ML18153A207

LER 97-012-01:on 971028,loss of Power to Latching Mechanism on Several Doors Occurred.Caused by Tripping of Two Breakers in Security Distribution Panel.Reset Affected Breakers Which Restored Power to Security Systems & Affected Doors

ML18153A207
Person / Time
Site:	Surry
Issue date:	01/13/1998
From:	Christian D VIRGINIA POWER (VIRGINIA ELECTRIC & POWER CO.)
To:
Shared Package
ML18153A206	List: ML18153A205 ML18153A207
References
LER-97-012, LER-97-12, NUDOCS 9801210215
Download: ML18153A207 (6)

Text

NRC FORM366 .S. NUCLEAR REGULATORY COMMISSION APPROVED BY 0MB NO. 3150~104 (4-95) EXPIRES 4/30/98 ESTIMATED BURDEN PER RESPONSE TO COMPLY W11H lHIS P.W-IDATORY INFORMATION COLLECTION REQUEST: 50.0 HRS.

REPORTED LESSONS LEARNED ARE INCORPORATED INTO lHE LICENSEE EVENT REPORT (LER) LICENSING PROCESS AND FED BACK TO INDUSTRY. FORWARD COM.1ENTS REGARDING BURDEN ESTIMATE TO lHE INFORMATION AND RECORDS P.W-IAGEMENT BRANCH (T-8 F33),

U.S. NUCLEAR REGULATORY COM.11SSION, WASHINGTON. DC (See reverse for required number of digits/characters for each block) 20555-0001. AND TO lHE PAPERWORK REDUCTION PROJECT (3150-010.C), OFFICE OF MANAGEMENT AND BUDGET.

WASHINGTON, DC 20503.

FACILITY NAME (1) DOCKET NUMBER (2) PAGE(3)

SURRY POWER STATION , Unit 1 05000 -280 1 OF6 TITLE (4)

EQ Unanalyzed Condition/Outside App. R Desion Basis Due to Unlatched Doors EVENT DATE (5) LER NUMBER (6) REPORT DATE (7) OTHER FACILITIES INVOLVED 8)

SEQUENTIAL REVISION FACILITY NAME DOCUMENT NUMBER MONTH DAY YEAR YEAR MONTH DAY YEAR NUMBER NUMBER Surry Power Station, Unit 2 05000-281 FACILITY NAME DOCUMENT NUMBER 10 28 97 97 -- 012 -- 01 1 13 98 05000-OPERATING THIS REPORT IS SUBMITIED PURSUANT TO THE REQUIREMENTS OF 10 CFR §: (Check one or more) (11)

MODE (9) N 20.2201(b) 20.2203(a)(2)(v) 50.73(a)(2)(i) 50. 73(a)(2)(viii)

POWER 20.2203(a)(1) 20.2203(a)(3)(i) X 50.73(a)(2)(ii) 50. 73(a)(2)(x)

LEVEL (10) 100  % 20.2203(a)(2)(i) 20.2203(a)(3)(ii) 50. 73(a)(2)(iii) 73.71 20.2203(a)(2)(ii) 20.2203(a)(4) 50.73(a)(2)(iv) OTHER 20.2203(a)(2)(iii) 50.36(c)(1) 50.73(a)(2)(v) Specify in Abstract below 20.2203(a)(2)(iv) 50.36(c)(2) 50.73(a)(2)(vii) or in NRC Form 366A LICENSEE CONTACT FOR THIS LER 12 NAME D. A. Christian, Station Manager I; ; ; ) N ; ; ; : ; ~ ~ l ; e Area Code)

COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT 113\

CAUSE SYSTEM COMPONENT MANUFAC1URER REPORTABLE CAUSE SYSTEM COMPONENT MANUFAC1URER REPORTABLE TONPRDS TONPRDS NA NA NA NA NA SUPPLEMENTAL REPORT EXPECTED (14) EXPECTED MONTH DAY YEAR I YES (If yes. complete EXPECTED SUBMISSION DATE).

