ML18059A964

LER 94-008-00:on 940329,discovered That Some Class 1E Circuits Were Not Isolated from non-Class 1E Circuits.Caused by Deficiencies in Installing Cables.Procedures Revised.W/ 940428 Ltr

ML18059A964
Person / Time
Site:	Palisades
Issue date:	04/28/1994
From:	Roberts W, Rogers D CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
LER-94-008, LER-94-8, NUDOCS 9405020290
Download: ML18059A964 (5)

Text

a David W. Rogers Plant Safety and Licensing Director .

. PDWERINli .

t/llCHlliAN'S PROliRESS Palisades Nuclear Plant

27780 Blue Star Memorial Highway, Covert, Ml 49043

~pril 28., I 994 Nuclear Regulatory Commission Document Control Desk Washington, D. C. 20555 DOCKET 50-255 - LICENSE DPR PALISADES PLANT-LICENSEE EVENT REPORT 94-008 - LACK OF SEPARATION OR ISOLATION BETWEEN IE AND NON-IE CIRCUITS.

licensee Event Report (LER)94-000 is attached. This event is reportable in*

accordance with I~CFR50.73.(a)(2)(ii)(B) as a condition outside the design basis of .the plant. This LER will be s~pplemented~

µviw-~.

David W. Rogers Plant Safety and.Licensing.Director CC Administrator, Region III, USNRC

• NRC Resident Inspector - Paltsades Attachment 9405020290-940428 PDR ADOCK 05000255 S

• PDR A CMS ENE'RGY COMPANY

NRC Form 388 U.S. NUCLEAR REGULATORY COMMISSION (9*931 . APPROVED OMB NO. 316~104 EXPIRES: 8/31 /86 LICENSEE EVENT REPORT (LERI FACILITY NAME C1I DOCKET NUMBER 121 PAGE (31 Palisades Plant 0 5 0 0 .o 2 5 5 OF 0 4 TITLE 141 LACK OF SEPARATION OR ISOLATION BETWEEN 1E AND NON-1 E CIRCUITS.

EVENT DATE !61 LER NUMBER 181 REPORT DATE !Bl OTHER FACILITIES INVOLVED 181 REVISION FACILITY NAMES MONTH DAY YEAR YEAR NUMBER MONTH DAY YEAR NIA 0 6 0 0 0 0 NIA 3 2 9 9 4 9 4 0 0 8 00042894 0 6 0 0 0 THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR I: IChtlck ono °'"'°"'of tM following/ 1111 OPERATING MOOE 191 N 20.402!bl 20.4061cl 60.731*112Hivl 73.711bl 20 .406l*ll1 Hil 60.3Blcll11 60.731*1121M 73.71(cl 20.406(*1!11fiil 60.38(cll21 60.731*112llviil OTHER (Specify in Abstr..:t 20.406(*111 lfiiil 60.731*112Hil 60.73(1)(211viiillAI below and in Text, 20.4061*111 llivl x 60. 7 31*112Hiil 60. 7 3!1112llviiillBI NRC Form 3BBAI 20.4061*1111M 60. 7 3(*11211iiil 60.731*11211xl LICENSEE CONTACT FOR THIS LER (121 NAME TELEPHONE NUMBER AREA CODE William L. Roberts, Staff Licensing Engineer 6 6 7 6 4 8 9 3 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT 1131 1--~--.~~~..-~~~~~ .......~~~~~~"'T""~~~~

MANUFAC* REPORTABLE MANUFAC* REPORTABLE CAUSE SYSTEM COMPONENT TURER TO NPROS CAUSE SYSTEM COMPONENT TUR ER TO NPROS SUPPLEMENTAL REPORT EXPECTED (141 MONTH DAY YEAR EXPECTED SUBMISSION YES Uf ye., campier. EXPECTED SUBMISSION DA TEI NO DATE 1161 0 5 7 9 4 x

ABSTRACT UJm1t 11> 1400_.,_,.._ I.e .* -imltr.ly rdrrtttn .urg1e-_,,. typewritten lineal 1181 On March 29 and 30, and on April 9, 1994, with the plant in cold shutdown, it was discovered in four separate areas that there was no separation of cables serving Class 1E loads or no isolation of circuits serving Class 1E and non-Class 1 E systems. These discoveries were made in the course of investigations performed during the current maintenance outage. Subsequently, six additional discrepancies were identified. These will be addressed in a supplemental repo~.

Review of each cable separation problem included a probability analysis that concluded there was a low risk of cable fault in the present configuration. However, given that each discrepancy identified to date was outside the plant's design basis and IEEE 279-1971, it was concluded that a variance from design basis had occurred.

Causes for. the deviations from separation or isolation criteria identified to date include inadequate design reviews and design installation controls utilized at the time of either plant construction or subsequent modifications during the 1980s time frame that added cabling or additional control circuits to the plant.

All of the separation or isolation issues will be resolved prior to heat up for the current maintenance outage. Longer term corrective actions include full utilization of the modification review process which has been enhanced, providing training to reviewers based on specific separation or isolation modification guidelines previously developed, and developing accurate schematics for affected systems. This report addresses the initial four discoveries.

