ML20129H517

Responds to Unresolved Item Noted in Insp Rept 50-341/85-09. Addl Info Supporting Conclusions of Review of Separation of Circuits Encl

ML20129H517
Person / Time
Site:	Fermi
Issue date:	06/10/1985
From:	Jens W DETROIT EDISON CO.
To:	James Keppler NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
References
VP-85-0132, VP-85-132, NUDOCS 8507190215
Download: ML20129H517 (28)

Text

{{#Wiki_filter:y ~ O Wyne H. Jcens Vice President Nuclear Operations FermF2 6400 North Dixie Highway Newport, Michigan 48106 (313) ses-4 t s June 10, 1985 VP-85-0132 Mr. James G. Keppler Regional Administrator Region III U.S. Nuclear Regulatory Commission 799 Roosevelt Road Glen Ellyn, Illinois 60137

Reference:

Fermi 2 Docket No. 50-341 NRC License No. NPF-33

Subject:

Detroit Edison Response Inspection Report 50-341/85009 ig This letter responds to an Unresolved Item described in your ~ Inspection Report No. 50-341/85009. The Unresolved Item .(85-009-01) deals with separation of BOP and divisional /RPS circuits. In a follow-up inspection regarding this item, Detroit Edison was requested to provide additional information.to support conclusions reached in a review performed on these circuits. The enclosed report provides the requested infor-mation. We trust this letter satisfactorily addresses the Unresolved Item. If you have any questions regarding this matter, please contact Mr. Lewis Bregni, (313) 586-5083. Sincerely, cc: P. M. Byron N. J. Chrissotimos M. D. Lynch (NRR-LBl) Faust Rosa (NRR-ICSB) C. C. Williams B. J. Youngblood (NRR-LBl) USNRC, Document Control Desk Washington, D.C. 20555 MIb i ! k 8507190215 850610 PDR ADOCK 05000341 G PDR O

Mr. James G. Keppler June 10, 1985 VP-85-0132 Page 2 bcc: F. E. Agosti D. Alexander R. C. Anderson R. W. Barr M. L. Batch T. A. Began E. R. Bosetti W. F. Colbert L. B. Collins O. K. Earle D. Ferencz L. G. Ferguson L. C. Fron C. R. Gelletly W. J. Glasser I E. P. Griffing W. R. Holland J. W. Honkala S.J. Latone R. S. Lenart P. A. Marquardt/ Docket File (2) T. M. McKelvey W. E. Miller, Jr. S. H. Noetzel J. A. Nyquist T. J. O'Keefe G. R. Overbeck T. D. Phillips J. L. Piana J. H. Plona E. R. Preston, Jr. G. K. Sharma L. E. Schuerman F. T. Schwartz P. M. Schwartz L. J. Simpkin D. Spiers G. M. Trahey L. F. Wooden A. E. Wegele S. P. Zoma Approval Control (136 NOC) Region III Chron File NRC File Secretary's Office (2412 WCB) u

THE DETROIT EDISON COMPANY FERMI 2 NUCLEAR OPERATIONS ORGANIZATION RESPONSE TO NRC INSPECTION REPORT NO. 50-341/85009 DOCKET NO. 50-341 LICENSE NO. NPF-33 INSPECTION AT: FERMI 2, NEWPORT, MICHIGAN INSPECTION CONDUCTED: FEBRUARY 12-22, 1985

RESPONSE TO NRC INSPECTION REPORT NO. 50-341/85009 Unresolved Item 85-009-01 While reviewing the licensee's as-built program the inspec-tor identified several cases where Balance of Plant (BOP) cables are tied electrically into Division II (two) cables in the HPCI system logic circuitry. Schematic diagram 6I721-2225-3 Revision "I" contains the logic circuitry for the HPCI system. The HPCI initiation signal seal in circuit contains BOP cables 218387-OC, 218384-OC and Division II cable 225303-2C in same circuit. The HPCI initiation from the remote shutdown panel contains BOP cable 218384-04 and Division II cable 218386-2C in same circuit.* The inspector informed the licensee that a review of safety-related circuits on schematic and loop diagrams is needed to assess the significance of this item.

