ML17353A604

LER 96-004-00:on 960220,surveillance Testing of AFW Actuation Circuitry Was Inadequate.Caused by Inadequate Surveillance Procedures.Tested Untested Portions of Actuation Logic for AFW Automatic Start signal.W/960318 Ltr

ML17353A604
Person / Time
Site:	Turkey Point
Issue date:	03/18/1996
From:	Hanek O, Hovey R FLORIDA POWER & LIGHT CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
L-96-068, L-96-68, LER-96-004, LER-96-4, NUDOCS 9603250229
Download: ML17353A604 (9)

Text

CATEGORY 1 ~

REGULATORY INFORMATION DISTRIBUTION SYSTEM (RIDS)

ACCESSION NBR:9603250229 DOC.DATE: 96/03/18 NOTARIZED: NO DOCKET FACIL:50-250 Turkey Point Plant, Unit 3, Florida Power and Light C 05000250 AUTH. NAME AUTHOR AFFILIATION HANEK,O. ,Florida Power & Light Co.

HOVEY,R.J. Florida Power & Iight Co.

RECIP.NAME RECIPIENT AFFILIATION

SUBJECT:

LER 96-004-00:on 960220,surveillance testing of AFW actuation circuitry was inadequate. Caused by inadequate surveillance procedures. Tested untested portions of actuation logic for AFW automatic start signal.W/960318 ltr.

DISTRIBUTION CODE: IE22T COPIES RECEIVED:LTR I ENCI ~ SIZE:

TITLE: 50.73/50.9 Licensee Event Report (LER), Incident Rpt, etc.

NOTES:

RECIPIENT COPIES RECIPIENT COPIES ID CODE/NAME LTTR ENCL ID CODE/NAME LTTR ENCL PD2-1 PD 1 1 CROTEAU,R 1 1 INTERNAL: 8 2 2 AEOD/SPD/RRAB 1 1 FILE CENTE 1 1 NRR/DE/ECGB 1 1 D EELB 1 1 NRR/DE/EMEB 1 1 NRR/DRCH/HHFB 1 1 NRR/DRCH/HICB 1 1 NRR/DRCH/HOLB 1 1 NRR/DRCH/HQMB 1 1 NRR/DRPM/PECB 1 1 NRR/DSSA/SPLB 1 1 NRR/DSSA/SRXB 1 1 RES/DSIR/EIB 1 1 RGN2 FILE 01 1 1 EXTERNAL: L ST LOBBY WARD 1 1 LITCO BRYCEPJ H 2 2 NOAC MURPHY,G.A 1 1 NOAC POORE,W. 1 1 NRC PDR 1 1 NUDOCS FULL TXT 1 1 NOTE TO ALL "RIDSN RECIPIENTS:

CONTROL DESKS PLEASE HELP US TO REDUCE WASTE) CONTACT THE DOCUMENT ROOM OWFN SD-5(EXT. 415-2083) TO ELIMINATE YOUR NAME FROM DISTRIBUTION LISTS FOR DOCUMENTS YOU DON'T NEED!

FULL TEXT CONVERSION REQUIRED TOTAL NUMBER OF COPIES REQUIRED: LTTR 25 ENCL 25

MAR 18 t996 L-96-068 10 CFR 50.73 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, D. C. 20555 Gentlemen:

Re: Turkey Point Unit 3 Docket No. 50-250 Reportable Event: 96-004-00 Inadequate Surveillance Testing of the Auxiliar Feedwater Actuation Circuitr The attached Licensee Event Report, 250/96-004-00, is being provided in accordance with 10 CFR 50.73(a) (2) (i) (B) .

Should there be any questions, please contact us.

