NRC-95-0105, Revises 950929 Request for Discretionary Enforcement W/ Respect to Requirements of TS Action Statement 3.8.1.1.d & TS 4.0.3,documenting That Addl auto-connected Loads Affected by Incomplete Surveillance Requirements

Revises 950929 Request for Discretionary Enforcement W/ Respect to Requirements of TS Action Statement 3.8.1.1.d & TS 4.0.3,documenting That Addl auto-connected Loads Affected by Incomplete Surveillance Requirements

ML20098C021
Person / Time
Site:	Fermi
Issue date:	10/02/1995
From:	Mckeon R DETROIT EDISON CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
CON-NRC-95-0105, CON-NRC-95-105 NUDOCS 9510060201
Download: ML20098C021 (12)

Text

-

I Robert McKeon Assistant Vice Presidient and anagw, Operations MI -- ' e N orth Dixie Hwy -

Edison n%=""** 1rme October 2,1995 -

NRC-95-0105 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, D. C. 20555

References:

1) Fermi 2 NRC Docket No. 50-341 NRC License No. NPF-43

2) Detroit Edison letter to NRC, " Request for Discretionary -

Enforcement," NRC-95-0091, dated September 29,1995

Subject:

Revision to Request for Discretionary Enforcement As discussed with Mr. T. Colburn on September 30,1995, this letter is a revision to ,

Reference 2 which is being submitted to document that additional auto-connected I loads are affected by the incomplete surveillance requirements. These additional l loads do not invalidate the reasons provided in Reference 2 for Discretionary l Enforcement. The revised enclosure and load list from Reference 2 are included with this letter. The enclosure is marked to indicate changes in the discussion provided earlier.

The purpose of this letter is to request discretionary enforcement with respect to the requirements of Technical Specification (TS) Action statement 3.8.1.1.d "A.C.

Sources - Operating" and TS 4.0.3 " Failure to Perform a Surveillance Requirement Within the Allowed Surveillance Interval," which requires shutdown within 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> after the allowed TS 4.0.3 surveillance performance extension. This shutdown is required when both separate and independent onsite A.C. electrical power sources are inoperable due to potentially inadequate surveillance test performance. Detroit Edison is submitting this request to obtain deferral from limited aspects of surveillance requirements which have not been adequately completed so that surveillance testing can be completed for the affected components in an orderly manner. 1 At 1700 hours0.0197 days <br />0.472 hours <br />0.00281 weeks <br />6.4685e-4 months <br /> on September 28,1995, all four diesel genen. tors were declared inoperable due to missed Technical Specification (TS) surveillance requirements due to incomplete control switch and relay contact position verification during surveillance testing. To conduct the required surveillance testing, all four diesel v

n-.. .

- \l 9510060201 951002- 1 PDR ADOCK 05000341 3 P _ .a -- _PDR_ ..

. -. . .- - ..- - _ . . - - - ~ . - ..- -. - - - . . .. .

i USNRC

~*

. October 2,~ 1995 ,

• NRC-95-0105 Page 2 '

j generators will be required to be removed from service in a sequential manner so that i the associated output breaker closure switch can be manipulated. In addition, various L emergency core cooling system support components (i.e., ECCS room coolers) will j need to be taken out of service to perform verification that the load sequencing control relay contacts are operating properly. In order to ensure a well planned testing

program and to ensure that the proper plant conditions exist for removing equipment from service, longer than the 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed by Technical Specification 4.0.3 is required.

f Based on successful operation of the diesel generators during the last refueling l outage and the monthly surveillance testing, and the industry and Fermi 2 history of high reliability for the associated control switches and control relays for the functions .

I

which have not been fully verified, Detroit Edison is confident that the diesel generators are fully functional as tested.