• NOTE:

This case is addressed in representa'cive sample No. 12 in Attachment A of this report. Response to Unresolved Item 85-009-01: Background and Summary: The Fermi 2 electrical separation principles were developed in the early to mid-seventies. They are initially described in PSAR Section 6 and reflected in GE Specification 22A3777; Edison Design Instructions DI-50 and DI-ll2; Design Specifi-cations 3071-33 and 3071-128; and submitted to NRC in FSAR Section 3.12, and answers to reviewer's questions in Appen-dices A and E notably Question 222.2. The design was reviewed by an Edison review group estab-lished in October 1974, who issued a series of reports. A comprehensive review of the Fermi 2 design was done by a Safety Review Task Force (SRTF) from April 1979 until January 1980. This review and the recommended follow-up actions included checking the adequacy of electrical separa-tion and a field walkdown that was completed in early 1981. The electrical separation design was discussed with the NRC during the early licensing stages of Fermi 2, and was docu-mented in the Interim Safety Evaluation Report in 1977 RESPONSE TO NRC INSPECTION REPORT NO. 50-341/85009 ( NUREG 0314). A final NRC review of electrical separation was conducted in 1981 and various examples of separation concepts'were discussed as the respective schematics were reviewed. The favorable conclusion of this review was sub-sequently recorded in section 8.3.4 of the SER (NUREG 0798). The Fermi 2 Plant has not committed to full compliance with Regulatory Guide 1.75 since this Guide was issued after the design criteria of Fermi 2 were established. However, the intent of Regulatory Guide 1.75 as embodied in IEEE Standard 384-1974 has been met. The Fermi 2 Plant does not identify associated circuits as a class but has performed sufficient analyses to show that adequate electrical separation exists between IE and non-IE circuits. The analysis was done as part of the design process without maintaining formal docu-mentation. Fermi 2 design criteria allow non-IE circuits in class IE trays under certain conditions. This is acceptable because wherever non-IE cables are installed in IE trays the instal-lation is controlled as IE. In addition, non-IE cables in IE trays will not impact the IE cables because the current source is limited to low levels or is fused. The non-IE cables in Fermi 2 were purchased to the same technical speci-fications as IE cables,and the cable insulation was selected and tested to demonstrate that it would not propagate a fire. Appropriate fire stops have been used in cases where non-IE cables cross over into IE trays. This design has been reviewed previously by the NRC and found acceptable (Region III Inspection Item 81-12-02). The effects of fires on electrical circuits have been eval-uated'previously as part of the fire protection study. The circuit analysis was performed to the criteria established in 10CFR50 Appendix R. The analysis established the systems and circuits necessary for het and cold shutdown of the plant, and included an analysis of those circuits associated with the shutdown circuits. The report chows that reactor shutdown can be achieved with a fire in any fire zone. The analyses were reviewed by the NRC at the plant and found ac-ceptable as indicated in Inspection Reports 84-16 (DRS), 84-49 (D RS ), and 85-014 ( D RS ), and supplement No. 5 to the SER, Appendix E. As discussed with the NRC, Detroit Edison is formalizing, with this submittal, the review of approximately 550 sche-matics where IE and non-IE circuits interface electrically without the intrinsic separation provided by isolation -

1 RESPONSE TO NRC INSPECTION REPORT NO. 50-341/85009 devices as described in Regulatory Guide 1.75. As a result of this review, a total of 656 cases where IE and non-IE circuits interface electrically were identified, and these cases were categorized in 13 representa'ive samples for the purpose of the analysis and documentation. These analyses were then documented for each representative sample shown on Attachment A to this report. The analysis addresses the im-pact of electrical faults in the non-IE circuit on the func-tion of the IE circuit. Analysis: See Attachment "A" for the summary analysis of each represen-tative sample. Each analysis is broken down into a descrip-tion of the representative sample and the number of cases involved, a discussion of the failure modes and effects, and pertinent conclusions. The applicable failure modes con-sidered were the maximum short circuit current, and circuit shorts, opens and grounds. All failure modes were con-sidered to initiate in the BOP non-IE circuit and were ana-lyzed-for effects on the applicable IE circuits.

