ML17353A740

LER 96-004-02:on 960524,identified Inadequate Surveillance Testing.Caused by Inadequate Surveillance Procedures.Entered Tech Spec Statements,Tested Required Instruments Functions & Revised Plant procedure.W/960618 Ltr

ML17353A740
Person / Time
Site:	Turkey Point
Issue date:	06/18/1996
From:	Hanek O, Hovey R FLORIDA POWER & LIGHT CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
L-96-147, LER-96-004, LER-96-4, NUDOCS 9606260005
Download: ML17353A740 (14)

Text

III'  % ISa REGULATOOINFORNATION DISTRIBUTION %STER (RIDE)

ACCESSION NBR:9606260005 DOC.DATE: 96/06/18 NOTARIZED: NO DOCKET FACIL:5(L-, 250 Turkey Point Plant, Unit 3, Florida Power and Light C 05000250 AUTH.NAMk AUTHOR AFFILIATION HANEK,O. Florida Power 6 Light Co.

HOVEY,R.J. Florida Power 6 Light Co.

RECIP.NAME RECIPIENT AFFILIATION

SUBJECT:

LER 96-004-02:on 960524,identified inadequate surveillance testing. Caused by inadequate surveillance procedures. Entered Tech Spec Statements, tested required instruments functions &

revised plant procedure.W/960618 ltr.

DISTRIBUTION CODE: IE22T COPIES RECEIVED:LTR ENCL 'SIZE:

TITLE: 50.73/50.9 Licensee Event Report (LER), Incident Rpt, etc.

NOTES:

RECIPIENT COPIES RECIPIENT COPIES ID CODE/NAME LTTR ENCL ID CODE/NAME LTTR ENCL PD2-3 PD 1 1 CROTEAUFR 1 1 INTERNAL: 2 2 AEOD/SPD/RRAB 1 1 CENTE 1 1 NRR/DE/ECGB 1 1 NRR/DE EELB 1 1 NRR/DE/EMEB 1 1 NRR/DRCH/HHFB 1 1 NRR/DRCH/HICB 1 1 NRR/DRCH/HOLB 1 1 NRR/DRCH/HQMB 1 1 NRR/DRPM/PECB 1 1 NRR/DSSA/SPLB 1 1 NRR/DSSA/SRXB 1 1 RES/DSIR/EIB 1 1 RGN2 FILE 01 1 1 EXTERNAL: L ST LOBBY WARD 1 1 LITCO BRYCEFJ H 2 2 NOAC MURPHYFG.A 1 1 NOAC POOREFW. 1 1 NRC PDR 1 1 NUDOCS FULL TXT 1 1 NOTE TO ALL "RIDS" RECIPIENTS:

PLEASE HELP US TO REDUCE WASTE! CONTACT THE DOCUMENT CONTROL DESK, ROOM OWFN SD-5(EXT. 415-2083) TO ELIMINATE YOUR NAME FROM DISTRIBUTION LISTS FOR DOCUMENTS YOU DON'T NEED!

FULL TEXT CONVERSION REQUIRED TOTAL NUMBER OF COPIES REQUIRED: LTTR .25 ENCL 25

JUNKS tgga FPL L-96-147 10 CFR 550.73 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, D. C. 20555 Gentlemen:

Re: Turkey Point Unit 3 Docket No. 50-250 Reportable Event: 96-004-02 Technical Specification Surveillance Procedure Review Identification of By letter L-96-068, dated March 18, 1996, as revised by L-96-115, dated May 13, 1996, Florida Power and Light Company (FPL) submitted Licensee Event Report (LER) 50-250/96-004-01, Inadequate Surveillance of the Auxiliary Feedwater Actuation Circuitry. This LER documented the first condition identified under the Technical Specification Surveillance Review Program in response to Generic Letter (GL) 96-01, "Testing of Safety-Related Logic Circuits."

The attached revised LER, 250/96-004-02, incorporates documentation of the second condition identified under the Technical Specification Surveillance Review Program in response to GL 96-01. The revised LER, 250/96-004-02, is being provided in accordance with 10 CFR 50.73(a) (2) (i) (B) .

FPL will report any future event identified as a result of the GL 96-01 review program as a supplement to LER 50-250/96-004.

