suggests that, actual in-plant conditions for these service condition parameters are generally not duplicated to the extent necessary to result in the simultaneous loss of redundant inverter-powered buses.
                      ~
2.4.6 Analysis of 1985 Events Forty-three LERs providing descriptive and other information concerning 45 l  reportable inverter loss events which occurred in calendar year 1985 were reviewed and evaluated. These LERs were submitted by licensees from 28 distinct plants and were identified as a result of information obtained from the RECON and Sequence Coding and Search System (SCSS) data bases. Forty-five additional inverter related events which occurred during this calendar year at 25 plants were also identified. These events were identified from information obtained from the Nuclear Plant Reliability Data System (NPRDS).
i 1
1 i
l l
 
The descriptive and other information contained in the 43 LERs is very similar to that contained in previous LERs and provided in Tables 1, 2, and 3.
Thirty-one of the 45 reportable inverter loss events were attributed to component failures with the remaining attributed to personnel actions. A major contributing factor for occurrence of these component failure events was incompatibility between actual plant service conditions and service conditions assumed in the design of the inverter units. Contributing factors and/or causes for approximately 50 percent of these component failure events were ambient temperatures and/or humidity within inverter enclosures and voltage spikes and perturbations at inverter terminals. Contributing factors and/or causes for the 14 events involving personnel actions were inadequacies in procedures, planning and/or training of plant personnel.                        .
Forty-one of the 45 inverter related events identified from information obtained from NPRDS was attributed to component failures with the contributing factors and/or causes identified above contributing to and/or causing in excess of 30 percent of these events. Although not all of these events resulted in a loss of inverter output, they are viewed to be meaningful since a number of them may be providing indicators of more serious inverter problems prior to actual occurrences involving such problems.
Review, analysis, and evaluation of these additional inverter related events l does not invalidate any of the previous findings, conclusions, and recommendations but rather provided additional support for these items.
2.5 Numerical Assessment of Risk Significance Reference 14 provf^ s t numerical analysis of the risk significance associated with inverter lyses. To assess the risk, this analysis relates the impact of inverter losses to the frequency of core damage in a PWR. As indicated in this reference, this required a detailed probabilistic risk assessment (PRA) model involving four specific areas:
An adequate model of the accident sequences; A knowledge of the direct and/or indirect dependence of the various plant systems on the vital 120 Vac buses; A detailed model of the vital 120 Vac system including the inverters; and An adequate model of human interaction with plant systems including maintenance and post-maintenance activities, and accident recovery l
l      actions.
Arkansas Nuclear One Unit 1 (ANO-1) was selected as the reference PWR plant for this evaluation. At the time the work for Reference 14 was being performed, the PRA for ANO-1 was the only study available which included fault trees developed at a sufficient level of detail to include inverters. However, even for the ANO-1 PRA, only the component cut sets of the " dominant" accident sequences were used and not the system fault trees. Therefore, the analysis is limited, since the contribution of inverter losses to the core damage frequency only included information that survived the truncation procedures of the ANO-1
 
Interim Reliability Evaluation Program (IREP) study and was contained in the identified " dominant" accident sequences.
With these limitations, the analysis in Reference 14 was performed in the following manner. First, the dependencies between the frontline and support systems were determined. A search was then carried out among the " component level" cut sets of the IREP study dominant accident sequences, to identify those sequences which contained minimum cut sets associated with 120 Vac system failure events. (Reference 15 defines minimum cut sets as the " smallest" com-bination of component failures, which if they all occur, will cause a specific event or action to occur.) Next, the contribution of inver'ter losses to 120 Vac buses was calcu          t ated, and the Fussell-Vesely importance measure for the inverters was calculateu with and without recovery actions. (Reference 14 defines this measure as the frequency of the union of all of the minimum cut sets containing the unavailabilities of the vital 120 Vac system components, including inverters, divided by the frequency of core damage.) Using this approach, the Fussell-Vesely importance measure for the inverters was calculated to be:
I(FV)= 4.4% without recovery actions
  -                I(FV) = 2.0% with recovery actions.
These results indicate that inverter losses provide a relatively small contri-bution to the frequency of core damage. However, as Reference 14 points out, these results should be interpreted only in the context of the IREP analysis and the ANO-1 design and only as lower bounds of more realistically calculated importance measures. These limitations apply for the following reasons:
* The inverter failure rate used in the IREP study was much lower than the one calculated from the data analysis contained in Reference 14. Owing to this lower inverter unavailability (and consequently to the lower 120 Vac vital bus unavailability) only a small number of cut sets survived the trun-cation procedure. Since the study used only these minimal cut sets, the results do not include the contributions of the additional cut sets that would have survived the truncation process if the higher inverter loss rate was used.
Due to the truncation process, two 120 Vac vital buses were not included in the dominant minimal cut sets. As a result, a sensitivity analysis using a frequency of double failures was not possible.
The ANO-1 design includes an automatic transfer (through a static switch)            .
of the 120 Vac bus power from the inverter to a 120 Vac supply from an emergency bus through a stepdown transformer. As a result, the contribution of the inverter unavailability to the 120 Vac bus unavailability is limited by the unavailability of this switch. For ANO-1, the unavailability of this switch was assumed to be very low. Finally, not all PWRs incorporate a static switch in the inverter design.
l
 
1 One of the possible effects of inverter failures and subsequent loss of the 120 Vac vital bus is a loss of power to control room instruments.
The possible negative effects of a loss of information on the operator's efforts to respond to other problems (e.g., inadvertent safety injection initiation) resulting from the loss of the vital bus also was not addressed in the analysis.
For these reasons, Reference 14 concluded that a more detailed study was needed to draw generic conclusions on the risk significance of inverter losses. To date, such a detailed study has not been completed.
in addition, the authors of Reference 14 used an average failure rate of 1.36 x 10E-5/hr. in their importance calculations. This rate was established using data for inverter events which occurred at nuclear plants between December 1972 and December 1981, and the following mathematical model:
f= N/CYn.
Where:
A= average failure rate for risk N = total number of inverter losses C = number of hours in a year (8760 hrs /yr)
Y = the total amount of reactor-years in the time interval n = number of inverters per plant Using this mathematical model and the data contained in Tables 4, 5, 6, 7, 8, and 9 of this report, A may be calculated using the following values.
N = 142 losses C = 8760 hrs /yr Y = 228 reactor-years (Using the data provided on page 13) n = 4 inverters / plant Hence, A = 142/(8760)(228)(4) = 1.78 X 10E-5 loss /hr.                    j Although this rate is higher than that used in Reference 14, the difference is is not considered significant. In addition, both of these failure rates are within the catastrophic failure (no electrical output) rate range from 8.5 x 10E-6/hr. to 1.9 x 10E-4/hr. as provided for inverters in NUREG/CR-3831: "The In-Plant Reliabil,ity Data Base for Nuclear Plant Components: Interim Report -
Diesel Generators, Batteries, Chargers and Inverters" dated January 1985        -
(Reference 16). However, inherent in the above model is an assumption that each inverter, loss event is independent and has an equal chance of occurring.
Clearly, the data contained in Tables 7, 8, and 9 at the back of this report invalidate this assumption. For example, item 9 in Table 3 provides a description of an event which occurred at McGuire Unit 1 on June 13, 1982. The event involved a momentary loss of power on a vital instrumentation and control system bus due to a loss of power output from an inverter. The inverter was subsequently declared inoperable. After replacing a circuit board and visually inspecting selected capacitors, the inverter was returned to
 
service. On June 15, the reactor was returned to power operation. Item 11 in Table 3 provides a description of another event which occurred at McGuire Unit 1 on June 24. This event involved a loss of power output from the same inverter which was irivolved in the event which occurred on June 13. However, following the June 24 event it was noted that the inspection and troubleshooting activities conducted for this inverter after the June 13 event had failed to identify three faulty capacitors. The three faulty capacitors subsequently caused the inverter loss on June 24. Thus, given the event on June 13, the probability of the inverter loss on June 24 is orders of magnitude greater than 10E-5/hr. Similar multiple events are provided in Tables 2 and 3.
This appears to indicate that 10E-5/hr is not a mean value for the unavailability of inverters as has been previously suggested. It also appears that improved mathematical modeling techniques, which provide for dependent losses, are necessary to establish the correct value. Finally, and possibly most important, not all failures are reported. For example, failures which are considered randem, and/or independent are not reportable to NRC in LERs. At the same time reporting to the NPRDS is known to be incomplete, particularly for 1984 and earlier. Therefore, the calculated failure rate and unavailability for inverters would tend to be underestimated due to lack of complete failure reportino.
Collectively,- the above points suggest that a valid numerical importance measure for events involving inverter losses would require an extensive mathematical model of plant-specific design features, an improved model of maintenance activities, and a more complete knowledge of operating histories and experiences. Such improvements involve improvements in existing PRAs (and in some cases further development of the PRA models) in addition to improvements in the completeness of actual operating history data. These activities are beyond the scope of this report.
I O
 
3.0 FINDINGS AND CONCLUSIONS The information presented and assessed in Section 2.0 of this report raises several issues concerning electrical inverters. The findings and conclusions related to these issues are presented below:
(1) Information contained in this report indicates that the number of events involving inverter losses per reactor-year shows little or no decrease in each calendar year. The number of events involving inverter losses which were described in LERs increased for each consecutive calendar year in the three-year period included in this study. These events, together with the additional events identified from the NPRDS data base also. clearly suggests that the number of events involving inverter losses which are occurring each calendar year are at least in the range of 50 to 60. This lack of overall industry wide improvement has occurred in spite of a number of previously recommended corrective actions. The precise reason (or reasons) for this is unkrmwn however this may indicate that licensees are not adequately acting on the lessons of experiences.
(2) Events involving inverters illustrate that a loss of power from the output of an inverter often results in a loss of power for the bus which it was supplying. The loss of bus power causes connected electrical loads to de-energize and this results in a number of undesirable plant conditions    '
and/or actions. Among these conditions and/or actions are:
Severe system transients, including reactor cooling transients, Challenges to plant operators and remaining functioning equipment.
Unnecessary actuations of safety systems including the reactor protection and safety injection systems, Improper control system responses including those provided for feedwater and steam generator level control, Degradation in redundancy for safety-related instrumentation channels and power supplies.
l Loss of indicators which provide information concerning plant and safety I
system status, Loss of f' unction for safety-related equipment and in some cases          _
safety-related systems, and Damage to mechanical equipment.
In general, more than one of the above listed conditions and/or actions i            usually occur simultaneously, however, each bus power loss does not
(            lead to all of the listed conditions and/or actions. Nevertheless, these undesirable situations, in conjunction with the frequency of the events, suggest that measures leading to a decrease in the number of such events are warranted.
1 1
 
I l
l (3) The dominant cause (65 percent) of the inverter loss events were                  i attributed to component failures. Such components include diodes, fuses,        I silicon control rectifiers, capacitorr., transistors, resistors, printed circuit boards, transformers and induc. tors. Review, analysis, and evaluation of information relating to these events clearly indicate that the major contributing factor for these component failures is incompatibility between actual plant service conditions and design service conditions (i.e.,
actual plant service conditions are more severe than that assumed in the design of inverters). Specifically, the data analysis showed that:
High ambient temperature and/or humidity within inverter enclosures, and electrical disturbances at inverter terminals contribute to or cause in excess of 50 percent of the events attributed to component failures.
Operation of plant switchgear and other electrical equipment can result in the generation of voltage spikes and perturbations which either cause or contribute to occurrences of events involving inverter losses. This occurs because many of the plant electrical loads which are energized or de-energized during plant evolutions have inductive characteristics.
The above findings suggest that measures (i.e., changing the actual plant service conditions and/or changing the design for inverters) which result in obtaining compatib,ility between the actual plant service conditions for inverters and their design service conditions should lead to a reduction in the number of events caused by inverter losses.
This report identifies three potential failure mechanisms for inverters.
These three mechanisms involve: (1) high ambient temperature and/or humidity within inverter enclosures; (2) electrical interconnections and physical arrangements of components which form the inverter circuitry; and (3) voltage spikes and perturbations at inverter inputs and outputs in conjunction with relatively rapid response times of solid state devices.
The two failure mechanisms involving service conditions, (i.e., ambient temperature / humidity and voltage spikes / perturbations) have common cause implications. These mechanisms potentially can cause the simultaneous l
loss of redundant inverter-powered buses. However, it is noted that of the 107 LER events studied none involved the simultaneous loss of redundant inverter-powered buses.
(4) The second largest number of events caused by inverter losses was personnel actions. Thirty-five percent of the events in this study were attributed to    -
personnel actions. These include: opening incorrect circuit breakers; connecting faulty test equipment to an inverter (or attendant circuitry);
l      causing short circuits during maintenance and testing activities; improperly l      transferring power sources for a bus; and removing the wrong inverter unit from service. Some of these actions result in damaged and/or failed components within an inverter unit. Others result in simply de-energizing a functioning unit. Principal contributing factors to such actions are inadequate maintenance and testing procedures and deficient practices.
Inadequate planning, training, and verification for related maintenance and
 
testing activities are also contributing factors. Specific inverter-related maintenance, testing, or operating actions which have not always been adequately performed by plant personnel include *.he following:
Verification that maintenance procedures include provisions which ensure that either a functional test is performed on related equipment in which leads have been lifted during maintenance, or the initial and final position of all leads are recorded.
Verification that maintenance procedures and actual practices preclude maintenance activities on more than one vital instrument inverter at the same time.
Verification that test equipment to be used during inverter maintenance or testing activities (which do not require the inverter to be de-energized) is functionally tested prior to connecting the equipment to the inverter.
Verification that applicable operating procedures prohibit an inverter unit or a single power source from supplying power to more than one vital bus during plant operating conditions above cold
,        shutdown except in emergency conditions.
1 I        Verification that procedures which address (equalize) charging of Class IE batteries include provisions to verify and adjust battery charger output voltage as needed to avoid excessively high inverter input voltage (that is, to consider the associated inverter high j        input voltage protective trip) prior to placing the battery charger
;        on equalize.
l These deficiencies suggest that there is need for improvements in planning.
l      procedures, verification methods, training, and practices regarding testing and/or maintenance activities associated with electrical inverter units.
(5) Two specific areas of circuitry design which involve inverter units warrant further consideration.
: a. One of these areas involves the RCS pressure instrumentation channels associated with PWR RHR system isolation valves. There are normally two pressure instrumentation channels with each channel providing a closure signal to one of the two motor-operated isolation valves installed in the RHR system suction line. A loss of power to either of these~ two instrumentation channels as a result of a single inverter -
loss causes a loss of shutdown cooling. This concern is addressed in AE0D Case Study Report C503 " Decay Heat Removal Problems at U.S.
Pressurized Water Reactors" (Ref. 8). Accordingly, it is only identi-fled in this report to point out that events involving inverter losses can affect the operability of the RHR system.
: b. The other area involves the circuitry which monitors the position of circuit breakers for RCP motors. This item appears to be limited to Westinghouse plants which use the SSPS. Upon loss of power output
 
from an inverter unit, this circuitry de-energizes, thus indicating to the SSPS that a circuit breaker for an RCP motor is open when in actuality it is not. Above a certain reactor power level, the SSPS causes a trip of the reactor with an attendant plant transient. Eight events involving this circuitry are identified in Tables 1 and 2.      In addition, operating experience shows that inadvertent opening of a circuit breaker for a reactor coolant pump motor is less likely than a loss of an inverter. This would suggest that a reassessment of the acceptability of this circuitry is warranted.
(6) Plant technical specification operating restrictions (e.g., action state-ments) for an ihoperable inverter, or the unavailability of one of two input power sources for inverters with dual power inputs, are not consis-tent for comparable plant design. At multiple unit sites inconsistencies in the technical specifications between plant units can contribute to personnel errors. This may cause inappropriate personnel actions which result in the plant being operated not in accordance with its technical specifications. These inconsistencies would suggest that a generic review and possible revision of plant technical specifications for inverters at some plants is warranted.
(7) Loss of an inverter unit can result in undesirable situations in both BWRs and PWRs. Loss of an inverter unit in PWRs can result in severe system transients with attendant loss of equipment functions. In general, this is because controllers, instrumentation, control circuitry and other equipment for control and safety syste'sm are powered by inverter units.
When power to any of these items is removed as a result of a loss of an inverter the equipment either looses its ability to function or functions in such a manner as to cause undesirable conditions and/or actions.
(8) Existing numerical analysis for risk significance suggest that (for certain plant designs) inverter losses contribute approximately 4.4%
to the core melt frequency without recovery actions, and 2.0% with recovery actions. These contributions are considered to be underestimates due to the limitations and assumptions used in the PRA calculations.
Extensive additional mathematical modeling of plant-specific design features, maintenance activities, operating histories and experience would be required to establish a valid upper bounds or conservative assessment.
Such modeling, however, would involve extensive additional detail relative to existing PRAs and would not be readily attainable. This quantitative estimate combined with engineering judgement indicate that corrective actions l      to reduce th9 incidence of inverter loss would appear justified.
9
 
4.0 RECOMMENDATIONS As noted in this report, 65 percent of the identified events involving inverter losses were attributed to component failures. Incompatibility between actual l    plant service conditions and design service conditions for inverters was a l    contributing factor or cause for over 50 percent of the component failures.
l    The remaining 35 percent of the identified events were attributed to personnel actions. Of these, inadequate maintenance and testing procedures or inappropriate personnel actions contributed to or caused approximately 85 percent of the events. In view of the continuing number of events involving inverter losses and the potential consequences of such events, the following recomendations are presented:
(1) The Office of Inspection & Enforcement (IE) should issue an infomation notice which addresses events involving inverter losses. The information notice should address.two areas.
l          First, the information notice should suggest that licensees review the l          compatibility between actual plant service conditions and design service conditions for installed inverters. Such reviews should consider evaluat-ing the need for continuous or regular monitoring of temperature and humidity internal to inverter enclosures. Also, the need for monitoring inverter input and output voltages for both steady state and transient (electrical) conditions should be evaluated during such reviews. Further, measures which prevent accumulation of dust and dirt on components internal to inverter enclosures should be considered.
Second, to minimize the number of inverter loss events resulting from personnel actions, licensees should consider reviewing related mafntenance and testing procedures and practices for inverters. To the extent possible, these reviews should be directed toward indentifying the appropriate sequence of steps required for inverter maintenance and testing activities.
To the extent possible, such reviews should include planning for specific inverter maintenance and testing activities. Specialized training and practice sessions with involved plant personnel, and verification of the identified appropriate sequences of steps to achieve these activities should also be considered. Following the completion of such reviews, appropriate resulting follow-up actions should be performed by licensees.
Also, it is suggested that any modifications resulting from such actions be identified and addressed in routine regional inspection reports.
;  (2) Eight events at three plants involving spurious reactor trips with
!        attendant plant transients are identified in this report. These events are attributed to the circuitry which monitors the position of the circuit breakers for reactor coolant pump motors. In view of this operating experiench and to prevent a single failure of a safety-related component from causing an unncessary plant transient, the as-installed arrangement for this circuitry should be reassessed by NRR. Two-out-of-four coincident logic for this circuitry could be considered for implementation. Operating experience indicates that this item applies to Westinghouse units with SSPS.
(3) Technical specifications which specifically address inverters and/or attendant buses for comparable plant designs should be reviewed to ensure that action statements addressing plant operating restrictions are
 
consistent. Inconsistent action statements identified during such reviews should be modified accordingly or at least technical bases establ.ished for such inconsistency. Such reviews should include special consideration for inverter units with dual power inputs. It is suggested that NRR consider this aspect during resolution of Generic Issue 128, " Electrical Power Reliability."
Y
 
