ML17353A690

LER 96-004-01:on 960220,identified Potential Tech Spec non-compliance Associated W/Surveillance Testing of AFW Actuation Circuitry on Sg.Caused by Inadequate Surveillance Procedures.Procedures revised.W/960513 Ltr

ML17353A690
Person / Time
Site:	Turkey Point
Issue date:	05/13/1996
From:	Hanek O, Hovey R FLORIDA POWER & LIGHT CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
L-96-115, LER-96-004, LER-96-4, NUDOCS 9605170247
Download: ML17353A690 (14)

Text

REGULATORY INFORMATION DISTRIBUTION SYSTEM (RIDS)

ACCESSION NBR:9605170247 DOC.DATE: 96/05/13 NOTARIZED: NO DOCKET FACIL:50-250 Turkey Point Plant, Unit 3, Florida Power and Light C 05000250 AUTH. NAME AUTHOR AFFILIATION HANEKEO. Florida Power a Light Co.

-HOVEY,R.J. Florida Power & Light Co.

RECIP.NAME RECIPIENT AFFILIATION

SUBJECT:

LER 96-004-01:on 960220,identified potential Tech Spec non-compliance associated w/surveillance testing of AFW actuation circuitry on SG.Caused by inadequate surveillance procedures. Procedures revised.W/960513 ltr.

DISTRIBUTION CODE: ZE22T COPIES RECEIVED:LTR I ENCL I SIZE:

TITLE: 50.73/50.9 Licensee Event Report (LER), Incident Rpt, etc.

NOTES:

RECIPIENT COPIES RECIPIENT COPIES ID CODE/NAME LTTR ENCL ID CODE/NAME LTTR ENCL PD2-3 PD 1 1 CROTEAU,R 1 1 INTERNAL: EOBy+PD/RAB 2 2 AEOD/SPD/RRAB 1 1 FILE CENTE 1 1 NRR/DE/ECGB 1 1 R7'DE/'LB 1 1 NRR/DE/EMEB 1 1

-NRR/DRCH/HHFB 1 1 NRR/DRCH/HICB 1 1 NRR/DRCH/HOLB 1 1 NRR/DRCH/HQMB 1 1 NRR/DRPM/PECB 1 1 NRR/DSSA/SPLB 1 1 NRR/DSSA/SRXB 1 1 RES/DSIR/EIB 1 1 RGN2 FILE 01 1 1 EXTERNAL: L ST LOBBY WARD 1 1 LITCO BRYCE,J H 2 2 NOAC MURPHYiG.A 1 1 NOAC POORE,W. 1 1 NRC PDR 1 1 NUDOCS FULL TXT 1 1 NOTE TO ALL "RIDS" RECIPIENTS:

PLEASE HELP US TO REDUCE WASTE! CONTACT THE DOCUMENT CONTROL DESK, ROOM OWFN SD-5(EXT. 415-2083) TO ELIMINATE YOUR NAME FROM DISTRIBUTION LISTS FOR DOCUMENTS YOU DON'T NEEDI FULL TEXT CONVERSION REQUIRED TOTAL NUMBER OF COPIES REQUIRED: LTTR 25 ENCL 25

0

(

MAY13 lggg L-96-115 10 CFR 550.73 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, D. C. 20555 Gentlemen:

Re: Turkey Point Unit 3 Docket No. 50-250 Reportable Event: 96-004-01 Inadequate Surveillance of the The attached revised Licensee Event 'Report, 250/96-004-01, is being provided in accordance with 10 CFR 50.73 (a) (2) (i) (B) .

If there are any questions, please contact us.