If there are any questions, please contact us.

ly yours, Dg /or~~

R. J. Bovey Vice President Turkey Point Plant OIH attachment cc: Stewart D. Ebneter, Regional Administrator, Region USNRC II, Thomas P. Johnson, Senior Resident Inspector, USNRC, Turkey Point Plant

~r An<

9606260005 9606%8 PDR ADOCK 05000250 8 PDR an FPL Group company z~yk',

LXCEMSEE EVENT REPORT LER PACI( ITY NAME (1) DOCKRT NUMRPR 2 naca TURKEY POINT UNIT 3 05000250 1 OP 10 TITLE (4) TECHNICAL SPECIFICATION SURVEILLANCE PROCEDURE REVIEW IDENTIFICATION OF INADE UATE SURVEILLANCE TESTING RYENT DATE LRR NUMBRR 6 RPT DATR 9 (YPNRR PACILITIRs INv. S MON DAY YR YR SR ~ R4 MON DAY YR PACILITY NAMES DOCKET ~ S 05 24 96 96 004 02 06 1S 96 Turkey Point Unit 4 05000251 OPERATING MODE (9)

POWER LEVEL (10) 100 LICENSEE CONTACT FOR THIS LER 12 Tele hone Number Olga Hanek, Licensing Engineer (305) 246-6607 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT (13) cAUsa MANUPACI'URPR NPRDS2 cAUsa coMpoNRNp MANUPACTURRR NPRDSP EXPECTED MONIM DAY SUPPLEMENTAL REPORT EXPECTED (14) NO @ YESO SUBMISSION DATE (15)

(if yes, complete EXPECTED SUBMISSION DATE)

ABSTRACT (16)

On February 20, 1996, while performing a review of Plant Procedures 3(4)-OSP-075.4, in response to Generic Letter (GL) 96-01, "Testing of Safety-Related Logic Circuits," Florida Power Light Company (FPL) identified that not all three S

combinations of the two out of three logic for the Steam Generator (SG) Low-Low Water Level Auxiliary Feedwater (AFW) start signal were verified as required by Technical Specification Table 4.3.2, Item 6.a.

On May 24, 1996, while performing a review of circuit designs in response to GL 96-01, FPL identified that certain breaker position switch contacts, associated with the safety-related swing 4 KV switchgear, have not been tested as part of any periodic surveillance as required by Technical Specifications 4.8.1.1.2.g.4 and 4.8.1.1.2.g.6.

Turkey Point has determined the root cause of the events to be inadequate surveillance procedures.

Corrective actions included entering Technical Specification Action Statements, testing of the required instrument functions to fulfillTechnical Specification surveillance requirements, and Plant Procedure revisions.

LXCENSEE PNT REPORT (LER) TEXT CXNUATXON FACILLTY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-02 2 OF 10 I. DESCRIPTION OF THE EVENTS Inadequate Surveillance Testing of the Auxiliary Feedwater Actuation Circuitry On February 20, 1996, during the performance of scoping and scheduling the effort required to respond to NRC Generic Letter 96-01,"Testing of Safety-Related Logic Circuits," Florida Power & Light Company (FPL) identified a potential Technical Specification non-compliance associated with surveillance testing of the AFW [AB] actuation circuitry on steam generator (SG) low-low water level. After review and evaluation of this issue, FPL concluded that the Technical Specification required testing for this circuitry was insufficient and the system was declared inoperable. The evaluation supporting this conclusion was completed at approximately 9:00 am on February 22, 1996.

The concern identified was that not all three (3) combinations of the 2/3 logic for the Low-Low Level SG Level Auxiliary Feedwater (AFW) start signal are verified in Plant Procedure 3/4-0SP-075.4, "Auxiliary Feedwater Auto-Start Test". In accordance with Table 4.3-2, Item 6.a and Section 1.2 of the Technical Specifications, "each possible interlock logic state" shall be tested when performing the "Actuation Logic Test". A review of other applicable Operations and Maintenance Plant Procedures determined that the required testing was not performed. Therefore, the subject surveillance requirement was not satisfied and Section 4.0.3 of the Technical Specifications was applicable. Technical Specification 4.0.3 allows 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for completion of a missed surveillance. The test was completed successfully at approximately 10:15 pm on February 22, 1996, for both units. Although AFW has four other auto-start signals [JE:RLY] (Loss of offsite power (LOOP), safety injection (SI), ATWS Mitigating System Actuation circuitry (AMSAC), SG Feedwater Pump Trip), credit is taken for Low-Low SG Level as the primary auto-start signal for several plant accident analyses.