5.0 REFEP.ENCES
: 1. IE Circular Number 79-02, " Failure of 120 Volt Vital AC Power Supplies,"
dated January 16, 1979.
: 2. IE Information Notice Number 79-29, " Loss of Nonsafety-Related Reactor Coolant System Instrumentation During Operation," dated November 16, 1979.
: 3. IE Bulletin Number 79-27 " Loss of Non-Class 1E Instrumentation and Control Power System Bus During Operation," dated November 30, 1979.
: 4. U.S. Naclear Regulatory Comission, " Loss of Integrated Control System Power and Overcooling Transient at Rancho Seco on December 26, 1985,"
NUREG-1195, dated February, 1986.
. 5. IE Information Notice !!cber 84-80, " Plant Transients Induced by Failure of Non-Nuclear Instrumentation Power," dated November 8, 1984.
: 6. NRC Memorandum for Karl V. Seyfrit from Frank Ashe, " Events Involving Loss of Electrical Inverters Including Attendant Inverters to Vital Instrument                                          [
Busses," dated October 21, 1982.
                                                                                                                            ~
: 7. U.S. Nuclear Regulatory Commission, " Licensed Operating Reactors," U.S.                                        .
NRC Report NUREG-0020, Vol. 7, No. 1, January 1983.
: 8. U.S. I;uclear Regulatory Comission, " Licensed Operating Reactors," U.S.
NRC Report NUREG-0020 Vol. 8, No. 1, January 1984.
: 9. U.S. Nuclear Regulatory Commission, " Licensed Operating Reactors," U.S.
NRC Report NUREG-0020, Vol . 9, No.1, January 1985,
: 10. Matthew Chiramal, " Effects of Ambient Temperature on Electronic Components in Safety-Related Instrumentation and Control Systems" AE0D/C604, dated December 1986.
: 11. Brookhaven National Laboratory, " Operating Experience an'd Aging - Seismic Assessment of Battery Chargers and Inverters," W. E. Gunther, M. Subudhi and J. H. Taylor, NUREG/CR-4564, dated June 1986.
: 12. NRC Memorandum for Harold R. Denton from Carlyle Michelson, " Operational Restrictions for Class 1E 120 Vac Vitcl Instrument Buses," dated July 15, 1980.                                                              .,
: 13. Harold Ornstein, " Decay Heat Removal Problems at U.S. Pressurized Water Reactors" AE00/C503, dated December 1985.
: 14. Brookhaven National Laboratory, " Analysis of Inverter Failures in Nuclear Power Plants," G.E. Bozoki and I.A. Papazoglou, dated April 1983.
: 15.    " Fault Tree Handbook," NUREG-0492, January 1981.
: 16. Oak Ridge National Laboratory, "The In-Plant Realiability Data Base for Nuclear Plant Components: Interim Report - Diesel Generators, Batteries, Chargers and Inverters," W. Keith Kahl and Raymond J. Borkowski, NUREG/CR-3831 dated January 1985.
 
1 Table 1 INVERTER-RELATED EVENTS AND CORRECTIVE ACTIONS FOR 1984 Plant Unit, Event Date                                          Description Of Occurrence and and LER Number              s                                    Corrective Actions
: 1. Grand Gulf 1                    On January 3, 1984 while in cold shutdown at 0920 hours and while placing a 01/03/84                        Division 2 battery charger on equalize, the Division 2 power supply tripped on 84-001-00                      high voltage. Subsequently, power was restored and several automatic actions occurred. These included initiation of Control Room Fresh Air Unit B, Standby Gas Treatment System 8, Drywell Purge Compressor B, Service Water B, Division 2 hydrogen analyzers, and Low Pressure Coolant Injection (LPCI) B and C. Also, isolation of Shutdown Cooling, Reactor Water Cleanup, and the Auxiliary and Containment Buildings occurred. The LPCI injection raised the water level to greater than four hundred inches.
The cause of these actions was attributed to the equalizing potentiometer on the battery charger being set such that the output voltage of the charger was greater than its normal equalizing voltage of 140 Vdc. This resulted in the associated inverter tripping at 147 Vdc. Following the inverter trip the associated charger tripped at 152 Vdc which allowed the inverter to reset and automatic actions to be initiated.
 
Table 1 (continued)
Plant Unit, Event Date                                                                                  Description of Occurrence and and LER Number                                                                                            Corrective Actions Corrective action was to revise the applicable. procedure so as to instruct the technicians to adjust the charger output to 140 plus or minus 1 Vdc prior to placing the chargers on equalize. In addition a design change to lower the charger high voltage trip to 145 Vdc was planned, thus permitting the charger to trip prior to the inverter.                      (This feature was later determined to be not feasible and was not implemented.)
: 2. Zion 1                                              On January 5,1984 at 0705 hours, while Unit I was in cold shutdown as part of 01/05/84                                            a refueling outage, a reactor trip occurred. The initiating signals for the 84-001-00                                            trip were from the Nuclear Instrument System (NIS) Channel II intermediate and source range bistables. The NIS signals occurred due to a momentary loss of the 120 Vac power supply.
The power supply loss occurred when one capacitor in one of the inverter output regulating transformers short circuited and caused this transformer to cease normal operation. The loss of this transformer overloaded the remaining transformers and resulted in a decrease in output voltage from the inverter.
An internal protective device associated with the capacitor removed it from the circuit and allowed the transformers to return to normal operation.
As part of a corrective action program the transformers in all of the instrument inverters will be replaced due to their age and the indication of deterioration caused by age and capacitor failures. Also, the new transformer
                                                                                                                                                                                                            \
l
 
{
Table 1 (continued)                                              I Plant Unit, Event Date                                                                                        Description of Occurrence and and LER Number                                                                                                  Corrective Actions capacitors will be replaced every three years in accordance with the estimates of capacitor life as provided by the manufacturer.
: 3. Diablo Canyon 1                                                            On January 6, 1984 at 1415 hours, while in cold shutdown, the plant 01/06/84                                                                    experienced an inadvertent safety injection actuation. This event occurred 84-001-00                                                                  during the performance of a surveillance test for a slave relay associated with the Solid State Protection System (SSPS).
While installing test equipment, the 120 Vac vital instrument supply was i                                                                                                                      grounded. This caused a momentary drop in inverter output voltage that was of sufficient duration to cause the bistables in Protection Set 1 to trip. Due to calibration activities, high steamline delta P Channel II bistables for steam generators 1-1 and 1-3 were in the tripped position thus satisfying the two of three coincidence logic and actuating Train 'B' of the safety injection system. Train 'A' of the system did not actuate since its associated output fuse had blown following grounding of the instrument supply. The Train 'B' actuation caused one charging pump and one diesel generator to start, and actuated one train of containment phase 'A' isolation valves.
The SSPS output cabinet fuse was replaced and proper test equipment installation verified. Also, a memorandum was issued to inform operators to place the SSPS in the ' test' mode (blocking the Engineered Safety Features actuation signal) except when required for testing or operation.
 
Table 1 (continued) i Plant Unit, Event Date                                Description of Occurrence and and LER Number                                          Corrective Actions
: 4. James A. Fitzp.atrick During power operation with the High Pressure Coolant Injection (HPCI) system                1 02/10/84              out of service for scheduled maintenance, a ground occurred on the 'A' Station 84-004-00            Battery system. During the performance of the ground isolation procedure the direct current control power to the inverter for the Reactor Core Isolation Cooling (RCIC) system was momentarily interrupted. The momentary loss of this direct current power requires a manual reset to re-power the inverter. The ground isolation procedure did not inform the operator that a manual reset was required. Inoperability of both HPCI and RCIC placed tha plant in a twenty-four hour Limiting Condition for Operation. The operator, after determining                  1 that the inverter would not reset automatically, performed a manual reset.
A change to the ground isolation procedure was incorporated to instruct the operator to manually reset the inverter for the RCIC system.
: 5. Sequoyah 2            At 2028 hours while Unit 2 was in Mode 1 operating at one hundred percent 02/27/84              power (2235 psig and 578 degrees Fahrenheit) vital inverter 1-II failed 84-003-00            resulting in a containment ventilation isolation, auxiliary building isolation, control room isolation, and causing other equipment fed from this inverter to lose power. The inverter board was then powered from the maintenance supply until the inverter could be fixed.
 
l Table 1 (continued)                                            l Plant Unit, Event Date                                                Description of Occurrence and and LER Number                                            Corrective Actions This incident was due to personnel shorting leads together while attempting to connect an oscilloscope to the inverter to adjust the frequency on the synchronization card.
Four fuses were replaced as well as an oscillator card before the inverter was placed back in service at 0305 hours on February 28, 1984.
: 6.        Washington Public        While in cold shutdown, operators were attempting to isolate a ground on the Power Supply System 2    Division 1, 125 Vdc panel DP-51-1. They wanted to isolate inverter IN-3 to 03/07/84                see if the ground was within this inverter. They first transferred the 84-015-00                inverter load to the alternate source by way of the static switch. This was accomplished by pushing the reverse pushbutton on the front of the inverter and the transfer occurred without incident. The operator then proceeded to open the direct current feeder to the inverter at panel DP-SI-1. Unknown to the operator, this action resulted in clearing of the direct current input fuse. The operator reclosed the direct current feeder breaker to the inverter at DP-SI-1 and then attempted to transfer the electrical load back to the inverter by pushing the forward pushbutton on the front of the inverter. This resulted in de-energizing the Division 1 instrument bus and causing isolation relays (normally energized) to de-energize with resulting isolations occurring. The manual bypass switch associated with the inverter was placed in the maintenance position to re-energize the Division 1 instrument bus.
 
Table 1 (continued)                                            -
Plant Unit, Event Date                                                                          Description of Occurrence and and LER Number                                                                                Corrective Actions Later the direct current input fuse was replaced and the inverter returned to service. Also, supplementary operational instructions were provided to enhance operator classroom information.
: 7. Diablo Canyon 1                                            At 1916 hours, while in Mode 5, 120 Vac vital instrument bus 1-3 was inadver-03/09/84                                                  tently de-energized. Loss of this bus resulted in the automatic operation of 84-007-00                                                  two engineered safety feature (ESF) systems. The.two ESF systems which actuated were the auxiliary building and control room ventilation systems.
The event occurred while a licensed operator was performing a routine walkdown of the direct current switchgear room and noticed that the " Inverter Input" breaker on the instrument inverter pane' 1-3 appeared to be tripped. The operator attempted to reset the breaker, which was actually closed and in the process de-energized the 120 Vac bus 1-3. The operator immediately recognized the error and placed the bus on the 120 Vac backup source. The de-energized bus was caused by the failure of the operator'to recognize that the breaker was closed. The operator mistakenly interpreted the " Inverter Input" breaker as the switch which supplies alternating current power to the inverter. This function is accomplished by the "AC Input" breaker which had a past history of tripping during power transients.      If the operator had reset the "AC Input" breaker, the inverter would have continued to receive power from the direct current source. However, the function of the " Inverter Input" breaker is to provide both the rectifier alternating current and the direct current inputs
 
i i
Table 1 (continued)
Plant Unit Event Date                                  Description of Occurrence and and LER Number                                          Corrective Actions to the inverter. Thus, when this breaker was opened, the inverter and associated bus were de-energized.
Non-specific labeling of the inverter breakers also contributed to the error by the operator. To prevent recurrence of this event, a simplified inverter diagram showing the location, function and labeling of each breaker was mounted on all 120 Vac instrument inverter panels in both Units 1 and 2.
: 8. Maine Yankee          While in a refueling shutdown condition, three inadvertent actuations of 04/13/84              safeguards systems occurred. The first event occurred when non-licensed 84-007-00            operators were removing inverter number 2 from service to perform maintenance. Prior to this event licensed operators had cross tied two of the alternating current vital buses to inverter number 2. When inverter number 2 was removed from service at approximately 0905 hours, the loss OE power to vital buses 2 and 3 caused two of four pressurizer pressure channels to de-energize and unblock their associated safety injection channels. The remaining channels unblocked and actuated due to the existing plant conditions, and allowed recirculation actuation to unblock. Additionally, several containment isolation valves cycled as a result of the safety injection signal. Recirculation actuation occurred on low refueling water storage tank level since the tank had been drained to fill the refueling cavity. Licensed operators re-energized inverter number 2, reconnected bus 3 to inverter 3, and cross-tied bus 2 to bus 3 (inverter 3). Upon connecting i
 
Table 1 (continued)
Plant Unit, Event Date                                Description of Occurrence and and LER Number                                          Corrective Actions bus 2 to bus 3, both trains of safety injection, recirculation actuation, and the first phase of containment isolation again actuated. The third event occurred when the cross-tied bus 2 was realigned to inverter 2. The bus 2 to bus 3 breaker was operated, affecting bus 2 and one pressurizer pressure sigma meter. This action resulted in an actuation of the 'A' Train of safety injection, recirculation, and containment isolation. A pressurizer pressure sigma meter spike was observed during the incident. The operator cross-tying the two vital buses to the wrong inverter led to the first event. The second and third events may have resulted from unreproducible voltage perturbations during the bus transfer; however, the exact cause was not identified.
Subsequent identical bus transfer operations did not produce similar results.
To prevent similar occurrences and resulting transients at power, applicable operating procedures will be revised to prohibit cross-tying vital buses during plant operating conditions above cold shutdown except in emergency conditions.
: 9. Turkey Point 3        At 1646 hours, a reactor trip occurred. The root cause of the trip was 04/24/84              determined to stem from a personnel error. A non-licensed turbine operator 84-014-00            attempting to take the 'A' standby static inverter out of service erroneously opened the output breaker of the adjacent '3A' normal static inverter. The
                            '3A' inverter was in service supplying power to a 120 Vac vital instrument power bus when its output breaker was opened. Loss of power to this vital bus resulted in de-energizing the power supplies for Channel II protection i
i
 
Table 1 (continued)
Plant Unit, Event Date                              Description of Occurrence and and LER Number                                        Corre'ctive Actions instrumentation. A turbine runback resulted initiated by the Nuclear Instrumentation System (NIS) rod drop circuitry due to loss of power. Upon realizing his error, the turbine operator re-closed the output breaker for inverter '3A'. However, an instrument power supply failure coupled with the current surge associated with instantaneously picking up all of the loads fed by the '3A' inverter, caused the current limiting feature associated with the inverter to activate which resulted in low output voltage from the '3A' inverter. This caused low voltage in the vital bus and its power supplies to Channel II protection instrumentation which resulted in another NIS rod drop signal. This signal initiated a second turbine runback which resulted in a reactor trip by the reactor protection system on pressurizer high pressure.
The operations staff responded to the first thirty percent turbine runback satisfactorily. Loss of the '3A' inverter was recognized and the runback limited for an actual load reduction.from 705 to 600 megawatts electrical.
The unit was stabilizing with reactor coolant system pressure and temperature, while still high, returning to normal at the reduced load. The onset of the second thirty percent runback (note that the unit is only designed to accommodate a fifty percent load rejection) coupled with above normal reactor coolant system pressure and temperature caused the reactor coolant system pressure to reach the setpoint of 2370 psig for a reactor trip on pressurizer high pressure. Also, the power operated relief valves were unavailable to assist in mitigating the transient due to their associated block valves being closed. The standby inverter was being taken out of service under a clearance
 
Table 1 (continued)
Plant Unit, Event Date                                                      Description of Occurrence and and LER Number                                                                          Corrective Actions number to perform preventive maintenance activities. The clearance provided instructions to the turbine operator to ensure the standby inverter is not in service as a prerequisite to removing it from service. Additionally, guidance was provided to remove the standby inverter from service per step 8.3 of Operating Procedure 9700.1 (Instrument AC Power Supply). Steps delineated in the clearance followed exactly the sequence of operation given in the op ating procedure for removal of an inverter from service. Further, new large size placards were in place that label the inverters using one-inch lettering and black on white color schemes, installed during recent human factors upgrade modifications. The '3A' inverter is the normal power supply to vital panel 3P07. This panel supplies power to a rack through sub-panel 22 and a breaker. The instrument power supply failure in the rack, suspected to have been caused by the electrical transient it underwent, caused the breaker in sub-panel 22 to trip. This caused loss of Train A auxiliary feedwater flow control and indication, Train A condensate storage tank level indication, and the subcooled margin monitor in Train A of the qualified safety parameter display system. The failed instrument power supply was replaced and the breaker in sub-panel 22 closed.
l Following satisfactory resolution of the problems identified above, the unit was returned to service.
1 I
 
Table 1 (continued)
Plant Unit, Event Date                                                        Description of Occurrence and and LER Number                                                      Corrective Actions
: 10. Sequoyah 1                                ,
At 2234 hours, with Unit 1 operating at one-hundred percent power (2235 psig, 05/21/84                        578 degrees Fahrenheit), the number elevan bearing on the turbine / generator 84-035-00                      failed causing the permanent magnetic generator (PMG) to fail. This resulted in actuation of the electrical trouble alarm and tripping of the generator.
Since the generator was operating at greater than fifty percent power, the P-9 interlock between the generator andt ' he reactor tripped the reactor. The bearing failure was caused by a thermocouple shorting to ground through the bearing and rotor. The thermocouple is a dual type which has an ungrounded tip and is insulated from the sheath. The thermocouple wore through the insulation and shorted to the sheath and then to ground. The rotor and PMG were repaired and the thermocouple was replaced.
During this trip, a loss of the 120 Vac vital inverter 1-II also occurred.
This loss caused several systems covered under Abnormal Operating Instruc-tion 25.2, " Loss of 120 Vac Vital Instrument Power Board 1-II," to malfunction. Manual corrective actions were taken to stabilize steam generator levels for steam generators 3 and 4. These included starting the
                                                      'B' motor-driven auxiliary feedwater pump, tripping the main feedwater pumps, and isolating feedwater.
The condenser circulating water pumps had tripped and were restarted without difficul ty. Ventilation isolations of the control building, the auxiliary building, and the containment building were reset and returned to normal. The
 
Table 1 (continued)                                            -
Plant Unit, Event Date                              Description of Occurrence and and LER Number                                          Corrective Actions
                        'B' Train for the auxiliary air compressors lost power and the level channel on the volume control tank failed causing approximately four hundred gallons of water to be pumped from the refueling water storage tank to the reactor coolant system before it was manually corrected. While the above systems were being corrected, plant personnel placed the 120 Vac board on the maintenance supply and all associated instruments returned to their correct readings after power was restored. There was no abnormal radiation present during this event.
The inverter was repaired by replacing a fuse. It was then tested and no other problems could be found.
: 11. LaSalle 2            At 0230 hours and again at 1650 hours, the normal and remote shutdown panel 05/31/84            control and instrumentation power supplies for the Reactor Core Isolation 84-024-00          Cooling (RCIC) system were lost.
Power is supp1 fed to the instrumentation and controls for the RCIC system from 125 Vdc bus 211Y, through a Topaz inverter. This inverter has a protective high voltage trip which turns the inverter off when the input voltage reaches 147 Vdc. The setpoints for the high voltage trips had drifted down to 134.8 Vdc and 130.5 Vdc for the normal and remote hutdown panel inverters respectively. At the time of this event, a battery charge was in progress on the battery which supplies these inverters.
 