} Detroit Edison is requesting that the completion of the remainder of the required

] surveillance testing be deferred to the next plant outage. The enforcement discretion is requested to begin at 1700 hours0.0197 days <br />0.472 hours <br />0.00281 weeks <br />6.4685e-4 months <br /> on September 29,1995, and will remain in effect j until an emergency Technical Specification change is approved. Detroit Edison will submit the emergency Technical Specification change request for approval by Tuesday, October 3,1995. Detroit Edison will develop and perform necessary tests,

) including evaluating whether performing on-line testing is consistent with prudent

risk management. If this request is granted, then for the period that this enforcement i discretion is in place and to avoid strictly compliance related operational restraints, the diesel generators will be declared administratively operable.

i If there are any questions related to this response, please contact Joe Conen,

Compliance Supervisor at (313) 586-1960.

I Sincerely, N W Enclosure

! cc: T. G. Colburn 1

H. J. Miller M. P. Phillips

! A. Vegel

. Region III 4

=

4 Enclosure to NRC-95-0105 Page1

1. Requirements for Which Reliefis Reauested At 1700 hours0.0197 days <br />0.472 hours <br />0.00281 weeks <br />6.4685e-4 months <br /> on September 28,1995, all four diesel generators were declared inoperable due to missed Technical Specification (TS) surveillance requirements due to incomplete control switch and relay contact position verification during surveillance testing.

The potentially affected contacts fall into two general categories, the diesel generator output breaker re-closure circuitry that is initiated following a load shed, and the emergency 480-volt load sequencer control relay contacts.

Diesel Generator Output Breaker Re-Closure Circuitry TS Surveillance 4.3.3.2," Emergency Core Cooling System Actuation Instrumentation," requires verifying that logic system functional tests and simulated automatic operation of all channels shall be performed at least once per 18 months. Loss of power (4160-volt bus loss of voltage or degraded voltage)is one of the functions that is tested as part of this surveillance requirement. Failure to meet the minimum operable channels results in entry to TS 3.8.1.1 for onsite power system inoperabilty. The associated surveillance test procedure involves tripping of the output breaker and verifies that the associated output breakers trip, initiating a load shed followed by the re-closure of the associated output breaker. The associated bus load shedding logic contacts close to re-energize the output breaker closing coil permissive relay (relay 52XX). Closure of one of the 52XX relay contacts, coincident with other breaker closure signals, results in closure of the breaker. However, this testing does not verify that the parallel control room breaker closure (CMC) switch contacts, or the 52XX relay seal-  ;

l in contacts, are not responsible for the re-energizing of the 52XX relay.

The surveillance test procedure has the CMC switch in the required l position which should result in the associated CMC switch contact )

being open, and the 52XX relay dropping out, however, there is no positive verification that these contacts are not in fact closed (i.e.,

stuck). Refer to the attached sketch for a schematic representation.

Emergency 480-volt Load Sequencer Control Relay Contacts TS Surveillances 4.8.1.1.2.e.4.b and 4.8.1.1.2.e.6.b require verifying that the diesel generator starts on the auto-start signal and energizes the emergency busses with automatically connected loads through the load sequencer. The associated surveillance test procedure involves

Enclosure to

,NRC-95-0105 Page 2 verification that the auto-connected loads are running on the 480-volt emergency busses after the diesels automatically start. However, this .

testing does not verify that the automatic digital load sequencer system I sequencing relays are responsible for actually closing the associated loads. There are parallel control switch contacts and control relay contacts that could provide for immediate connection of the loads to the 480-volt emergency bus after diesel generator starting without a closure signal from the load sequencer system. The sequence of surveillance testing establishes the conditions to open these parallel contacts, but does not include positive verification that the parallel contacts are actually open. Refer to the attached sketch for a sample l schematic representation.

i Failure to provide positive verification that the proper logic path has provided the energization of the relay coils as described above results in the diesel generators being administratively declared inoperable in accordance with TS 3.8.1.1. TS 3.8.1.1 requires two separate and t independent onsite A.C. electrical power sources, Division I and Division [

II, each consisting of two emergency diesel generators.