Very truly yours, R. J. Hovey Vice President Turkey Point Plant OIH attachment cc: Stewart D. Ebneter, Regional Administrator, Region II, USNRC Thomas P. Johnson, Senior Resident Inspector, USNRC, Turkey Point Plant 9605170247 960513 PDR S

ADOCK 05000250 PDR

)

~~gP an FPL Group company

LICENSEE EVENT REPORT LER DOCXE'T NUMBER FACILITY NAME ll) 2 PACE TURKEY POINT UNIT 3 05000250 1 OF T TITLE )6) INADEQUATE SURVEILLANCE TESTING OF THE AUXILIARY FEEDWATER ACTUATION CIRCUITRY EVENT DATE 5 LER NUHBER {6) RPT DATE (7) OTHER FACILITIES INV. {8)

MON DAY YR SEO S R< HON DAY YR FACILITY NAMES DOCXET S S) 02 20 96 96 004 01 05 13 96 Tntkey Point Unit 6 05000251 OPERATINC HODE {9)

PONER LEVEL )10) 100 LICENSEE CONTACT FOR THIS LER (12 Tele hone Number Olga Hanek, Licensing Engineer 305 246-6607 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT 13 CAUSE SYSTEH COMPONENT MANUFACTURER NPRDS? CAUSE SYSTEH COMPONENT HANUFACTURER NPRDSs SUPPLEMENTAL REPORT EXPECTED ) lh) NO YES 0 EXPECTED SUBMISSION DATE <15)

MONTH

)II yes, cosylete EXPECTED SUBMISSION DATE)

ABSTRACT (16)

On February 20, 1996, "while performing a review of Plant Procedures 3(4)-OSP-075.4, Florida Power & Light Company (FPL) identified that not all three combinations of the two out of three logic for the Steam Generator (SG) Low-Low Water Level Auxiliary Feedwater (AFW) start signal were verified as required by Technical Specification Table 4.3.2, Item 6.a.

Turkey Point has determined the root cause to be inadequate surveillance procedures.

Corrective actions included testing of the untested portions of the actuation logic for the AFW automatic start signal on SG low-low water level for both units. Plant Procedures 3(4) -OSP-075.4 will be revised to include all three combinations of the two out of three logic for the SG low-low water level AFW start signal prior to the next performance of this surveillance. t This inadequate surveillance testing is being reported in ac'cordance with 10 CFR 50.73 a (2 i) B) .

LICENSE VENT REPORT (LER) TEXT ONTINUATION FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-01 2 OF 7 Z. DESCRIPTION OF THE EVENT On February 20, 1996, during the performance of scoping and scheduling the effort required to respond to NRC Generic Letter 96-01, "Testing of Safety-Related Logic Circuits," Florida Power &- Light Company (FPL) identified a potential Technical Specification non-compliance associated with surveillance testing of the AFW [AB] actuation circuitry on steam generator (SG) low-low water level. After review and evaluation of this issue, FPL concluded that the Technical Specification required testing for this circuitry was insufficient and the system was declared'inoperable. The evaluation supporting this conclusion was 'completed at approximately 9:00 am on February 22, 1996.

The concern identified was that not all three (3) combinations of the 2/3 logic for the Low-Low Level SG Level Auxiliary Feedwater (AFW) start signal

'are verified in Plant Procedure 3/4-0SP-075.4, "Auxiliary Feedwater Auto-Start Test". In accordance with Table 4.3-2, Item 6.a and Section 1.2 of the Technical Specifications, "each possible interlock logic state" shall be tested when performing the "Actuation Logic Test". A review of, other applicable Operations and Maintenance Plant Procedures determined that the required testing was not performed. Therefore, the subject surveillance requirement was not satisfied and Section 4.0.3 of the Technical Specifications was applicable. Technical Specification 4.0.3 allows 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for completion of a missed surveillance. The test was completed successfully at approximately 10:15 pm on February 22, 1996, for both units.

Although AFW has four other auto-start signals tJE:RLY] (Loss of offsite power (LOOP), safety injection (SI), ATWS Mitigating System Actuation circuitry (AMSAC), SG Feedwatez Pump Trip), credit is taken for Low-Low SG Level as the primary auto-start signal for several plant accident analyses.

ZI. CAUSE OF THE EVENT The root cause of the event was .inadequate surveillance procedures.

ZZZ. ANALYSIS OF THE EVENT The Turkey Point AFW System is a shared system between Units 3 and 4. It uses secondary steam to drive three AFW pump turbines which supply feedwater to the steam generators during transients when the normal feedwater source is not available. The system consists of two independent trains each capable of providing required flows to both units. Control and motive power to the AFW valves is provided by either Vital AC oz DC. The required AFW flow of approximately 125 gpm/unit must be delivered within three minutes of the generation of an RPS/ESFAS signal for LOOP or Small Break LOCA. This time is an assumption for the analyses used to establish the minimum flow requirement.

