Information Notice No. 86-70: Potential Failure of All Emergency Diesel Generators

                                                            SSINS No.: 6835 
                                                            IN 86-70       

                                UNITED STATES
                        NUCLEAR REGULATORY COMMISSION
                    OFFICE OF INSPECTION AND ENFORCEMENT
                           WASHINGTON, D.C. 20555

                               August 18, 1986

Information Notice No. 86-70:   POTENTIAL FAILURE OF ALL EMERGENCY DIESEL
                                   GENERATORS 

Addressees: 

All nuclear power reactor facilities holding an operating license or a 
construction permit. 

Purpose: 

This notice informs recipients of multiple design deficiencies in a vital ac
power system that could potentially result in the loss of all emergency 
diesel generators (EDGs). It is expected that recipients will review the 
information for applicability to their facilities and consider actions, if 
appropriate, to preclude a similar problem occurring at their facilities. 
However, suggestions contained in this information notice do not constitute 
NRC requirements; therefore, no specific action or written response is 
required. 

Description of Circumstances: 

On June 10, 1986, in accordance with 10 CFR Part 21, Florida Power & Light 
(FP&L) reported the results of a failure modes and effects analysis (FMEA). 
This analysis identified multiple design deficiencies in the Turkey Point 
Units 3 and 4 vital ac power system that could potentially result in the 
loss of both EDGs due to overloading. In addition, one deficiency was 
identified that could result in the loss of all ac power to Unit 4. Turkey 
Point Units 3 and 4 share two EDGs. Simplified diagrams of part of the 
Turkey Point 3 & 4 electrical distribution system are provided as Figures 1 
and 2. 

One design deficiency involved a "swing bus." As shown on Figure 1, 480 volt
MCC "D" is normally supplied from EDG "B" but will shift its power supply to
EDG "A" if needed. MCC "D" also feeds a non-safety stub bus through a single
circuit breaker. This breaker is normally opened by the 4B load sequencer to
isolate the non-safety loads from MCC "D" when the 4B 4160V bus is loaded on
EDG "B". A single failure in that circuit breaker would leave the non-safety
loads connected to MCC "D". During safety injection for one unit, the 
additional non-safety loads could overload EDG "B", possibly resulting in a 
trip of this EDG. MCC "D" would then transfer its power supply and could 
overload EDG "A" as well. 




8608130578 
.

                                                           IN 86-70 
                                                           August 18, 1986 
                                                           Page 2 of 3 

In addition to the above design deficiency, five deficiencies in the EDG 
load EDGs. Both EDGs could be overloaded in the event of a safety injection 
on one evaluation were found, each of which could contribute to an 
overloading of both unit and a loss of offsite power to both units. In some 
cases this could occur without a single failure. These deficiencies are as 
follows: 

o    The post-TMI Emergency Operating Procedures require an additional 
     charging pump and high head safety injection pump in the 1-30 minute 
     and 30-60 minute EDG load interval, respectively. 

o    In the event of a single failure of one EDG, actual testing of 
     component cooling water and intake cooling water showed that pump loads 
     (KW) were higher than expected. Under this condition, the cooling water 
     pumps provide flow to parallel hydraulic trains. Since the flow 
     resistance is lower, the pump flow rate is greater and the pump motor 
     horsepower would increase. This in turn may increase the load on the 
     EDG to an unacceptable value. 

o    Recent environmental qualification evaluations per 10 CFR 50.49 assumed
     that the emergency containment coolers operate longer than previously 
     assumed. 

o    Load center transformer losses had not been accounted for in prior EDG 
     load evaluations. 

o    Some nonsafety loads that are auto-start enabled when the safety 
     injection signal is reset could result in EDG overloading. These loads 
     would not always immediately start, but would auto-start when their 
     start setpoints were reached after the reset. 

In addition to the overloading deficiencies above, a design deficiency was 
found that could result in the loss of one EDG, and at the same time could 
result in the loss of all ac power to Unit 4 as mentioned earlier. In the 
event of a single failure of the 4A battery or the 4A load sequencer 
subsequent to a loss of off-site power, the 4A 4160V bus shown in Figure 2 
would be prevented from automatically loading onto the "A" EDG. It would 
also prevent the transfer of the 4A MCC swing bus from 4A load center to 4B 
load center. The "B" EDG has a self-contained supply of fuel oil that lasts 
about one hour. After that time, fuel must be gravity supplied by the day 
tank via a solenoid operated valve. However, this valve is powered from MCC 
4A. Therefore, the above mentioned single failure would also cause the loss 
of the "B" EDG and the loss of all ac power to Unit 4. The Unit 3 3B 4160V 
bus would also be deenergized, along with three of the four high head safety
injection pumps and the control room air-conditioning. 

Discussion: 

The single failure vulnerability of the non-safety stub bus discussed above 
may have been evaluated during the licensing review and the loads on the 
EDGs found to be low enough so that failure of the stub bus breaker would 
not overload the diesel. Subsequent to initial operation, however, 
additional loads have been 
.

                                                           IN 86-70 
                                                           August 18, 1986 
                                                           Page 3 of 3 

added on the diesels. Prior to November, 1985, there was the potential for 
loading the EDGs to 3544 kw in the 1-30 minute period and 3451 in the 30-60 
minute period following a LOCA in one unit with a loss of offsite power in 
both units. These load levels exceed the highest FSAR value (112 hour 
exceptional rating) of 3050 Kw by a substantial margin. With the EDGs 
overloaded, the potential exists that safety-related loads would not start 
or would not operate at design ratings. Under these conditions, the EDG 
engines could stall and damage to the generator and/or engine could occur. 
There are no test data available to demonstrate that the EDGs could accept 
the above load levels. 

As an interim solution to the above design deficiencies, FP&L disabled the 
automatic transfer between EDGs and established a dedicated operator to take
corrective action (i.e., manipulate appropriate breakers) as necessary. The 
licensee has now modified EDG loads, loading sequences and plant procedures.
This example illustrates the importance of reviewing EDG load limits under 
all possible operating configurations for a range of design basis accident 
conditions. FP&L, through an FMEA, system testing, and evaluation of EDG 
load limits, found design deficiencies that may have prevented one or both 
EDG's from performance their required function. 

No specific action or written response is required by this information 
notice. If you have any questions about this matter, please contact the 
Regional Administrator of the appropriate regional office or this office. 




                                   Edward L. Jordan Director 
                                   Division of Emergency Preparedness 
                                     and Engineering Response 
                                   Office of Inspection and Enforcement 

Technical Contact:  Henry Bailey, IE
                    (301) 493-9006

                    Joseph Giitter, IE
                    (301) 492-9001

Attachments:
1.   Figures 1 and 2, Turkey Point - Units 3 & 4* 
2.   List of Recently Issued IE Information Notices