== Conclusion:== The analysis of the representative samples of IE and non-IE circuits shows that the ability of the IE system to perform its assigned functions is not impaired by the postulated electrical faults in the non-IE circuits that are associated with them. The safety of the Fermi electrical design ia enhanced by rigorous electrical separation between the two redundant ESF divisions. These divisions are each electrically separated from the four channel reactor protection system which is it-self separated into two divisions. Each electrical division as well as the balance-of-plant electrical designs are segregated by voltage / power levels into three distinct groups: power, control, and instrumentation circuits. Segregation by voltage / power within each electrical division significantly improves the electrical integrity of the basic separation design and is enforced through the use of sepa-rate tray, conduit and cabling systems for each group. Within each group are both ac and dc operating systems. The ac system is normally grounded, but the de system is main-tained ungrounded to substantially improve its independence and integrity. -

ATTACHMENT "A" ANALYSIS OF THE REPRESENTATIVE SAMPLES ELECTRICAL SEPARATION 4

INDEX FOR THE REPRESENTATIVE SAMPLES ANALYSIS Representative Sample No. 1 Class IE and Non-IE Interface in the Annunciator System Representative Sample No. 2 Class IE and Non-IE Interfaces of the Isolation Valve Mimic Representative Sample No. 3 Interface of-Class IE Motor Circuit with Non-IE Load Monitoring Representative Sample No. 4 Non-IE Thermocouple Circuits Sharing Class IE Pre-Fabri-cated Cables to the COP's ' Representative Sample No. 5 Class IE Motor Circuit Inter-face with Class Non-IE Motor Heater Circuit Representative Sample No. 6 A Circuit Fed from Non-IE Power with a Permissive Tied to Circuit Divisional (IE) Cable Representative Sample No. 7 Class IE and Non-IE Interface of the Process Computer Representative Sample No. 8 Interface of Flasher Circuit (Flashing CMC Quadrant) with Class IE Flasher Bus Representative Sample No. 9 Interface of Class IE Power Feed with Non-IE Suction Pressure Switches Representative Sample No. 10 Interface of Class IE Switch-gear Buses Feeding Non-IE Load L with Non-IE Control Circuits l for the Non-IE Load Representative Sample No. 11 Interface of Class IE and Non-IE Switchgear Bus Potential Circuits Representative Sample No. 12 Class IE and Non-IE Interface in the HPCI Control Circuitry Representative Sample No. 13 Interface of Class IE Circuits with Non-IE Reactor Recircu-lation MG Set 1

i 4 Representative Sample No. 1 Page 1 of 2 . Representative Sample No.: 1 ' Number of Cases Identified: 360 Eo 1. DESCRIPTION: Class IE and Non-IE interfaces in the Annunciator. System.. The Annunciator System collects alarm status informa-tion from plant systems and provides that information. to the plant operators on a visual annunciator, sequen-tially on printers and'a CRT, and also to the Procee9 Computer. The Annunciator / Sequential Recorder has been designed to meet the IEEE Guidance for Surge Withstand Capabi-lity.. Electrical integrity of the alarm system is enhanced by the use of an ungrounded 24V de alarm bus which is monitored actively for grounds by a dedicated 1 _ ground detection circuit. Alarm status dry contacts are wired from other plant L systems into panel Hil-P827. A typical cabling scheme j - utilizes two conductors in a multi-conductor IE' control cable to carry alarm information as far as a relay room termination cabinet.- The other conductors of this cable provide a IE control function. From the termina-tion cabinet, the Non-IE cable system carries the alarm status to Hil-P827. Thus interfaces between IE and Non-IE exists at these points: 4 1. Between conductors in the multi-conductor IE cable. The cable insulation is the separation barrier.- 2. The alarm sensing device, which, for example, is a IE relay whose coil is in the IE control circuit, but one of whose contacts provides the alarm status, wired to Hil-P827. Isolation is provided by coil-to-contact separation.

Representative Sample No. 1 Page 2 of 2 2. FAILURE MODE AND EFFECTS ANALYSIS: External line-to-line or multiple.line-to-ground fault could cause a maximum current of approximately 24mA because of the current limiting of the annunciator system. Since this is very much less than the IE-routed cable ampacity (about 15 amps), and a typical control relay contact rating (about 1 amp), there is no effect'on safety, since the insulation barrier's rating are not exceeded. An open circuit will have no effect on safety because the annunciator performs no safety-related function. 3. CONCLUSION: The results show that on any external faults the maxi-mum current is 24mA which is far less than the cable ampacity of about 15 amperes and relay contact rating of 1 amp. This is not a safety concern because of the insignificant fault current levels. l 1 l

Representative Sample No. 2 Page 1 of 2 Representative Sample No.: _ 2, Number of Cases Identified: 108 1. DESCRIPTION: The Isolation Valve Mimic Network collects status infor-

m. tion from those systems controlling primary contain-ment isolation, and routes that status information to the appropriate indicator unit on the Isolation Valve Mimic at Hil-P601.