The control logic governing AFW operation is such that a variation in specific plant parameters, beyond the setpoint limits, results in a signal to open the steam supply valves on the affected units(s) . As configured, the AFW system automatically initiates as a result of any one of the following:

I 5

LICENSE VENT REPORT (LER) TEXT ONTINUATION FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-01 3OF7

1) SI actuation

2) 2 out of 3 Low-Low water level in any one of the three SGs

3) Loss of both steam generator feedwater pumps (SGFP)

4) -Bus Stripping (Bus stripping from one bus opens two out of three AFW steam motor operated valves (MOVs))

5) ATWS Mitigating System Actuation circuitry Surveillance requirements of the AFW System that apply to auxiliary feedwatez actuation are provided in Technical Specification Section 4.7.1.2.1. as stated below:

"The required independent auxiliary feedwater trains shall be demonstrated OPERABLE:

a ~

b. At least once per 18 months by:

1) Verifying that each automatic valve in the flow path actuates to its correct position upon receipt of each Auxiliary Feedwater Actuation test signal, and

2) Verifying that each auxiliary feedwater pump receives a signal as designed automatically upon receipt of each 'tart auxiliary Feedwater Actuation test signal."

Surveillance requirements foz Engineered Safety Features Actuation System (ESFAS) Instrumentation that apply to auxiliary feedwater actuation are provided in Technical Specification Section 4.3.2.1 as stated below:

"Each ESFAS instrumentation channel and interlock and the automatic actuation logic and relays shall be demonstrated OPERABLE by performance of the ESFAS Instrumentation Surveillance Requirements specified in Table 4.3-2".

Item 6a of Technical Specification Table 4.3-2, requires that the automatic actuation logic and actuation relays of the auxiliary feedwater system have an ACTUATION LOGIC TEST performed each refueling outage.

The definition of an ACTUATION LOGIC TEST is provided in Technical Specification Section 1.2 as stated below:

"An ACTUATION.LOGIC TEST shall be the application of various simulated input combinations in conjunction with each possible interlock logic state and verification of the required logic output. The ACTUATION LOGIC TEST shall include a continuity check, as a minimum, of the output device".

If a Technical Specification Surveillance Requirement is not performed, Surveillance Requirement 4.0.3 must be met. It states the following:

LICENSE VENT REPORT (LER) TEXT ONTINUATION W

FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-01 4 OF 7 "Failure to perform a Surveillance Requirement'ithin the allowed surveillance interval, defined by Specification 4.0.2, shall constitute noncompliance with the OPERABILITY requirements for a Limiting Condition for Operation. The time limits of the ACTION requirements are applicable at the time it is identified that a surveillance requirement has not been performed. The ACTION

-requirements,may be delayed for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to permit the completion of the surveillance when the allowable outage time limits of the ACTION requirements are less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Surveillance requirements do not have to be performed on inoperable equipment".

Surveillance Requirement 4.0.2 that is referred to above states:

"Each Surveillance Requirement shall be performed within the specified time interval with a maximum allowable extension not to exceed 25% of the surveillance interval".

The AFW automatic start logic consists of 5 actuation signals: Bus Stripping, SI, Trip of SGFPs, AMSAC, and Low-Low Level on any SG. In order to determine if Technical Specification surveillance requirements of the AFW actuation logic was being satisfied, schematic and logic diagrams of the logic circuitry were compared against the associated test procedures to ensure all logic and parallel signal paths were being tested properly. The following summarizes the results of this design versus testing review.

The logic associated with Bus Stripping and SI is verified by simulating the actual process signals (i.e. Loss of 4KV Voltage, Hi-Hi Containment Pressure) during Integrated Safeguards Testing procedures 3/4-0SP-203.1,2.

The Trip of SGFPs logic is satisfied when both pump breakers aze open and either pump control switch has been placed in the start position and returned to mid position. Therefore, this logic actuated AFW when either/both SGFPs have tripped or one has tripped while the other has been manually stopped. The vazious combinations of switch positions are tested properly as well as independent actuation of each train of AFW circuitry by procedure 3/4-0SP-075.4, The AMSAC auto start logic is not required to be tested by Technical Specifications. However, the AMSAC logic is tested via procedure 3/4-OSP-093.1 as directed by Operations or following design modifications or maintenance activities.

