ML17229A701

LER 98-003-00:on 980326,discovered Containment Pressure Instrumentation Design Single Failure Vulnerability.Caused by Inadequate Design by Personnel Error.Removed RPS & ESFAS Containment Pressure Bypass Keys immediately.W/980427 Ltr

ML17229A701
Person / Time
Site:	Saint Lucie
Issue date:	04/27/1998
From:	Frehafer K, Stall J FLORIDA POWER & LIGHT CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
L-98-111, LER-98-003-01, LER-98-3-1, NUDOCS 9804300179
Download: ML17229A701 (9)

Text

CATEGORY REGULA RY INFORMATION DISTRIBUTI SYSTEM (RIDS)

ACCESSION NBR:9804300179 DOC.DATE: 98/04/27 NOTARIZED: NO DOCKET FAC1L:50-389 St. Lucie Plant, Unit 2, Florida Power Ec Light Co. 05000389

'UTH. NAME - AUTHOR AFFILIATION FREHAFER,K.W. Florida Power 6 Light Co.

STALL,J.A. Florida Power 6 Light Co.

RECIP.NAME RECIPIENT AFFILIATION

SUBJECT:

LER 98-003-00:on 980326,discovered containment pressure instrumentation design single failure vulnerability. Caused by inadequate design by personnel error. Removed RPS 6 ESFAS containment pressure bypass keys immediately.W/980427 ltr.

DISTRIBUTION CODE: IE22T COPIES RECEIVED:LTR ENCL SIZE:

TITLE: 50.73/50.9 Licensee Event Report (LER), Incident Rpt, etc. E NOTES:

RECIPIENT COPIES RECIPIENT COPIES ID CODE/NAME LTTR' ENCL ZD CODE/NAME LTTR ENCL PD2-3 PD 1 GLEAVES,W 1 1 INTERNAL: ACRS 1 1 2 2 AEOD/SPD/RRAB 1 1 1 1 NRR/DE/ECGB 1 1 NRR/DE/EELB 1 1 NRR/DE/EMEB 1 1 NRR/DRCH/HHFB 1 1 NRR/DRCH/HICB 1 1 NRR/DRCH/HOLB 1 1 NRR/DRCH/HQMB 1 1 NRR/DRPM/PECB 1 1 NRR/DSSA/SPLB 1 1 NRR/DSSA/SRXB 1 1 RES/DET/EIB 1 1 RGN2 FILE 01 1 1 D

EXTERNAL: L ST LOBBY WARD 1 1 LITCO BRYCE, J H 1 1 0 NOAC POORE,W. 1 1 NOAC QUEENER,DS 1 1 NRC PDR 1 1 NUDOCS FULL TXT 1 1 C U

NOTE TO ALL "RIDS" RECIPIENTS:

PLEASE HELP US TO REDUCE WASTE. TO HAVE YOUR NAME OR ORGANIZATION REMOVED FROM DZSTRIBUTION LISTS OR REDUCE THE NUMBER OF COPZES RECEIVED BY YOU OR YOUR ORGANIZATION, CONTACT THE DOCUMENT CONTROL DESK (DCD) ON EXTENSION 415-2083 FULL TEXT CONVERSION REQUIRED TOTAL NUMBER OF COPIES REQUIRED: LTTR 25 ENCL 25

Florida Power & Light Company,6351 S. Ocean Drive. Jensen Beach, FL34S57 April 27, 1998 L-98-111 10 CFR 50.73 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, D. C. 20555 Re: St. Lucie Unit 2 Docket No. 50-389 Reportable Event: 98-003 Date of Event: March 26, 1998 Containment Pressure Instrumentation Desi n Sin le Failure Vulnerabilit The attached Licensee Event Report is being submitted pursuant to the requirements of 10 CFR 50.73.

