ML17311B174

LER 95-004-01:on 950329,containment Electrical Penetration Overcurrent Protective Devices Found Outside Design Basis. Caused by Error on Part of Original Architect Engineer. Modified Affected Circuits Critical to Normal Operational

ML17311B174
Person / Time
Site:	Palo Verde
Issue date:	09/04/1995
From:	Grabo B ARIZONA PUBLIC SERVICE CO. (FORMERLY ARIZONA NUCLEAR
To:
Shared Package
ML17311B171	List: ML17311B170 ML17311B174
References
LER-95-004, LER-95-4, NUDOCS 9509120076
Download: ML17311B174 (16)

Text

LICENSEE EVENT REPORT (LER)

ACILITYNAME (1) DOCKET NUMBER (2) PAGE (3)

Palo Verde Unit 1 0 5 0 0 0 5 2 8 1oFO 8 IT LE (4)

Containment Electrical Penetration Qvercurrent Protective Devices Outside the Desi n Basis EVENT DATE 6 LER NUMBER 6 REPORT DATE OTHER FACIUTIES INVOLVED 8 MONTH DAY YEAR SEQUENTIAL REVIQON MONTH FACIUTYNAMFS T NUMBERS NUMBER NUMBER Paio Verde Unit 2 0 5 0 0 0 5 2 9 0 3 2.9 9 5 9 5 0 0 4 0 1 0 9 0 4 9 5 Palo Verde Unit 3 0 5 0 0 0 5 3 0 IS REPORT IS SUBNTTED PURSUANT To THE REQUEST EMENTS OF 10 CFR B: (Ct>>ck ane or more af th>> fotrovvimp) (11) 20.402(b) 20.45(c) 50.73(a)(2)(iy) 73.71(b) 20.45(a)(1) (i) 50.35(c)(1) 50.73(a)(2)(v) 73.71(c) ~

20.45(a)(1) rii) 50.35(c)(2) 50.73(a)(2)(vii) OTHER (Specify in Abstract LEVEL(to) 8 5 20.45(a)(1) rai) 50.73(a)(2)(vpi)(A) beknv and in TeirL NRC Form X 50.73(a)(2)(i) 20.405(a)(1)+ X 50.73(a)(2)(u) 50.73(a)(2)(viu)(B) 20.4M(a) (t)(v) 50.73(a) (2)riii) 5073(a)(2)00 LICENSEE CONTACT FOR THIS LER (12)

E LEPHONE NUMBER Burton A. Grabo, Section Leader, Nuciear Regulatory Affairs 6 0 2 3'9 3 - 6 4 92 COMPLETE ONE UNE FOR EACH COMPONENT FAILURE DESCRIBED IN Ttas REPOR T (13)

CAUSE SYSTEM MANUFAC REPORTABLE CAUSE MANUFAC. REPORTABLE TURER TO NPRDS TURER TO NPRDS SUPPLEMENTAL REPORT EXPECTED (14) EXPECTED DAY YEAR SUBMISSON YES BI yes. complete EXPECTED SUBMISSION DATE)

X No DATE (1 5)

BsTRAGT (Umrt to 1 400 spaces. I.e., a pproximateiy Mieen sinple-space typevvritten lines) (1 5)

On March 29, 1995, at approximately 1400 MST, Palo Verde Units', 2, and 3 were in MODE 1 (POWER OPERATlON) when Arizona Public Service Company (APS)

Engineering determined that redundant ovezcurrent protection was not provided on thirty-four (34) electrical containment penetration circuits in each of Units 1, 2, and 3 resulting in a condition that was outside the design basis of the plant. Operations declared the thirty-four (34) affected containment penetration overcurrent protective devices inoperable and entered the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> shutdown action statement in accordance with TS 3.8.4 event was a design error on the part of the original Architect Engineer for

'. The cause of the using non-conservative assumptions during the initial plant design.'

As corrective action, the affected circuits critical to normal power operation were modified to include the required redundant overcurrent protective devices.

The remain'ing affected circuits were deenergized and a seven (7) day surveillance was implemented to verify the circuits remain deenergized until they comply with the design basis.