2. Inadequate Surveillance of the 4KV D Bus Clearing On May 24, 1996, during the continuing review of circuit designs in response to Generic Letter 96-01, FPL identified a potential Technical Specification non-compliance associated with surveillance testing of Emergency Diesel Generator (EDG) [EK:dg] verification of bus stripping and automatic closure of the EDG breaker [EK:bkr] within 15 seconds of the test signal. Four breaker contacts [EA:52b] per train, associated with the safety-related swing 4KV switchgear [EA:swgr], have not been tested as part of any periodic surveillance. Assuming all four of the untested contacts were in a failed condition, a single active failure could result in a failure of both EDGs to automatically load their respective safety busses during a loss-of-offsite power (LOOP) ~

The contacts in question are part of the bus clear permissive signal to allow the EDG output breaker to close. The contacts are redundant pairs which signal that the swing 4KV bus is being powered from tQe opposite train. For example, the contacts in the bus clear logic for the 3A EDG are closed when the swing 4KV bus is powered from Train B.

Periodic surveillances to verify that the busses strip and the EDG output breaker closes have been performed with the swing 4KV bus aligned to the train being tested, to verify that the swing bus loads will strip and provide a proper bus clear signal. Surveillances have

LICENSEE T REPORT (LER) TEXT C<IEUATIOE FACZLZTY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-02 3 OF 10 not been performed with the swing 4KV bus aligned to the train opposite that being tested.

II. CAUSE OF THE EVENTS Root Cause The root cause of the events was inadequate surveillance procedures.

III. ANALYSIS OF THE EVENTS Inadequate Surveillance Testing of the Auxiliary Feedwater Actuation Circuitry Design and Licensing Bases Design Bases The Turkey Point AFW System is a shared system between Units 3 and 4.

It uses secondary steam to drive three AFW pump turbines which supply feedwater to the steam generators during transients when the normal feedwater source is not available. The system consists of two independent trains each capable of providing required flows to both units. Control and motive power to the AFW valve's is provided by either Vital AC or DC. The required AFW flow of approximately 125 gpm/unit must be delivered within three minutes of the generation of an RPS/ESFAS signal for LOOP or Small Break LOCA. This time is an assumption for the analyses used to establish the minimum flow requirement.

The control logic governing AFW operation is such that a variation in specific plant parameters, beyond the setpoint limits, results in a signal to open the steam supply valves on the affected units(s). As configured, the AFW system automatically initiates as a result of any one of the following:

1) SI actuation

2) 2 out of 3 Low-Low water level in any one of the three SGs

3) Loss of both steam generator feedwater pumps (SGFP)

4) Bus Stripping (Bus stripping from one bus opens two out of three AFW steam motor operated valves (MOVs))

5) ATWS Mitigating System Actuation circuitry Licensing Bases Technical Specifications Surveillance requirements of the AFW System that apply to auxiliary feedwater actuation are provided in Technical Specification Section 4.7.1.2.1. as stated below:

"The required independent auxiliary feedwater trains shall be demonstrated OPERABLE:

LXCENSEE T REPORT (hER) TEXT CCXNUATXON FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-02 4 OF 10 a ~

b. At least once per 18 months by:

1) Verifying that each automatic valve in the flow path actuates to its correct position upon receipt of each Auxiliary Feedwater Actuation test signal, and

2) Verifying that each auxiliary feedwater pump receives a start signal as designed automatically upon receipt of each auxiliary Feedwater Actuation test signal."

Surveillance requirements for Engineered Safety Features Actuation System (ESFAS) Instrumentation that apply to auxiliary feedwater actuation are provided in Technical Specification Section 4.3.2.1 as stated below:

1 "Each ESFAS instrumentation channel and interlock and the automatic actuation logic and relays shall be demonstrated OPERABLE by performance of the ESFAS Instrumentation Surveillance Requirements specified in Table 4.3-2".

Item 6a of Technical Specification Table 4.3-2, requires that the automatic actuation logic and actuation relays of the auxiliary feedwater system have an ACTUATION LOGIC TEST performed each refueling outage.