{
I Table 1 (continued)
Plant Unit, Event Date                              Description of Occurrence and and LER Number                                          Corrective Actions As the charge progressed, the battery voltage increased upwards to the point that the high voltage trip point was exceeded and the inverters turned off.
When the charging voltage was adjusted down to normal, the inverters reset automatically and operated normally.
The trip setpoints were reset to 147 Vdc and 147.2 Vdc for the normal and remote shutdown panel inverters respectively. Also, a survey of all safety-related inverters was performed to ensure that the high voltage trip setpoints are periodically calibrated.
: 12. Turkey Point 4      On June 10, 1984, at 0018 hours a turbine runback to approximately 06/10/84            510 megawatts occurred. The root cause of this runback was determined to 84-011-00          stem from an electrical transient in the normal static inverter that was in service supplying power to a vital 120 Vac instrument power bus. This resulted in a momentary loss of power to a vital power panel and its feeds to the Nuclear Instrumentation System (NIS) Channel N-42 power range nuclear instrumentation. A momentary loss of NIS Channel N-42 detector voltage resulted in the initiation of a rod drop signal which generated the turbine runback.
Immediate corrective actions included stabilizing the unit, transferring the vital power panel onto the standby static inverter and completion of satisfactory logic circuit testing and load testing of the failed inverter
 
Table 1 (continued)
Plant Unit, Event Date                                        Description of Occurrence and and LER Number                                                    Corrective Actions with a resistive load of fifty-three amperes. Load testing was performed with line disturbance monitoring equipment which did not record any abnormal fluctuations. The failed inverter was returned to service and licensed operators were requested to maintain an awareness of the inverter status.
Long term corrective actions included replacement of the inverters with state of the art equipment to ensure a more reliable power supply and evaluation of design changes to the rod drop circuitry to prevent a turbine runback on a spurious rod drop signal.
: 13. Donald C. Cook 1            .On June 17, 1984 at 2034 hours, while in ?cde 1 and operating at sixty-eight 06/17/84                    percent power, a reactor trip and safety injection occurred due to the loss 84-010-00                    of a control rces instrument distribution inverter. The reactor trip occurred due to indication of Yow reactor coolant system flow with reactor power greater than the P-8 setpoint. The safety injection occurred due to an indication of low steamline pressure concurrent with high steam flow caused by the operation of steam dumps.
The cause of the inverter failure'was attributed to a shorted capacitor. The failure of the capacitor was attributed ts operationMthin a high ambient tcmper4%re er.vironment.
Corrective action was to replace the capacito.'s in all four inverters With capacitors having a higher dielectric strength and a higher temperature w
 
'l                                                                                                                              _ 45 Table 1 (continued)
Plant Unit Event Date                                                              Ucscription of Occurrence tad and LER Number                                                                      Corrective Actions    ~~
rating. Air conditioning was ,also added so that cool air 15 directed into the inverter' enclosures.
: 14. Davis Besse 1                                    At 0420 hours, with the unit operating at ninety-four percent of full pcwer, 06/24/84                                        the Channel 4 120 Vac essential instrumentation bus Y4 de-energized due to 84-010-00                                      the essential inverter YV4 blowing an input fuse. This de-energized Channel 4 of the reactor protection system and opened its associated control rod drive breaker set 'A' and 'C'.
The loss of essential inverter YV4 was attributed to the failure of a zener
                                                                                                                                                                                                ~
diode and resistor in its logic power supply circuit board. The YV4 inverter was repaired and returned to service with the Y4 bus at 1057 hours on June 24, 1984. After the required surveillance test was completed on Channel 4 of the reactor protection system, the instrument and control mechanic who had been doing the testing intended to close the open control rod drive breaker which he thought was breaker 'D'. However, he accidentally opened this breaker and with breakers ' A' and 'C' already opened, caused a reactor shutdown.
The personnel involved with the incident are aware of the error in judgment they made and the consequences that followed. This event was reviewed by all instrument and control shop personnel. Also, signs were posted on the control rod drive breaker cabinets stating " Caution, verify flag position before opening or closing breakers." This is a visible means to the mechanics and/or
 
ze
                                                                                                            ~
0~                                                                                              /
_c Table 1 (continued)              -
Plant Unit, Event Date                                                                                          Description at Occurrence and and LER Number                                                                        Corrective Actions operators of what to look for prior to resetting any breaker. Also, the                                                        /
control rod drive breakers were labeled to indicate their associated reactor protection system channels.
: 15. Brunswick 2                                                                      On June 25, 1984 at 2214 hours, with. Unit'l at one hundred percent power and 06/25/84                                          Unit 2 in a refuel / maintenance outage with no fuel in the reactor, Train A of 84-010-00                                        the control building emergency air filtration system automatically started due to a control building fire alam caused by the failure of a capacitor in the Unit 2 uninterruptible pomr supply system inverter.
Within six minutes, the fire alarm was reset and the train returned to standby. Subsequently, the inverter supply was restored to service.
: 16.                                Zion 2                                            While in hot standby (Mode 2) at less than one percent power, Unit 2 tripped 07/09/84                                          due to a failure of an instrument inverter and consequential loss of Nuclear 84-016-00                                        Instrumentation System (NIS) Channel N-36, intermediate range.                                                                        ,
The instrument inverter failure was attributed to a short circuit in the slave output transformer. The short circuit caused an overload of the master output transformer in the inverter., By design, the master transformer goes into a current limiting mode when overloaded, and output voltage drops to twenty                                                    ,
percent or less of rated voltage. The disturbance to the inverter caused a master output transformer resonating capacitor to fail several minutes later.
 
Table 1 (continued)                                            1 Plant Unit, Event Date                                              Description at Occurrence and and LER Number                                                          Corrective Actions Due to an earlier lack of information concerning potential problems peculiar to the type of instrument inverters used at Zion, the output transformers were potentially subjected to excessive output winding circulating currents during the first eight years of operation. The result of such operation was to prematurely age the transformer insulation.
The instrument alternating current distribution system at this station is designed so that when the unit is at normal power conditions, the loss of any one instrument inverter will not automatically trip the reactor. However, below approximately ten percent power, a number of reactor trips which are blocked for power operation become unblocked. NIS Channel 36 is one of these.
Thus the inverter failure caused the trip through the unblocked trip function.
The master and . slave transformers associated with the inverter which failed were replaced. The inverter was restarted on a resistive test load and proper operation verified. The inverter was then returned to normal service and the reactor was returned to Mod 2 2 operation. In addition, all original transformers are to be scheduled for replacement as soon as parts are available. Also, preventative maintenance and surveillance procedures are already in place to prevent similar problems from occurring in the replacement transformers.
4
 
Table 1 (continued)                        -
Plant Unit, Event Date                                                  Description of Occurrence and and LER Number                                                              Corrective Actions
: 17. Arkansas Nuclear 2 , At 0118 hours a manual reactor trip was initiated from one hundred percent 07/20/84            full power following a spurious half-leg trip (one of two paths) caused by 84-019-00          switching of inverter 2Y11. This inverter supplies power to Channel A of the Core Protection Calculator, the Number 1 Control Element Assembly Calculator, Engineered Safety Features and Plant Protection System (PPS) cabinets, and the AB trip matrices for half of the Control Element Drive Mechanism (CEDM) breakers. At approximately 0100 hours an operator, dispatched to reset an inverter alarm, inadvertently pressed the " alternate source to load" button instead of the " reset" button. Realizing his mistake, he pressed the " inverter to load" button to return the inverter to the normal configuration. When the inverter was switched back to normal, an electrical transient apparently occurred which resulted in tripping of four CEDM breakers and all PPS Channel A trip parameters. Based on the degraded plant indications and the belief that an automatic trip was imminent, a control room operator tripped the reactor manually. Reactor trip recovery proceeded with no unusual difficulties, and no significant post-trip anomalies were noted.
The inverter was inspected and operated with no apparent output degradation during testing. Subsequently, it was returned to normal service.
I
 
Table 1 (continued)                                            - ,
Plant Unit, Event Date                                                                          Description of Occurrence and and LER Number                                                                          Corrective Actions
: 18. Donald C. Cook 2                                              At 1414 hours, while operating at one hundred percent power, a reactor trip 08/05/84                                    occurred due to the loss of a 120 Vac vital bus inverter. The required 84-020-00                                    actions occurred properly. These included a turbine trip, feedwater isolation and starting of the turbine and motor driven auxiliary feedwater pumps.
The bus failure was attributed to a blown fuse in the associated 120 Vac inverter. The reactor trip occurred due to indication of low reactor coolant l
system flow with reactor power greater than the P-8 setpoint.
i Silicon control rectifiers, diodes and the blown fuse associated with the failed inverter were replaced. The inverter was started and operated properly for three and one-half hours prior to being declared operable at 0615 hours on i
August 6, 1984.
L                              19. Donald C. Cook 1                                              The unit was in Mode 1 operating at one hundred percent of rated thermal 1                                                  08/14/84                                    power. At 1520 hours on August 14, 1984 the "Crid IV Inverter Abnormal" 84-018-00                                    alarm was received. Operators were dispatched to the 4160 volt switchgear room to investigate. They reported that there was water on the floor around the Crid IV inverter and a temporary blower used for cooling was blowing a fine mist of water on the inverter. Also, reported was that the alternating current output voltage had dropped to ninety-two volts and a burning odor was
 
Table 1 (continued)    -
Plant Unit, Event Date                                                                  Description of Occurrence and and LER Number                                                                            Corrective Actions smelled coming from the inverter. At 1529 hours on August 14, 1984,'it was decided to reduce power.-
At the same time Crid IV inverter failed resulting in a-reactor trip and actuation of Train A of safety injection. The reactor trip was caused by an indication of low reactor. coolant flow in coincidence with being above the P-8 permissive setpoint (fifty percent power). The cause of the Train A safety injection was indicated low steamline pressure-(signal given by loss of Crid IV) concurrent with high steamline flow via the steam dumps. A Train B safety injection did not occur because the Train B output relays are powered by the Crid IV inverter and as sucii they could not energize to give a safety injection signal.
As a result of this occurrence three major items were reviewed for their safety implications. These items were: -1) reactor coolant system cooldown,
: 2) thermal effects of safety -injection, and 3) effects on emergency core cooling system piping. Review results for the first two items indicated that the unit remains conservative with respect to these items. Visual inspections performed for the third item resulted in the conclusion that there was no evidence of any mechanical damage or abnormal movement'of the piping.
The bus which the Crid IV inverter supplies was switched over to its alternate power source. The Crid IV inverter was damaged by the water sprayed on it and s
6
 
                                                                                - 51.-
Table 1 (continued)
Plant Unit, Event Date                                              Description of Occurrence and and LER Number                                                        Corrective Actions a new spare inverter was installed. .Also, a design change was initiated.and        ,
approved which would modify the Crid Inverter. Ventilation. This would include the installation of an exhaust fan at the top of the inverter and eliminate the need for temporary blowers.
: 20. Donald C. Cook 2                On September 11, 1984 at.1517 hours, the C2 capacitor in the 120 Vac vital 09/11/84                      bus Channel III inverter shorted internally causing failure of the inverter.
84-024-00                      Loss of this inverter caused power to be lost to the relay indicating the position.of the breaker for reactor coolant pump number 23. The loss of the signal to the Solid State Protection System indicated that the breaker was open, although it actually remained closed. This false indication caused a          ,
reactor trip on what appeared to be low reactor coolant flow in conjunction with a reactor power level greater than permissive P-8. The unit had been operating at one hundred percent power up to the time of this trip.
The reactor trip review revealed one problem associated with the trip. The containment atmosphere radiation monitor ERS-2400 failed to transfer to its back-up direct current power supply. Channels ERS-2401 and ERS-2405 which are addressed in the Technical Specifications had their channel parameters l                                                      re-entered and were declared operable at 2235 hours on September 11, 1984, i                                                      The action items in the Technical Specifications were complied with..
l s
l                                      1
 
9.
2
                                                                                - 52'-
Table 1 (continued)
I                    Plant Unit, Event Date                                        Description of Occurrence and and LER Number                                                        Corrective Actions j                                            ,
This event was similar to other trips that were a result of 120 Vac vital bus    -
I                                                        inverter failures. However, a contributing factor in the'other events was' l                                                        high ambient temperature around the inverters. In this case, the ambient temperature was not unusually high and was not considered to be a factor. No
!                                                        specific reason for this particular failure was determined.
1
!  '                                                    As corrective action, the faulty C2 capacitor was replaced ard as preventative j  !                                                    action, all the diodes, silicon controlled rectifiers, fuses FU1 and FU2, and the alternating current voltmeter were replaced. The 120 Vac vital bus
;                                                        inverter was placed on a load bank for two hours and declared operable at i
j                                                        2230 hours on September 11, 1984. The total inoperable period was seven hours j                                                        and thirteen minutes.
1
: 21. Turkey Point 4                At 1745 hours while Unit 4 was operating at one hundred percent power, a
;                          09/20/84                      turbine runback to seventy percent power occurred. This runback was followed j                          84-021-00                    by a reactor trip.
I During an investigation for a ground in the 3A direct current bus, the
                                                          " normal" 4A static inverter. tripped due to a blown fuse. This inverter was in service supplying power to a 120 Vac vital instrument bus. The 4A inverter j                                                        failure resulted in a loss of power to vital panel 4P07 and its feeds to the i
Nuclear Instrumentation System (NIS) Channel N-42 power range nuclear instrumentation. AlossofNISChapelN-42detectorvoltageresultedand l
l                                                                                                                                          ..
                                                          ,m
 
Table l'(continued)                                                      ,
{    Plant Unit, Event Date                                Description of Occurrence and j        and LER Number                                          Corrective Actions initiated a "NIS Rod Drop" signal which generated the turbine runback. A
'                              reactor trip occurred when the reactor protection logic for steam flow greater                      ;
than feedwater flow coincident with steam generator low level for the 'B' 1
;                              steam generator was made up.
j                                                                                                                                .i l                              When the 4A inverter failed, an attempt was made to transfer vital panel 4P07 to the " standby" static inverter (AS) but that inverter failed also.                          ,
!                              Electrical personnel investigated the failure of the inverters and found a i                              blown fuse for both the 4A and AS inverters. The fuse for the AS inverter was I
j                              replaced and an attempt was made to re-energize the AS inverter but the fuse l                              blew a5ain. A new fuse was placed in the AS inverter and the logic outputs were checked as per the maintenance manual from the manufacture and found to                        ,
j                              be within specifications. The AS inverter was energized as per Operating Procedure 9700.1. Instrument AC Power Supply - Operation of Normal and Spare                ,
Inverters, and the inverter developed rated voltage.
l The fuse for the 4A inverter was replaced and the logic outputs were checked                        ,
as per the maintenance manual and found to be within specifications. The 4A l
j inverter was energized in accordance with the appropriate operating procedure l                              and it developed rated voltage. The.4A inverter was then loaded by connecting it to vital panel 4P07. The 4A inverter picked up the . load in normal fashion.
After the AS inverter was placed back in service, the loads on the 4A inverter-were transferred to the. AS inverter and Unit 4 was returned to service on 1                                                                                                      -
i i
 
l                                                                                                                        Table 1 (continued)                                          -
Plant Unit, Event Date                                                                Description of Occurrence and and LER Number                                                                          Corrective Actions
}
4 i
September 21, 1984 at 0639 hours, with the AS inverter in service and the 4A-inverter in standby. This was done so further investigations into the cause.
.l of the 4A inverter failure could be made. These investigations discovered a wiring error in the input filter circuit for the 4A inverter. This error
!                                                                                                        allowed the circuit to be more susceptible to direct current bus problems and l                                                                                                        was corrected. This condition was believed to be the cause of the blown fuse in the 4A inverter. This inverter was subsequently returned to service.          ,
: 22. San Onofre 2                                        At 1812 hours, with Units 2 and 3 in Mode 1 and operating at one hundred
;                e                                  10/02/84                                            percent power, the failure of vital inverter 2Y002 resulted in the
!                                                    84-056-00                                          de-energization of the Unit 2 Channel B 120 Vac vital bus. The Unit 2 Fuel Handling Isolation System (FHIS) and Containment Purge Isolation System          ;
(CPIS), and the Units 2 and 3 common Toxic Gas Isolation System (TGIS)            ;
actuated due to loss of power. Additionally, all Plant Protection System (PPS) Channel B functions tripped. However, since the PPS requires two of four channels for a complete actuation, a reactor trip did not occur.
Channel B PPS trips were placed in bypass at 1830 hours. At 1838 hours,
!                                                                                                        Channel B 120 Vac vital bus was re-energized from its alternate source.
!                                                                                                        Channel B PPS trips were reset at 1856 hours. The FHIS, CPIS, and TGIS were reset at 1925 hours.
Investigation determined that the Channel B inverter failed due to a diode f
short in a power supply. The power supply was replaced and tested. Channel B 4
e                                          ,
4 f
 