Very truly yours, J. A. Stall Vice President St. Lucie Plant JAS/EJW/KWF Attachment cc: Regional Administrator, USNRC, Region II Senior Resident Inspector, USNRC, St. Lucie Plant

'P804300i79 980427 PDR ADOCK 05000389 8 PDR an FPL Group company

NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB No. 31604)104 EXPIRES 04/30/SS (4-86)

ESTIMATED BURDEN PER RESPONSE To COMPLY WITH THIS MANDATO INFORMATION COLLECTION REQUEST: 60.0 HRS. REPORTED lESSON lEARNED ARE INCORPORATED INTO THE UCENSING PROCESS AND FE BACK TO INDUSTRY. FORWARD COMMENTS REGARDING BURDEN ESTIMAT LICENSEE EVENT REPORT (LER) TO THE INFORMATION AND RECORDS MANAGEMENT BRANCH (T.a F33)

U.S. NUCIEAR REGULATORY COMMISSION. WASHINGTON, DC 206664N01 AND TO THE PAPERWORK REDUCTION PROJECT (316&0104), OFFICE 0 (See reverse for required number of MANAGEMENTAND BUDGET. WASHINGTON, DC 20603.

digits/characters for each block)

FACIUTY NAME (1) DOCKEr NUMB(R (2) PAGE (3)

ST LUCIE UNIT 2 05000389 1 OF6 11TLE (4)

Containment Pressure Instrumentation Design Single Failure Vulnerability FACIUTY NAME DOCKET NUMBER MONTH OAY YEAR SEQUENTIAL REVISION NUMBER NUMBER MONTH DAY YEAR n/a FACIUTY NAME DOCKET NUMBER 26 98 98 003 0 4 27 98 n/a OPERATING MODE (9) 20.2201 (b) 20.2203(a) (2) (v) 50.73(a) (2)(i) 50.73(a) (2) (viii)

POWER LEVEL (10) 100 20.2203 (a) (2) (i) 20.2203(a) (3)(ii) 50.73(a) (2)(iii) 73.71 OTHER 20.2203(a) (2)(iii) 50.36(c) l1) 50.73(a)(2)(v) Specify In Abstract below or in NRC Form 388A 20.2203(a) (2) (iv) 50.36(c) (2) 50.73(a)(2)(vii)

NAME TELEPHONE NUMBER Srra(ude Area Coda)

K. W. Frehafer, Licensing Engineer (5611 468-4284 CAUSE SYSTEM COMPONENT MANUFACTURER REPORTABLE REPORTABLE To NPRDS CAUSE SYSTEM COMPONENT MANUFACTURER To NPRDS JE n/a n/a n/a A JE )'2@":j'SSPN MONTH OAY YEAR EXPECTED YES SUBMISSION (If yes, complete EXPECTED SUBMISSION DATE). X No DATE (15)

ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single. spaced typewritten lines) (16)

On March 26, 1998r Unit 2 was in Mode 1 at 100 percent reactor power. During a UFSAR design basis review, Engineering discovered a single failure vulnerability for the containment pressure input signals to the Unit 2 reactor protection system and engineered safety feature actuation system. With one containment pressure channel in bypass, a postulated failure of a circuit breaker or fuse could fail two channels of the containment pressure inputs to the reactor protection system and engineered safety features actuation systems, such that the two of three coincidence logic would not be available in this condition.

The cause of this event was that the design of the containment pressure instrumentation did not meet the channel separation and independence requirements of IEEE Standard 279-1971 due to cognitive personnel error on the part of the original designers.

Corrective actions included: the immediate removal of the RPS and ESFAS containment pressure bypass keys from the control room and securing the keys in the plant manager's key locker; applicable changes to surveillance procedures were made to prohibit use of the bypass key for containment pressure bistable testing; a review of'all Unit 2 instrumentation lines was completed to ensure that this condition was isolated to the design of the containment pressure instruments; and evaluating a long term corrective action for this condition.

NRC FORM 388 (4-86)

NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSIO I4-96)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION YEAR SEQUENTIAL REVISION ST LUCIE UNIT 2 05000389 2 OF 6 98 -- 003 0 TEXT (If more speceis required, use edditionel copies of NRC Farm 386AI (17I E EYEhlI On March 26, 1998, Unit 2 was in Mode 1 at 100 percent reactor power. During a UFSAR design basis review, Engineering identified a single failure vulnerability for the containment pressure input signals to the Unit 2 reactor protection system (RPS) [EIIS:JC] and engineered safety feature actuation system (ESFAS) [EIIS:JE].