The definition of an ACTUATION LOGIC TEST is provided in Technical Specification Section 1.2 as stated below:

"An ACTUATION LOGIC TEST shall be the application of various simulated input combinations in conjunction with each possible interlock logic state and verification of the required logic output. The ACTUATION LOGIC TEST shall include a continuity check, as a minimum, of the output device".

If a Technical Specification Surveillance Requirement is not performed, Surveillance Requirement 4.0.3 must be met. It states Ehe following:

"Failure to perform a Surveillance Requirement within the allowed surveillance interval, defined by Specification 4.0.2, shall constitute noncompliance with the OPERABILITY requirements for a Limiting Condition for Operation. The time limits of the ACTION requirements are applicable at the time it is identified that a surveillance requirement has not been performed. The ACTION requirements may be delayed for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to permit the completion of the surveillance when the allowable outage time limits of the ACTION requirements are less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Surveillance requirements do not have to be performed on inoperable equipment".

Surveillance Requirement 4.0.2 that is referred to above states:

"Each Surveillance Requirement shall be performed within the specified time interval with a maximum allowable extension not to exceed 25% of the surveillance interval".

LICENSEE 1NT REPORT (LER) TEXT CINUATION FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-02 5 OF 10 AFW Auto Start Logic Testing The AFW automatic start logic consists of 5 actuation signals: Bus Stripping, SI, Trip of SGFPs, AMSAC, and Low-Low Level on any SG. In order to determine if Technical Specification surveillance requirements of the AFW actuation logic was being satisfied, schematic and logic diagrams of the logic circuitry were compared against the associated test procedures to ensure all logic and parallel signal paths were being tested properly. The following summarizes the results of this design versus testing review.

The logic associated with Bus Stripping and SI is verified by simulating the actual process signals (i.e. Loss of 4KV Voltage, Hi-Hi Containment Pressure) during Integrated Safeguards Testing procedures 3/4-OSP-203.1,2.

The Trip of SGFPs logic is satisfied when both pump breakers are open and either pump control switch has been placed in the start position and returned to mid position. Therefore, this logic actuated AFW when either/both SGFPs have tripped or one has tripped while the other has been manually stopped. The various combinations of switch positions are tested properly as well as independent actuation of each train of AFW circuitry by procedure 3/4-OSP-075.4.

The AMSAC auto start logic is not required to be 'tested by Technical Specifications. However, the AMSAC logic is tested via procedure 3/4-OSP-093.1 as directed by Operations or following design modifications or maintenance activities.

The Low-Low S/G Level logic for AFW start is derived from the same logic relays used in the Reactor Protection System (RPS) to initiate reactor trip. Operation of these logic relays'oils and contacts which generate a reactor trip are tested on a monthly basis by procedure 3/4-0SP-049.1.. However, the relay contacts used for the AFW start logic are not verified since its test relay contacts are wired in series to block AFW actuation. As a result, the AFW start logic is tested separately (on an 18 month basis) by procedure 3/4-OSP-075.4 by placing the Low-Low Level instrument loop bistable switches in test in order to actuate the logic relays. However, only channels 1 & 2 bistables are actuated on each S/G to simulate the Low-Low S/G Level signal. In order to properly verify the 2/3 relay logic matrix, channels 1 & 3 and 2 & 3 bistables should also be actuated.

ANALYSIS The Updated Final Safety Analysis Report (UFSAR) Chapter 14 accident analysis credits AFW for mitigation of several events. The following AFW related transients were reviewed: 1) Loss of Normal Feedwater Flow, .2) Loss of Non Emergency AC to Plant Auxiliaries,. 3) Steam Generator Tube Rupture (SGTR), 4) Main Steam Line Break, and 5) Small Break LOCA. None of these transients rely on AFW initiation from bus stripping. The analyses assume .

AFW System actuation on SI or Low-Low SG Water Level.

The Loss of Normal Feedwater Flow transient is analyzed in Section 14.1.11 of the UFSAR. A loss of normal feedwater results in a reduction in capacity of the secondary system to remove the heat generated in the reactor core.

The analysis of the transient described in this section demonstrates that the AFW system is capable of removing the stored and residual heat, thus preventing either overpressurization of the Reactor Coolant System or loss of water from the reactor core, and returning the plant to safe condition.