                                                                                                                                        ^
Table 1 (continued)                                                ..
Plant Unit, Event Date                              Description of Occurrence and and LER Number                                        Corrective Actions 120 Vac vital bus was restored to its normal power source, the vital inverter at 0440 hours on October 3, 1984.
: 23. Turkey Point 4      At 0226 hours, Unit 4 was heating up from cold shutdown to hot shutdown at 10/09/84            180 degrees Fahrenheit 375 psig with the reactor coolant system solid. While  -
84-022-00          investigating for a ground on vital panel 4P07, the normal 4A static inverter tripped due to a blown fuse. The 4A inverter was in service supplying power to ,
a 120 Vac vital instrument bus. The 4A inverter failure resulted in a loss of power to vital panel 4P07 and caused the feeds to the Nuclear Instrumentation System (NIS) bistables for NIS Channels N-32 (source range) and N-36 (inter-mediate range) tc de-energize, generating reactor trip signals. Reactor power was below the P-6 permissive which unblocked the reactor protection logic for the resulting reactor trip. In addition, the loss of power to panel 4P07 initiated the closure of the let-down line pressure control valve (PCV-4-145) which was operating in the automatic mode. The loss of power to the Overpressure Mitigating System (powered from panel 4P07) caused the pressurizer power operated relief valve to open when the temperature inputs failed low resulting in the reactor coolant system pressure dropping to l
50 psig. Immediate corrective actions were to place valve PCV-4-145 in the manual mode to re-establish letdown pressure control, close the power operated relief valve, cooldown and stabilize the reactor coolant system and i
l l
9
 
Table 1 (continued) f
  ,                Plant Unit, Event Date                                                            Description of Occurrence and i                    and LER Number                                                                        Corrective Actions 1
4 i'
)
re-energize vital panel 4P07 using the spare AS inverter. An attempt was made.
l                                                  ,
j                                                              to transfer vital panel 4P07 to the ' spare AS static inverter but that inverter-
,                                                          s i                                                              also failed. Electrical personnel investigated the failure of the inverters                  .
4 l                                                              and found a blown fuse in both the 4A and spare AS inverters. The fuse for                    .
l                                                ,
the spare AS inverter was replaced and the inverter was energized and l                                                              developed rated voltage. The spare inverter was returned to service and I                                                              panel 4P0/ was re-energized.
I l
l                                                              Continuing investigations by electrical maintenance personnel revealed a j                                                              wiring error in the direct current input filter section of the 4A inverter.
j                                                              Upon discovery, the inverter was rewired and satisfactorily tested in i                                                              accordance with the procedures provided by the manufacturer. This wiring                      ,
l                                                              error. allowed the circuit to be more susceptible to direct current' bus problems. Also, this. condition was believed to have caused the blown fuse in the 4A static inverter. Concerning the blown fuse for the spare AS inverter,                  i i                                                                the exact cause for this was not clearly established. However, to further evaluate potential causes, three temporary operating procedures were                      '!
l                                                              established to allow study of simulated failures and loading responses of the 4A and AS inverters under various load combinations and load transfers.                      l' l                                                              Should results of these procedures reveal any significant corrective actions are necessary such actions will be taken as appropriate. Long tem corrective .
l                                                              actions involve replacing the inverters to ensure more reliable power i                                                              supplies.
i a
          . - - .        4  -          , ___      - - ,                        . -          __
 
Table 1 (continued)                                          .
Plant Unit, Event Date                            Description of Occurrence and and LER Number                                      Corrective Actions
: 24. Turkey Point 3    At 0237 hours, while Unit 3 was operating at one hundred percent power, a 10/09/84        turbine runback to seventy percent reactor power occurred. During an 84-026-00        investigation for a ground on an inverter associated with Unit 4, a temporary loss of power occurred on the 120 Vac instrument bus supplying power to the Unit 3 vital panel 3P07. This caused Nuclear Instrumentation System (NIS) Channel N-42 to generate a "NIS Rod Drop" signal causing a turbine runback to seventy percent power. Approximately thirty seconds after the runback signal, the power to panel 3P07 returned and the N-42 power range channel returned to normal indication levels. An inadvertent transfer of        .
power for panel 3P07 from the normal 3A inverter to the spare AS inverter, which is shared with Unit 4, was believed to be the cause of the loss of power. Just prior to this event associated with Unit 3, the AS inverter had been made inoperable by a blown fuse as the result of an unrelated event on Unit 4 (see LER 84-022 described above). A thorough investigation involving equipment tests failed to reveal any equipment related cause for this temporary loss of power. Immediate corrective action was to stabilize Unit 3 at seventy percent reactor power. After a twelve hour investigation failed to reveal any equipment failures, preparations were begun at 1400 hours on October 9, 1984 to return Unit 3 to full reactor power.
Corrective actions included training on inverter switching for the personnel on shift during the event. The event was also identified as one to be i
 
Table 1 (continued)
Plant Unit, Event Date                              Description of Occurrence and and LER Number                                          Corrective Actions                                                q discussed in operator requalification classes via the operating experience feed back program.
: 25. Virgil C. Sumer      The plant was in Mode 5 for the first refueling outage with Train 'A' of the 10/18/84          residual heat removal (RHR) system in service. Train 'B' of the RHR system 84-045-00          was out of service for routine maintenance and the reactor coolant system (RCS) vented at a temperature of approximately 110*F. At 1605 hours, a power loss to 120 Vac distribution panel APN-5901 de-energized Channel I of the Solid State Protection System and ca'used the instrument channel for RCS wide range pressure to initiate an auto-closure of the operable RHR suction isolation valve. Following determination that the power loss had been caused by personnel error during the performance of a plant modification, operations                        ,
personnel restored power to APN-5901. The suction valve was then reopened and                        ;
Train 'A' of the RHR system returned to service at 1630 hours (total time of RHR isolation was approximately twenty-five minutes).
The cause of the power loss and subsequent RHR isolation was attributed to personnel error. This event occurred during implementation of a modification to upgrade the incore thermocouple circuitry.in accordance with the conditions set forth in the Operating License Section C.23.d. " Inadequate Core Cooling Instruments." A section of this design package required the removal of a previously installed power cable and the deletion of its corresponding termination sheet. The termination sheet incorrectly indicated that the power
 
Table 1 (continued)                                          .
Plant Unit Event Date                            Description of Occurrence and and LER Number                                      Corrective Actions
                                                          ,  cable was routed from breaker number 19 of distribution panel APN-5901 to an isolation fuse panel. The power cable had been initially installed but not terminated during the construction program as a part of preliminary work to upgrade the incore thermocouple system. A subsequent modification installed a power feed to panel APN-5907 using breaker number 19 on APN-5901. The termination sheet for the power cable was not revised to show this modification; however, the plant one-line drawings were revised to reflect that breaker number 19 on panel APM-5901 actually provided power to panel APN-5907.
The instructions contained in the modification package to remove the power cable failed to show that it was not actually terminated to breaker number 19.
Thus when the electrician implementing this section of the modification saw breaker 19 closed, he obtained authorization from the control room to open the breaker. When the breaker c9 panel APN-5901 was opened, the loss of power to APN-5907 caused three process cabinets being fed from the panel to automatically transfer to an alternate source of power. Annunciator alarms      -
immediately made the control room personnel aware of the power loss even though no loss of equipment had occurred at this time. At the request of control room personnel, an instrument and control supervisor went to the relay room and identified the cause of the alarms. At approximately 1605 hours, the electrician reclosed the breaker without first obtaining clearance frma
!                                                              control room personnel. Reconnecting the load generated an overcurrent 1
I i
 
Table 1 (continued)                                            -
Plant Unit, Event Date                                Description at Occurrence and and LER Number                                          Corrective Actions l
condition on the inverter feeding panel APN-5901 causing a reduction in the output voltage. When an operator reopened breaker number 19, the inverter tripped and initiated the RHR suction isolation valve closure. Operations restored power'to panel APN-5901 from an alternate source approximately twenty-five minutes later and re-established RHR.
I                                  The licensee initiated the following actions to prevent a potential recurrence. On October 19 and 22, 1984 electrical maintenance personnel l                                  attended training sessions which emphasized a.) the need to verify circuits (prior to de-energizing) by either the circuit number or the electrical feeder i
list to insure accuracy of drawings and, b.) if a circuit is incorrectly de-energized, notify the control room to restore the circuit per the appropriate plant procedure. Second, this event was reviewed by appropriate engineering personnel. This review emphasized the need to include sufficient l                                  instructions in modification packages to reduce the probability of inadvertent equipment isolations during the impl'ementation of plant modifications.
Finally, the licensee initiated an investigation into the cause of the j                                  inverter trip. This investigation is designed to evaluate the response of the
!                                  inverter during the event.
l
                                ,                                                                  9
 
I                                                                                                                                Table''l (continued)                                                    ,
l          Plant Unit, Event Date                                      -Description of Occurrence and i            and LER Number                                                  Corrective Actions l          26. Limerick 1      ,
At 0208 hours during fuel loading of Unit 1 prior to initial criticality 11/09/84                  with the reactor at zero percent power level and all control rods fully l
j                84-005-00                inserted, a non-coincident full scram signal occurred along with alarms in j                                          the main control room indicating a problem with the IB.RPS (reactor protection i                                          system) and UPS (uninterruptible power supply) static inverter. Also l                                      indicated was the loss of power to the 18 RPS.and UPS 120 Vac distribution j                                          panel. Investigation revealed that the breakers (two in series) in the IB RPS i                                          and UPS relay protection panel had opened. These breakers supply the power to the distribution panel and this panel supplies power to the "B" RPS trip l                                          system. With the shorting links in the RPS noncoincident scram channel logic l                                          removed, the loss of power to the "B" RPS trip system caused a full scram j                                          signal to occur.
1 In an effort to restore power to the distribution panel, operations personnel j                                          attempted to bypass the static inverter utilizing the bypass / isolation switch l                                          thereby supplying power directly from the alternate power source to the panel feeder breakers. This was done because of the alarm which occurred simultane-ously with the reactor-scram signal indicating a problem within' the static inverter. Several attempts by the operations personnel to reclose the panel
;                                          feeder breakers were unsuccessful and resulted in burning out the shunt trip l                                        . coils of the breakers.
1
                                                                                                    . _ . .  .;          - . _ . .__s
 
Table 1 (continued)
Plant Unit, Event Date                            Description of Occurrence and and LER Number                                      Corrective Actions Investigation revealed that the metal band securing an inductor to its mounting bracket had failed. This inductor is located in the IB RPS and UPS static inverter panel number 18D160. The weight of the inductor
!                        (approximately 70-80 lbs.) caused it to drop off its mounting bracket and fall onto a capacitor bank located directly below. This created a short circuit in the panel initiating the automatic transfer switch within the static inverter.
l This transferred the power source feeding the IB RPS and UPS 120 Vac distribution panel from the preferred source to the alternate source. Since the alternate power source was at a voltage slightly higher than the 126 Vac setpoint of the overvoltage protection relay, the relay tripped the panel feeder breakers' on overvoltage.
i The voltage of the alternating current source was reduced at 1000 hours. This was accomplished by changing the tap settings on the 480-120 volt transformer which supplies the alternate power to the panel. The panel feeder breakers were replaced and power was restored to the 18 RPS and UPS 120 Vac distribution panel by 1900 hours. The static inverter remained bypassed and completely isolated from the alternating current source. The failed inductor and several other affected components in the static inverter panel were replaced. Power to the IB RPS and UPS 120 Vac panel was restored to the normal operating alignment via the static inverter and direct current power source by 2300 hours. An inspection of all other static inverter panels was conducted and no similar problems we're identified.
 
Table 1 (continued)                                                      ,
Plant Unit, Event Date                                                    Description of Occurrence and and LER Number                                                              Corrective Actions
: 27. Washington Public                          While in cold shutdown during a maintenance outage the control room operators Power Supply System 2 noted severe fluctuations in the Division II Uninterruptable Power Supply 11/13/84                              (UPS). These fluctuatio.M resulted in clearing of numerous fuses in the 84-118-00                              control room, some of which disabled the Fire Control Panels. Several relays                    i in the Nuclear Steam Supply Shutoff (NSSS) system were noted to be chattering.
The control room operators pushed the manual isolation pushbuttons to stop the                  i relay chattering in the MSSS system. They then placed the manual bypass                        -'
switch of the Division II inverter in the maintenance bypass position to                    .
restore and stabilize the UPS bus. Fire watches were then established to monitor those areas required by technical specifications.
Fuses were replaced in various UPS circuits as necessary. The inverter was examined and two logic boards were found damaged. A defective chip on the static switch logic board resulted in intermittent voltage output from the inverter. The transient was attributed to this defective chip. The inverter was repaired and returned to service. All systems were returned to a normal configuration.
: 28. North Anna 1                              At 0640 hours Unit I tripped from one hundred percent power due to a vital 11/14/84                              bus inverter failure. The inverter was supplying power to 125 Vac vital 84-019-00                              bus I-III. The inverter failure caused this bus and its associated equipment to become de-energized. Loss of power to the relay which senses 'C' reactor coolant pump breaker position caused the reactor trip on what appeared                  ,
G
 
Table 1 (continued)
Plant Unit, Event Date                                  Description of Occurrence and and LER Number                                              Corrective Actions i
to be low reactor coolant system flow coincident with reactor power greater than thirty percent. In actuality the 'C' reactor coolant pump never stopped running during this event.
Vital bus I-III was de-energized for less than two minutes. The inverter had damaged silicon control rectifiers and a blown fuse which prevented it from l                          being re-energized. The bus was subsequently powered from its SOLA              ,
transformer. All equipment powered from vital bus I-III responded as expeczed during loss and restoration of the bus. The most significant equipment response involved the 'B' steam generator. The 'B' main feed valve and the
;                            'B' feed bypass valve both failed closed. The 'B' wide range level indication i                            failed low. The auxiliary feedwater pump which supplies the 'B' steam generator failed to start automatically and was manually started by the
!                            control room operator. These actions caused the 'B' steam generator level to drop below the narrow range indication while no wide range level indication was available. Level was restored to the 'B' steam generator within a few minutes.
Loss of vital bus I-III also de-energized all four water box vacuum breakers which caused all circulating water pumps to trip. This vital bus also supplies power to many containment isolation trip valves including component l
l                            cooling to the reactor coolant pumps. Other significant equipment that was powered from the 1-III vital bus was one power range detector, twenty-six l
l
 
0-Table 1 (continued)                                          ,
Plant Unit, Event Date                            Description of Occurrence and and LER Number                                        Corrective Actions incore thermocouples, Solid State Protection System (SSPS) Channel III inputs.
SSPS Train 'B' output relays, and radiation monitor cabinet 1-2.
At 0654 the 'B' reactor coolant pump was secured due to the number one seal leakoff flow indicating zero gallons per minute and high proximity and seismic vibration readings. Shutting down this reactor coolant pump was a precautionary action and was not a required action to mitigate the effects of    ,
the reactor trip.
One of the blowdown containment isolation trip valves did not close automatically and would not close manually during this event. A solenoid operated valve (SOV) for this trip valve would not change position.
Maintenance personnel agitated the SOV and the valve was subsequently cycled satisfactorily.
The source range excore detectors had to be manually reinstated due to one intermediate range detector being undercompensated.
All parameters and equipment except those noted above responded as expected for a post trip condition. The unit was placed in Mode 2 on November 17, 1984 and returned to one hundred percent power on November 19, 1984.
 
Table 1 (continued)
Plant Unit, Event Date                                Description of Occurrence and and LER Number                                            Corrective Actions
: 29. St. Lucie 2    ,
While at sixty-eight percent power, Channel 'A' of the engineered safety 11/29/84              features (ESF) actuated. This resulted in a Containment Isolation Signal 84-014-00              (CIS), Safety Injection Actuation Signal (SIAS) and Main Steam Isolation Signal (MSIS). When the MSIS was generated the main steam isolation valves shut and the reactor tripped on low steam generator level. During this event, two high pressurizer pressure channels generated trip signals. These signals were in simultaneously for approximately eight tenths of a second. It was not apparent from valve position indication or quench tank indications whether or                              ' -
not the power operated relief valves opened.
Just prior to the trip the inverter which supplied the  'A' ESF actuation panel failed. Later it was determined that this failure was due to a failed diode.
Once this occurred, another inverter became the auctioneered power supply to the 'A' ESF actuation panel. Approximately two minutes after this inverter became the power source, the fuse on the ESF panel blew which in turn caused a complete loss of power tc the 'A' actuation channel. This resulted in initiation of 'A' Channel CIS, SIAS and MSIS. The cause of the blown fuse was not identified. The fuse did not blow again when the initiating sequence of events was repeated.
The fuse and diode were replaced and the associated electrical systems were returned to service.
W
 
C Table 1 (continued)                                          ,
Plant Unit, Event Date                            Description of Occurrence and and LER Number                                        Corrective Actions    -
: 30. Byron 1      ,
At 0334 hours during Mode 5 operation, alternating current bus III 12/18/84          de-energized. This caused Channel I of the Nuclear Instrumentation System 84-030-00        (NIS) to de-energize. The engineered safeguard feature (ESF) actuation signals associated with this channel were initiated from the resulting MIS bistable trips. One of these ESF signals actuated Train B of the boron dilution protection system (BDPS), which switched the suction for the centrifugal charging pump from its normal letdown source (Volume Control Tank) to its borated water source (Refueling Water Storage Tank). The Train A ESF sequencing cabinet, Solid State Protection System (SSPS) Train A output, and SSPS Train A and B input cabinets were also de-energized by the loss of instrument bus III. This prevented Train A of the BOPS from actuating. At 0340 hours, bus III was re-energized from its standby source. All of the affected components were re-energized and restored to normal status. The BDPS actuation signal was reset and the charging pump suction was restored to normal.
The failure of instrument bus III was attributed to a shorted capacitor in the control circuitry for the instrument bus inverter. This caused the output fuse associated with the inverter to blow. The capacitor failure was attributed to age degradation.
 