Very truly yours, 40tb Robert J. Hovey Vice President Turkey Point Plant OIH attachment cc: S. D. Ebneter, Regional Administrator, Region II, USNRC T. P. Johnson, Senior Resident Inspector, USNRCg Turkey Point Plant

'7603250229 9603%8 PDR S

ADOCK 05000250 PDR pg f7f" an FPL Group company

LICENSEE EVENT REPORT LER DOCXET NUHBER 2 PACE 3 FACILITY NAHE (1)

TURKEY POINT UNIT 3 05000250 1 Of' TITLE (4) INADEQUATE SURVEILLANCE TESTING OF THE AUXILIARY FEEDWATER ACTUATION CIRCUITRY EVENT DATE 5 LER NUHBER 6 RPT DATE I OTHER FACILITIFS INV 8 HON DAY YR Rf HON DAY YR FACILITY NAHES DOCXET 4 S 02 20 96 96 004 00 03 18 96 Turkey Paint Unit 4 05000251 OPERATING NODE (5)

PURER LEVEL (10) 100 LICENSEE CONTACT FOR THIS LER 12 Tele hone Number Olga Hanek, Licensing Engineer 305 246-6607 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT 13 CAUSF. SYSTDI COHPONFNT HANUFACTURFR NPRDS? CAUSE SYSTEH COHPONENT HANUFACTURFR NPRDS?

EXPECTED HONTH DAY SUPPLEHENTAL REPORT EXPECTED (14) NO YESO SUBHISS ION DATE (15)

(lf yee, canylete EXPECTED SUBHISSION DATE)

ABSTRACT (16)

On February 20, 1996, while performing a review of Plant Procedures 3(4)-OSP-075.4, Florida Power & Light Company (FPL) identified that not all three combinations of the two out of three logic for the Steam Generator (SG) Low-Low Water Level Auxiliary Feedwater (AFW) start signal were verified as required by Technical Specification Table 4.3.2, Item 6.a.

Turkey Point has determined the root cause to be inadequate surveillance procedures.

Corrective actions included testing of the untested portions of the actuation logic for the AFW automatic start signal on SG low-low water level. Plant Procedures 3(4)-OSP-075.4 will be revised to include all three combinations of the two out of three logic for the SG low-low water level AFW start signal prior to the next performance of this surveillance.

This inadequate surveillance testing is being reported in accordance with 10 CFR 50.73 a 2 i B

t LICENSEE ERG'NT REPORT (LER) TEQVZ t

CONTINUATION FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-00 2OF7 Z. DESCRZPTZON OF THE EVENT On February 20, 1996, during the performance of scoping and scheduling the effort required to respond to NRC Generic Letter 96-01,"Testing of Safety-Related Logic Circuits," Florida Power & Light Company (FPL) identified a potential Technical Specification non-compliance associated with surveillance testing of the AFW [AB] actuation circuitry on steam generator (SG) low-low water level. After review and evaluation of this issue, FPL concluded that the Technical Specification required testing for this circuitry was insufficient and the system was declared inoperable. The evaluation supporting this conclusion was completed at approximately 9:00 am on February 22, 1996.

The concern identified was that not all three (3) combinations of the 2/3 logic for the Low-Low Level SG Level Auxiliary Feedwater (AFW) start signal are verified in Plant Procedure 3/4-0SP-075.4, "Auxiliary Feedwater Auto-Start Test". In accordance with Table 4.3-2, Item 6.a and Section 1.2 of the Technical Specifications, "each possible interlock logic state" shall be tested when performing the "Actuation Logic Test". A review of other applicable Operations and Maintenance Plant Procedures determined that the required testing was not performed. Therefore, the subject surveillance requirement was not satisfied and Section 4.0.3 of the Technical Specifications was applicable. Technical Specification 4.0.3 allows 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for completion of a missed surveillance. The test was completed successfully at approximately 10:15 pm on February 22, 1996, for both units.

Although AFW has four other auto-start signals [JE:RLY] (Loss of offsite power (LOOP), safety injection (SI), ATWS Mitigating System Actuation circuitry (AMSAC), SG Feedwatez Pump Trip), credit is taken for Low-Low SG Level as the primary auto-start signal for several plant accident analyses.

ZZ. CAUSE OF THE EVENT The root cause of the event was inadequate surveillance procedures.

ZZZ. ANALYSIS OF THE EVENT The Turkey Point AFW System is a shared system between Units 3 and 4.

uses secondary steam to drive three AFW pump turbines which supply feedwater It to the steam generators during transients when the normal feedwater source is not available. The system consists of two independent trains each capable of providing required flows to both units. Control and motive power to the AFW valves is provided by either Vital AC or DC. The required AFW flow of approximately 125 gpm/unit must be delivered within three minutes of the generation of an RPS/ESFAS signal for LOOP or Small Break LOCA. This time is an assumption for the analyses used to establish the minimum flow requirement.