On May 17, and August 10, 1995, six (6) additional problem circuits were identified as not being included in the surveillance program for TS 3.8.4.1.

There have been no previous similar events reported pursuant to 10CFR50.73 in the last three years specific to containment penetration overcurrent protective devices.

'TI509120076 950904

'PDR ADOCK 05000528 S PDR

LICENSEE EVENT REPORT (LER) TEXT CONTINUATION ACUlYNAME DOCKET NUMBER LER NUMBER PAGE YEAR SEQUENllAL 'ENSK)

NUMBER  : NUMBER Palo Verde Unit 1 0 5 0 0 0 5 2'8 9 5 0 0 4 0 1 0 2 Cf0 8 1 ~ REPORTING REQUIREMENT:

This LER 528/529/530/95-004 is being written to report conditions that resulted in the nuclear plant being in a condition that was outside the design basis of the plant as specified in 10 CFR 50.73(a)(2)(ii)(B) and a condition prohibited by the plant's Technical Specifications as specified in 10 CFR 50.73(a)(2)(i)(B).

Specifically, on March 29, 1995, Palo Verde Units 1, 2, and 3 were in MODE 1 (POWER OPERATION) operating at approximately 85 percent, 9 percent, and 100 percent power, respectively, when as a result of a calculation reverification effort, Arizona Public Service Company (APS) Engineering personnel determined that redundant overcurrent protection was not provided on thirty-four (34) electrical containment (NH) penetration (PEN) circuits in each of Units 1, 2, and 3 (a total of one .hundred and -two).

The design basis for Palo Verde Nuclear Generating Station (PVNGS) requires, two (2) protective devices on the electrical circuits outside the containment penetrat'ion specifically credited for containment penetration feedthrough protection where calculated maximum fault current exceeds the thermal rating of the penetration feedthrough. As a result of APS Engineering's findings, Units 1, 2, and 3 were in a condition outside the design basis of the plant.

At approximately 1400 MST, on March 29, 1995, APS Management determined that the thirty-four (34) affected containment penetration overcurrent protective devices were not in compliance with plant Technical Specificat'ion (TS) 3.8.4.1 (Applicability Modes 1 through 4) which states in part:

"Primary and backup containment penetration conductor overcurrent protective devices associated with each containment electrical penetration circuit shall be OPERABLE. The scope of these protective devices excludes those circuits for which credible fault currents would not exceed the electrical penetration design rating.....

With one or more of the above required containment penetration conductor overcurrent protective devices inoperable:

a ~ Restore the protective device(s) to OPERABLE status or deenergize the circuit(s) by tripping the associated backup circuit breaker or racking -out or zemoving the inopezable device within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and declare the affected system or component inoperable and verify the backup circuit breaker racked out at least once per 7 days thereafter..."

Units 1, 2, and 3 Operations personnel (utility, licensed) declared the thirty-four (34) affected containment penetration overcurzent protective devices inoperable and entered the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> action statement for TS Limiting Condition for Operation (LCO) 3.8.4.1 Action (a). This 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> action .statement expired on April 1, 1995, at 1400 MST.

LICENSEE EVENT REPORT (LER) TEXT CONTINUATION ACIUTYNAME ~ DOCKET NUMBER 'ER NUMBER R PAGE YEAR NUMBER Palo Verde Unit 1 0 5 0 0 0 5 2 8 9 5 0 0 4 0 1 03of 0 8 Following the initial event, while reconciling the procedure that lists the electrical circuits subject to the requirements of TS 3.8.4.1 and the design calculations, APS Maintenance Engineering personnel discovered additional circuits not included in the surveillance program. The circuits were designed with redundant overcurrent protection; however, surveillance testing was not being performed on them. The following six problem circuits were identified by two separate engineers on different occasions.

Five (5) problem circuits were discovered on May 17, 1995. The affected circuits were the Control Element Assembly (CEA) hold bus (AA) circuits.