Table 1 (continued)-
Plant Unit, Event Date                              _ Description of Occurrence and and LER Number                                          Corrective Actions The station implemented maintenance procedures to maintain capacitor _ integrity and will be installing new capacitors.      It is expected that these actions will prevent or limit this type of failure in the future.
: 31. William B. McGuire 2 With Unit 2 operating at one hundred percent power, operations personnel 12/21/84            were in the process of shutting down 120 Vac Channel II inverter IEV1B for 84-034-00          preventive maintenance. The operators had correctly applied the alternate supply power to the IEVlB manual transfer switch which would have supplied power to the vital loads on bus IEKVB when inverter IEV1B was removed from service. The operators mistakenly actuated the 2EV1B manual transfer switch for bus 2EKVB, removing it from service without having the Unit 2 alternate supply power available to supply the Channel II instrument and control loads.
The cause of this event was personnel error, due to the failure of operator A and independent verifier, operator B, to properly identify the equipment being removed from servi,ce and failure to follow procedure steps.
The removal of inverter 2EV1B from service without an alternate alternating current power supply resulted in loss of 120 Vac to all the Channel II vital instrumentation and controls. The Unit 2 steam generator level control system was set to the Channel II instrumentation to control the steam generator levels.
4
____ ___ _ _  -_s
 
o Table 2 INVERTER-RELATED EVENTS AND CORRECTIVE ACTIONS FOR 1983 Plant Unit, Event Date                                Description Of Occurrence And And LER Number    N                                    Corrective Actions
: 1. Calvert Cliffs 2      During surveillance testing at 0305 hours the number 21 vital inverter tripped.
01/04/83              resulting in the loss of number 21 vital instrument bus. The loss of power 83-002/03X-2          to this bus caused a pressurizer pressure controller to de-energize thereby shutting the shutdown cooling return isolation valve and rendering both shutdown cooling loops inoperable. Subsequently, power to the controller was restored and shutdown cooling was reestablished at 0320 hours.
As reported in another related licensee event report (Item 28 in Table 3) which described an event which occurred on December 28, 1982, testing and research revealed that improper size and type fuses were installed in the vital instrument buses. Results of short circuit tests performed on a vital bus indicated that when a fault occurred at a vital load, the load fuse would not isolate the fault before the current limiter feature associated with the inverter operated. In doing so, the output voltage of the inverter would collapse to near zero volts and then return to normal, thus randomly de-energizing and re-energizing engineered safety features actuation system modules, causing challenges to various safety systems. Similar tests done with new fuses installed and the current limiter feature removed showed that a vital load fault would not affect the output of the inverter, thus preventing inadvertent safety system operation.
 
  . - . -  ~ - - . . - .          .-  - - .      . . . - . . _ _ _ - - -        _
                                                                                              . _ - .  -      -= .      .  . . . - . . - - . -.
Table.2 (continued)                            ,
Plant Unit, Event Date                                                    Description of Occurrence and j                and LER Number                                                                  Corrective Actions 1
I Using the above test results, the fuses in all four vital buses associated with each unit were replaced. Also, the current limiting feature for J-                                            inverters 11, 12, 21, and 22.were removed.                                                                -
: 2.            North Anna 1        On January 22, 1983 with the unit in Mode 5, the residual heat removal flow I                        01/22/83            was lost when an associated suction valve unexpectedly closed. This event
;                        82-003/03L-0        was initiated when inverter 1-III failed thereby causing the 1-III 120 Vac l                                              vital bus to de-energize. The loss of this bus resulted in de-energizing an l                                              auxiliary relay which provides the logic to close the residual heat removal suction valve on increasing reactor coolant system pressure. Four minutes j                                              after losing power to vital bus I-III the power to the bus was restored by l                                              shifting the load to the alternate power supply. Residual heat removal flow was restored after the suction valve was reopened. The failure of the l
j                                              inverter was determined to be caused by the failure of a silicon control rectifier (SCR) board in the inverter.                                                                        1 i
i Corrective action was to replace the SCR board in the inverter. Also, a power                                -
supply card in a primary plant process cabinet which was damaged as a result
]
j                                              of the inverter failing was replaced.
1                                                                                                                                                            .
                                                                              .,                                                                          -F i
.i 1
 
Table 2 (continued)                                                                  .
Plant Unit Event Date                                    Description of Occurrence and and LER Number                                              Corrective Actions
: 3. Davis Besse 1 ,          On January 31, 1983 at 0938 hours, the station experienced a loss of 120 Vac 01/31/83              .,
essential bus Yl. The cause of the loss of this bus was the blowing of the 83-007/03L-0            input fuse to the inverter which supplies this bus. As a result,of the loss                            -
of the Y1 bus, the following instrumentation was de-energized: Channel 1 of-the reactor protection system Channel 1 of the safety features actuation system, Channel 1 of the steam and feedwater rupture control system, Channel 1/ Loop 1 instruments associated with the auxiliary shutdown panel, Channel 1 post-accident monitoring instrumentation and a chlorine detector.
At 1200 hours, after replacing the input fuse to the inverter and returning the Y1 bus to service at 1134 hours, it was observed that one channel of pressurizer level indication was not functioning. The cause of this loss was attributed to re-energization of the Y1 bus which placed a surge voltage on the amplifier within the transmitter. A new amplifier was installed and the channel tested and returned to service.
: 4. Calvert Cliffs 2        At 1003 hours while in Mode 3, during testing of the number ?! inverter, a 02/03/83                voltage spike in the 120 Vac system resulted in a fuse blowing which in turn 83-007/0lT-0            caused Channel A of the reactor protection system (RPS) to de-energize. In anticipation of the fuse blowing a licensed operator had previously been                          -
instructed to de-energize Channel A of the RPS. He mistakenly de-energized Channel D of the RPS. The two of four coincidence channels of the de-energized pressurizer pressure high modules caused the power operated
_ _ _ _                    __ _ _ _ _ _ _ _ _ .      m___
 
Table 2 (continued)
Plant Unit Event Date                                                                        Description of Occurrence and-and LER Number                                                                                Corrective Actions                            .
                                    .                          relief valves to open. Operator action caused the power operated relief.
s              valves to close thirty seconds later. Pressurizer pressure decreased to 1520 psia, thus initiating a safety injection actuation signal. .No unter uns injected into the reactor coolant system. Pressurizer pressure mes returr.ed=
to normal at approximately 1900 hours. The pressure increa:;a in the pressurizer quench tank caused the rupture disk to open. At 2120 hours the block valves were closed for personnel safety during replacemet af the quench                                      V
                                                                                                                                            ~
tank rupture disk.
Channel A of the RPS de-energized due to a direct current input ~ fuse to th inverter blowing during a test transfer cf the number 21 inverter. The fuse                                        R blew due to crossed power leads in the number 21. inverter. The leads were-crossed the previous day during maintenance activity ca this inwertier in which
                                                                                                                                              ~
the leads ~ uere required to be lifted and replaced uti.h a resista / bank for iced testing the inverter.
                                                                                                                              '                  ~
5 y
                                                            - The leads were returned to their correct location and the blown input fuse 4 replaced. Also, a procedure change met made to in wre either.a functionel test is performed on equipment in which Yeads were lifted duNag maintenance                              , . , ,
d or to record the initial and final position cf 411 iends. Furt'neFall licensed operators and maintenance personnel grqa rade auere of this ennt.
_                                            Q N                                                C
_~
                                                                                                                                                                    -w
* i                                                                                                                      -
l                                                                                                                                                  .s                _#
j                                                                                                                                    g,
                                                                                                                                          ''          N jl          ~. .
j                                                                                                                              's, ' n
                                                                                                                                '                        '  +~  '
I.. _  -  ._      _  .,_ _ _ ,. _. __ -_. _ _ - ~_,._ _..                          - , _ _ _ . . -          . .
                                                                                                                                  ~:
                                                                                                                                                                            = .. s
 
          ~
                              -6  %'                                                                              g ./ y    ,                      (A  -
                                                                                                                                                                          .9
,    , ~
                                                                                                                                          ,y
                                  ~                                            ~ ~ '
O-      .                x      ~
                                                                                                                                            ~ - - . .,
l' q4" - q,N4  .
                                                                                                                .' 2                          -
}                                                                                            _
                                                                                                                                                                          ~
L                                                                                          Table 2-(continued)                                                                          '
?
l          Fiar.t Unit. Eweet Date                                                                '
Description of Or:currence aml.                        N
;              and LER humber _                                                                              Corrective Actions                  '
i
: 5. Fort St. Vru n.                      On February 15. 1983 with the plant operating at thirty eight percent thennal 02/15/83                  s          power,- the catlet temperature in loop 2 of the prestressed concrete . reactor 83-006/03L-0                        vessel coaling water system ekceeded 120 degrees Fahrenheit.                                                              .
The.cause of this event was the failure of a fuse in the ;iower inverter which '                                        7, supplies non-interruptible instrument bus number 2. Amono lhe instrumentation supplied by instrument bus number 2 is a temperature controller for loop 2 of                                                        j j                                                      the cooling water system. The loss of electrical power to this~ controller l                                                      caused the temperature control valve to fail closed and interrupted service j                                                      water cooling to loop 2 of the cooling system. This in turn, caused the
:                                                      cooling water outlet temperature to increase above the 120 degree Fahrenheit limit specified in Section 4.2.15(b) of the Technical Specifications for the j                                                      station. The blown fuse in the instrument power inverter was replaced, and I                                                      the inverter was tested and returned to service.
i l
j            6. Susquehanna 1                        A fuse supplying a Topaz inverter had blown several times. This inverter                                                              ,
j                02/26/83                              supplies power to instrumentation and speed control circuitry for the l                83-006/03X-1                          reactor core isolation cooling system at the remote shutdown panel. This                                                              +
loss of power prevented operation of the reactor core isolation cooling system from the remote shutdown panel but the system would function normally in all-
]
l other respects. This report also identifies additional similar events which l                                                      occurred on July 14, July 24, and July' 31, 1983.                                                                                      ,
i
!                                                                                                                                                                                              i i                                                                                                                                                                                              '
l i
 
y
                                                                          ~
Table _2'(continued)                                                    \/
                                                                                                                              .I Plant Unit Event Date                                    Description of Occurrence and and LER Number                                            Corrective Actions This report was dated August 10, 1983 and as of this date the reoort indicates s  that the cause or corrective action for the above events had not been determined. Recorders were installed to monitor operating characteristics and              -
e,nvironmental conditions, and to record dynamic parameters of the circuit during any repeat occurrences. The recorded data is to be used to determine the cause and proper corrective action for such events.
: 7. Donald C. Cook 1      During normal operation.the inverter for the A8 diesel generator failed twice 03/10/83              thus rendering the AB diesel generator inoperable. Investigation of the 83-023/03L-0          initial loss of the inverter revealed that a fuse had blown.
The inverter was inspected for damaged components and the fuse was replaced.
Also, the inverter was tested and the affected diesel generator was operated for an operability check.
Several hours later the inverter failed again as the same fuse blew with no other apparent component failures. Investigation into the second occurrence revealed that the AB diesel generator room temperature was 108 degrees Fahrenheit. This temperature was in excess of the operating temperature specified for the inverter as provided by its manufacturer. The ventilation inlet dampers for the AB diesel generator room were found wired shut and electrically disconnected.
 
                                                      ,                                                Table 2 (continued)                                                    .,
!    Plant Unit, Event Date                                Description of Occurrence and and LER Number                                          Corrective Actions The blown fuse was replaced and the ventilation dampers were opened. Also,
.                              the diesel generator room was cooled down.          ,
: 8. North Anna 2        With Unit 2 in Mode 6, both residual heat. removal (RHR) cooling loops were 04/14/83            out of service as a result of flow being temporarily lost due to one of two 83-023/03L-0        in series RHR system suction valves closing. This event was initiated while transferring vital bus power supplies from the normal battery charger to the.
l 1                              sw.ng battery charger. The transfer was complete except for opening the
}                              direct current breaker in the direct current distribution cabinet for' the j                              charger being taken out of service. While attempting to open this breaker the operator inadvertently opened the one just below it which was the input breaker to the inverter which supplies the 2-1 120 Vac vital bus. This action resulted in de-energizing an auxiliary relay for a pressure channel which provided a signal to the logic to close the RHR-suction valve. The operator immediately realized his mistake and reclosed the input breaker to the inverter. The closed RHR suction valve was .then reopened and RHR flow restored.
The responsible operator was re-instructed in the proper use of the applicable l                              procedures by the shift supervisor.
4
'l e
w      1                                        -
w                      - w--cv v    - +
 
Table 2 (continued)                                            -
Plant Unit, Event Date                                                                    Description of Occurrence and and LER Number                                                                                Corrective Actions
: 9.              North Anna 2        ,
With Unit 2 in Mode 6, a loss of vital bus 2-I resulted in losing residual 04/29/83                ,
heat removal (RHR) flow for less than one minute when one of two in series 83-036/03L-0                                RHR suction valves closed. In addition, one of two source range channels and the containment particulate and gaseous radiation monitors were de-energized. This event occurred when electrical maintenance personnel were performing a ground isolation procedure for 125 Vdc bus 2-I. While performing this procedure test leads were shorted together as individual loads were being transferred to another 125 Vdc bus. This error caused the direct current power supply breaker to the inverter which supplies 120 Vac vital bus 2-I to open. This action de-energized an auxiliary relay for a pressure channel which provided a signal to the logic to close the RHR suction valve. As a result the valve traveled closed and RHR flow decreased to less than required.
In addition, both the instrument and control power supplies to source range Channel N-31 and the inlet and outlet trip valves and radiation monitoring
!                                                                                      drawers for the containment gaseous and particulate radiation monitors were
!                                                                                      de-energized.
Within one minute after losing power to 120 Vac vital bus 2-I the power to this bus was restored by shifting the load to the alternate power supply. The RHR flow was restored after the suction valve to the RHR pumps was reopened.          ,
The affected radiation monitors were placed back in service when their common suction and discharge trip valves were reopened and air flow to the monitors was restored. No further action was necessary to restore the affected source l
 
                                                                                ;                                                                        Table 2'(continued)                                            .
i Plant Unit, Event Date                                            Description of Occurrence and and LER Number                                                      Corrective Actions l                                                                                                              .
range channel. Maintenance personnel were subsequently informed of the conse-quences of their error.
i
: 10. James A. Fitzpatrick            During normal plant operation the independent power supply inverter for the 05/02/83                      'B' side low pressure coolant injection system indicated a minor trouble 83-019/03L-1                alarm. The initial source of the alarm was indicated as a fan failure. The
,                                                        signal which actuates this alarm does not trip the inverter off line, but j                                                        rather only indicates that a trouble condition exists for the inverter.
Initial action was to declare the unit inoperable thus placing the plant in a seven day limiting condition for operation as specified in Section 3.5.b of i
the Technical Specifications.
Investigation of the trouble alarm using trouble shooting guidelines from the vendor identified a failed gate firing module printed circuit board.
This printed circuit board was replaced and the inverter was placed in service fourteen hours after being declared inoperable.
: 11. Davis Besse 1                    On May 10,1983 at 1026 hours, the station experienced a loss of 120 Vac 05/10/83                      essential bus Y4. As a result of the loss of-this bus, the following 83-023/03L-0                  instrumentation was de-energized: Channel 4 instrumentation associated with the reactor protection system and the safety features actuation system. The loss of Channel 4 instrumentation associated with the reactor protection
 
t                                                                  Table 2 (continued)
Plant Unit, Event Date                                        Description of Occurrence and and LER Number                                                    Corrective Actions system coincident with testing of the Channel 1 instrumentation resulted in an incorrect power signal being provided to the integrated control system. This caused a reactor trip. The Y4 bus was repowered via its alternate source at 1052 hours.
The loss of the Y4 bus was caused by the blowing of the input fuse for the I                                                    inverter which supplies this bus. . While performing modification workLin a low    -i voltage swichgear room a spray 'can being used tipped over and the nozzle broke off causing water to spray onto the protective plastic on the scaffolding. As a result, water and debris from the scaffolding worked its way around the protective plastic into the regulated rectifier and caused the input fuse for -
the' associated inverter to blow.                                                    !
The blown fuse for the inverter was replaced and the Y4 bus was restored to its normal supply at 1336 hours.
1
: 12. Salem 1                        On May 25, 1983, during routine power operation an operator inadvertently.
05/25/83                opened the supply breaker to.the number 1C vital instrument inverter. An 83-024/03L-0            automatic transfer to the alternate power supply occurred with no loss of equipment or indication. The~ operator was implementing a tagging request for the number 2C vital instrument inverter (associated with Unit 2).and erroneously entered Unit 1, de-energizing the wrong inverter.
e 4
 
Table 2 (continued)                                          ,
Plant Unit, Event Date                                                        Description of Occurrence and and LER Number                                                                  Corrective Actions the inverter was immediately restored to service and the operator involved was reprimanded.
: 13. Browns Ferry 2                                On May 26, 1983, with Unit 2 operating at one hundred percent power the 05/26/83                                    inverter failure alarm for the High Pressure Coolant Injection System (HPCIS) 83-028/03L-0                                was received on panel 9-3.
4 The inverter for the HPCIS was found to be inoperable due to a blown fuse.
Also, during return to service testing, the turbine control valve for the HPCIS failed to open due to an oil relay linkage misadjustment.
The fuse was replaced and the inverter returned to service. The relay linkage was adjusted and the HPCIS was tested satisfactorily. The system was inoperable for about twenty-one hours.
l
: 14. North Anna 1                                  On June 6, 1983 with Unit 1 operating at one hundred percent power vital 06/06/83                                    bus 1-I was momentarily de-energized while attempting to clear an inverter 83-042/03L-0                                trouble alarm. The trouble alarm was caused by the. inverter frequency drifting from the normal frequency. The supply for the vital bus was being transferred from the inverter to the alternate source. The transfer switch has an interlock to prevent transfer of a vital bus unless the frequency of j                                                                          the two sources is matched. Since the frequency of the two sources was not matched, the interlock would not allow the transfer unless th'e alternate
 
Table 2 (continued)
Plant Unit, Event Date                                                            Description of Occurrence and and LER Number                                                          Corrective Actions
                                              ,          source was de-energized. The operator deviated from an operating procedure and used a portion of an abnormal procedure and as such de-energized the alternate source and transferred the vital bus to the dead bus. This momentary loss of power caused the turbine and reactor to trip. Also, as a result of the vital bus being lost many containment isolation valves closed including the component cooling valve associated with the reactor coolant pumps. The annunciator panel was also lost momentarily. The vital bus was energized from the alternate alternating current source within a few seconds.
Also, the cooling water to the reactor coolant pumps was restored immediately.
Operations personnel were trained as to how a problem with the inverter that does not cause a loss of a vital bus will be resolved. Also, the abnormal procedure was revised to include guidance with regard to a vital bus that has not failed yet.
: 15. Browns Ferry 2                                      On June 15, 1983, with Unit 2 operating at ninety-three percent power the 06/15/83                inverter failure alarm for the High Pressure Coolant Injection System 83-034/03L-0            (HPCIS) was received on panel 9-3.
The inverter for the HPCIS was found to be inoperable due to a blown fuse. An identical fuse at the same location previously blew on May 26, 1983. (See
!                                                        item 13 above.) Measurements of the load current which these fuses conduct indicated nothing abnormal. However, a capacitor discharge occurs when these G'
 
Table 2 (continued)                                            -
7 Plant Unit, Event Date                                                              Description of Occurrence and and LER Number                                                                          Corrective Actions fuses are installed. This could have stressed the fuse which was replaced on May 26, 1983 such that it would no longer carry rated current.
The blown fuse was replaced and the inverter was returned to service. Also, all connections to the inverter for the HPCIS and its associated loads were inspected and found to be satisfactory.
: 16. Donald C. Cook 2                                      During normal operation a reactor trip occurred as a result of a failure in 06/23/83                                            a 120 Vac vital bus inverter.
83-Ob2/03L-0 j                                                                                  The inverter failure occurred due to the failure of a capacitor which in turn caused a fuse to b'ow. The resulting loss of power caused the reactor to trip from an indication that a breaker for a reactor coolant pump was open. The cause of the capacitor failing was attributed to operating temperature being above the rated design temperatures.
The capacitor and fuse were replaced and the inverter was returned to service.
Also, an engineering review to correct the operating temperature problem was in progress at the time of this event.
 