There are three ways that the infor-mation is wired to the Isolation Valve Mimic. CASE A. A limit switch contact on a IE valve is wired to a Non-IE interposing relay which is fed from a fused Non-IE grounded source of 24V dc. The interposing relay contacts are, in turn, monitored by the 48V dc ungrounded power sup-ply of the Isolation Valve Mimic Network. CASE B. A limit switch contact on a IE valve is routed through a IE cable and terminated in a Relay Room cabinet. The two conductors are then extended as a Non-IE cable to the Isola-tion Valve Mimic Network where they are moni-tored by the network's 48V dc ungrounded sup-l P Y-CASE C. The third scheme uses a qualified IE signal isolation device to provide a signal to the mimic panel by Non-IE cables. The information provided by the Isolation Valve Mimic is also provided on Control Room panel inserts, appro-priate to their particular system function. The inter-face of the mimic's circuitry with safety-related cir-cuits are at the originating IE device (e.g., valve limit switch contact); in the IE cable, two of whose conductors are used by the mimic; in the IE raceway systems (e.g., the "lC" or "2C" tray systems); and in the termination cabinet where the circuit connection is made to the Non-IE raceway system (i.e., the "OC" system).

Representative Sample No. 2 Page 2 of 2 2. FAILURE MODE EFFECTS ANALYSIS: Case A The field cabling for Case A is wired from the limit switch using a 12 AWG wire. The limit switch is wired to the relay coil using a fused Non-IE 24V de grounded supply. The maximum fault on these circuits is postu-lated to be a direct short across the relay coils. However, these circuits are protected by 5A and 10A fuses, which will limit any fault current to protect the 12 AWG wire. Case B a. Any line-to-line or multiple line-to-ground short circuit at external points will produce the same result as a sensing contact closure. The result-ing current produced is limited by the optical isolator impedance to about 30mA not considering the limiting cable impedance. 30mA at 48V dc will not degrade the sensing contacts, which typically are rated for 1 amp or greater, and is much less than the smallest conductor ampacity, which is typically 15 amps. Thus no device damage or cable damage can occur due to fault energy, and there is ~ no effect on safety. Since the 48V de power sup-ply is ungrounded, a single line-ground short has no effect. b. Open circuits would result in no current flow, with no possible damage, therefore, and no effect on safety. Case C No analysis needed as a qualified IE isolator is used. 3. CONCLUSIONS: Faults do not degrade safety.

s Representative Sample No. 3 Page 1 of 2 Representative Sample No.: 3 Number of Cases Identified: 87

1. -

DESCRIPTION: Non-IE load monitoring circuits used to provide oper-ator indication of motor current on the IE 260 volt, 480 volt and 4160 volt motors' interface with the respective IE switchgear circuits. The Non-IE. circuits -are routad from the switchgear to the control panels by various Non-IE trays and IE-Divisional trays. Where the Non-IE circuit is routed in the IE divisional trays the circuit also can interface with IE cables in that tray. 2. FAILURE MODES: TheLfailures-that might take' place in this Non-IE cir-cuit and affect'the IE associated equipment or cables ares (1) Open, short, or ground on the interfacing load monitor cable. (2) Failure of the milliamp indicating meter and thus apply the 24V dc flasher bus output on the inter-facing load monitor cable. i 3. FAILURE EFFECTS: Failure mode (1)-an open, short or ground on the inter-facing load' monitor cable will not reflect'through the isolation transducer which is located in the switchgear and therefore cannot affect'the IE equipment operation. ~ This failure mode will not increase the current flow in the cable and thus the cable will not affect any adja-cent cables in the IE tray system. Failure mode (2)-a failure of the milliamp indicating meter app).ying the 24V de flasher bus output to the interfacing load monitor cable will not affect any IE equipment due to the relatively low current'and voltage available. The circuit of the 24V de flasher is fused at six (6). amperes thus limiting the available current to well below the capacity of #16 wire used in the cir- ~ .cuit and the 24V dc will not be reflected through the transducer isolation device.-

Representative Sample No. 3 Page 2 of 2 4. CONCLUSIONS: The Non-IE load monitoring circuits are isolated from the IE equipment by isolation transducers.- Where the load monitor circuit cables,are routed in the IE trays the energy levels available are well below the cable ratings and thus the non-IE load monitor circuits will not degrade any IE equipment. 4 1