The Low-Low S/G Level logic foz AFW start is derived from the same logic relays used in the Reactor Protection System (RPS) to initiate reactor trip.

Operation of these logic relays'oils and contacts which generate a reactor trip are tested on a monthly basis by procedure 3/4-'SP-049.1. However, the relay contacts used for the AFW start logic are not verified since its test relay contacts are wired in series to block AFW actuation. As a result, the AFW start logic is tested separately (on an 18 month basis) by procedure 3/4-0SP-075.4 by placing the Low-Low Level instrument loop bistable switches in test in order to actuate the logic relays. However, only channels 1 & 2 bistables are actuated on each S/G to simulate the Low-Low S/G Level signal.

In order to properly verify the 2/3 relay logic matrix, channels 1 & 3 and 2

& 3 bistables should also be actuated.

LICENSE VENT REPORT (LER) TEXT ONTINUATION FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-01 5OF7 ANALYSIS The Updated Final Safety Analysis Report (UFSAR) Chapter 14 accident analysis credits AFW for mitigation of several events. The following AFW related transients were reviewed: 1) Loss of Normal Feedwatez Flow, 2) Loss of Non Emergency AC to Plant Auxiliaries, 3) Steam Generator Tube Rupture (SGTR), 4) Main Steam Line Break, and 5) Small Break LOCA. None of these transients rely on AFW initiation from bus stripping. The analyses assume AFW System actuation on SI or Low-Low SG Water Level.

The Loss of Normal Feedwater Flow transient is analyzed in Section 14.1.11 of the UFSAR. A loss of normal feedwater results in' reduction in capacity of the secondary system to remove the heat generated in the reactor coze.

The analysis of the transient described in this section demonstrates that the AFW system is capable of removing the stored and residual heat, thus preventing either overpressurization of the Reactor Coolant System or loss of water from the reactor core, and returning the plant to safe condition.

The UFSAR analysis assumes that AFW flow is initiated three (3) minutes following a start signal on Low-Low SG level. This event specifically credits AFW initiation on Low-Low SG level. As a backup, the operator would also be expected to manually initiate AFW on a reactor trip at Step 7 of 3/4-EOP-E-O, which is one of the m'emorized immediate operator steps.

The Loss of Non-emergency A-C Power to Plant Auxiliaries is analyzed in Section 14.1.12 of the UFSAR. The accident of record assumes that AFW is initiated on Low-Low SG level. However, because this event also assumes a LOOP, both main feedwater pumps will trip on undervoltage and cause an AFW initiation on the main feed pump breakers opening. AFW will also be initiated on bus stripping for this event. Accordingly, the AFW Actuation System (AFAS) testing inadequacies did not affect plant response to this event.

The SGTR transient is analyzed in Section 14.2 4 of the UFSAR. AFW is initiated for the SGTR on a SI signal. Accordingly, the AFAS testing inadequacies did not affect plant response to this event.

The Main Steam Line Break transient is analyzed in Section 14.2.5 of the UFSAR. AFW is initiated foz the steam line break on a SI signal.

Accordingly, the AFAS testing inadequacies did not affect plant response to this event.

The Small Break LOCA is analyzed in Section 14.3.2.2 of the UFSAR. AFW is initiated foz the,.small break LOCA on a SI signal. Accordingly, the AFAS testing inadequacies did not affect plant response to this event.

Based on the preceding, the only event where AFW automatic initiation is not demonstrated by the conduct of the surveillance testing is the Loss of Normal Feedwater event resulting in initiation on Low-Low SG level.

Additionally,,a normal reactor trip is expected to result in AFW initiation on Low-Low SG level.

This event is reportable under the requirements of 10 CFR 50.73(a)(2)(i)(B).

LXCENSEAVENT REPORT (LER) TEXT%)NTXNURTXON FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-01 6OF7 As defined by 10 CFR 50.36, Limiting Conditions foz Operation (LCO) aze "the lowest functional capability or performance levels of equipment required for safe operation of the facility. When an LCO of a nuclear reactor is not met, Xhe licensee shall shut down the reactor or follow any remedial action permitted by the Technical Specifications until the condition can be met."