Table 2 (continued)                                          -
Plant Unit, Event Date                                    Description of Occurrence and
[                              and LER Number                                                  Corrective Actions I
: 17. Susquehanna 1              With the reactor in hot shutdown due to the failure of a startup transformer, l
06/24/83              ,
the Train 'B' power failure alarm for the leak detection system associated 83-096/03L-0            with the reactor core isolation cooling system was received in the main control room.
Loss of the startup transformer was considered to be the cause of the undervoltage trip which resulted in the loss of power from the inverter which l                                                          supplies Train 'B' of the leak detection logic system. During initial
!                                                          investigation, it was found that this inverter had not automatically reset although its power source when checked was found satisfactory.
i                                                          The inverter was manually reset and logic Train 'B' returned to service.
Subsequent bench tests of both a spare and the affected inverter demonstrated proper operation of the high and low voltage trips and resets.
: 18. North Anna 2              On July 17, 1983, with Unit 2 operating at one hundred percent power the 07/17/83                inverter feeding vital bus 2-I failed causing the bus to de-energize. The 83-059/03L-0            loss of vital bus 2-I resulted'in reactor and turbine trips. Vital bus 2-I powers the relay that senses the position of the breaker for the 'A'. reactor coolant pump motor. When power was. lost, this relay dropped out simulating that the breaker through which power is provided to the 'A' reactor coolant j                                                          pump motor was opened coincident with reactor power greater than thirty percent thus causing a reactor trip followed by a turbine trip. The inverter 9
 
                                                                                                                    .c i
Table 2'(continued).
                                                                              ~
Plant Unit, Event Date                                  Description of Occurrence and and LER Number                                            Corrective Actions i                                                                                                                      ,
failed due to voltages induced by faulty silicon controlled rectifiers which caused the 400 ampere input fuses to blow.
The silicon controlled rectifiers, fuses and power transfonner for the            ,
inverter were replaced and the unit returned to service following verification of its reliability.
: 19. Grand Gulf 1          On July 18, 1983, at 2120 hours, an unanticipated actuation of the Division II 07/18/83            LOCA logic occurred. All automatic actions expected to occur did occur except-i 83-084/03X-1        for the automatic starting of the 'C' residual heat removal pump. The LOCA signal was produced by a malfunctioning inverter. Earlier on July 14, 1983 a 1                                    problem had been discovered with the 24 Vdc power supply which was supplied by the inverter that malfunctioned on July 18, 1983. This problem was i
characterized as the 24 Vdc power supply providing low voltage to the Division II trip units for the Emergency Core Cooling System. The sequence of events which occurred on July 18, 1983 was explained as follows. The output voltage from the 120 Vac inverter was increasing a'nd decreasing similar to a I                                    sinusoidal wave. At one point in time,'the negative peak of the inverter output voltage dipped to below the normal input rating for the connected 24 Vdc power supply. This caused all instruments which were being powered by this 24 Vdc supply to be driven downscale. This included the wide range reactor level trip indicating units and their two associated output trip relays. Following this the output voltage of the inverter rose to above the
 
Table 2 (continued)
Plant Unit, Event Date                                  Description of Occurrence and and LER Number                                              Corrective Actions
                                  ,          normal input voltage for the 24 Vdc supply which in turn sent power to the trip indicating units and their associated output trip relays. However, since the response time of the trip units is slower than that of the output relays, these relays energized and sealed in a LOCA signal before the trip units could rise above their trip setpoints. It was believed that the failure of the 'C' residual heat removal pump to start stemmed from a relay in the load shed sequence panel.
The 120 Vac inverter involved in this event was replaced. Also, the breaker, fuse block, wiring, relays and handswitch associated with the 'C' residual heat removal pump were inspected and tested.
: 20. Browns Ferry 2            With Unit 2 operating at ninety-five percent power, the operator discovered 08/01/83                smoke coming from the inverter for the High Pressure Coolant Injection System 83-046/03L-0            (HPCIS). The HPCIS was declared inoperable and the inverter was removed from service for repair.
A failed voltage output transformer in the inverter was replaced and
;                                            subsequently the inverter was returned to service. Surveillance instructions
!                                            for the HPCIS were successfully completed and the system declared operable.
l                                                                                                                                          .
l                                                                                                                  __      - - - _ - - -
 
                                                                                                                                                      ~
                                                                                              !                                                                                      Table 2 (continued)                                              ,
Plant Unit, Event Date                                        Description of Occurrence and and LER Number                                                  Corrective Actions
: 21. Donald C. Cook 2              During normal operation, a reactor trip occurred as a result of a failure. in 08/22/83                    s a 120 Vac vital bus inverter. The inverter failure occurred due to the 83-081/03X-1                  failure of a capacitor which caused a fuse in the inverter to blow. The failure of the capacitor was attributed to operating temperatures within the inverter enclosure being above the rated design temperature. Loss of the
!                                                                      inverter caused the reactor to trip from an indication that a breaker for a reactor coolant pump motor was opened in conjunction with the reactor operating above thirty percent power.
The capacitor and fuse were replaced. Also, associated silicon control recti-t                                                                      fiers, diodes and a panel meter were replaced. In addition air conditioning and forced air cooling were installed as temporary measures while an engineer-ing review is in progress to identify a long term solution for the operating temperature problem.
: 22. Big Rock Point                Following a lightning strike at the plant site, operators observed a blown 09/21/83                      fuse on the static inverter equipment provided for one of the two containment 83-013/03L                  vacuum relief loops. This resulted in the associated ventilation supply loop being inoperable.
The fuse was replaced and the inoperable ventilation loop was subsequently returned to normal service.
 
i                                                                  l                                                            Table 2 (continued) i                                                              .
Plant Unit, Event Date                                            Description of.0ccurrence and and LER Number                                                        Corrective Actions l
l      23. James A. Fitzpa. trick        During normal plant operation the 'B' independent power supply for the low.
09/25/83                    s pressure coolant injection system tripped. Investigation of this power 83-42/03L                    supply revealed that it had tripped due to a faulty inverter leg assembly.
;                                          The failure was electronic in nature.
The faulty assembly was replaced with a new unit. The inverter was subsequently tested and returned to service.
: 24. Susquehanna 1                  While shutdown at 1940 hours, a fuse blew that was supplying power to a Topaz 11/02/83                    inverter. This inverter supplies power to instrumentation and speed control 83-153/03X-1                  circuitry at the remote shutdown panel. This circuitry is provided for the.
reactor core isolation cooling system. The loss of this inverter prevents operation of this system from the remote shutdown panel, but the system would have functioned normally in all other aspects.
The blown fuse was replaced with a ten ampere slow' blow fuse. This action was taken based on discussions with General Electric and Bussman. Recorders had been previously installed in the circuit to' monitor operating characteristics and environmental conditions. The monitored parameters were found to be within the. normal ranges. No. additional circuit monitoring or corrective actions were planned.
4
 
Table 2 (continued)                                            .
Plant Unit, Event Date                                                            Description of Occurrence and and LER Number                                                                          Corrective Actions
: 25. Crystal River 3                                  At 1551 hours on November 3,1983 while perfoming maintenance on' the 120 Vac 11/03/83                                      ,
vital bus transfer switch, a _ fuse was blown rendering inverter 3A inoperable.
83-058/03L-0                                    The vital bus then switched to the backup power supply as designed.
The failure of inverter 3A was caused by maintenance personnel inadvertently shorting out a lamp base.
The inverter was repaired, tested, and returned to service at 1115 hours on November 10, 1983. The responsible personnel were reinstructed on proper operation and maintenance of the vital bus transfer switches.
: 26. Davis Besse 1                                    At 2150 hours, 120 Vac essential instrumentation panel Y2 de-energized. As 11/09/83                                        a result of the loss of Y2, the following instrumentation was also 83-061/03L-0                                    de-energized: Channel 2 of the reactor protection system, Channel 2 of the steam and feedwater rupture control system, Channel 2 of the remote shutdown panel, Channel 2/ Loop 2 instrumentation for the remote shutdown panel, Channel 2 flow indication for the high pressure injection and decay heat removal systems, a chlorine detector, and a fuel handling radiation monitor.
The loss of power to essential instrumentation panel Y2 was the result of a blown main fuse in its normal power supply inverter YV2. At 2300 hours, panel Y2 was transferred to its alternate power supply. A complete check of the inverter per its technical manual _ recommendation was conducted, and all
 
Table 2 (continued)                                            -
Plant Unit, Event Date                                      Description of Occurrence and 4
and LER Number                                                    Corrective Actions branch circuit fuses were checked. No problems could be found. In 1981, a
!                                                              facility change request was completed which reduced the branch circuit fuses to as low a value as possible. It is believed that the most likely cause of the blown fuse was an intermittent fault on a branch circuit. Fast-acting fuses were used but even with this the manufacturer of the inverter (Cyberex) stated that this would not prevent the main fuse from prematurely blowing depending on the point on the voltage curve at the inverter at the instant of a fault.
l                                                              The blown fuse was replaced, and panel Y2 was transferred back to its normal l                                                              power supply (the inverter) at 0210 hours on November 10, 1983.
: 27. Joseph M. Farley 2            On November 21, 1983 at 2321 hours, the 2D inverter was declared inoperable 11/21/83                    due to a failed capacitor.
;                                  83-062/03L-0 The failed capacitor was replaced. The inverter was tested and returned to service at 0551 hours on November 22, 1983.
: 28. Salem 2                      On November 25, 1983, at 0800 hours, the 28 125 Vdc bus was cleared and tagged 11/28/83                    for the performance of routine battery surveillance testing. The 2B vital 83-060/01T-0                instrument bus remained energized from the 28 vital instrument inverter. The i                                                              2A and 2C vital instrument buses, inverters and 125 Vdc buses were fully operational. Three days later on November 28, 1983, at 1306 hours, the 2A e .
 
                                                              - 92 .
Table 2 (continued)
Plant Unit, Event Date                                      Description of Occurrence and and LER Number                                                Corrective Actions vital instrument bus was transferred to its alternate power source and the 2A instrument inverter was removed from service to perform routine meter i                                      calibrations. Recognizing.that 2B and 2C vital instrument inverters were i                                      energized and supplying their respective buses, the-requirement that 28 inverter be connected to its 125 Vdc bus was overlooked. Consequently, action          :
statement 3.8.2.2 contained in the Technical Specifications for the station which requires two 115 Vac vital instrument buses to be energized from their respective inverters with the inverters connected to their respective-125 Vdc j                                      buses was not entered. Upon attempting to restore the 2A instrument inverter l                                      to service, a problem was encountered with the inverter transfer switch.
l Subsequently, at 1010 hours on November 29, 1983, the 2A vital instrument bus was de-energized to investigate and remedy the problem. Because the-2B and 2C vital instrument buses were still energized from their respective. inverters, the requirement that the 28 inverter be connected.to its direct current bus was again overlooked. The applicable technical specification requirement for Unit I requires two vital instrument buses to be energized. However, fit does not require the inverter or the direct current buses to be operable. The difference between Unit I and Unit 2. applicable technical specification requirements may have been a contributing factor to the oversight. At approximately 1900 hours on. November 29, 1983, the 28 125 Vdc bus was returned to service.
 
i Table 2 (continued)
Plant Unit, Event Date                                                    Description of 0ccurrence and and LER Number                                            Corrective Actions The 2A inverter transfer switch was cleaned and tested. satisfactorily. The 2A' vital instrument bus and its inverter were returned to service at 1938 hours    ,
on November 30, 1983. Shift supervisors have been, instructed.that in the future, as a general policy during plant modes 5 or'6. maintenance'and/or testing will not be allowed to proceed.in more than one bus train at any one time. If it is deemed necessary for any. reason to deviate from this policy -
containment integrity will be established and then Technical Specification 3.8.2.2 will be entered prior to allowing maintenance and/or testing to proceed on the second bus train. 'The licensing department will also proceed to resolve the differences between the Unit 1 and Unit 2 applicable technical specification requirement.
: 29. James A. Fitzpatrick                  During normal plant operation the independent power supply. inverter lfor the-12/15/83        'A' low pressure coolant injection (LPCI) system tripped. The 'A' LPCI bus 83-063/03L-0  was placed on maintenance power. and the surveillance testing was performed in accordance with the appropriate technical specification.
Investigation revealed that the inverter unit tripped as the battery charger was switched from equalize voltage to float voltage. No defects were found and the occurrence could not be duplicated.
e
 
_ .                                              .~
Table 2 (continued)                                          ,
Plant Unit, Event Date                                      Description of Occurrence and and LER Number                                                Corrective Actions The inverter was returned to service three hours after the event and was moni-tored closely during the next equalizing cycle. No further trips were observed.
: 30. Davis Besse 1            At 1515 hours while an instrument and control (I&C) mechanic was implementing 12/17/83                a facility change request, an alternating current lead was shorted to ground, i
83-072/03L-0            resulting in the de-energization of 120 Vac essential buses Y1 and Y1A. As a result of the loss of bus Y1, the following channels were also de-energized:
Channel 1 of the reactor protection system, Channel 1 of the safety features l                                                      actuation' system, Channel 1 of the steam and feedwater rupture control system, Channel 1/ Loop 1 instrumentation associated with the auxiliary shutdown panel, Channel 1 post-accident monitoring instrumentation, a chlorine detector, and a spent fuel pool / fuel handling area radiation monitor. When power was lost to Channel 1 of the reactor protection system, the high auctioneered power signal i
to the Integrated Control System (ICS) went to zero percent power. The ICS l                                                      responded by giving a command for continuous control rod motion outward. The l                                                      control rod mouon caused reactor power to increase, resulting in a reactor trip due to high flux.
l The cause of the loss of bus Y1 was due to personnel error. While removing screws on the terminals located in a circuit associated with a containment post accident high range radiation monitor, the screw slipped off the screw
 
D
                                                                                        . 95 -
Table 2 (continued)
I Plant Unit, Event Date                                                Description of Occurrence and I                    and LER Number                                                            Corrective Actions i
                                              ,              starter and the lead pulled the screw back which then shorted it to ground,            t At 1542 hours, Y1 was re-powered from its alternate source YAR.
1-Under a maintenance work order the inverter fuse YV1 was replaced and bus Yl
;                                                            was restored to its normal power supply at 2000 hours on December 18, 1983, l                                                            thus' removing the unit'from'the applicable action statement in the technical specifications. Also, the 18C mechanic was counseled by the lead I&C Engineer. The I&C Foreman conducted a' meeting with the 18C shop personnel ta j                                                            emphasize the importance of exercising caution when working in and around essential power distribution systems.
4
: 31. Salem 2                              At 1614 hours on December 20, 1983 during a maintenance shutdown, the 28 4KV 12/20/83                            vital bus was transferred from the number 22 station power transformer to the-83-066/03L-0                        number 21 station power' transformer. During this ' transfer, residual heat removal (RHR) common suction valve 2RH1 closed. This resulted in a loss of RHR flow through the reactor coolant system. . The. number 22 RHR pump was
!                                                            secured.
l
!                                                            The loss of RHR f16w was due to an oversight on.the part of operating shift l                                                            personnel. At the time of the transfer, the 2B vital instrument inverter was -
l being supplied from its normal power supply, the 28 4KV vital bus (via -
stepdown transformers). The automatic backup power supply, the 28125Vdc bus to the inverter was de-energized at'this time for battery maintenance. The
 
1 Table 2 (continued)                                                  ,
Plant Unit, Event Date                                  Description of Occurrence and and LER Number                                      Corrective Actions i                              ,
transfer caused a momentary loss of power to the 2B 4KV vital bus, the 2B vital instrument inverter, and consequently the 28 vital instrument bus. This in turn de-energized a pressure transmitter which then provided a signal to
,                                  close a RHR suction valve (2RH1). The cause for this event was determined and the 2RH1 valve was reopened. Also, the number 22 RHR pump was started and RHR 1                                  flow was reestablished within twenty two minutes.
A news letter item was issued to inform all operations department personnel of this incident.                                          '
: 32. William B. McGuire 2    Following quarterly preventative maintenance a 120 Vac vital instrument and
]
12/22/83          control power system battery inverter tripped upon being energized and was 83-089/03L-0      therefore inoperable.
This trip was attributed to numerous component failures which possibly were
;                                  due to a power surge upon being energized. The bad or weak components included three bad capacitors and six other weak ones,'a bad silicon control rectifier shorting board, four weak silicon control rectifiers, one bad
:                                  clamping diode, and a bad direct current sensing board.
ihe failed and questionable components were replaced. The inverter was func-tionally tested and subsequently declared operable.
 