IX I NO SUBMISSION DATE ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single-spaced typewritten lines) (16)

On October 27, 1997, tripping of two breakers in a security distribution panel resulted in loss of power to security systems, as well as loss of power to the latching mechanism on several doors, causing the doors to become unlatched. The affected doors have security, EQ, and/or fire protection functions. At the time of occurrence, Unit 1 was at 100% power and Unit 2 was at intermediate shutdown in the process of starting up following completion of a scheduled refueling. Compensatory measures were implemented, as required, including security provisions. It was determined that having multiple EQ doors I

in an unlatched condition simultaneously resulted in an unanalyzed condition because the defined I allowed breach times for the EQ doors assume no simultaneous EQ door breaches. It was also concluded that fire doors being unlatched resulted in being outside the Appendix R design basis because the unlatched doors may not have prevented the spread of a fire from one fire area to others.

A design change to revise the power failure mode on the affected doors from energized-to-latch to I

energized-to-unlatch has been implemented. This report is being submitted pursuant to 10CFRSO. 73(a)(2)(ii)(A) [unanalyzed condition] and 10CFRSO. 73(a)(2)(ii)(B) [outside design basis].

Upon further review, it was determined that a previous situation also resulted in an EQ unanalyzed condition; therefore, this LER supplement is being submitted pursuant to 10CFRSO. 73(a)(2)(ii)(A).

9801210215 980113 PDR ADOCK 05000280 S PDR

NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (4-95)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1) DOCKET LER NUMBER (6) PAGE (3)

YEAR T SEQUENTIAL NUMBER T REVISION NUMBER Surry Power Station Unit 1 05000 - 280 97 -012-- 01 2 OF 6 TEXT (If more space is required, use additional copies of NRC Form 366A) (17)

1.0 DESCRIPTION

OF THE EVENT On October 27, 1997 at 1625 hours0.0188 days <br />0.451 hours <br />0.00269 weeks <br />6.183125e-4 months <br />, with Unit 1 at 100% power and Unit 2 at intermediate shutdown in the process of starting up following completion of a scheduled refueling outage, a loss of power occurred to security systems due to a circuit breaker tripping. Compensatory measures were implemented within ten minutes to address the loss of the security systems. Specifically, the compensatory measures were for the loss of protected and vital area alarms, loss of closed circuit television, loss of radio communications, and loss of eiectronic control access.

Subsequently, the door between the Turbine Building and the Emergency Switchgear Room (2-BS-DR-21) was found unlatched; this door is a non-vital security controlled door, an environmental qualification (EQ) door, and a fire. door. Shortly thereafter, a second door - the door between the Emergency Switchgear Room and the back stairway to the Main Control Room (2-BS-DR-20) - was also found unlatched; this door is a non-vital security controlled door and a fire door. As a result of these doors being found unlatched, other doors were checked. It was discovered that the following doors were also unlatched:

- Between Emergency Diesel Generator Rooms and Turbine Building (1-BS-DR-1, 2-BS-DR-2, 1-BS-DR-3) - non-vital security controlled, EQ, and fire doors

- Between Unit 2 Switchgear Room and Stairway to Control Room (2-BS-DR-45) -

non-vital security controlled and fire door

- Between Unit 2 Cable Spreading Room and Turbine Building (2-BS-DR-49) - non-vital security controlled and fire door The identified doors becoming unlatched was the result. of a second circuit breaker tripping. In the unlatched condition, the fire doors were considered inoperable and, as required by Technical Specifications, posting of fire watches for the affected fire doors was initiated. While in the process of posting the required fire watches, the fire doors identified above were verified to be latching properly, after power was restored by resetting the breakers. Therefore, the fire watches were secured. At that time, it was suspected that the loss of power to the security systems resulted in the doors becoming unlatched.

In parallel with the actions taken from the security and fire protection perspectives, it was determined that an EQ watch was not necessary since a watch would serve no purpose because the doors would not perform their EQ function in an unlatched condition.

However, an assessment of the unlatched doors on EQ was subsequently initiated. On October 28, 1997, it was determined that having multiple EQ doors in an unlatched condition simultaneously resulted in an unanalyzed condition; the unanalyzed condition resulted because the *defined allowed outage times for the EQ doors assume no

. NRC FOR¥ 366A (4-95)

NRG FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (4-95)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1) DOCKET LER NUMBER (6) PAGE (3)

YEAR I SEQUENTIAL NUMBER I REVISION NUMBER Surry Power Station Unit 1 05000- 280 97 -012-- 01 30F6 TEXT (If more space is required, use additional copies of NRG Form 366A) (17)

1.0 DESCRIPTION

OF THE EVENT (continued) simultaneous EQ door breaches. A non-emergency one hour report to the NRC was completed at 1825 hours0.0211 days <br />0.507 hours <br />0.00302 weeks <br />6.944125e-4 months <br /> on October 28, 1997 in -accordance with 10CFR50. 72(b)(1 )(ii)(A).