NRC Form 388A U.S. NUCLEAR REGULATORY COMMISSION 18-113) APPROVEO OMB NO. 3150-0104 EXPIRES: 8/31185 LICENSEE EVENT REPORT °(LERI TEXT CONTINUATION FACILITY NAME l1l DOCKET NUMBER 12) LER NUMBER 131 PAGE 14)

SEQUENTIAL REVISION YEAR NUMBER NUMBER Palisade.s Plant 0500025594 0 0 8 0 Q 0 2 OF 0 4 Event Des9ription:

On March ~9 and 30, and April 9, 1994, with the plant in cold shutdown, it was discovered that some Class 1E (safety-related) circuits were not isolated from non-Class 1E circuits. Requirements for electrical independence and isolation are defined in the Palisades FSAR, Chapters 7 and 8, and IEEE 279-1971. These require that non-Class 1 E circuits be isolated from Class 1E circuits so that a fault in a non-Class 1E circuit would not affect the Class 1E circuit. The discrepancies were identified in circuits for the Reactor Protection System (RPS) and Engineered Safety Features (ESFI on March 29 and March 30, and on the Subcooled Margin Monitor (SMMI on April 9. The plant was in cold shutdown at the time of discovery of the deficiencies and has been shut down since. Since discovery, these deficiencies have had no impact the operational safety of the plant.

Low Temperature Overoressure Protection: The first discovery on March 29, 1994, involved a lack of isolation between Class 1E Primary Coolant System (PCS) temperature transmitters that provide inputs to the Reactor Protection System (RPS) via the Thermal Margin Monitor (TMMI *and the Class 1E Low Temperature Overpressure Protection (LTOP) system. These circuits were not isolated from non-Class 1E PCS temperature indicators used for plant control. The LTOP is considered to have been outside its design basis since its installation in 1989.

Thermal Margin Monitor: Again on March 29, it was found that four channel circuit independence was not provided between the safety related *upper* and *1ower" nuclear power range signals nor between the safety related TMM circuits. Redundant channels in both the nuclear power range indication system and the TMM systems are routed through the same raceway. In addition, each of these systems is connected to both the non-1 E Critical Function Monitoring System (CFMS) and plant data logger without adequate Circuit 1E to non-1 E isolation An analysis of the effects of both discoveries lead to the conclusion that the TMM had been outside the plant's separation and isolation design basis since the TMM was installed in 1988.

Inverter Power Cables: As a result of ongoing drawing reviews and physical walkdowns of systems, another discrepancy was identified on March 30, 1994. The power cables from inverters to RPS and ESF instrument loops were not separated in accordance with Palisades design basis cable separation criteria. Cables for "right" channel inverters Y20 and Y40 were routed together in the same cable tray, as were cables for "left" channel inverters Y10 and Y30. This condition has existed since original plant construction.

Subcooled iMarain Monitors: On April 9, in the course offurther examinations prompted by the previous discoveries, plant personnel identified that power feeds to the Class 1E Subcooled Margin Monitors (SMMsl were not isolated from power feeds to non-Class 1E devices. The SMMs had been installed in 1980 to meet requirements of NUREG 0737 Item 11.F.2. One requirement was that primary and backup display channels should be electrically independent,, supplied from Class 1E sources and physically separated from other devices per Reg Guide ~ .75.

In each case, operability determinations were made and .the appropriate equipment was declared inoperable. Those cases which required resolution prior to startup from the current maintenance *outage were identified. With the plant in cold shutdown at the time of discovery, none of the affected systems was required to be operable.

Because each condition identified to date showed that the plant was outside its design basis, they are reportable in accordance with 10CFR50.73(a)(2)(ii)(B).

Cause Of The Event:

For three of the discrepancies addressed in this report an inadequate or incomplete review of electrical design was made which allowed the circuits to be modified during the 1980s time frame without adequate isolation. These involved the LTOP, TMM and SMM issues. A lack of engineering design guides to define standards, methods and examples needed to achieve isolation or separation 'and a lack of composite schematic diagrams for use by engineering contributed to the problem.

In the case of inverter power cables which were not properly separated, the cause was traced back to deficiencies in installing cables in accordance with design requirements during the initial construction phase of the plant.

I

NRC Form 388A U.S. NUCLEAR REGULATORY COMMISSION 19-831 APPROVED OMB NO. 3160-0104 EXPIRES: B/31 /86 LICENSEE EVENT REPORT (LERI TEXT CONTINUATION FACILITY NAME (1) DOCKET NUMBER 121 LER NUMBER 131 PAGE 141 SEQUENTIAL REVISION YEAR NUMBER NUMBER Palisades Plant

• 6 6 0 0 0 2 6 6 9 4 0 0 8 Q Q 0 3 OF 0 4 Analvsis of the Event 1

In the first two cases where there was a deviation in separation criteria for the IMM and TMM/LTOP, a probability analysis was performed. Though a cable fault had a low probability of occurring, proper cable separation and isolation was not provided and a single failure could affect the required function. The TMM, therefore, was outside its design basis since installation in 1988, and the LTOP .system outside the design basis since installation in 1989.