Table 2 (continued)
Plant Unit, Event Date                              Description of Occurrence and and LER Number                                            Corrective Actions
: 33. Sequoyah 2      ,
On December 23, 1983 with Unit 1 in Mode 5 (130 degrees Fahrenheit, 300 psig) at-12/23/83          ,
zero percent power and Unit 2 in Mode 1 at one hundred percent power.. it was 83-181/01T-0        discovered that 120 Vac vital inverter 1-I had been taken out of service for Maintenance Instruction (MI) 10.6, "120 Volt Vital Instrument Power Board Check," and had not been returned to service within twenty four hours.
While performing MI-10.6, vital inv'erter 1-I was taken out of service at 0008 hours on December 20, 1983. Operations was notified at 0630 hours on l
December 20, 1983 to put the inverter back in service. The incoming assistant
!                                shift engineer (ASE) was told the inverter would be needed to be removed from service again that night and this ASE decided to leave it out of service since he (Unit 1) was in a nonapplicable mode.
The senior reactor operator for Unit I failed to realize that even though Unit I was in a nonapplicable mode, Unit 2 was not. Electrical maintenance personnel noted that the inverter was still out of service at 0650 hours on December 22, 1983. Operations was notified at 0700 hours and the inverter was returned to service at 0800 hours on December 22, 1983.
MI-10.6 was revised to add a signoff for notification of senior reactor opera-tors for both units if an inverter. is being taken out of service.
o
 
k 98 Table 3 INVERTER-RELATED EVENTS AND CORRECTIVE ACTIONS FOR 1982 Plant Unit Event Date                                                                                        Description Of Occurrence And-                            -
And LER Number            s                                                            Corrective Actions
: 1.                  Millstone 2                                          During refueling operations a preventive maintenance test was being performed        ,
01/06/82                                              on a static switch. In performing.this test, a test lead with a short circuit 82-002/03L-0                                          was connected to the printed circuit card of.this switch. This caused a component on the card to fail and a silicon controlled rectifier to become continuously gated. The load on inverter number 2 was transferred to . inverter number 6, but because the silicon controlled rectifier was on continuously the outputs of the two inverters.were connected in parallel. Due to a frequency difference a large current flow resulted from each inverter causing their input fuses to blow. This resulted in loss of a vital instrument panel which in turn caused contact closure in the overpressure protection circuit for shutdown cooling. This caused an associated valve to close which in turn resulted in a loss of shutdown cooling. Shutdown cooling was restored in approximately seven j                                                                                      minutes.
i The cause of this event was a sho.rt circuit in a test lead used in performing a
!                                                                                      preventive maintenance test. A departmental memorandum was issued to test l                                                                                      technicians to check all test leads for short circuits prior to connecting to I
i                                                                                      equipment.
l l
 
Table 3 (continued)
Plant Unit, Event Date                                        Description of Occurrence.and and LER Number                                              Corrective Actions
: 2.      Diablo Canyon .1        Prior to fuel load, the operators received an undervoltage alarm for a vital 02/12/82              ,
instrument alternating current panel. An operator was dispatched to 82-003/03X-1            investigate the source of the undervoltage alarm. When the normal alternating                      ;
current feeder breaker to inverter.IY-11 was manually switched off to check-for                    "
a tripped breaker, this inverter also tripped. The operator immediately placed panel PY-11 on back-up power and proceeded to check the remainder of the breakers and discovered the feeder breaker to panel PY-lb was in the tripped condition. Panel PY-15 was placed on back-up power. Subsequently, the tripped breaker was reset and panel PY-15 was placed back on normal power. From 1137 hours, when inverter IY-11 tripped until 1600 hours, both channels of the Plant Vent Radiation Monitor (RM 14A and 148) were inoperable because the sample pumps do not restart when power to the monitors are restored.
Furthermore, from 1120 hours, when it was suspected that panel PY-15 tripped, until 1210 hours, when power to the' panel was restored, the Plant Vent Iodine Monitor (RM-24) and the Plant Vent Flow Recorder (FR-12) were inoperable.
Investigations into the possible causes for the undervoltage alarm and the panel PY-15 trip did not reveal any specific causes. Inverter IY-11 tripped when normal alternating current was removed.because of blown fuses in the direct current power supply. The cause of the blown fuses was not identified.
S
 
                                                                                                    - 100 -
Table 3 (continued)                                              ,
l
;                    Plant Unit, Event Date                                                            Description of Occurrence.and
;                        and LER Number                                                                      Corrective Actions l
1 i                                                                  .
The blown fuses were replaced and all equipment was returned to normal service.
l                                                                          A design change was reconnended to provide sample pump alarms in the control room.
j
: 3. Joseph M. Farley 2                            On March 16, 1982, the 120 Vac vital bus 'B' was de-energized when inverter 28 03/16/82                                      tripped. Section 3.8.2.1 of the Technical Specifications in part, requires 82-011/03L-0                                  the 'B' bus and the 28 inverter to be operable and energized. This event-
.                                                                          occurred when_ inverter 28 failed due to a blown fuse in the voltage regulator circuit.
!                                                                          Following repla~ cement of the blown fuse in the inverter, bus 'B' was returned-
!                                                                          to service.
;                      4. Zion 1                                        During a refueling outage on March 17, 1982 a residual heat removal suction
{                          03/17/82                                      valve from the reactor coolant system started to close due to an inadvertent
;                          82-011/01T-0                                  opening of the output breaker for inverter 111. The operating residual heat j                                                                          removal pump was tripped.
The output breaker for inverter 111 opened due to contractor personnel (working in the auxiliary electric equipment room) accidentally dropping a piece of-sheet metal on it. The resulting loss of power caused a pressure transmitter to fail high which resulted in an automatic closure of a residual heat removal suction valve.
l
 
                                                      - 101 -
Table 3 (continued) i    Plant Unit, Event Date                              Description of Occurrence and and LER Number                                        Corrective Actions
\
!                            The output breaker for inverter 111 was reclosed and the residual heat removal suction valve reopened. The residual heat removal system was restored to i
!                            operation within three minutes. Furthermore, construction personnel working in the auxiliary electric equipment room were informed of the. necessity to be careful while working in this area.
: 5. Davis Besse 1      On April 9, 1982, the station experienced a loss of 120 Vac distribution panel
~
04/09/82          Y2 while in Mode 6 (refueling). Since distribution panel Y4 had already been 82-020/03X-2      de-energized for routine maintenance, Channel 2 of the safety features actuation system actuated when power was lost to panel Y2. Also, Channel 2 of the reactor protection system was de-energized causing a loss of one channel of source range nuclear instrumentation.
The loss of panel Y2 was due to a blown: fuse in inverter YV2. The fuse in this inverter blew when a short to ground occurred during maintenance on the control .
room emergency ventilation system. The control power supplied from Y2 to the control power panel for this system was overlooked when the system was tagged l                            cut by a contractor employee.
i 1
The blown fuse in the inverter was replaced and the responsible person was counseled by the maintenance engineer.
f a
l 4                                                                                                              .
 
1                                                                                                                                                                                            .
                                                                                                                                        - 102 -
Table 3 (continued) 4 Plant Unit Event Date                                      Description of Occurrence and and LER Number                                            Corrective Actions
: 6. Beaver Valley 1,  On April 14, 1982, the number three 125 Vdc battery was placed on a.24 hour 04/14/82        ,
equalization charge due to the addition of water to the battery cells during a                                                                                        82-015/03L-0      the performance of a weekly surveillance _ test. When this action was followed
!                                                                                                          by the receipt of the number three vital bus and battery operation alarms, con-f                                                                                                            struction engineering personnel were contacted and informed of the condition.
I After identifying that the alarmed condition was being caused by the high
,                                                                                                            charger output which had transferred the inverter supply to the direct current bus source, an attempt was made to return the inverter supply back to its j                                                                                                            normal alternating current source. This was accomplished by raising the normal
!                                                                                                            alternating current supply input voltage above the direct current bus source through a potentiometer adjustment inside the inverter cabinet. Since this l                                                                                                            also raised the inverter output voltage, a second adjustment was begun to lower the inverter output voltage. It was during this adjustment due to the
!                                                                                                            responsiveness of the-potentiometer being used that an overadjustment was made, which drove the inverter output voltage meter on the front of the inverter l
l cabinet off scale low (less than 110 Vac). After this occurred, the inverter
!                                                                                                            output breaker was opened which resulted in the loss of power to the vital bus.
Power to the vital bus was then established through its auxiliary power supply 4                                                                                                            at 1350 hours.
Maintenance was informed of the high charger output which was then adjusted to its nominal value. Also, after completing the adjustments inside the inverter
 
                                                                - 103--
Table 3 (continued)-                                                  -
Plant Unit, Event Date                                        Description of. Occurrence and                                                    -
and LER Number                                              Corrective Actions                                            ,          ,
i 1
j                              ,
cabinet, power to the vital bus was transferred back from the auxiliary source -
l to the inverter at 1405 hours.
l        7.      Millstone 2            During routine steady state operations, a 120 Vac vital instrument bus was 06/06/82                lost. The loss of this bus caused the power fuses to blow in an associated              g
]
i                82-024/03L-0            engineered. safety actuation systra (ESAS) cal;inet. The vital bus was j                                        de-energized for approximately four hours. The ESAS cabinet was de-energized for approximately six and one-half hours.                                                  -
The bus was lost due to a roof leak resulting from abnormally heavy rains-wnich              _
allowed water to enter the top of'an inverter, shortire, out its circuitry. The
                                                                                                                                ~
f
;                                        alternate source for the 120 Vac bas was un'available at the time of this
,i occurrence.                                                                -
1                                  +
The inverter was inspected and wetted components corrected. The ESAS cabinet                      -
;                                                                                                      u-                                        ,
fuses were replaced and the vital bus returned to service. Also, a water                                ,
shield was installed for two of the inverters.                    l                                            l s                      <                      - ,
j      8.      Davis Sasse 1          On June 8, 1982 source range detector N!2 was de-energized for detector replace-
\                                                                                                              I 06/08/82                ment. During the performance of a procedure to isolate a direct current ground,                              ,
82-029/03L-0 e
f
                                                                                                  , '                                                  l vi;      .,
e                                .
: .          n
 
T3                                                                        s        , v      m  - N '^ '
                                                                          - 104 -                                                          M Table 3 (continued)                                                    ,
4
    ,      P,lant Unit, Event Date                                            Description of Occurrence and      .                  ,
and LER Number                                                        Corrective Actions          -
t direct current distribution panel D2P was de-energized. At 1045 hours 120 Vac y essential inverten YV2 failed, de-energizing essental 120 Vac bus Y2 and source range datu tcr NII. This resulted in the station being without an cperable            ,
source range detector. At the time bus Y'2 was lost Channel 2 of the safety features actuation system (SFAS) de-energized and a full SFAS levels .1 tiirough 4 actuation occurred. Within an hour, the statior: re-energized bus Y2 from its alternate source.
The cause of this occurrence was attributed to a component failure within the regulated rectifier YRF2. Normally, this rectifier supplies direct current power to inverter YV2 whit.a panel D2P supplies the alternate direct current
:                                                power through coupling diodes. Should the rectifier fail, the alternate direct
]
current supply automatically assumes the load and a battery drain light illumi-nates to indicate the failure. Troubleshooting revealed that the regulated rectifier voltage control module in YRF2 had failed in such a manner that the rectifier was capable of carrying the loaded inverter only with the aid of the alternate direct current power supply. When the alternate direct current supply was removed (during the ground isolation) the rectifier could not i                                                support inverter YV2 by itself and thus the direct current input breaker for YV2 tripped free on undervoltage and de-energized bus Y2.
e
 
l                                                                          .- 105 -
Table 3 (continued)
Plant Unit, Event Date                                  .        Description of Occurrence and and LER Number i
Corrective Actions The rectifier voltage control module was replaced and the inverter was tested l                                    ,
and returned to service. A routine load test was added to the preventive l                                                  maintenance program for this equipment.
: 9. William B. McGuire 1        On June 13, 1982, while Unit 1 was operating at seventy-five percent poker,-
06/13/82                    a momentary loss of power was experienced on a vital instrumentation and              '
82-052/03L-0                control power system bus. This caused a failure of Channel 1 of the reactorL protection and instrument systems, and engineered safety systems. This. .
concurrent with an already-tripped Channel.3 for reactor coolant system loop C' flow instrumentation resulted in a two out of three coincidence reactor trip on rw loop flow. The associated 120 Vac vital bus inverter was declared z.w erable and the bus was' transferred to its alternate supply.
                                                        ..f the transient ensuing from the reactor trip and subsequent turbine trip, the condensate feedwater. system was overpressurized causing the-lifting of various rehaater relief valves and a rupture en reheater D-I relief line piping. 'Through operator action these adverse effects.were soon controlled and.
a stable hot standby condition was then i;;aintained.
4 Discussions.with the inverter manufacturer verified that either the silicon controlledrectifier(SCR)ishortingprintedcircuitboardoraconstantvoltage transformer (CVT) capacitor were the most probable failed components in the malfurictioning inverter. During1 corrective maintenance no symptoms of
 
                                                                  - 106 -
Table 3 (continued).
Plant Unit, Event Date                                          Description of Occurrence and and LER Number                                                Corrective Actions malfunction were observed and output voltage waveforms appeared normal and compared favorably to those of a similar inverter. The SCR shorting circuit board was replaced as a precautionary measure and the CVT capacitors were visually inspected (defomation of the capacitor ' casing sometimes accompanies failure). After observing proper operation.of the inverter it was returned to service.
: 10. St. Lucie 1                      Twice during normal full power operation, one of. the four redundant 120 Vac 06/22/82                    instrument power buses was lost when the output breaker of the 1A static in .
82-026/03L-0                verter opened. Each event caused the loss of one channel of the reactor.
protection and' engineered safeguards systems. In both cases the bus was returned to service immediately by use of the associated maintenance bypass bus. Upon investigation in each case, no apparent cause for the events was found. The 1A inverter was observed to be functioning properly.
After the second occurrence, the oscillator circuit board in the associated inverter was replaced as_a preventive measure based upon a~ previous event of this type. The output breaker was' subsequently reclosed and the line up re-turned to normal.
: 11. William B. McGuire 1              On June 13, 1982, Unit I experienced a reactor trip due to the loss of 120 Vac 06/24/82                    vital instrument bus inverter, EVIA. On June 15, 1982 after performing main-
 
                                                  - 107 -
I                                          Table 3 (continued)
Plant Unit, Event Date                              Description of Occurrence and and LER Number                                          Corrective Actions 82-053/03L-0  ,
tenance on this inverter, the reactor was returned to power operation. On June 24, 1982 the unit was shut down for a schedule outage. During the plant cooldown and mode deescalation, the same static inverter (EVIA) again malfunc-tioned causing an isolation valve (IND-2) in the residual heat removal' system (ND) to close. Operators stopped the operating residual heat removal pump to protect it from los's of suction and were able to restore' residual heat removal flow six minutes after IND-2 closed. However, the loss of flow effected a          ;
transition from Mode 5 (less than or equal to 200*F) to Mode 4 (greater than or l                          equal to 200 F) operation. The involved inverter was subsequently declared inoperable and its associated bus was supplied by a distribution panelboard.
The closure of the ND suction isolation valve, IND-2, rendered both trains of i                          the residual heat removal system inoperable. causing operation under appropriate action statement requirements.
4 The loss of power to reactor coolant system loop D pressure process control instrumentation caused the overpressurization protection. interlock to function, thus closing IND-2. Normally, the instrumentation provides an open premissive signal to the controller for IND-2 on a decreasing reactor coolant system pres-sure of 385 psig and the interlock closes the valves on an increasing pressure of 560 psig. The redundant ND suction isolation. valve, IND-1 in series with INU-2 is similarly interlocked by reactor coolant system loop C pressure process control instrumentation.
r I
l
 
s.
                                                    - 108 -
Table 3 (continued)                                              g Plant Unit, Event Date                                  Description of Occurrence and and LER Number                                            Corrective Actions Observers present at the inverter during its malfunction noted voltage fluctua-tions of the equipment. The output voltage was 116 volts for several minutes and had been as low as 100 volts. During maintenance on June 29 and 30, 1982, the constant voltage transformer (CVT) capacitors were disconnected and capaci-tance checks were conducted. Three capacitors had definitely failed and each of the remaining capacitors measured close to the required 13 microfarads. All three of the failed capacitors had deformed casings. However, the inspection and troubleshooting activities for this static inverter on June 13, 1982 in response to the original failure did not identify the faulty capacitors which later caused the additional incident on June 24, 1982. The location of these capacitors in the inverter cabinet was such that visual inspection was signifi-cantly obstructed. In order to see the later discovered deformation in the capacitor casings, the soldered connections for the capacitors had to be disconnected and the capacitors removed from the inverter.
The failed capacitors in the output CVT capacitor bank were replaced and proper operation of the inverter was monitored until it was returned to service on July 2, 1982. As a result of this incident, the possibility of CVT capacitor failure, the symptoms, and verification method were included in the. Vital inverter corrective maintenance procedure.
Also, operations group procedure " Draining the Reactor Coolant System" was amended to provide a step to lock open IND-1 and IND-2 valve operator power
 
                                                                                      - 109 -                                        .*
Table 3 (continued)                                                                    -
Plant Unit, Event Date                                                        . Description of Occurrence and and LER Number                                                        Corrective Actions breakers. Instrumentation maintenance proce'dures " Reactor Coolant Wide Range Pressure Calibration," and " Pressurizer Vapor Temperature Calibration," were modified to ensure power is removed from IND-1 and IND-2' valve operators prior to maintenance when the' residual heat removal system is in~ operation. After the June 24, 1982 incident the " Controlling Procedure for Unit Shutdown" was-changed to add step 3.2.6.3, "after N2 blanket has been established in'the pressurizer, lock open the power supply breakers to IND-1B and IND-2A to pre-vent inadvertent loss of residual heat removal flow." These procedures were modified so as to include provisions'to prevent the inadvertent loss of residual heat removal flow.
: 12. Rancho Seco                                On June 24, 1982, during the performance of routine preventive maintenance on' 06/24/82                      the 'B' inverter, a' condition occurred that caused a momentary unanticipated 82-015/03L-0                  loss of decay heat removal flow to the reactor vessel. Technicians had com '
pleted work on the 'B' inverter. The 'B' bus had been powered by a temporary source to allow preventive maintenance on the inverter. When the technicians attempted to return the inverter to service, it tripped to a' standby state thus                            ;
;                                                          causing the 'B' bus to lose power. A pressure transmitter which is powered by the 'B' bus, fails in the high position on loss of power. 'With this .trans-
,                                                          mitter reading high, the decay heat removal system overpressure protection-
                                                                                                                            ~
l                                                          features responded, closing an asecciated valve and tripping the 'B' decay' heat l                                                          removal system pump. The sequence occurred twice before the inverter was successfully put back in service.
l                                                                                                    -
* l e
 
                                                                                - 110 -
Table 3 (continued)                              g.
I  Plant Unit, Event Date                                                          Description of Occurrence and and LER Number                                                                    Corrective Actions i
Corrective action in this instance was to revise the inverter. vital bus trans-fer procedure used by the electrical technicans to ensure operations personnel anticipate the possibility of momentary loss of the dec&y heat removal system during maintenance of the 'B' inverter.
: 13. San Onofre 2                      While in Mode 4 on July 21, 1982, 120 Vac vital bus 2Y03 was accidentally 07/21/82                          de-energized from its associated inverter. The bus was immediately re-82-072/03L-0                      energized from its alternate power supply.
,                                          Investigation into the cause of this event, revealed that the bus was acciden-tally de-energized due to an inadvertently applied instrument ground. This temporary ground was applied during equipment testing within a radiation moni-toring panel. Action Statement b. in Section 3.8.3.1 of the Technical Specifi-cations was initiated. This statement requires the de-energized bus to be:
(1) re-energized within two hours or be in at least Mode 3 within the next six hours and in Mode 5 within the following thirty hours; and (2) re-energized from its associated inverter within twenty-four hours or be in at least Mode 3 within the next six hours and in Mode 5 within the following thirty hours.
Following removal of the ground the bus was re-energized from its associated inverter.
 