Representative Sample No. 4 Page 1 of 1 Representative Sample No.: 4 Number of Cases Identified: 2 1. DESCRIPTION: The wiring from the Non-IE thermocouple converter circuits in the Relay Room are run in IE prefabricated cables to make the transition from the Relay Room to the Control Room operating panel. 2. FAILURE MODE EFFECTS ANALYSES: .The prefabricated cables have size #16 AWG wire and maximum postulated fault current is 50mA at 30V de due to the output characteristics of the converter. The cable is rated for 600V ac and approximately 15 amperes. In consideration of this small fault current, no degradation of the wire insulation is postulated. 3. CONCLUSION: Because of low fault currents there is no degradation of insulation, and the circuits in their present state are acceptable. J

Representative Sample No. 5 Page 1 of 1 Representative Sample No.: 5 Number of Cases Identified: 9 1. DESCRIPTION: A Class IE motor has a motor heater which is energized only when-the motor is not running. The local Non-IE motor heater contactor is interlocked with the IE motor circuit breaker via a 2 conductor #12 AWG cable run as a IE circuit. This cable connects a breaker auxiliary switch with the local contactor control circuit. The function of this interlock is non-safety related even though the interconnecting cable is designed as IE. 2. FAILURE MODES: The only electrical failure which can affect the IE portion of this circuit is a fault to ground which bypasses the M coil producing the maximum available fault current. This fault for a size 1 contactor and a control transformer of 100VA produces a maximum 12 amp fault current. This represents the maximum current the control transformer can deliver with a short placed directly at its secondary terminals due to its own internal impedance. 3. FAILURE EFFECTS: A two conductor #12 cable can sustain a fault of this magnitude indefinitely without reaching its maximum continuous operating temperature of 90*C even in a 40% full cable tray. Therefore, there will be no effect on the adjacent cables in the same IE raceways even if the control fuse on its circuit does not open. 4. CONCLUSION: No subsequent loss of any safety function can result from this type of failure since the interconnecting cables can safely carry the maximum fault current continuously without damage.

n Representative Sample No. 6 Page 1 of 1 Representative Sample No.: 6 Number of Cases Identified: 1 1. DESCRIPTION: A skid mounted Non-IE component uses two conductors of a twelve conductor IE cable to an intermediate point. The circuit for the Non-IE component is powered from a Non-IE 130V de source via a 5 amp fuse. The Non-IE component was originally powered from a IE source but was moved when the component was found to be not quali-fied. The control scheme is wired with the IE cable due to the lack of Non-IE conduit and trays in the skid area. 2. FAILURE MODE EFFECTS ANALYSIS: The worst case fault on the Non-IE circuit is 254A for 0.016 sec. before it will be cleared by the SA fuse. (Note this fuse will be added to the fuse control program). 3. CONCLUSION: Any fault on Non-IE wires has no detrimental effect on the remaining IE circuitry as it will be cleared by the fuse before cable damage can occur.

2 1 Representative Sample No. 7 Page 1 of 2 Representative. Sample No.: 7 Number of Cases Identified: 5 1. DESCRIPTION: IE and Non-IE circuits interface in the Process Com-puter and low current instrument signal loop. The Process Computer collects analog and digital sig-nals for data acquisition and calculation but is not used for~ controlling any process. The computer system is Non-IE equipment. Five analog computer points are taken from IE circuits via dropping resistors. Non-IE cables routed in seismic trays are used to connect the flow / speed loops and the rocess Computer. The five loops are treated in three groups. 1. RHR Flow Loops 2. HPCI/RCIC Speed Loops 3. RWCU Flow Loop The RHR flow and HPCI/RCIC turbine speed loops are for indication only, i.e. they do not have any control function. The RWCU flow loop is associated with a flow detection loop that provides an isolation signal to the RWCU isolation valves. A redundant RWCU temperature leak detection also provides an isolation signal to the same valves. 2. FAILURE MODE EFFECTS ANALYSIS: The worst-case fault will result in the indication to go either upscale or downscale, depending upon the indi-i vidual loop. These changes in indication do not result in changes in control function except in the case of the RWCU where an inadvertent isolation could occur. The fault'does not result in any other loop failures due to'the design of the power supply.

Representative Sample No. 7 Page 2 of 2 3. . CONCLUSION: The use of Non-IE cables for the Process Computer interface with RHR and RWCU flow loops and with HPCI/RCIC speed loops is acceptable. None of the failureslof the Non-IE cables can jeopardize the safe operation of the systems. In the event of loss of flow or speed indication in the Control Room, the operator will have various information sources i.e., valve position, pump amperes, etc. which can be used to take appropriate operator action.