When the inadequate separation of power cables from inverters was discovered, the discrepancy was reviewed for operability impact. The loads for the four channel RPS and ESF systems were declared inoperable. These included RPS, Containment High Pressure ICHP), Containment High Radiation (CHRI. Auxiliary Feedwater Actuation Signal (AFAS), S/G Low Pressure, Safety Injection Signal (SIS), TMM, and Anticipated Transient Without SCRAM (ATWS), Recirculation Actuation Signal IRAS), lff

• Comparator. Two channel systems such as LTOP and Source Range/Wide Range nuclear instrumenta.tion were not affected and remained operable Plant Technical Specifications require that one SMM channel be operable. If a cable fault occurred and one of the SMMs was lost, the redundant channel would be used and the plant would remain operable without violation of Technical Specifications.

However, since both SMM channels were tied to non-Class 1E equipment, there is the potential that a common mode event could .

impact both channels. The SMMs have been outside their design basis since installation in 1980.

Safetv Significance and Ooerabilitv Low Temoerature Overpressure. Protection: On March 29, 1994, the first discrepancy associated with the issue was identified.

There was a lack of isolation between Class 1E circuits providing input to the Primary Coolant System (PCS) and non-Class 1E circuits for the same system. The impact is analyzed in the plant's FSAR as transient event 15.4.2. Uncontrolled control bank withdrawal at power is bounded and analyzed and a loss of Thermal Margin/Low Pressure (TM/LP) would affect its capability to trip the reactor. However, since the Variable High Power Trip function is not affected, the RPS transient events would be covered and the reactor would trip. For Low Temperature Overpressure Protection, a complete loss of PCS temperature input would result in an alarm in the control room. If the cable fault occurred during plant startup a LTOP actuation would occur. The LTOP system is tested within 31 days prior to rstartup and monthly thereafter. The likelihood of a cable fault occurring within the 31 day period and disabling both channels of LTOP is remote. Other information available to the operator would include pressure inputs, wide range temperatures for the "C" and "D" channels accessible from the SMM microprocessor, and reactor core exit thermocouple indication and recording; all information at the operator's disposal in the control room.

Thermal Margin Monitor: The second event, discovery that the Thermal Margi'n Monitor (TMMI (which is safety related), was not separated from the non-safety related datalogger and the Critical Function Monitoring System (CFMS), is analyzed in the plant FSAR (Transient Event 15.4.21. Uncontrolled control bank withdrawal at power is bounded and analyzed and a loss of Thermal Margin/Low Pressure (TM/LP) would affect its capability to trip the reactor. However, since the variable high power trips (VHPTI is not affected and is also analyzed, the RPS transient events would be covered and the reactor would be tripped.

Inverter Cable Separation: The third deficiency, identified on March 30, 1994, involved a lack of power cable separation from inverters to RPS and ESF instrument loops. Cables for the "right" and "left" channels were installed together rather than separated. Though loss of two RPS channels would not meet Technical Specifications, the remaining two channels would be capable of sensing process conditions and satisfying RPS coincidence logic.

Subcooled Margin Monitors: On April 9, 1994, the Subcooled Margin Monitors (SMM) were declared inoperable when it was found*

that this Class 1E system was powered from the same source as the non-Class 1E feedwater control solenoid valves. In a case where both SMMs are lost, the alarm response procedure requires that the operator manually calculate subcooling margin using pressure and temperature curves or steam tables.

NRC Form 388A U.S. NUCLEAR REGULATORY COMMISSION

~ (9-831 APPROVED OMS NO. 3160-0104 EXPIRES: 8/31186 LICENSEE EVENT REPORT (LERI TEXT CONTINUATION FACILITY NAME 111 DOCKET NUMBER 121 LER NUMBER 131 PAGE 141 SEQUENTIAL REVISION YEAR NUMBER NUMBER 0 5 0 0 0 2 6 5 9 4 0 0 8 Q Q Q 4 OF Q 4 Palisades Plant i

Corrective Actions:

To provid~ higher quality designs, a number of enhancements to the plant's design change program have taken place in recent years. In the early 1990s, modification procedures were revised to more clearly identify separation and isolation requirements. By 1993, engineering guidelines had been developed to identify sp'ecific approaches to implementing effective channel separation and Class 1E to non-Class 1E isolation in the field. These guidelines are now referenced in the plant modification procedures.

Prior to 1994 the plant's modification process was revised to require a multi-disciplinary group review of all safety-related design changes just prior to their release for installation.

During the current maintenance outage an overall review of channel separation and Class 1E to non-Class 1E isolation is being conducted. As part of this review, composite connection diagrams for preferred AC power circuits have been developed. Prior to startup from the current outage, all identified separation and isolation deviations will be resolved. Training of plant personnel regarding the Class 1E to non-Class 1E isolation and associated design guidelines and bases will be conducted as part of technical

• staff training.

Previous Occurrences:

LER 93-006