TS 3.8.1.1, Action d, states that with both of the required onsite A.C. l electrical power division inoperable, restore at least one of the above required inoperable divisions to operable status within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or be in at  ;

least hot shutdown within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and cold shutdown within the following 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. In accordance with the provisions of TS 4.0.3, the action requirements may be delayed for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to permit the completion of the surveillance when the allowed outage time limits of the ,

Action requirements are less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

To conduct the required surveillance testing, all four diesel generators will be required to be removed from service in a sequential manner so that the associated output breaker closure switch can be manipulated. In addition, various emergency core cooling system support components (such as essential room coolers), will need to be taken out of service to perform verification that the load sequencing control relay contacts are operating properly. In order to ensure a well planned testing program and to ensure that the proper plant conditions exist for removing equipment from ,

service, longer than the 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed by Technical Specification 4.0.3 is required.

Therefore, Detroit Edison is requesting relief from the requirements of TS  !

3.8.1.1.d and TS 4.0.3 with respect to the diesel generator output breaker re-closure circuitry and the 480-volt emergency bus load sequencers.

i 1

i Enclosure to l

' .NRC-95-0105  :

Page 3 Should the NRC determine not to grant this request for discretionary enforcement, a reactor shutdown will be required.

2. The Circumstances Surrounding the Situation. Including the Need for Prompt Action At 1700 hours0.0197 days <br />0.472 hours <br />0.00281 weeks <br />6.4685e-4 months <br /> on September 28,1995, all four diesel generators were declared inoperable due to potentially inadequate surveillances for the diesel generator output breaker re-closure logic circuitry and the 480-volt emergency bus load sequencer control relay logic circuitry.

The existing surveillance test procedures do not provide positive verincation that the proper logic path has provided the energization of the relay coils associated with the diesel generator re-closure circuitry nor the 480-volt emergency bus load sequencer control relay logic circuitry.

Based on successful operation of the diesel generators during the last refueling outage and the monthly surveillance testing, and the industry and Fermi 2 history of high reliability for the associated control switches and control relays for the functions which have not been fully verified, Detroit l Edison is confident that the diesel generators are fully functional as tested.

Prompt NRC action is required so that orderly surveillance testing of the diesel generator output breaker control switch contacts and the 480-volt emergency bus load sequencer control relay contacts can be performed without an unnecessary shutdown. Forcing the plant into a shutdown transient to verify that there is not a control switch or relay contact failure that could hypothetically have masked problems during apparently successful surveillance testing, does not provide an increased safety margin.

3. Why the Situation Could Not Have Been Avoided Electrical surveillance overlap drawings were created as a result of Licensee Event Report (LER)94-003. An independent review was performed in conjunction with the development of these overlap drawings.

This review identified concerns of contact ambiguity with regard to certain portions of the diesel generator output breaker and 480-volt emergency bus load sequencer surveillance tests. These concerns were reviewed and found to be valid by Fermi 2 engineering personnel. The ambiguity determined that contacts in parallel with the contacts intended to be functionally tested are not verified to be open. This could hypothetically result in a false satisfactory test of the contact function. Therefore, this

e Enclosure to

, ' ,NRC-95-0105 Page 4 -

situation is a result of the review to improve documentation of required -

, electrical system surveillance testing. This situation could not be avoided because Fermi 2. is aggressively reviewing and documenting overlap

requirements and is conservatively assuming that hypothetical contact failures could mask otherwise apparently successful surveillance testing.

The surveillance testing sequence establishes the required conditions to j fully test these devices, however, this testing does not include sufficient verification steps to confirm all required contacts function as intended.

4. The Preliminary Evaluation of the Safety Sienificance and EnvironmentalImpact i.

Granting this proposed enforcement discretion would have no adverse l impact on the public health and safety. The testing deficiencies did not, j and would not, prevent the surveillance testing which has been performed

from demonstrating that the emergency diesel generators are functional -

and will perform the safety functions if needed. Therefore, Detroit Edison believes that there is no unreviewed safety question, no significant hazards 4 consideration or adverse consequences to the environment as a result of this enforcement discretion. This will be futher discussed in the i

amergency Technical Specification change that will be submitted with i- regard to this issue (refer to item 6 below).

