Information Notice No. 86-70: Potential Failure of All Emergency Diesel Generators
SSINS No.: 6835
IN 86-70
UNITED STATES
NUCLEAR REGULATORY COMMISSION
OFFICE OF INSPECTION AND ENFORCEMENT
WASHINGTON, D.C. 20555
August 18, 1986
Information Notice No. 86-70: POTENTIAL FAILURE OF ALL EMERGENCY DIESEL
GENERATORS
Addressees:
All nuclear power reactor facilities holding an operating license or a
construction permit.
Purpose:
This notice informs recipients of multiple design deficiencies in a vital ac
power system that could potentially result in the loss of all emergency
diesel generators (EDGs). It is expected that recipients will review the
information for applicability to their facilities and consider actions, if
appropriate, to preclude a similar problem occurring at their facilities.
However, suggestions contained in this information notice do not constitute
NRC requirements; therefore, no specific action or written response is
required.
Description of Circumstances:
On June 10, 1986, in accordance with 10 CFR Part 21, Florida Power & Light
(FP&L) reported the results of a failure modes and effects analysis (FMEA).
This analysis identified multiple design deficiencies in the Turkey Point
Units 3 and 4 vital ac power system that could potentially result in the
loss of both EDGs due to overloading. In addition, one deficiency was
identified that could result in the loss of all ac power to Unit 4. Turkey
Point Units 3 and 4 share two EDGs. Simplified diagrams of part of the
Turkey Point 3 & 4 electrical distribution system are provided as Figures 1
and 2.
One design deficiency involved a "swing bus." As shown on Figure 1, 480 volt
MCC "D" is normally supplied from EDG "B" but will shift its power supply to
EDG "A" if needed. MCC "D" also feeds a non-safety stub bus through a single
circuit breaker. This breaker is normally opened by the 4B load sequencer to
isolate the non-safety loads from MCC "D" when the 4B 4160V bus is loaded on
EDG "B". A single failure in that circuit breaker would leave the non-safety
loads connected to MCC "D". During safety injection for one unit, the
additional non-safety loads could overload EDG "B", possibly resulting in a
trip of this EDG. MCC "D" would then transfer its power supply and could
overload EDG "A" as well.
8608130578
.
IN 86-70
August 18, 1986
Page 2 of 3
In addition to the above design deficiency, five deficiencies in the EDG
load EDGs. Both EDGs could be overloaded in the event of a safety injection
on one evaluation were found, each of which could contribute to an
overloading of both unit and a loss of offsite power to both units. In some
cases this could occur without a single failure. These deficiencies are as
follows:
o The post-TMI Emergency Operating Procedures require an additional
charging pump and high head safety injection pump in the 1-30 minute
and 30-60 minute EDG load interval, respectively.
o In the event of a single failure of one EDG, actual testing of
component cooling water and intake cooling water showed that pump loads
(KW) were higher than expected. Under this condition, the cooling water
pumps provide flow to parallel hydraulic trains. Since the flow
resistance is lower, the pump flow rate is greater and the pump motor
horsepower would increase. This in turn may increase the load on the
EDG to an unacceptable value.
o Recent environmental qualification evaluations per 10 CFR 50.49 assumed
that the emergency containment coolers operate longer than previously
assumed.
o Load center transformer losses had not been accounted for in prior EDG
load evaluations.
o Some nonsafety loads that are auto-start enabled when the safety
injection signal is reset could result in EDG overloading. These loads
would not always immediately start, but would auto-start when their
start setpoints were reached after the reset.
In addition to the overloading deficiencies above, a design deficiency was
found that could result in the loss of one EDG, and at the same time could
result in the loss of all ac power to Unit 4 as mentioned earlier. In the
event of a single failure of the 4A battery or the 4A load sequencer
subsequent to a loss of off-site power, the 4A 4160V bus shown in Figure 2
would be prevented from automatically loading onto the "A" EDG. It would
also prevent the transfer of the 4A MCC swing bus from 4A load center to 4B
load center. The "B" EDG has a self-contained supply of fuel oil that lasts
about one hour. After that time, fuel must be gravity supplied by the day
tank via a solenoid operated valve. However, this valve is powered from MCC
4A. Therefore, the above mentioned single failure would also cause the loss
of the "B" EDG and the loss of all ac power to Unit 4. The Unit 3 3B 4160V
bus would also be deenergized, along with three of the four high head safety
injection pumps and the control room air-conditioning.
Discussion:
The single failure vulnerability of the non-safety stub bus discussed above
may have been evaluated during the licensing review and the loads on the
EDGs found to be low enough so that failure of the stub bus breaker would
not overload the diesel. Subsequent to initial operation, however,
additional loads have been
.
IN 86-70
August 18, 1986
Page 3 of 3
added on the diesels. Prior to November, 1985, there was the potential for
loading the EDGs to 3544 kw in the 1-30 minute period and 3451 in the 30-60
minute period following a LOCA in one unit with a loss of offsite power in
both units. These load levels exceed the highest FSAR value (112 hour
exceptional rating) of 3050 Kw by a substantial margin. With the EDGs
overloaded, the potential exists that safety-related loads would not start
or would not operate at design ratings. Under these conditions, the EDG
engines could stall and damage to the generator and/or engine could occur.
There are no test data available to demonstrate that the EDGs could accept
the above load levels.
As an interim solution to the above design deficiencies, FP&L disabled the
automatic transfer between EDGs and established a dedicated operator to take
corrective action (i.e., manipulate appropriate breakers) as necessary. The
licensee has now modified EDG loads, loading sequences and plant procedures.
This example illustrates the importance of reviewing EDG load limits under
all possible operating configurations for a range of design basis accident
conditions. FP&L, through an FMEA, system testing, and evaluation of EDG
load limits, found design deficiencies that may have prevented one or both
EDG's from performance their required function.
No specific action or written response is required by this information
notice. If you have any questions about this matter, please contact the
Regional Administrator of the appropriate regional office or this office.
Edward L. Jordan Director
Division of Emergency Preparedness
and Engineering Response
Office of Inspection and Enforcement
Technical Contact: Henry Bailey, IE
(301) 493-9006
Joseph Giitter, IE
(301) 492-9001
Attachments:
1. Figures 1 and 2, Turkey Point - Units 3 & 4*
2. List of Recently Issued IE Information Notices
Page Last Reviewed/Updated Tuesday, March 09, 2021