The control logic governing AFW operation is such that a variation in specific plant parameters, beyond the setpoint limits, results in a signal to open the steam supply valves on the affected units(s). As configured, the AFW system automatically initiates as a result of any one of the following:

1) SI actuation

t t LICENSEE EVENT REPORT (LZR) TEXT CONTINUATION FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-00 3OF7

2) 2 out of 3 Low-Low water level in any one of the three SGs

3) Loss of both steam generator feedwater pumps (SGFP)

4) Bus Stripping (Bus stripping from one bus opens two out of three AFW steam motor operated valves (MOVs))

5) ATWS Mitigating System Actuation circuitry Surveillance requirements of the AFW System that apply to auxiliary feedwater actuation are provided in Technical Specification Section 4.7.1.2.1. as stated below:

"The required independent auxiliary feedwater trains shall be demonstrated OPERABLE:

a ~

b. At least once pez 18 months by:

1) Verifying that each automatic valve in the flow path actuates to its correct position upon receipt of each Auxiliary Feedwater Actuation test signal, and

2) Verifying that each auxiliary feedwater pump receives a start signal as designed automatically upon receipt of each auxiliary Feedwater Actuation test signal."

Surveillance requirements for Engineered Safety Features Actuation System (ESFAS) Instrumentation that apply to auxiliary feedwater actuation are provided in Technical Specification Section 4.3.2.1 as stated below:

"Each ESFAS instrumentation channel and interlock and the automatic actuation logic and relays shall be demonstrated OPERABLE by performance of the ESFAS Instrumentation Surveillance Requirements specified in Table 4.3-2".

Item 6a of Technical Specification Table 4.3-2, requires that the automatic actuation logic and actuation relays of the auxiliary feedwater system have an ACTUATION LOGIC TEST performed each refueling outage.

The definition of an ACTUATION LOGIC TEST is provided in Technical Specification Section 1.2 as stated below:

"An ACTUATION LOGIC TEST shall be the application of various simulated input combinations in conjunction with each possible interlock logic state and verification of the required logic output. The ACTUATION LOGIC TEST shall include a continuity check, as a minimum, of the output device".

If a Technical Specification Surveillance Requirement is not performed, Surveillance Requirement 4.0.3 must be met. It states the following:

"Failure to perform a Surveillance Requirement within the allowed surveillance interval, defined by Specification 4 '.2, shall

FACILITY NAHE DOCKET NUHBER LER NUHBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-00 4 OF 7 constitute noncompliance with the OPERABILITY requirements foz a Limiting Condition for Operation. The time limits of the ACTION requirements are applicable at the time it is identified that a surveillance requirement has not been performed. The ACTION requirements may be delayed for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to permit the completion of the surveillance when the allowable outage time limits of the ACTION requirements are less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Surveillance requirements do not have to be performed on inoperable equipment".

Surveillance Requirement 4.0.2 that is referred to above states:

"Each Surveillance Requirement shall be performed within the specified time interval with a maximum allowable extension not to exceed 25% of the surveillance interval".

The AFW automatic start logic consists of 5 actuation signals: Bus Stripping, SI, Trip of SGFPs, AMSAC, and Low-Low Level on any SG. In order to determine if Technical Specification surveillance requirements of the AFW actuation logic was being satisfied, schematic and logic diagrams of the logic circuitry were compared against the associated test procedures to ensure all logic and parallel signal paths were being tested properly. The following summarizes the results of this design versus testing review.

The logic associated with Bus Stripping and SI is verified by simulating the actual process signals (i.e. Loss of 4KV Voltage, Hi-Hi Containment Pressure) during Integrated Safeguards Testing procedures 3/4-0SP-203.1,2.

The Trip of SGFPs logic is satisfied when both pump breakers are open and either pump control switch has been placed in the start position and returned to mid position. Therefore, this logic actuated AFW when either/both SGFPs have tripped oz one has tripped while the other has been manually stopped. The various combinations of switch positions are tested properly as well as independent actuation of each train of AFW circuitry by procedure 3/4-0SP-075.4.