For the testing deficiencies associated with the diesel generator output

breaker logic, the function of the inadequately tested contact is not needed

(function bypassed) when the output breaker CMC switch is in the OPEN

position, the normal plant operations state. Further, any hypothetical j failure of the subject contacts could have gone undetected during the surveillance testing only if a parallel contact in the output breaker CMC

switch or the 52XX relay had failed closed. If this had occurred, the output breaker would still function as needed because the 52XX relay '

i , would reset via the failed closed parallel contact (s) and provide the required breaker closing coil permissive logic.

For the inadequately tested load sequencer contacts, any hypothetical failure of the subject contacts could have gone undetected during the surveillance testing only if a parallel contact in the associated CMC

, control switch or control relay contact had failed closed. If this had i occurred, the associated load would still function as needed because the

logic would be completed via the failed closed parallel contact (s) and the i

480-volt emergency bus loads would load onto the bus when the diesel breaker closes. In addition, since the surveillance testing did verify that the diesels were able to respond adequately to the connection of all loads, e

I Enclosure to NRC-95-0105 ,

'Page 5 any failure which had not been detected during previous testing has had no' impact on the function of the diesels.

In a worst case, highly improbable scenario, represented by concurrent . ,

failure of all of the incompletely tested contacts (up to 15 individual contacts on 15 separate loads for the worst case diesel generator), up to 185 hp of additional load would be immediately connected to that diesel generator when the diesel generator output breaker closes. . Refer to j Attachment No. I for a listing and description of the loads. Engineering evaluations have judged that the diesels are capable of accepting the  :

simultaneous connection of all of the additional loads coincident with l other loads being sequenced onto an individual diesel generator when the i diesel output breaker closes. This evaluation is based on pre-operational l testing when a core spray pump and a residual heat removal pump were simultaneously loaded onto the diesel generator (approximately 800hp  :

above normal sequenced loading).  ;

i

5. Proposed Compensatory Actions Night orders are being issued that explain the nature of the inadequate  !

surveillance requirements to heighten operator awareness to diesel generator loading response and control room switch manipulations.

Because the testing deficiencies do not impact the safety functions of the diesels, no further compensatory action is necessary.

6. Justification for the Duration of the Reauest Detroit Edison is submitting this request to obtain deferral from limited aspects of surveillance requirements for the diesel generator output breaker re-closure logic circuitry and the 480-volt emergency bus load sequencer control relay logic circuitry until the next plant outage. The enforcement discretion is requested to begin at 1700 hours0.0197 days <br />0.472 hours <br />0.00281 weeks <br />6.4685e-4 months <br /> on September 29,1995, and will remain in effect until an emergency Technical Specification change is approved. Detroit Edison will submit the emergency Technical Specification change request for approval by Tuesday, October 3,1995.

Detroit Edison will develop and perform necessary tests, including evaluating whether performing on-line testing is consistent with prudent risk' management.

Furthermore, a preliminary look at probabilistic risk analysis shows that removal of some of the affected equipment from service during operation to complete the surveillance testing would increase the instantaneous core damage risk. Some example risk increases would be 72% for removing

l

• i Enclosure to

.NRC-95-0105 Page 6.

l the Division I Non-Interruptable Air System (NIAS) or 57% for removing l the Diesel Generator 11 from service during operation to verify the j position of the associated impacted component contacts. j Based on successful operation of the diesel generators during the last refueling outage and the monthly surveillance testing, and the industry and Fermi 2 history of high reliability for the associated control switches and control relays for the functions which have not been fully verified, Detroit l Edison is confident that the diesel generators are fully functional as tested.

Therefore, for the period that this enforcement discretion is in place, to avoid strictly compliance related operational restraints, the diesel generators will be declared administratively operable with respect to the above described surveillance requirements. ,

7. Onsite Review Oreanization (OSRO) ADDroval On September 29,1995, the OSRO approved the justification and supporting documentation for this request for enforcement discretion.

OSRO approved the revision to this information on October 2,1995.