1 L Representative Sample No. 8 Page 1 of 1 Representative Sample No.: 8 Number of. Cases Identified: 2 1. DESCRIPTION: The circuits in these cases are interconnected alarm circuits which are designed to provide an alarm (flashing CMC quadrant) when both Division I and II SGTS CMC switches are in the off position. CMC switches are backlighted rotary control switches i located on panels in the Control Room. A Non-IE cable is used as part of the flasher circuits l to connect one contact each from Division I and Division II -IE CMC switches. The-flasher circuits are I. ' protected by a-1A fuse. !-I' - 2. FAILURE MODE EFFECTS ANALYSIS: Any fault on the Non-IE cable which is run in a con-duit, will be~ cleared by the fuses in less than.01- ~ seconds. The only postulated effect will be the loss of flasher indicator which does not affect any safety function. 3. CONCLUSIONS: L The flasher power supply (source) is unaffected by any failure of the Non-IE cable, as fuses clear the fault in less than.01 sec. Loss of'any flasher indication does not affect any con-trol capabilities. The Control Room operator has other information that supplements the lack of information from the flasher indicator on the CMC. ,~.

r. L. f Representative Sample No. 9 Page 1 of 1 Representative Sample No.: 9 Number of Cases Identified 2 .l. DESCRIPTION: A set of unqualified pressure switches are wired into an alarm logic powered by the IE control _ batteries. The logic was not redesigned as previous case #6 since the unqualified switches are seismically mounted in seismic racks. The circuit is protected with a 5A FRN fuse. This circuit provides operators information in the form of alarm and display only. 2. FAILURE MODE EFFECTS ANALYSIS: a. Any line-to-line or multiple line-to-ground shorts on the pressure switch contacts and associated wiring will have the same result electrically as contact closure. b. A single short-to-ground has no effect as the IE power supply is ungrounded. c. An open in the pressure switch circuitry would [ result in loss of the alarm function. 3. CONCLUSION: A failure in the Non-IE circuits does not impair the ability of the IE systems to perform their intended functions. n

~ Representative Sample No. ~. 0 Page'l of 1 Representative Sample No.: 10 Number of Cases' Identified: 22 -1. DESCRIPTION: Th'e 480 volt breakers feeding Non-IE loads from Class IE busses are fully qualified and controlled entirely from the Class IE battery. Since these are supplying non-essential loads, the control cables between the switchgear and control room are treated as Non-IE cables.- Control fuses in the switchgear protect the Class IE battery. 2. FAILURE MODES: The maximum fault current condition would be a positive to negative 130V dc fault immediately downstream of the fuse. This fault current would represent the worst case power drain on'the Class IE dc power system. 3. FAILURE EFFECTS ANALYSIS: The maximum de fault current value at the 480V switch-gear _ busses is calculated to_be 770 amperes. The' Buss-man FRN-30 fuses specified for this application will clear a fault of this magnitude in less than.01 seconds. Thus, the fuses in the individual switchgear positions feeding Non-IE loads, will serve as adequate isolation devices to isolate the Non-IE circuit from the IE dc power supply as stated in FSAR item E222.2, Article (5). 4. CONCLUSION: The fuse sizes are sufficiently low in comparison to the capability of the IE dc power supply that there is no' realistic condition where the Non-IE cables will jeopardize the integrity of the IE dc power supply. All fuses for the control circuits on the IE 480V breaker positions, including the breaker positions feed-ing Non-IE loads, have been included in Specification 3071-128, Section EJ so that they are maintained under the Fermi 2 Fuse Control Program. c

e- ~ C-~. Representative Sample No.'ll-Page 1 of 2 ' Representative Sample No.: 11 Number.of Cases Identified: 54 1. -DESCRIPTION: The 4160V and 480V bus potential circuits have IE_and Non-IE cables' terminated in IE termination cabinets to terminal points which are jumpered together. The cables feedingfthe potential monitor lights and bus synchronizing scheme-are Non-IE. 2. FAILURE MODES: (Refer to Attached Sketch) a.- Short circuit in Non-IE circuits b. Open circuit in Non-IE circuits 3.. FAILURE MODE EFFECTS ANALYSIS: a. All. branch-circuits _are individually fused and the % ential transformer secondary fuses, sizes are selected to coordinate with the pot b. All circuits being fed.from the termination.cabi-net are functionally Non-IE i.e., indicating and recording instruments or a bus synchronizing scheme.which are not needed'for safe shutdown of the plant. c. The IE bus undervoltage load.shed scheme _ located in:switchgear is isolated from other branches by selective fuses. The undervoltage load shed scheme will not be affected by faults on the Non-IE circuits, as the scheme has a built-in two second delay to override transient effects of the

faults, d.