Units 2 and 3 Operations personnel deenezgized the affected circuits in accordance with TS LCO 3.8.4.1 Action (a). Unit 1 was in a refueling outage at the time, and TS LCO 3 '.4.1 was not applicable. The .affected circuits in Units 2 and 3 were restored to service after the .associated overcurrent protective devices were successfully tested. The affected circuits in Unit 1 were tested and returned to service prior to returning to MODE 4 following their (fifth) refueling outage (1R5).

The sixth problem circuit was discovered on August 10, 1995. The affected circuit was associated with the steam generator (AB) nozzle (NZL) dam control (XC) panel (PL). On August 10, 1995, Units 1, 2, and 3 Operations personnel entered TS LCO 3.8.4.1 Action (a). The affected circuit was deenezgized in each unit, and a seven (7) day conditional'urveillance was implemented to verify the affected circuit remained deenergized. The seven (7) day conditional surveillance requirement remained in effect until the associated overcurrent protective devices were successfully tested.

2 ~ EVENT DESCRIPTION:

On March 10, 1995, APS Engineering personnel identified that during the initial design of PVNGS, the penetration protection calculations (13-EC-PK-160 and 13-EC-PH-240) were performed using non-conservative assumptions. The problems with the calculations were found during a calculation reverification review.

The following problems were found with calculation 13-EC-PK-160:

a. The worst-case short circuit was postulated as a hot-to-neutral fault across the, containment penetration. The calculated maximum current was below the penetration conductor long-time rating, thus alleviating the need to credit two protective devices'owever, while performing a calculation reverification, APS Engineering discovered that a hot-to-ground fault (which is equally credible) results in a fault current that exceeds the penetration conductor long-time rating. As a.result, fifteen (15) electrical circuits, previously designed with only one protective device, now require two protective devices'.

Seven (7) circuits requiring redundant ovezcurrent protective devices were not analyzed or included in the original calculation.

0 4>>

LICENSEE EVENT REPORT (LER) TEXT CONTINUATION ACIUIYNAME . DOCKET NUMBER LER NUMBER PAGE YEAR SEOVENTlAL R NUMBER NUMBER Palo Verde Unit 1 0 5 0 0 0 5 2 8 9 5 0 0 4 0 1 0 4of0 8 The following problems were found with calculation 13-EC-PH-240:

a ~ Six (6) electrical circuits contained 125 volt DC circuit breakers (72) upstream of their respective inverters (INVT) which were credited as one of the required protection devices. The other protective devices were 480 volt AC circuit breakers (52) located downstream of their respective inverters. The correlation of current through an AC circuit breaker is not linear to that through a DC circuit breaker. The detailed engineering analysis necessary to coordinate AC and DC circuit breakers was not included in the original calculation.

b. The original calculation contained six (6) 120 volt AC circuits located downstream of voltage regulators (90) that credited the current limitation effect of the regulator plus the impedance of the downstream cables to limit short circuit current to a level below the penetration conductor long-time rating. As a result, primary and back-up overcurzent protective devices were not required.

However, considering the current limitation, effect of both the voltage regulator and the impedance of the downstream cables concurrently is not a valid assumption. The reverified short circuit levels, based on the full load current limiting effect of the voltage regulators, aze above the penetration long-time such, redundant overcurzent protective=devices coordinated with ratings's penetration feedthrough damage curves are'equired.

APS Engineering personnel, upon discovery of the errors in the original calculations, initiated an investigation in accordance with the APS Corrective Action Program. While preliminary information suggested that a number of circuits were involved, sufficient information on the specific circuits was not confirmed until )ust prior to the management decision on-Mazch 29, 1995.

At approximately 1400 MST on March 29, 1995, APS Management declared the affected containment penetrations inoperable; APS notified the NRC via the Emergency Notification System pursuant to 10CFR50.72(b)(1)(ii)(B).

Unit 1 was preparing to shut down on April 1, 1995, in order to enter a refueling outage. As a result, APS requested enforcement discretion to extend the Allowed Outage Time (AOT) for TS 3.8.4.1 to 1400 MST, April 4, 1995, in order to allow the performance of Steam Generator high temperature chemical cleaning prior to cooling down to MODE 5 (COLD SHUTDOWN). Discretion was verbally granted by the NRC on March 31, 1995.