Attachment I to

,NRC-95-0105 Page1 TABLE NO.1 480-Volt Emergency Load Sequencer List l

LOAD DESCRIPTION LOAD l (Grouped by connected Diesel Generator) 480V MCC RATING (HP)

Drywell Cooling Fan #1 72B-3A 30.0 l RCIC & CSS Room Cooler 72B-3A 15.0 Div. I Control Air Compressor Room Cooler 72B-3A 5.0 Div. I Switchgear Room East ESS Cooler 72B-2B 5.0 Div. I Switchgear Room West ESS Cooler 72B-2B 5.0 )

Div. I Control Air Compressor 72B-3A 30.0 j Div. I Battery Charger Room Cooler 72B-2A 5.0 i Drywell Cooling Fan #2 72C-3A 30.0 Div. I Thermal Recombiner Cooling Unit 72C-3A 5.0 Div. I RHR Room Cooler 72C-3A 20.0 Div. I EECW Room Cooler 72C-3A 5.0 Div. I SGTS Room Cooler 72C-2A 3.0 Div. I CCHVAC Recirc/ Emergency Makeup Fan 72C-2A 20.0 Div.1CCHVAC Return Air Fan 72C-2A 25.0 Div. I CCHVAC Chill Water Pump 72C-2A 7.5 Div. I CCHVAC Supply Fan 72C-2A 40.0 Div. I A/C Equipment Room Cooling Unit 72C-2A 1.0 Div. I CCHVAC Chiller Compressor Oil Pump 72C-2A 0.25 Div. I CCHVAC Emergency Makeup Filter Heater 72C-2A 16.1 Cable Tray Cooling Fan 72C-2A 1.0 Drywell Cooling Fan #3 72E-5A 30.0 Div.11 Control Air Compressor Room Cooler 72E-5A 5.0 Div. II Core Spray Room Cooler 72E-5A 15.0 HPCI Room Cooler 72E-5A 7.5 Div. II Control Air Compressor 72E-5A 30.0 Drywell Cooling Fan #4 72F-4A 30.0 Div. II Switchgear Room East ESS Cooler 72F-2A 5.0 Div.11 Switchgear Room West ESS Cooler 72F-2A 5.0 Div. II EECW Room Cooler 72F-4A 5.0 Div.11 Thermal Recombiner Room Cooler 72F-4A 5.0 Div.11 RHR Room Cooler 72F-4A 20.0 Div. II SGTS Room Cooler 72F-5a 3.0 Div.11 CCHVAC Recirc/ Emergency Makeup Fan 72F-5A 20.0 Div.11 Battery Charger Room Cooler 72F-2A 2.0 Div.11 CCHVAC Chill Water Pump 72F-5A 7.5 Div. II A/C Equipment Room Cooling Unit 72F-5A 1.0 Div.11 CCHVAC Supply Fan 72F-5A 40.0 Div. II CCHVAC Return Air Fan 72F-5A 25.0 Div. Il CCHVAC Chiller Comp Oil Pump 72F-5A 0.25 Div. Il CCHVAC Em Makeup Filter Heater 72F-5A 16.1

> i

. 1

- l Attachment 1 to

,NRC-95-0105 l Page 2 i TABLE NO.1 480-Volt Emernency Load Secuencer List (Cont'd) 1 1

NOTE: 480V MCC's prefixed 72B are associated with Diesel Generator No. I1 480V MCC's prefixed 72C are associated with Diesel Generator No.12 l 480V MCC's prefixed 72E are associated with Diesel Generator No.13

, 480V MCC's prefixed 72F are associated with Diesel Generator No.14 4

4 1

4 1

1 4

l k

b I

i

. 0 . I ~ .

. / ..

n o ,'E % 6 cTpo T .1= B@(

' , c uc a

s

..:., as ecerrRae::~^~ "

so . p2

,e vs

cu

,,,3 4 aroon t7ou r tsoo.n.

9 :46,47/ 70

• _al. at s g 22150 ,, ,, 3 cc,7 Q res s* ree ee ree ' Nc7 T(sfr0 C * '

, , , . ,.y PcA n M i 'f

..u o sa Eo

'~

NM Y

st a 6 tcd%L

,9/ aig

.fa... n . ','J IJ,G'y, W

J282 k y J2 'S h*- .i ,ay[ g ?, a :6 )y Ja-st u v i ,.asmfaXreost-eet; >a F diI3 8 Js vi F.26 g ~a-@@, rk -

p.e, 3

., l3 O', s'g"j,,q,, 'S c an ,,s . s t ' ~ sn-e 3 ea l - k i3Ihs esl 44. .?