Open circuits in any of the branch circuit cables of'the Non-Class IE systems will not affect safe shutdown of the plant. 4. CONCLUSION: All branch circuits are electrically isolated and there-fore a failure on a Non-Class IE cable will not affect a Class IE system.

4160v Bus Y R presentativo Sample No, 11 Page 2 of 2 .y g PRit%RY f*uSES = = i n Bub 90T h TRF's w w w lH SEtouthp.3 =: FOSES = = 30A g .y. 7 g

=

c= e gguq 0 PAES o

== == == =

==o SA ()()()() () ( > + t w &E. 7 tato, c-; az.- S hc ETN R n A n o c.t e ; i NNIer .~~ sc,nM = tSr* m t,u s Rrs ATE o M 2,7 b , Nc4 -i3 C Y c a t.e_, st a t.Tr:: chE-E y V V V if 1 L _p '( 3( SMET't REATED r o 7mTm. To sos tattemn "0 V 0 " E TE "- WWERVoL7 % f. i e,, yggega,g SWc. MoniTon. L O AD SwSO S*.ktMt. wgw,wg g, 5twerat. L'4"T TYPICAL 4160V BUS POTENTIAL DIAGRAM i 1

,e to: ~ Representative-Sample No. 12 Page 1 of 2 [RepresentativeSampleLNo.: -12 Number of. Cases. Identified: 2-1. DESCRIPTION: IE -and 'Non-IE ' circuits interface in tlue <HPCI control-circuitry. The Fermi. commitment to mitigate the effects of an exposure fire in the' Control Room adjacent to Panels Hil-P601 and Hll-P602,. required the design of.an alter-nate means to start the'HPCI from a local, shutdown panel.(Division-II Shutdown Panel). The circuitry and panel.were designed as:Non-IE equipment with the . exception of the isolating devices consistent with the requirements of Appendix "R". The circuits'in question include the " manual initiate" pushbutton which is located in the Non-IE shutdown-panel. This pushbutton is isolated through-the use of qualified relay contacts M -Tl and M -T3 of relay i 3 C35-K73. The isolation relay is normally deenergized and is located in a qualified panel. It'is controlled by Non-IE 130V battery power via a key locked transfer switch. Associated with the pushbutton is the "HPCI INITIATED" lamp located on the Non-IE shutdown panel. The lamp is ~ isolated by a circuit similar to the pushbutton except that' contacts M -T2 and M -T4 of a separate relay 2 4 C35-K35 are used. 2. FAILURE MODE EFFECTS ANALYSIS: A fault may take place in the Non-IE shutdown panel circuits.- Since these circuits are normally deener-gized, except-during the specified fire mitigation, the two:open contacts in series constitute adequate isola-tion of the Non-IE remote shutdown panel from the HPCI logic. 3. CONCLUSION: For this specific case the level of isolation provided (relay contacts of a qualified relay in a Class IE equipment panel) is adequate to maintain the integrity of the HPCI system. I I

r Rsprosentativo Sample No. 12 Page 2 of 2

}

~ 58:. een P6ae .~ _ - - - - - - u. u,- , 001o. / L * '* h _ W~ 5 "M M $~% l l Gie U l' EI50t, ....n n p' f* L 8 T. g ? -,,rrst' (.c q at9 .i: -l TZ T .3 si w m. m.. ^ l e_,_ _ _ _ _ _ 7 kPh2 " D. c. i -,_o,,,,w-i g. t.O M,*.#. .- f ~@ o O' Ni -g n,c E 1 1 N ^ . ):' 7 g)u, 8 l START i O l i ; se (.n-2 4 W ;, I 88 AA-78 3 ' 'hkid'r !faj l f.*.*., _a e oca isotoo r-e eJo9c'9 dc m i- % u Di, 44 3 1,,,,..,. .v3*M s i a e .33, n'** Ja-ti' p - w, ,, r -m.. e. .. G,u,,,,. n. H n::4u t w '8848 8 N'-*cw) M* ene si Ja a-22snosef 166d4 0L 1***' R set St: w, vs p s,o n L