The AMSAC auto start logic is not required to be tested by Technical Specifications. However, the AMSAC logic is tested via procedure 3/4-OSP-093.1 as directed by Operations or following design modifications or maintenance activities.

The Low-Low S/G Level logic for AFW start is derived from the same logic relays used in the Reactor Protection System (RPS) to initiate reactor trip.

Operation of these logic relays'oils and contacts which generate a reactor trip are tested on a monthly basis by procedure 3/4-0SP-049.1. However, the relay contacts used for the AFW start logic are not verified since its test relay contacts are wired in series to block AFW actuation. As a result, the AFW start logic is tested separately (on an 18 month basis) by procedure 3/4-0SP-075.4 by placing the Low-Low Level instrument loop bistable switches in test in order to actuate the logic relays. However, only channels 1 & 2 bistables are actuated on each S/G to simulate the Low-Low S/G Level signal.

In order to properly verify the 2/3 relay logic matrix, channels 1 & 3 and 2 3 bistables should also be actuated.

FACILITY NAME DOCKET NUNBER LER NUNBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-00 5OF7 ANALYSIS The Updated Final Safety Analysis Report (UFSAR) Chapter 14 accident analysis credits AFW for mitigation of several events. The following AFW related transients were reviewed: 1) Loss of Normal Feedwater Flow, 2) Loss of Non Emergency AC to Plant Auxiliaries, 3) Steam Generator Tube Rupture (SGTR), 4) Main Steam Line Break, and 5) Small Break LOCA. None of these transients rely on AFW initiation from bus stripping. The analyses assume AFW System actuation on SI or Low-Low SG Water Level.

The Loss of Normal Feedwater Flow transient is analyzed in Section 14.1.11 of the UFSAR. A loss of normal feedwater results in a reduction in capacity of the secondary system to remove the heat generated in the reactor core.

The analysis of the transient described in this section demonstrates that the AFW system is capable of removing the stored and residual heat, thus preventing either overpressurization of the Reactor Coolant System or loss of water from the reactor core, and returning the plant to safe condition.

The UFSAR analysis assumes that AFW flow is initiated three (3) minutes following a start signal on Low-Low SG level. This event specifically credits AFW initiation on Low-Low SG level. As a backup, the operator would also be expected to manually initiate AFW on a reactor trip at Step 7 of 3/4-EOP-E-O, which is one of the memorized immediate operator steps.

The Loss of Non-emergency A-C Power to Plant Auxiliaries is analyzed in Section 14.1.12 of the UFSAR The accident of record assumes that AFW is

~

initiated on Low-Low SG level. However, because this event also assumes a LOOP, both main feedwater pumps will trip on undervoltage and cause an AFW initiation on the main feed pump breakers opening. AFW will also be initiated on bus stripping for this event. Accordingly, the AFW Actuation System (AFAS) testing inadequacies did not affect plant response to this event.

The SGTR transient is analyzed in Section 14.2 4 of the UFSAR. AFW is initiated for the SGTR on a SI signal. Accordingly, the AFAS testing inadequacies did not affect plant response to this event.

The Main Steam Line Break transient is analyzed in Section 14.2.5 of the UFSAR. AFW is initiated for the steam line break on a SI signal.

Accordingly, the AFAS testing inadequacies did not affect plant response to this event.

The Small Break LOCA is analyzed in Section 14.3.2.2 of the UFSAR. AFW is initiated for the small break LOCA on a SI signal. Accordingly, the AFAS testing inadequacies did not affect plant response to this event.

Based on the preceding, the only event where AFW automatic initiation is not demonstrated by the conduct of the surveillance testing is the Loss of Normal Feedwater event resulting in initiation on Low-Low SG level.

Additionally, a normal reactor trip is expected to result in AFW initiation on Low-Low SG level.

This event is reportable under the requirements of 10 CFR 50.73(a)(2)(i)(B).

t t LICENSEE EVENT REPORT (LER) TEXT CONT INUATION FACILITY NAHE DOCKET NUHBER LER NUHBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-00 6 OF 7 As defined by 10 CFR 50.36, Limiting Conditions for Operation (LCO) are "the lowest functional capability oz performance levels of equipment required for safe operation of the facility. When an LCO of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the Technical Specifications until the condition can be met."