+a T.< ,,eg I' g-1 srIdht I M y k4 4r' sa aq'. eim-rra.ie f cm9

,' s4 .,

68. '

SL-JL4 I f*havii.. N

C'e sw4 65"' 62' ti T

en.%5,4(,."'!', vi

y. rc4,n 76 . *1 bisos

,(- n 6as sw.e [

. $II.arsasa 9aise E36u anti-na ,

I Tc4Y t o . ..  ! T05 3 ros 4 gm - ,,

b - I

• ll, 6M[IaT 3m '7.#_,4 n,,

^8' C A- av<

]> w.-

2 ut ,, us A

8" s2-a 44.< as o *r :4 A25 3 /

,, c' 16- ,,, at--

'm

') $. e

..r. I m.vn-sita

,.I e.,,,, . . . . - , . .....

u. o .

i Q g so g 3 it

u. ' -

it .

p 6 N - L%,8*t?

5 s g . ton t; 3, p ,

,. s. <6we H,

" 84 29?

';[ j!!!!

kRm\SSW2. *-.

aT .tu m )

IL

. v j i otti ses ,o %T- ~.

l *"tr3 343o  ;:

h TT 525 C

()

g g ,,

,y

- s-

. ,y, 2- a.

/{

<ftiQn p) =,j agg ,..;

s

=+

-a .it

( Q~-

,x ) s

/g / x ( $

e / ar l es../ gn L-g * , :E' Sap {(/* ssxx tj

~-

.n. ,

N. 4[3 8 M u li 3 ., -

s bt ,

s ._ _ ,:.

'f

/

/ pin ssoneaea '#J W;e a #f s's P t wo C A 44. 8 c. < r. s. fi s sai t PAU465tp JJ &P

(.SEE 61N-2572 55,2?

ft ' .. /

- [

t m

1. " b, 5 II $t W S." M $ El $

• o l >

1t  !

I

.,N _

&" S Mn .

sN e

f- _ F" o s s

f. a f- _ T"r 5

}-

e' a,b

_ g." y , '5_ 'm -

f- _

7" p

w a

. e-e s

k t

. f j i .

8 m_"m

,E ~

c s

aN/

n . t e

4 s

, y 1

a' a "r ,

n

" F F , t

' s

' ' I , '

a .

c.

8 1 * ., L 1 e

t n

e 2 "m

. , { 0 c, ' I n f s ,,, h 6 .

' ' l s '

I IL e e s

e 0 0 M g IU g 1

. 4 s s

• re I

T.

) s a t , H T r ,

v Ue E

t D -

- ( -

_ N 7e -

' A

. 1, . F 3 M"""-

~ 2e $

y,.t . e L R E

Ma _

o. q , ';

~ t s e L s

. O w e

W,Ef O e g C 'c r E

.t

. g P. -

E" s n*."l. I

(

~

h F

I I

1 i <

l j(

f* 9 1

E U

Q t

t w e Y Yes u

e e

w e

} C t e

u N

s a ro o c, ,,n h E

. -aim R G

m

,gg i$e i 7 E E

M -

- 4

- ' gg I C

i-( E 4gtg# '

m m

P H

n -

e s

s e

e

[ [ k

>on

\

eN a

wi t

j -

ka t -

eum s -

e L c

sE" o

gen t

as

,a Nts i e m

r a

s 4T@T W T S 9 "

,* P-

, r A

c gTMT s

[

wstc c

- - - N~

~

J' 0t 2 e e*

C- 9 s 9 N.

t

- T' l stt i 'N jj

,estto !o g,,e-*

• 4 a A [.

A _

_ S a s a p

• s . t s

a c c. . c h M g .

. ,~

n -

E ~~

aA "

,q "

1. t

• l, 4W ,~

8 " ' q ,. . -

_ 0 8

i-t T g, -

_ 8 = ,

_. .e e _

S .

w _

~

lii fij llt i ,ll ,l ;l ' l !l