1 ZCENSEE NT REPORT (LER) TEXT C'ZNUATZON FACILiTY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-02 6 OF 10 The UFSAR analysis assumes that AFW flow is initiated three (3) minutes following a start signal on Low-Low SG level. This event specifically credits AFW initiation on Low-Low SG level. As a backup, the operator would also be expected to manually initiate AFW on a reactor trip at Step 7 of 3/4-EOP-E-O, which is one of the memorized immediate operator steps.

The Loss of Non-emergency A-C Power to Plant Auxiliaries is analyzed in Section 14.1.12 of the UFSAR. The accident of record assumes that AFW is initiated on Low-Low SG level. However, because this event also assumes a LOOP, both main feedwater pumps will trip on undervoltage and cause initiation on the main feed pump breakers opening. AFW will also be an AFW initiated on bus stripping for this event. Accordingly, the AFW Actuation System (AFAS) testing inadequacies did not affect plant response to this event.

The SGTR transient is analyzed in Section 14.2 4 of the UFSAR. AFW is initiated for the SGTR on a SI signal. Accordingly, the AFAS testing inadequacies did not affect plant response to this event.

The Main Steam Line Break transient is analyzed in Section 14.2.5 of the UFSAR. AFW is initiated for the steam line break on a SI signal.

Accordingly, the AFAS testing inadequacies did not affect plant response to this event.

The Small Break LOCA is analyzed in Section 14.3.2.2 of the UFSAR. AFW is initiated for the small break LOCA on a SI signal. Accordingly, the AFAS testing inadequacies did not affect plant response to this event.

Based on the preceding, the only event where AFW automatic initiation is not demonstrated by the conduct of the surveillance testing is the Loss of Normal Feedwater event resulting in initiation on Low-Low SG level.

Additionally, a normal reactor trip is expected to result in AFW initiation on Low-Low SG level.

This event is reportable under the requirements of 10 CFR 50.73(a)(2)(i)(B) .

Safety Significance and Operability Assessment As defined by 10 CFR 50.36, Limiting Conditions for Operation (LCO) are "the lowest functional capability or performance levels of equipment required for safe operation of the facility. When an LCO of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the Technical Specifications until the condition can be met."

Implicit in this definition is that the lowest functional capability or performance levels of equipment be maintained assuming any credible single failure. As such, the principle purpose of LCOs is to ensure the preservation of single failure criteria by requiring all redundant components of safety systems be operable. When the required redundancy is not maintained, either due to equipment failure, maintenance, or surveillance testing, action is required within a specified time to shutdown the plant and/or perform actions to ensure a safe condition. This LCO action time is a temporary short term relaxation of the single failure criteria which is consistent with the overall system reliability, probability of the equipment function being required (i.e. LOOP Design Basis Accident occurring) during the specified time, and the safety significance of the inoperable equipment/system.

Also, as defined by 10 CFR 50.36, "Surveillance Requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that the facility

LICENSEE T REPORT (LER) TEXT C<+IEUATIOE FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO ~

TURKEY POINT UNIT 3 05000250 96-004-02 7 OF 10 operation will be within safety limits, and that the limiting conditions of operation will be met". This states that Surveillance Requirements support meeting LCOs.

GL 91-18 provides guidance on actions to be taken when a Technical Specification Surveillance is missed. The GL refers to the Standard Technical Specifications version of Surveillance Requirement 4.0.3 and which forms the basis for Surveillance Requirement 4.0.3 contained in the Turkey Point Technical Specifications. The GL version of 4.0.3 states in part that:

"Failure to perform a Surveillance Requirement within the specified time interval shall constitute a failure to meet the OPERABILITY requirements for a Limiting Condition of Operation...".

Surveillance Requirements and the "Action Logic Test" definition imply or intend that all signal/actuation paths be tested. The review of 3/4-OSP-075.4 showed that the signal/actuation paths for the steam generator low-low level AFW initiation signal was only tested for one of three paths on each steam generator. This is inconsistent with the Turkey Point Plant testing that is performed on similar logic for both the RPS and ESFAS. Based on this difference, the existing testing performed was not considered sufficient to meet the intent of the Technical Specification surveillance, and Technical Specification 4.0.3 was entered and the required actions met.

Additional testing that insured compliance with the Technical Specification surveillance requirements was implemented without a plant shutdown.