Unit 1 remained in the extended action statement for TS 3.8.4.1 until at 1008 MST on April 3, 1995, when MODE 5 was achieved, and TS 3.8.4.1 was no longer applicable. The thirty-four (34) containment penetration overcurrent protective devices were returned to OPERABLE status during the (fifth) refueling outage (1R5) prior to MODE 4,(HOT SHUTDOWN) entry.

In Units 2 and 3, nine (9) of the thirty-four (34) electrical containment penetration circuits were required to be energized for safe plant operations. The remaining circuits could be deenergized without affecting power operation. On March 31, 1995, at 2048 MST and 1706 MST, respectively, Units 2 and 3 complied with the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> action statement for

II 0 LICENSEE EVENT REPORT (LER) TEXl" CONTINUATION DOCKET NUMBER LER NUMBER PAGE YEAR R NUMBER Palo Verde Unit 1 0 5 0 0 0 5 2 8 9 5 0 0 4 0 1 0 5 Cf 0 8 TS LCO 3.8.4.1 Action (a). The affected circuits were either modified,to comply with the PVNGS design requirements within their specified TS AOT or left deenergized to be modified at a later date, and an additional seven (7) day surveill'ance was implemented to verify that the affected circuits not required for normal power operation remain deenergized until they are returned to a configuration in compliance with the design basis.

On March 30, 1995, APS requested two Notices of Discretionary Enforcement (NOED) - one for TS 3.8.4.1 in Unit 1 (as discussed earlier) and the other for TS LCO 3.6.3 Action (1) (Applicability Modes 1 through 4) in Units 2 and 3 which states in part:

"With one oz more of the isolation valve(s) inoperable, maintain at least one isolation valve OPERABLE in each affected penetration that is open and either:

hours' a ~ Restore the inoperable valve(s) to OPERABLE status within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, or....

b. Be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 "

The NOED for TS 3 '.3 Action (1) was requested for Units 2 and 3 to extend.

the AOT for an additional 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> to add the required redundant protective device on the circuit for a Nuclear Cooling Water (CC) containment isolation valve (ZSV). The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> extension was a precautionary measure to preclude an unnecessary plant transient. The NOED was verbally, approved by the NRC on March 31,- 1995, but was not needed. The modifications were completed within the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> action statement for TS LCO 3.6:3 Action (l.a).

On May 17, 1995, APS Maintenance Engineering personnel discovered five (5) circuits identified in the Electrical Penetration Protection calculation that were not included in the procedure that lists the electrical circuits sub)ect to the requirements of TS 3.8.4.1. The affected circuits were the CEA hold bus circuits. The five (5) CEA hold bus circuits have the potential to affect any of the eighty-nine (89) CEA containment penetration feedthrough circuits depending on the CEA configuration on the hold bus. Units 2 and 3 Operations personnel deenezgized the affected circuits in accordance with TS LCO 3.8.4.1 Action (a). Unit 1 was in a refueling outage at the time, and TS LCO 3.8.4.1 was not applicable. The circuits in Units 2 and 3 were restored to service after the 'ffected associated overcurrent protective devices were successfully tested on May 18 and 19, 1995 respectively. The affected circuits in Unit 1 were tested and returned to service prior to returning to MODE 4 following their (fifth) refueling outage (1R5).

An evaluation was performed to determine capable of passing if the affected circuits were a credible faul't current that would exceed their associated electrical penetration design rating prior to May 17, 1995.

The evaluation, completed August 3, 1995, concluded that the affected circuits were capable of passing credible fault currents in excess of their associated electrical containment penetration design rating and

~l LICENSEE EVENT REPORT (LER) TEXT CONTINUATION ACILITYNAME DOCKET NUMBER LER NUMBER PAGE YEAR SEQUENBAt. REV NUMBER NUMBER Palo Verde Unit 1 0 5 0 0 0 5 2 8 9 5 0 0 4 0 1 06of08 should have been included in the scope of TS 3.8.4.1. The condition was

.determined to be reportable.