Implicit in this definition is that the lowest functional capability oz performance levels of equipment be maintained assuming any credible'ingle failure. As such, the principle purpose of LCOs is to ensure the preservation of single failure criteria by requiring all redundant components of safety systems be operable. When the required redundancy is not maintained, either due to equipment failure, maintenance, or surveillance testing, action is required within a specified time to shutdown the plant and/or perform actions to ensure a safe condition. This LCO action time is a temporary short term relaxation of the single failure criteria which is consistent with the overall system reliability, probability of the equipment function being required (i.e. LOOP Design Basis Accident occurring) during the specified time, and the safety significance of the inoperable equipment/system.

Also, as defined by 10 CFR 50.36, "Surveillance Requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that the facility operation will be within safety limits, and that the limiting conditions of operation will be met". This states that Surveillance Requirements support meeting LCOs.

GL 91-18 provides guidance on actions to be taken when a Technical Specification Surveillance is missed. The GL refers to the Standard Technical Specifications version of Surveillance Requirement 4.0.3 and which forms the basis for Surveillance Requirement 4.0.3 contained in the Turkey Point Technical Specifications. The GL version of 4.0.3 states in part that:

"Failure to perform a Surveillance Requirement within the specified time interval shall constitute a failure to meet the OPERABILITY requirements for a Limiting Condition of Operation...".

Surveillance Requirements and the "Action Logic Test" definition imply or intend that all signal/actuation paths be tested. The review'of 3/4-OSP-075.4 showed that the signal/actuation paths for the steam generator low-low level AFW initiation signal was only tested for one of three paths on each steam generator. This is inconsistent with the Turkey Point Plant testing that is performed on similar logic for both the RPS and ESFAS. Based on this difference, the existing testing performed was not considered sufficient to meet the intent of the Technical Specification surveillance, and Technical Specification 4.0.3 was entered and the required actions met.

Additional testing that insured compliance with the Technical Specification surveillance requirements was implemented without a plant shutdown.

LICENSE EVENT REPORT (LER) TEXT ONTINUATION FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-01 7OF7 While GL 91-18 and the Technical Specifications provide specific criteria to be followed when a surveillance is not met, there is a strong case that demonstrates that operability of the AFW system and its actuation logic was maintained even though surveillance testing had some inadequacies. All active components (e.g., relays, bistables) have been shown by existing testing to remain operable and capable of changing state. By testing of the RPS, the subject relays and contacts for the RPS have been shown to be operable. The primary aspect of testing that had not been met was showing those contact points for AFW actuation for the remaining two out of three logic points are made up when required. These relays and their associated contacts are located in the Cable Spreading Room, which is a controlled environment. The contacts are open during normal operation, and are not subject to welding or other phenomenon that would result in their degradation. It is considered highly improbable that one set of relay contacts would remain functional and another set would fail to function.

Accordingly, on this basis, there was a high level of confidence that the untested portions of the steam generator low-low level AFW actuation circuitry were functional and capable of performing their design functions.

An analysis was performed to determine the chan'ge in Core Damage Frequency (CDF) for failure of the AFW system to actuate in the event of a low-low level in the steam generators. The analysis increased the AFW pump common cause failure to start by a factor of one hundred to account for the'"

actuation failure and assumed the probability of the operator's failure to turn on the AFW pumps while carrying out the Emergency Operating Procedure as 1.50E-02. The calculated CDF change is 7.00E-07/ yr. This is considered not risk significant based on the criterion of risk significance for permanent plant changes in the Electric Power Research Institute Probabilistic Safety Assessment Applications Guide.

IV. CORRECTIVE ACTIONS The untested portion of the Low-Low S/G Level AFW start logic was tested successfully on February 22, 1996.

2. Plant Procedures 3-0SP-075.4 and 4-0SP-075.4 will be revised to include all combinations of the 2/3 low-low steam generator level logic prior to the next performance of this surveillance.

V. ADDITIONAL INFORMATION A. Similar Events: None B. Additional Information: None EIIS Codes are shown in the format [EIIS SYSTEM: IEEE component function identifier, second component function identifier (if appropriate)].

l'