While GL 91-18 and the Technical Specifications provide specific criteria to be followed when a surveillance is not met, there is a strong case that demonstrates that operability of the AFW system and its actuation logic was maintained even though surveillance testing had some inadequacies.

active components (e.g., relays, bistables) have been shown by existing All

~ testing to remain operable and capable of changing state. By testing of the RPS, the subject relays and contacts for the RPS have been shown to be operable. The primary aspect of testing that had not been met was showing those contact points for AFW actuation for the remaining two out of three logic points are made up when required. These relays and their associated contacts are located in the Cable Spreading Room, which is a controlled environment. The contacts are open during normal operation, and are not subject to welding or other phenomenon that would result in their degradation. It is considered highly improbable that one set of relay contacts would remain functional and another set would fail to function.

Accordingly, on this basis, there was a high level of confidence that the untested portions of the steam generator low-low level AFW actuation circuitry were functional and capable of performing their design functions.

Probabilistic Safety Assessment An analysis was performed to determine the change in Core Damage Frequency (CDF) for failure of the AFW system to actuate in the event of a low-low level in the steam generators, The analysis increased the AFW pump common cause failure to start by a factor of one hundred to account for the actuation failure and assumed the probability of the operator's failure to turn on the AFW pumps while carrying out the Emergency Operating Procedure as 1.50E-02. The calculated CDF change is 7.00E-07/ yr. This is considered not risk significant based on the criterion of risk significance for permanent plant changes in the Electric Power Research Institute Probabilistic Safety Assessment Applications Guide.

LXCENSEE T REPORT (LER) TEXT C(QXNUATXON FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-02 8 OF 10

2. Inadequate Surveillance of the 4KV D Bus Clearing Design Bases The Emergency Power System provides AC power to Turkey Point Units 3 and 4 station loads to assure the capability for a safe and orderly shutdown, as well as continued maintenance of the units in a safe condition under the following circumstances:

1) Normal operating modes of the units,

2) Loss of Offsite Power (LOOP),

3) Design basis accident on one unit requiring mitigation of accident conditions and subsequent safe shutdown of the unit, together with achieving and maintaining the non-accident unit in hot shutdown condition,

4) Postulated fires requiring shutdown of the units with or without availability of offsite power,

5) 10 CFR 50.63 Station Blackout events.

Four onsite EDGs are provided with two EDGs dedicated to each unit.

The EDGs supply on-site power in the event of a LOOP. Although dedicated to a specific unit, each of the EDGs supplies loads which are common to both units safety injection pumps [BQ:p) and vital DC battery chargers (e.g., [EJ:byc]). The A EDGs feed the A 4KV busses and the B EDGs feed the B 4KV busses of their respective units. Also,,

the D 4KV bus of each unit is a swing bus, which can be powered either of its respective A or B 4KV busses. To enable the EDG by output breakers to automatically close on to the 4KV busses, all load breakers connected to the 4 KV busses must be opened (bus stripping and clearing). Breakers supplying the required equipment can then be sequentially closed with sufficient time delay between breaker closures to prevent overloading the EDGs.

Technical Specifications Surveillance requirements of the Electrical Power Systems that apply to the EDGs are provided in Technical Specifications Section 4 '.1.1.2. In the event of a loss-of-offsite power, the applicable surveillance requirements are provided in Technical Specification Sections 4.8.1.1.2.g.4.a and b, and 4.8.1.1.2.g.6.a and b, as discussed below:

Each diesel generator shall be demonstrated OPERABLE:

g. At least once per 18 months, during shutdown (applicable to only the two diesel generators associated with the unit):

4) Simulating a loss-of-offsite power by itself, and:

a) Verifying deenergization of the emergency busses and load shedding from the emergency busses, and b) Verifying the diesel starts on the auto-start signal, energizes the emergency busses with any permanently connected loads within 15 seconds,....

LXCENSEE T REPORT (LER) TEXT C(INURTION FACZL1TY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 05000250 96-004-02 9 OF 10

6) Simulating a loss-of-offsite power in conjunction with an ESF Actuation test signal, and:

a) Verifying deenergization of the emergency busses and load shedding from the emergency busses; b) Verifying the diesel starts on the auto-start signal, energizes the emergency busses with any permanently connected loads within 15 seconds, If a Technical Specification Surveillance Requirement is not performed, Surveillance Requirement 4.0.3 must be met.

following.