• O("$M;,-

E *! 8 ' '4 3 ,,. 1 'd' I e43 G ,g i n ami t

' ou n,

t, x .~ w t T4 T n asar 'a j '" 'I b.2hij L,_-jdy J' ~ I' -""'E xg'~F &- nuwsg :- Gr,6 It9 J eiri-*6it E mL.w aa ee a,_j.i.,s. w..,,,.,, Ya ma as j, aa.n Jt wa "....3 uT. i. eat o :.3 ,. c. s 3 eo L 9 e ut el e~- t seti uw.Ai,Jm Hic,ss DetTwtLL,,,',, yz; on,rs yng nNr

1. as Pf A%

drI MM MI/14W/Wp/vc Pttituitt. w,%ag $g.at sw sse nes SEMEDIN . I

• g

~~, ~ 1v.I RimoTE lie TI0nse marl 327Pior l 9 B ~ ,j,I",, 24Hs MQ L35 13 ct3 IL 41 1191-4. Utia unA Siis9ill. l .) 1,. 8vPAH 5ft4n. I 3 - -{ * - - * - "g- -,,on ung. e C15 Si 6tt1M 4 re.4P.0fl $68'llW89Wvre stt.sn..L@,,,,,,,. 3

1. f ne ors i3 "i7 I

't to g 4.t is <> c is C te 08 j am o r., at wisot h shW tdre-IT33.re, rinas j (CAP) L 1 s r as .. I .7J 57 k Gr.. 33c C'.8 90 l JJ %a C35 si ( 15

s. CSS si US si i

"r si o / ess-snscol,64 au as5 snool se g !,g 84 a g, f l ll 3 n.se < ssa 3s H il-Hil-j c 24 c,. g-P60 Pf.12 9 e

• h,,s, g

a. '\\ O t a f .a us-et tims ic 0 6564 4 (Ws l ~ -*

- = 8 j '} ".oi .v Representative Sample No. 13 K Page 1 of 2 l_ Representative Sample No.: 13

r Number of Cases Identified

2 1. DESCRIPTION: Divisional cables in Non-IE Reactor Recirculation MG ~ Set Drive ~ Motor Trip Circuit. The original G.E.-designed Reactor Recirculation MG Set trip provided for ATWS mitigation installed two relays qualified:for IE service in each of the two drive motor trip circuits. These relays are controlled by IE relays that respond to RPV Water Level-Low, and RPV Pressure-High. Since the ATWS control is a backup to the Reactor Protection System, G.E. specified that the cabling from the sensors to the trip circuit be indepen-- dent-. of the RPS cabling. In order to meet this require-ment, the channels were assigned to the divisional cabling systems, 1C and 2C. Due to the system . requirement that either divisions' sensors trip both motors, it is inevitable that the opposite division's cables, 1C and 2C, be connected together, in parallel, at the trip circuit of each motor. The trip circuit is fed from Non-IE 130V de batteries, through fuses' instal-led at'the switchgear. Non-IE cabling connects the trip circuit to a IE Relay Room cabinet, where the ATWS relays are located. Trip contacts from sensor channels are cabled through divisional cables to electrically join the trip circuit and ATWS relays at the'same cabi-net. Each sensor trip contact is locally fused before connecting to the IE-routed cable. The safety analysis no longer takes credit for this trip mitigating an ATWS accident. Credit now depends on the-trip of the MG-Set's Generator Field Breaker. G.E. recommended however, retaining the trip of the drive motor to obtain a higher reliability of the trip . function. All of the components supplied to perform the function up to the interface with the Non-IE trip circuit, are qualified for safety application: namely the sensors, trip units, relays and cables, j Li

r-A _ :t 0 Representative Sample No. 13 Page 2 of 2 2. FAILURE MODE EFFECTS ANALYSIS: Fuse protection is provided between the 130V dc Non-IE feed and the IE-routed cabling, and will therefore pre-vent any. fault in the non-qualified circuitry from dam-aging the cabling. Energy. levels will be low enough to prevent any cable damage, which precludes the possi-bility-of compromising divisionally redundant functions that have cables sharing-the divisional raceways in question. The relays at the trip unit cabinets, that perform IE functions, are further isolated from any faults originating in this circuit by local, 1 amp fuses. No effect on safety can result from any credible fault hypothesized. 3. CONCLUSIONS: There is no'effect on safety for any hypothesized, credible fault in the Non-IE system with which the subject equipment is interfaced. <}}