The Unit 2 RPS and ESFAS protective functions for reactor trip, safety injection actuation signal (SIAS), containment isolation actuation signal (CIAS), and main steam isolation signal (MSIS) are designed and licensed to be a three channel system with one installed spare as described in UFSAR. [ESFAS functions for the recirculation actuation signal (RAS) and the containment spray actuation signal (CSAS) were licensed to be a four channel system in that they utilize energize-to-actuate logic to perform the protective function and therefore, could be affected by single failures associated with loss of a DC bus.] The design requirements for these protective systems are in part specified in IEEE Standard 279-1971, "Criteria for Protection Systems for Nuclear Power Generation Stations," and 10 CFR 50, Appendix A, General Design Criteria 21 "Protection System Reliability and Testability."

Containment pressure input signals to RPS and ESFAS are provided by four pressure transmitters

[EIIS:JE:PT] located outside containment. Each transmitter has a dedicated containment penetration with a normally energized solenoid valve [EIIS:JE:SOL] in its process sense line.

Power for the MA/MC and MB/MD solenoids is provided from the SA and SB - DC buses [EIIS:EJ]

respectively (see figure 1). Since two isolation valves are supplied from the same power circuit, and since the valves are designed to fail closed on loss of power, a single failure of a circuit breaker [EIIS:EJ:72] or fuse [EIIS:EJ:FU] can be postulated that will cause a loss of two redundant containment pressure measurement channels. Loss of two containment pressure channels could prevent actuation of the protective system when in a two-out-of-three configuration (i.e., with a containment pressure channel placed in bypass). The consequences of this single failure are contrary to IEEE 279-1971, Section 4.11, in that the protective system design did not permit any one containment pressure channel to be bypassed for maintenance with the remaining active parts of the system still able to meet single failure criteria. Therefore, the Technical Specification basis for allowing the extended bypass of a containment pressure channel (i.e., the ability to meet the single failure criteria with the remaining three channels) was incorrect.

The cause of this event was that the design of the containment pressure instrumentation did not meet the channel separation and independence requirements of the IEEE standard, due to cognitive personnel error on the part of the original designers. The designers failed to reconcile the requirements of 10 CFR 50, Appendix A,'eneral Design Criteria 55 and 56 with the requirements of Regulatory Guide 1.11, "Instrument Lines Penetrating Primary Reactor NRC FORM 388A I4.96)

NRC FORM 366A '.S. NUCLEAR REGULATORY COMMISSIO I4-96)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION YEAR SEQUENTIAL REVISION ST LUCIE UNIT 2 05000389 3 OF 6 98 003 0 TEXT fifmora space is required, uso edditionel copios of NRC Form 388A/ I17)

Containment," and IEEE Standard 279-1971. General Design Criteria 55 and 56 requires that, for lines penetrating the primary reactor containment and directly connected to the containment atmosphere, the lines should have one automatic valve inside and outside containment, unless it can be demonstrated that the design is acceptable on some other defined basis.

Regulatory Guide 1.11 provides the suitable design bases for instrument lines that penetrate containment that are part of a protection system. The regulatory guide states*that power-operated valves should remain as-is upon loss of power in order to assure redundancy, independence, and testability of the protection system. However, as previously discussed, the power operated containment pressure instrument sensing line isolation valves fail closed on a loss of power. Although the fail closed failure mode is conservative with respect to General Design Criteria 55 and 56, this failure mode introduces a single failure that could prevent the ESFAS and RPS trip functions associated with the containment pressure instruments with a containment pressure channel in bypass.

This condition is reportable under 10 CFR 50.73(a)(2)(v) as any condition alone that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.

The Unit 2 RPS and ESFAS systems (with the exception of RAS and CSAS) are licensed as two-out-of-three protection systems with an installed spare channel. The basis for the licensed configuration is that these systems are designed to meet IEEE Standard 279-.1 971, including the single failure criterion, with three channels in service. Since the fourth containment pressure channel is considered an installed spare, the Unit 2 Technical Specifications allow a failed containment pressure channel to be placed in bypass for an extended period of time.

The action statement for a single inoperable RPS containment pressure channel (ACTION ¹2.a of Technical Specification Table 3.3-1) allows continued startup and/or power operation provided the inoperable channel is placed in the bypassed or tripped condition within one hour.

The action statement for a single inoperable ESFAS containment pressure channel (ACTION ¹13 of Technical Specification Table 3.3-3) allows continued startup and/or power operation provided the inoperable channel is placed in the bypassed or tripped condition within one hour.

However, the single failure vulnerability invalidates the basis for the Technical Specification indefinite bypass allowed outage time for the containment pressure instrument channels. This condition is not applicable for Unit 1 because the containment pressure instrument sensing line configuration is different and the Unit 1 Technical Specifications have a 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> allowed outage time for placing a containment pressure instrument channel in bypass.