Implicit in this definition is that the lowest functional capability or performance levels of equipment be maintained assuming any credible single failure. As such, the principle purpose of LCOs is to ensure the preservation of single failure criteria by requiring all redundant components of safety systems be operable. When the required redundancy is not maintained, either due to equipment failure, maintenance, or surveillance testing, action is required within a specified time to shutdown the plant and/or perform actions to ensure a safe condition. This LCO action time is a temporary short term relaxation of the single failure criteria which is consistent with the overall system reliability, probability of the equipment function being required (i.e. LOOP Design Basis Accident occurring) during the specified time, and the safety significance of the inoperable equipment/system.

I Also, as defined by 10 CFR 50.36, "Surveillance Requirements aze requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that the facility operation will be within safety limits, and that the limiting conditions of operation will be met". This states that Surveillance Requirements support meeting LCOs.

GL 91-18 provides guidance on actions to be taken when a Technical Specification Surveillance is missed. The GL refers to the Standard Technical Specifications version of Surveillance Requirement 4.0.3 and which forms the basis for Surveillance Requirement 4.0.3 contained in the Turkey Point Technical Specifications. The GL version of 4.0.3 states in part that:

"Failure to perform a Surveillance Requirement within the specified time interval shall constitute a failure to meet the OPERABILITY requirements for a Limiting Condition of Operation...".

Surveillance Requirements and the "Action Logic Test" definition imply or intend that all signal/actuation paths be tested. The review of 3/4-OSP-075.4 showed that the signal/actuation paths for the steam generator low-low level AFW initiation signal was only tested foz one of three paths on each steam generator. This is inconsistent with the Turkey Point Plant testing that is performed on similar logic for both the RPS and ESFAS. Based on this difference, the existing testing performed was not considered sufficient to meet the intent of the Technical Specification surveillance, and Technical Specification 4.0.3 was entered and the required actions met ~

Additional testing that insured compliance with the Technical Specification surveillance requirements was implemented without a plant shutdown.

LICENSEE E'OlENT REPORT (LER) TEXT CONTZNUATXON FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-00 7OF7 While GL 91-18 and the Technical Specifications provide specific criteria to be followed when a surveillance is not met, there is a strong case that demonstrates that operability of the AFW system and its actuation logic was maintained even though surveillance testing had some inadequacies. All active components (e.g., relays, bistables) have been shown by existing testing to remain operable and capable of changing state. By testing of the RPS, the subject relays and contacts for the RPS have been shown to be operable. The primary aspect of testing that had not been met was showing those contact points foz AFW actuation for the remaining two out of three logic points are made up when required. These relays and their associated contacts are located in the Cable Spreading Room, which is a controlled environment. The contacts are open during normal operation, and are not subject to welding or other phenomenon that would result in their degradation. It is considered highly improbable that one set of relay contacts would remain functional and another set would fail to function.

Accordingly, on this basis, there was a high level of confidence that the untested portions of the steam generator low-low level AFW actuation circuitry were functional and capable of performing their design functions.

An analysis was performed to determine the change in Coze Damage Frequency (CDF) for failure of the AFW system to actuate in the event of a low-low level in the steam generators. The analysis increased the AFW pump common cause failure to start by a factor of one hundred to account for the actuation failure and assumed the probability of the operator's failure to turn on the AFW pumps while carrying out the Emergency Operating Procedure as 1.50E-02. The calculated CDF is 7.00E-07 which is below 1.00E-06, the screening criteria of the Electric Power Research Institute Pzobabilistic Safety Assessment Application Guide.

ZV. CORRECTIVE ACTIONS The untested portion of the Low-Low S/G Level AFW start logic was tested successfully on February 22, 1996.

2. Plant Procedures 3-0SP-075.4 and 4-0SP-075.4 will be revised to include all combinations of the 2/3 low-low steam generator level logic prior to the next performance of this surveillance.

V. ADDITIONAL INFORMATION A. Similar Events: None B. Additional Information: None EIIS Codes are shown in the format [EIIS SYSTEM: IEEE component function identifier, second component function identifiez (if appropriate)].