It states the "Failure to perform a Surveillance Requirement within the allowed surveillance interval, defined by Specification 4.0.2, shall constitute noncompliance with the OPERABILITY requirements for a Limiting Condition for Operation. The time limits of the ACTION requirements are applicable at the time it is identified that a surveillance requirement has not been performed. The ACTION requirements may be delayed for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to permit the completion of the surveillance when the allowable outage time limits of the ACTION requirements are less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Surveillance requirements do not have to be performed on inoperable equipment".

Surveillance Requirement 4.0.2, referred to above, states:

"Each Surveillance Requirement shall be performed within the specified time interval with a maximum allowable extension not to exceed 25% of the surveillance interval".

Bus Clearing Signal The bus clearing signal is a required permissive for automatic closure of the diesel breaker in order to satisfy the above surveillance requirements. There are two redundant bus clearing relay circuits train for reliability purposes. Only one of the two bus clearing per relays is required to pick up as a permissive for the diesel breaker closure permissive. In addition, there is a contact for both the "D" 4KV bus supply and incoming breakers in parallel for each of the bus clearing relay circuits (see attached sketch) .

Technical Specification surveillance requirements 4.8.1.1.2.g.4.b and 4.8.1.1.2.g.6.b are intended to be tested by procedures 3/4-0SP-203.1 (Train A) and 3/4-0SP-203.2 (Train B). Since Train A and B are tested independently, the D 4KV bus is aligned to the train being tested in order to satisfy the surveillance criteria with respect to stripping and loading of the intake cooling water (ICW) [BI:p] and component cooling water (CCW) pumps [CC:p] powered from the D 4KV bus. However, with the D 4KV bus aligned to the train under test, only one path in the bus clear relay circuit is tested., The two bus clearing relay circuit paths for the D 4KV bus aligned to the opposite train are not tested by the above plant procedures.

LICENSEE T REPORT (LER) TEXT C INUNCTION FACILITY NAME DOCKET NUMBER LER NUMBER PAGE NO.

TURKEY POINT UNIT 3 ~ 05000250 96-004-02 10 OF 10 Safety Significance Assuming that the contacts which are not tested are not operational, a single failure (e.g. CCW pump breaker or ICW pump breaker fails to trip) will result in a failure of both EDGs to automatically load their respective safety busses during a LOOP. Note that there are two redundant bus clearing circuits per train for reliability purposes.

Four contacts would have to fail for the non-tested circuit path not to function. In addition, the bus tie breakers are interlocked such that the supply breaker cannot be closed when the incoming breaker is open. Operating procedures require both the supply and incoming breaker be open for bus isolation. Therefore, the probability of concurrent failure of the four contacts is extremely low.

The two bus clearing relay circuit paths for the D 4KV bus aligned to the opposite train were tested successfully on May 24, 1996, therefore, the Technical Specification Sections 4.8.1.1.2.g.4 and 4.8.1.1.2.g.6 surveillance requirements were met.

IV. CORRECTIVE ACTIONS Inadequate Surveillance Testing of the Auxiliary Feedwater Actuation Circuitry

1. The untested portion of the Low-Low S/G Level AFW start logic was tested successfully on February 22, 1996.

2. Plant Procedures 3-0SP-075.4 and 4-0SP-075.4 will be revised to include all combinations of the 2/3 low-low steam generator level logic prior to the next performance of this surveillance.

2. Inadequate Surveillance of the 4D 4KV Bus Clearing The two bus clearing relay circuit paths for the D 4KV bus aligned to the opposite train were tested successfully on May 24, 1996.

2. Plant procedures will be revised to test all possible paths of the bus clearing relay circuits prior to the next performance of this surveillance.

V. ADDITIONAL INFORMATION A. Similar Events: None B. Additional Information: None EIIS Codes are shown in the format [EIIS SYSTEM: IEEE component function identifier, second component function identifier (if appropriate)j.

A BUS B BUS NOTE:

ONE OUT OF TWO BUS CLEAR lO +

RELAYS PER TRAIN REQUIRED nO I

TO PICKUP AS A PERMISSIVE O O

FOR EOG BREAKER CLOSURE. I o

0 BUS B CONTACTS IF BREAKER IS hl OPEN, CONTACT IS CLOSED ICW CCW PUMP C PUMP C TESTED PATH (TYPICAL) s ~

BUS BUS BUS BUS CLEAR CLEAR CLEAR CLEAR RELAY 1 RELAY 2 RELAY 1 RELAY 2 TRA1N A TRA(N B