                                                - 111 -
Table 3 (continued)
Plant Unit, Event Date                            Description of Occurrence and and LER Number                                      Corrective Actions
: 14. Joseph M. Farl_ey 2 On July 22, 1982, Channel 2 of the reactor coolant system subcooling monitor 07/22/82          and the 2B containment hydrogen analyzer were declared inoperable'when the 2G 82-032/03L-0      inverter failed. Sections 3.3.3.8 and 3.'6.4.1 of the Technical Specifications, in part, require these items to be operable. Following the restoration of power with an alternate power supply these items were declared operable.
The faulty power supply was scheduled to be replaced during the next refueling outage.
: 15. San Onofre 2        While in Mode 4 at 1610 hours a 120 Vac vital bus was accidentally de-energized 07/23/82          from its associated inverter. The bus was re-energized from.its alternate 82-045/03L-0      power supply within ten minutes.
The accidental de-energization of the bus was attributed to grounding of.the bus caused by disconnection of a jumper which was placed across three fuses on feeder lines to the plant protection system panel for Channel A. The jumpers had been placed to avoid de-energization of the bus during replacement of fuses. -Fuse replacement was necessitated by discrepancies between the vendor l                        and architect-engineer drawings.
l                        The ground was removed and the bus was subsequently re-energized from its l                        associated inverter at 2200 hours.
P' s                                                                *
 
                                                                                                                                            /%.
                                                                                    -- 112 -
Table 3 (continued)                                              g Plant Unit, Event Date                                                    Description of Occurrence and 4
and LER Number                                                                Corrective Actions i            16. Donald C. Cook,I                          While in Mode 6 with the reactor head removed the inverter from the      ,
08/23/82                                AB Emergency Diesel Generator. failed, leaving the only in service centrifugal
!                    82-076/03L-0                            charging pump motor without an emergency power supply. The charging pump motor was shifted to another emergency power source 'nine minutes after the inverter l                                                            for the AB Emergency Diesel Generator failed.
i i
The diesel was returned t'o service 117 hours 50 minutes later, after the inverter had been returned to service following repair. The inverter was I                                                            repaired by replacing several solid state components, and transformer gate and shorting boards.                                          -
l t
: 17. Donald C. Cook 2                          During nomal operation, a reactor trip occurred as a result of the loss of
]                    08/24/82                              power to a 120 Vac vital bus. This loss was due to failure of the inverter I
82-072/03L-0                          which supplies power to this bus. The inverter failure was attributed to a burned out resistor and diode on an oscillator board. Also, an associated fuse
)                                                            was found blown.
j                                                            The inverter was repaired by replacing the oscillator board and fuse. Subse-l                                                            quently, the inverter was verified to be operating correctly and returned to l                                                            service.
I 3
: 18. Edwin I. Hatch I                        While operating in a steady state condition at 2250 megawatts thermal power, l
i i                                                          -
1
 
                                                                                          - 113 -                            ,
Table 3 (continued)
Plant Unit, Event Date                                                                        Description of Occurrence and and LER Number                                                                                          Corrective Actions the inverter for the 'A' train of the low pressure coolant injection (LPCI)
                                                                                                                                      ~
09/11/82                                ,
82-082/03L-0                                      system tripped. The unit was placed in a seven day limiting condition for operation per the applicable section of the Technical Specifications. The inverter for the redundant 'B' train of LPCI remained operable. - The alternate power source for motor control center IE Division I was placed in service per the appropriate operation procedure.
The inverter for the 'A' train of LPCI tripped due to the failure of an output filter capacitor. The failed capacitor had blown and had spattered insulating material which led to the failure of other inverter components.
Six fuses and two output filter capacitors were replaced. Following repair and verification of proper operation the inverter was. returned to service.
: 19. Surry 2                                            During normal operations at one hundred percent power, vital bus III inverter 10/10/82                                        failed initiating a turbine runback which led to reactor trip and safety 82-063/03L-0                                      injection. The loss of vital bus III resulted in the loss of one channel of        -
high-high containment pressure. This placed the unit in a condition where the degree of redundancy was less than that specified in Table 3.7-2 of.the Techni-cal Specifications.
O t
                                                                                      ~,
 
                                                                                                                                          --114 -
Table 3 (continued)                                ,
i                          Plant Unit, Event Date                                                                                            Description of Occurrence and i                                    and LER Number                                                                                                Corrective Actions i
An inductor in the vital bus III inverter failed shorted and thereby caused the l                                                            ,
i                                                                                                  loss of vital bus III. This bus was re-energized by cross-connecting it to i                                                                s i                                                                                                  vital bus I.
I i
l The failed inductor in the inverter from vital bus III was replaced and the inverter and bus were returned to normal service.
f
: 20. Edwin I. Hatch 2                                                With the unit operating at a steady state condition of 2415 megawatts thermal j                                      10/11/82                                                  power, an inverter trouble alarm was received. Investigation of the inverter
;                                      82-114/03L-0                                              trouble alarm disclosed that an inverter had tripped. The motor control center which this inverter was supplying was switched to its alternate power supply.
The unit was placed in an eight hour limiting condition for operation as per 3
the appropriate action statement in the Technical Specifications.
The cause of the trip was attributed to a failed bearing on the inverter leg i                                                                                                  fan.
i The inverter leg (fan included) was replaced, functionally tested satisfactorily and returned to normal service.
: 21. Susquehanna 1                                              During the startup testing program, the high pressure coolant injection system.
  ;                                    11/03/82                                                    became inoperable when the input voltage to'an associated static inverter ex-l
)
i l                                                          .
 
                                                              - 115 -
Table 3 (continued)                                                                                          %
Plant Unit, Event Date                                Description of Occurrence and and LER Number                                            Corrective Actions
!              82-049/03L-0 ,        ceeded the high level trip setpoint thus causing the inverter to trip. This rendered the control circuits for the high pressure coolant injection system
!                                      inoperable. The high level trip setpoint for the inv'erter was exceeded during an adjustment of the output voltage for an attendant 125 Vdc battery charger.
The high level trip setpoint for the inverter was raised and the unit was re-turned to normal service.
t
: 22. Calvert Cliffs 1        During Mode 1 operation at 0946 hours, the direct current input breaker to the 11/09/82              inverter supplying 120 Vac vital instrument bus number 11 was inadvertently 82-068/03L-0          opened, de-energizing the associate bus. Due to the ensuing voltage stepdown transient, the number 11 4160 volt bus supply breaker opened on undervoltage.
The direct current breaker was believed to have been accidently opened during the pulling of electrical cables in the cable spreading room for Unit 1.                                                These cables were being moved to the Unit I cable spreading room to supply power to the third train of the auxiliary feedwater system for Unit 2.                                                The number 11 diesel generator started and connected to the number 11 4160 volt bus shortly 1                                      thereafter, re-energizing the 4160 volt bus. The loss of the vital instrument
;                                    bus resulted in a loss of the normal power supply to the number 11. steam generator feedwater regulating valve (FRV) control system. The alternate supply was not automatically supplied to the FRV control system due to failure of a power supply relay. The loss of the FRV control system led to a reactor trip on low water level in the number 11 steam generator.
 
M ..
                                                                      - 116 -
Table 3 (continued)                                          f Plant Unit, Event Date                                                  Description of Occurrence and and LER Number                                                            Corrective Actions The cause of the opening of the direct current input breaker to the inverter is believed to have been an electrical cable brushing against the control switch for the breaker. Subsequent testing of the control switch revealed it was easily opened by downward movement of the switch. Due to the quiet operation of the breaker, contractor personnel were not aware that the breaker had tripped.
Corrective actions included replacing the power supply relay which had failed.
Also, a one-time test was performed on the redundant bus power supply relays for the FRV control systems for Units 1 and 2 to verify operability. In addi-tion, all operators were trained on the specifics of this event. Further, to prevent recurrence of such an event, a modification was performed to the inverter cabinets to prevent inadvertent opening of the direct or alternating current breakers within these cabinets.
: 23. North Anna 1                        With Unit 1 in Mode 3, 120 Vac vital bus 1-IV lost voltage due to the failure j          11/25/82                        of its normal power supply inverter. Vital bus I-IV was manually switched to j        82-078/03X-1                      its alterna 2 power supply, a voltage regulating transfomer.
l                                          The inverter was examined and found to have a failed oscillator board, trans-l                                          former and fuse.
i l
 
                                                        - 117 -
Table 3 (continued)
Plant Unit, Event Date                                      Description of Occurrence and and LER Number                                                              Corrective Actions The failed components in the inverter were replaced and.the inverter tested and subsequently. returned to service.
: 24. Salem 2                    Following a shift of the number 28 vital bus power source in preparation for 11/29/82                  planned maintenance on the number.1 station power transformer, the control 82-145/03X-1              room operator observed that the P-250 computer had shut down. Since the reactor coolant system subcooling margin. monitor utilizes computer data points
                                                                                                                      ~
and memory it was declared inoperable.
Investigation revealed that a failure of the computer inverter power supply. had occurred, and the computer had 'apparently shifted to its backup supply. Trans-ferring the number 2B bus power source caused a momentary loss of power which resulted in a shutdown of the computer. Further investigation showed that the loss of the inverter was due to a failed oscillator circuit breaker.
The failed oscillator circuit board was replaced and the inverter, subcooling monitor, and computer were returned to normal service.
: 25. James A. Fitzpatrick      During normal plant operation, the inverter for the 'A' low pressure coolant 12/15/82                  injection system tripped. The associated electrical loads were transferred              ,
82-056/03L-0              to the maintenance power' supply and the redundant system was verified to be operable as required by Technical Specifications.
                                                                                                                  . I:
9 9
 
e
                                                              - 118 -
Table 3 (continued)                                                      ,
Plant Unit, Event Date                                        Description of Occurrence and and LER Number                                              Corrective Actions Tripping of the inverter was attributed to a failed gate timing control card.
i The failed control card was replaced and the inverter was returned to service.
: 26. St. Lucie 1                  During normal full power operation, one of four redundant 120 Vac instrument 12/20/82              power buses was lost when the output breaker of the 1A static inverter opened.
,            82-068/03L-0          This caused a loss of one channel of the reactor protection and engineered safeguards systems. The bus was returned to service by use of the associated maintenance bypass bus. Investigation into this event disclosed no apparent cause of failure.
4 The inverter contacts were cleaned, tested and the inverter placed back in service.
: 27.        St. Lucie 1            During normal full power operation, one of four redundant 120 Vac instrument 12/25/82              power buses was lost when the output breaker of the 1A static inverter opened.
I            82-067/03L-0          The event caused a loss of one channel of the reactor protection and engineered i                                    safeguards systems. The bus was immediately returned to service by use of the associated maintenance bypass bus. Investigation into the event revealed a malfunctioning output frequency module.
i The frequency module was adjusted, the output breaker was closed, and the line up returned to normal.
l
 
                                                                            - 119 -
Table 3 (continued) i Plant Unit, Event Date                                                Description of Occurrence and and LER Number                                                        Corrective Actions
: 28. Calvert Cliffs,2                    At 1620 hours with the reactor in Mode 5, the number 22 vital. alternating current 12/28/82                inverter failed causing the number 22 120 Vac vital bus to de-energize. The 82-055/03X-1            loss of this vital bus caused a shutdown cooling return isolation valve to
!,                                                  close thus rendering both shutdown cooling loops inoperable. At 1632 hours the
}
number 22 120 Vac vital bus was placed on the alternate source. Subsequently, l                                                  the isolation valve was opened and the system returned to service.
Testing and research revealed that improper size and type fuses were installed in the vital instrument buses. Results of short circuit tests performed on a vital bus indicated that when a fault occurred on a vital load, the load fuse
{
!                                                  would not isolate the fault before the current limiter feature in the inverter
!                                                  operated. In doing so, the output voltage of the inverter would collapse to near zero volts and then return to normal, thus randomly de-energizing f
l                                                    associated engineered safety features actuation system (ESFAS) modules. Such
!                                                    actions caused a number of actuations of various safety systems.
}                                                    The fuses in all four vital buses of each unit were replaced with consideration given to individual bus loading. Also, the current limiting feature of inver-
;                                                    ters 11 and 12 (associated with Unit 1) and inverters 21 and 22 (associated
)                                                    with Unit 2), the four inverters that supply power to the ESFAS modules were removed. Testing performed after the new fuses were installed and the current t
j i                                                                                                                            _
 
                                                - 120 -
Table 3 (continued)                                                ,
Plant Unit, Event Date                              Description of Occurrence and and LER Number                                        Corrective Actions limiters removed showed that a vital load fault would not affect the output of the inverter, thus preventing inadvertent safety system operation.
: 29. St. Lucie 1          During normal full power ope' ration, while the number seven trip circuit breaker 12/30/82            (TCB) was electrically isolated for maintenance, one of the four 120 Vac 82-071/031-0        instrument buses was lost when the output breaker of the 1A static inverter opened. This caused four trip circuit breakers to open thus resulting in an open circuit in the reactor protection system trip logic. The opened TCBs resulted in reactor and turbine trips. Upon investigation into the cause of the inverter trip, it was determined that the frequency oscillator for the 1A inverter had drifted.
The oscillator circuit board was replaced. The output breaker associated with the inverter was reclosed and the line up returned to normal.
 
        .                                                - 121 -
Table 4 CATEGORIZATION OF INVERTER-RELATED EVENTS IN TABLE 1 Plant Name                                                                                      Attributed Causes Personnel Actions                                          Component Failures Grand Gulf 1                                                                  1 Zion 1                                                                                                              1 Diablo Canyon 1                                                              2 James A. Fitzpatrick                                                          1 Sequoyah 2                                                                    1 WPPSS 2                                                                      1                                      1 Maine Yankee                                                                  2 Turkey Point 3                                                                3                                                                  -
Sequoyah 1                                                                                                          1 LaSalle 2                                                                    2 Turkey Point 4                                                                5                                      1 Donald.C. Cook 1                                                                                                    2 Davis Besse 1                                                                                                        1 Brunswick 2                                                                                                          1 Zion 2                                                                                                              1 Arkansas Nuclear 2                                                            1 Donald C. Cook 2                                                                                                    2 San Onofre 2                                                                                                        1 Virgil C. Summer                                                              1 Limerick 1                                                                                                          2 North Anna I'                                                                                                        1 St. Lucie 2                                                                                                          1 Byron 1 '                                                                                                            1 William B. McGuire 2                                                          1 Totals:                      21                                        17 4
 
j; o  6
                                        - 122 -
Table 5 CATEGORIZATION OF INVERTER RELATED-EVENTS IN TABLE 2 Plant Name                                  ' Attributed Causes Personnel Actions      Component Failures Calvert Cliffs 2                        2 Nortn Anna 1                            1                        1 Davis Besse 1                            2                        2 Fort St. Vrain                                                    1 Susquehanna 1                                                      6-Donald C. Cook 1                                                  2 North Anna 2                            2                        1 James A. Fitzpatrick                    1                        2 Salem 1                              ,
1 Browns Ferry 2                                                    3 Donald C. Cook 2                                                  2 Grand Gulf 1                                                      1 Big Rock Point                                                    1 Crystal River 3                          1 Joseph M. Farley 2                                                1 Salem 2                                  2 William B. McGuire 2                                              1 Sequoyah 2                              1 Totals  13                        24
                    /
9
 
                                                                                                                              +          . .
                                        - 123 --
Table 6 CATEGORIZATION OF INVERTER-RELATED EVENTS IN TABLE 3                            ,
Plant Name                                              Attributed Causes.
Personnel Actions                        Component Failures Millstone 2                                          2                                          1 Diablo Canyon 1                                      1 Joseph M. Farley 2                                                                              2 Zion 1                                                1-Davis Besse 1                                        1                                          1 Beaver Valley 1                                      1 William 8. McGuire 1                                                                            2 St. Lucie 1                                                                                      5 Rancho Seco                                          2 San Onofre 2                                          2 Donald C. Couk 1                                                                                1 Donald C. Cook 2                                                                                1 l        Edwin I. Hatch 1                                                                                1 Surry 2                                                                                          1 Edwin I. Hatch 2                                                                                1 l        Susquehanna 1                                        1 Calvert Cliffs 1                                      1 North Anna 1                                                                                    1 Salem 2                                                                                          1 James A. Fit,zpatrick                                                                            1 Calvert Cliffs 2                                                                                1 Totals:                12                                      20 i
1 4
  - - - ,                  .    ..,m.,    --._.-._,,--..,m,,.-        _,y---,--m.,--w-,_.        -=r-<e      = v- v- e---v~    -*r + - ' - - - - - - - + ' -
 
4                    - .u -.                      a                s,.    .            -.._._a. .a
                                                                                                                                                            ~
  -g            ~p
                                                                                                    - 124 -
Table 7 TOTAL LOSSES ATTRIBUTED TO PERSONNEL ACTIONS AND COMPONENT FAILURES WHICH OCCURRED IN 1984 Attributed Cause Source of Data                                        Personnel Actions                            Component Failures 4
: 1.          From LER Data (Table 4)                                                      21                                                17
: 2.          From NPRDS Data                                                                3                                                16 Totals:                      24                                                33 1                                                                                                                                                                      .
i 4
I
                                                                    /
x 4
l
    , ~ _ . . . _ _ . . . . . _ . _ _ - . _ . . . , _ . , . . _ .          . _ _ _ _ _ _ . , - _ _ _ . _ . . . . . _ _ , . _ _                    ___. - _ - . . .. ,. _ __ _ . _ _ _ _._._ -__ .
 
                                                                                                                                                        ~          -
t
                                                                                                      - 125 -
t Table 8 TOTAL LOSSES ATTRIBUTED TO PERSONNEL ACTIONS AND-COMPONENT FAILURES WHICH OCCURRED IN 1983 Attributed Causes Source of Data                                                      Personnel Actions    Component Failures
: 1. 'From LER Data (Table 5)                                                        13                  24
: 2. From NPRDS Data                                                              _                    M i
Totals:    13                  38 a
l bummiigmimmira ni a ni i i si m
 
9        +,      ..                      -  - .
                                                    - 126 -
Table 9 TOTAL LOSSES ATTRIBUTED TO PERSONNEL ACTIONS AND COMPONENT FAILURES WHICH OCCURRED IN 1982 Attributed Causes Personnel Actions    Component Failures Source of Data 12                  20
: 1. From LER Data (Table 6) a
                                        ~
2
: 2. From NPRDS Data Totals:  12                  22 F e 9
e 1}}

Revision as of 06:25, 4 December 2024

Forwards AEOD/C605, Case Study Rept,Operational Experience Involving Losses of Electrical Inverters. Study Initiated Based on Observation of Lack of Overall industry-wide Improvement in Operational Performance of Devices
ML20212E744
Person / Time
Issue date: 01/20/1987
From: Stello V
NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO)
To: Asselstine, Roberts, Zech
NRC COMMISSION (OCM)
References
AEOD-C605, NUDOCS 8703040461
Download: ML20212E744 (1)
v • d • e


Text

Retrieved from "https://kanterella.com/w/index.php?title=ML20212E744&oldid=3999936"