Additional walkdowns and testing were performed by Engineering and Security personnel to verify the power failure mode of the fire door latches. As the energized-to-latch configuration (i.e., unlatch on loss of power) was identified, fire watches were again posted. Upon further review, it was subsequently determined that fire doors in an unlatched condition due to the loss of power resulted in being outside the 10CFR50 Appendix R design basis. This conclusion was reached because the doors in an unlatched position may not have provided their assumed fire rating and, therefore, may not have prevented the spread of a fire from one fire area to other fire areas.

This report is being submitted pursuant to the requirements of 10CFR50. 73(a)(2)(ii)(A) for being in an unanalyzed condition due to multiple EQ doors in an unlatched condition simultaneously, as well as pursuant to the requirements of 10CFR50. 73(a)(2)(ii)(B) for being outside the 10CFR50 Appendix R design basis due to fire doors being in an unlatched condition as a result of a loss of power.

As a follow-up to the preparation of this LER, further review of a previous situation was conducted in December 1997. Specifically, on August 7, 1997, the door between the Turbine Building and the Emergency Switchgear Room (ESGR) (2-BS-DR-21) would not latch. The door was repaired and subsequently the latch was replaced. In the August time frame, this situation was reviewed and determined to not be reportable because the 1997 cumulative allowed breach duration for door 2-BS-DR-21 remained less than that allowed by the EQ program. Upon further review, it was determined that during the du-..,

repair an assumption in the defined allowed breach times for EQ doors had not been implemented; the specific assumption that had not been implemented was the requirement to close door 1-BS-DR-18 (between the Units 1 and 2 ESGRs) when door 2-BS-DR-21 is not able to be latched. This situation also resulted in an EQ unanalyzed condition and this LER supplement is being submitted pursuant to 10CFR50. 73(a)(2)(ii)(A).

2.0 SIGNIFICANT SAFETY CONSEQUENCES AND IMPLICATIONS The loss . of power to the door latching mechanisms existed for a short duration (i.e., approximately 90 minutes). During this short period of time, the unlatched doors would not have performed their EQ function; similarly, the unlatched doors may not have provided their assumed fire rating and, therefore, may not have prevented the spread of a fire from one fire area to other fire areas. However, a condition requiring the doors to NRC FORM 366A (4-95)

NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (4-95)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1) DOCKET LER NUMBER (6\ PAGE (3)

YEAR I SEQUENTIAL NUMBER I REVISION NUMBER Surrv Power Station Unit 1 05000 -280 97 -012-- 01 4 OF 6 TEXT (If more space is required, use additional copies of NRC Form 366A) (17) 2.0 SIGNIFICANT SAFETY CONSEQUENCES AND IMPLICATIONS (continued) perform their EQ or fire protection function did not occur. Therefore, this incident did not result in a condition adverse to nuclear safety, and the health and safety of the public were not affected.

3.0 CAUSE OF THE EVENT The loss of power to the security systems was the result of the tripping of one of the breakers in a security distribution panel in the Central Alarm Station (CAS). The identified doors becoming unlatched was the result of the tripping of a second breaker in the same CAS panel. Interviews with Security and Operations personnel revealed that the breakers tripped near the completion of the monthly periodic test (PT) being performed on the security diesel generator. The breaker trips are believed to have occurred when the alternate AC input to the inverter transferred from the diesel generator to the normal power source. Engineering has evaluated the breaker trips. It is recognized that the capacity of the breaker that resulted in the loss of power to the security systems needs to be increased.* The second breaker affecting the doors is believed to be near its design loading.

Related to the August 7, 1997 door repair, the reason the breach time assumption was not implemented is because the assumptions have not been effectively communicated, nor have they been proceduralized. The process used in the past to implement the breach time assumptions was to include them in an EQ Engineering Evaluation that was a part of the work order package. On the August 7, 1997, the EQ Engineering Evaluation assumptions (i.e., compensatory measures) were not implemented because it was believed that the evaluation did not apply to the repair activities.

4.0 IMMEDIATE CORRECTIVE ACTION(S)

Upon the loss of power to the security systems, the Security staff implemented compensatory measures within ten minutes. Specifically, the compensatory measures were for the loss of protected and vital area alarms, loss of closed circuit television, loss of radio communications, and loss of electronic control access. These compensatory measures remained in place until power was restored and testing was performed by Security to verify the operability of the security systems.