NRC FORM 388A I4-96)

NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSIO I4-96I LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION YEAR SEQUENTIAL REVISION ST LUCIE UNIT 2 05000389 4 OF 6 98 003 0 TEXT llfmore spaceis required, use additional copies of NRC form 366A/ f17)

High containment pressure signals are used as input for the following protection system functions: RPS reactor trip, SIAS,,CIAS, CSAS, and MSIS. The single failure scenario discussed in this licensee event report is only applicable when a containment pressure instrument channel is placed in bypass; with all channefs operable or one channel in trip, alf applicable single failure criteria continue to be met. In the unlikely event that the isolation valves fail closed on loss of power, safety class annunciators LA-15 and LB-15 would alert the operators to this condition.

In the unlikely event that RPS or ESFAS containment pressure function was required when a channel of containment pressure was in bypass, and the isolation valves failed closed such that the function would not be performed, diverse protection is provided. The containment pressure initiation signal is diverse to other process parameters that would provide the equivalent protective function as summarized below.

RPS reactor trip - Provided by the thermal margin/low pressure trip (LOCA) or low steam generator pressure trip (main steam line breaks (MSLB))

SIAS - Provided by low pressurizer pressure CIAS - Provided by SIAS or high containment radiation MSIS - Provided by low steam generator pressure Therefore, FPL concludes that a postulated loss of the containment pressure input to the RPS reactor trip, SIAS, CIAS, and MSIS functions would not prevent the required protective system function.

The high containment pressure signals are used to initiate CSAS, and automatically starts the containment spray (CS) pumps. However, unlike RPS, MSIS, SIAS, and CIAS, the CSAS protection system is an energize to actuate system, and is licensed as a four channel protection system. Because of the existing CSAS design single failure vulnerabilities due to a loss of a DC bus, the Unit 2 Technical Specificatt'ons limit the allowed outage time for a bypassed CSAS channel to 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, at which time the channel must be placed in the tripped condition.

Therefore, single failures of the containment pressure instrumentation that could affect the CSAS function are already addressed by the Unit 2 Technical Specifications.

Based on the above, FPL concludes that the identified containment pressure instrumentation single failure vulnerability had no significant impact on the health and safety of the public.

NRC FORM 388A I4-96I

NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSIO I4.96I LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION YEAR SEQUENTIAL REVISION ST LUCIE UNIT 2 05000389 5 OF 6 98 003 0 TEXT (ifmore spaceis required, use additional copies of NRC Farm 368A/ I17)

The single failure scenario discussed in this licensee event report is only applicable when a containment pressure instrument channel is placed in bypass; with all channels operable or one channel in trip, all applicable single failure criteria continue to be met. The following corrective actions will preclude operation with a containment pressure instrument channel in bypass.

The RPS and ESFAS containment pressure bypass keys (with the exception of CSAS where bypass in excess of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is not allowed by the Technical Specifications) were immediately removed from the control room and secured in the plant manager' key locker.

Applicable surveillance procedures were changed to prohibit use of the bypa'ss key for containment pressure bistable. testing, and to provide the necessary caution statements to ensure channels not under test are clear of any trip conditions before performing testing.

3. A review of the Unit 2 instrumentation lines that penetrate containment was performed to ensure that this condition is not applicable to other protective system sensing lines with no discrepancies found.

FPL is evaluating the appropriate long-term solution necessary to eliminate this concern.

'one Eailed&ampanants Jdeotifiad:

None NRC FORM 399A I4.96I

J NRC FORM 366A '.S. NUCLEAR REGULATORY COMMISSIO (4-9S)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION YEAR SEQUENTIAL REVISION ST LUCIE UNIT 2 05000389 6 OF 6 98 003 0 TEXT (Ifmoro spacois roquirod, use additional copies of hfRC Form 3MAI I17]

SA Bus Inside Containment Transmitters ISE-07-5A A

ISE-07-5C l ~ ~ ~ ~ ~ ~ ~

I-SE-07-5B l<E-07-5D

~ ~ ~ ~ ~ ~

D Outside Containment SB Bus Figure 1 Unit 2 Containment Pressure Instrument Sensing Line Configuration NRC FORM 388A I4.9S)