Upon recognition of fire doors being in the unlatched condition and, therefore, considered inoperable, posting of fire watches for the affected fire doors was initiated, as required by Technical Specifications. While in the process of posting the required fire watches, the fire doors identified above were verified to be latching properly. Therefore, the fire watches were secured.

NRC FORM 366A (4-95)

" rr==============l NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (4-95)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1) DOCKET LER NUMBER (6) PAGE (3)

YEAR I SEQUENTIAL NUMBER I REVISION NUMBER Surrv Power Station Unit 1 05000 - 280 97 -012-- 01 50F6 TEXT (If more space is required, use additional copies of NRC Form 366A) (17) 4.0 IMMEDIATE CORRECTIVE ACTION(S) (continued)

The breakers in the affected CAS panel were reset, restoring power to the security systems and to the affected doors.

An assessment of the unlatched doors on EQ was initiated when it was determined that an EQ watch was not necessary since a watch would serve no purpose because the doors would not perform their EQ function in an unlatched condition.

As a result of the further review related to this LER, information regarding EQ door requirements was communicated to on-shift personnel specifying contact with the Station or Corporate EQ Coordinator for direction, as well as summarizing the action required if an EQ door is not capable of providing its EQ function. This information was provided in the interim until the assumptions (i.e., compensatory measures) are proceduralized.

5.0 ADDITIONAL CORRECTIVE ACTIONS On October, 28, 1997, the EQ assessment was completed, and it was concluded that having multiple EQ doors in an unlatched condition simultaneously resulted in an unanalyzed condition; the unanalyzed condition resulted because the defined allowed outage times for the EQ doors assume no simultaneous EQ door breaches. A non-emergency one-hour report to the NRC was completed at 1825 hours0.0211 days <br />0.507 hours <br />0.00302 weeks <br />6.944125e-4 months <br /> on October 28, 1997 in accordance with 10CFRS0.72(b)(1 )(ii)(A).

Additional walkdowns and testing were performed by Engineering and Security personnel to verify the power failure mode of the fire door latches. As the energized-to-latch

. configuration (i.e., unlatch on loss of power) was identified, fire watches were again posted; these fire watches remained in place until modifications were performed. Upon further review, it was determined that fire doors in an unlatched condition due to the loss of power resulted in being outside the 10CFRSO Appendix R design basis; this conclusion was reached because the doors in an unlatched position may not have provided their assumed fire rating and, therefore, may not have prevented the spread of a fire from one fire area to other fire areas.

On November 7, 1997, another PT was performed on the security diesel generator. This PT differs from the monthly PT performed on October 27, 1997 in the way it is initiated (i.e., feeder breaker being opened versus security diesel generator transfer switch placed in test position). Therefore, the PT performed on November 7, 1997 closely resembles a loss of power event that would require operation of the security diesel generator. The November 7, 1997 PT was performed successfully with no breakers tripping. In addition, the scheduled monthly PT was performed satisfactorily with no breakers tripping on November 24, 1997.

NRC FORM 366A (4-95)

$rr==============i NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION

• (4-95)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION.

FACILITY NAME (1) DOCKET LER NUMBER (6) PAGE (3)

YEAR I SEQUENTIAL NUMBER I REVISION NUMBER Surrv Power Station Unit 1 05000 - 280 97 -012-- 01 6 OF 6 TEXT (If more space is required, use additional copies of NRC Form 366A) (17) 6.0 ACTIONS TO PREVENT RECURRENCE A design change package (DCP) was initiated to change the power failure mode for the affected doors from energized-to-latch to energized-to-unlatch. This change in failure mode eliminates the impact of the breaker tripping incident on the Surry Appendix R and EQ Programs because the door latches now lock upon a loss of power, thereby ensuring that the functional requirements for the doors will be met. This DCP has been completed on the affected doors with respect to the non-vital security controlled, EQ, and fire protection functional requirements.

Both breakers that tripped will be replaced.

As a result of the further review of this LER, the assumptions (i.e., compensatory measures) in the allowed EQ door breach times will be proceduralized and communicated to the affected personnel.

7.0 SIMILAR EVENTS None.

8.0 MANUFACTURER/MODEL NUMBER Not applicable.

9.0 ADDITIONAL INFORMATION None.

NRC FORM 366A (4-95)