On August 10, 1995, APS Maintenance Engineering personnel discovered a circuit associated with the steam generator nozzle dam control panel that was not included in the procedure that lists the electrical circuits sub)ect to the requirements of TS 3.8.4.1. On August 10, 1995, Units 1, 2, and 3 Operations personnel entered TS LCO 3.8.4.1 Action (a). One of the protective devices in the affected circuit was a properly rated fuse while the redundant protective device was a breaker. The affected circuit was deenergized in each unit, and a seven (7) day conditional surveillance was implemented to verify'he affected circuit remained deenergized until August 23, 1995, when the circuits were returned to a configuration in compliance with the design basis.

3. ASSESSMENT OF THE SAFETY CONSEQUENCES'ND IMPLICATION OF THIS EVENT:

The OPERABILITY of the containment penetration conductor overcurrent protective devices. ensures that the fault current through a containment penetration feedthrough is less than its damage curve. This design feature prevents the circuits from delivering short-circuit currents of a magnitude and duration which could cause thermal damage to the penetrations.

The primary protective devices installed on the thirty-four (34) affected circuits reported in revision 0 of this LER were OPERABLE and capable of performing their safety function. Only the added assurance of the redundant containment protective devices was in question.

Regarding the additional circuits reported in this supplemental LER, at least one of the overcurzent protective devices in each circuit was a properly rated fuse which does not require testing in order to demonstrate OPERABILITY. Only the added assurance of a properly tested redundant, ovezcurzent protective device was in question. Furthermore, the affected circuits are not in continuous use during normal plant operation. The five (5) circuits associated with the CEA hold bus are used during maintenance and testing activities. The circuit associated with the steam generator nozzle dam control panel is continuously energized during all Modes; however, used during Modes in which TS LCO 3 '.4.1 is not applicable.

it is only This event did not result in any challenges to the fission product barriers oz result in any releases of radioactive materials. There were no adverse safety consequences or implications as a result of this event.

This event did not adversely affect'he safe operation of the plant or the health and safety of the public.

41 i+i LICENSEE EVENT REPORT (LER) TEXT CONTINUATION ACILflYNAME DOCKET NUMBER LER NUMBER PAGE YEAR R NUMBER Palo Verde Unit 1 0 5 0 0 0 5 2 8 9 5 0 0 4 0 1 0 7 Cf 0 8 4., CAUSE OF THE EVENT:

An investigation of the March 29, 1995 condition was performed under the APS Corrective Action Program. The investigation determined that the cause of the event was a design error on the part of the original Architect Engineer (A/E). When the design documents were transferred from the A/E to APS; only minimal review of their adequacy and completeness was performed by APS. The decision to perform only minimal reviews was based on APS'eliance on the expertise provided by the A/E, who was conducting design activities under the A/E's 10CFR50, Appendix B, Quality Assurance Program.

In 1989, APS discovered that many of the original calculations had not been updated to include the additions and changes made. during construction, start-up, and commercial operation. In addition, many of these calculations did not adequately explain the assumptions or rationale used by the original designers. In 1990, APS initiated the Calculation Reverification Program to address and resolve these discrepancies. The findings of this ongoing effort have resulted in the discovery by APS personnel of similar deficient design conditions and the initiation of required corrective actions to restore the plants to their approved design configuration (SALP Cause Code B: Design, Manufacturing, or Installation Error) .

Investigations aze being performed on the additional problem circuits discovered on May 17, 1995, and August 10, 1995. The investigations to date attributed the reasons for the circuits not being included in the surveillance program to oversights on the part of APS Engineering personnel during the development of the original PVNGS Technical Specifications and during the development of a 1989 Site Modification respectively.

No unusual characteristics of the work location (e.g., noise, heat, poor lighting) directly contributed to this event. There were no procedural errors which contributed to this event.

5. STRUCTURES, SYSTEMS, OR COMPONENTS INFORMATION:

As discussed in Section 1, the affected circuits were declared inoperable at the time the problem conditions were recognized. There are no indications that other structures, systems, or components were inoperable at the start of the events that contributed to the events. No components with multiple functions were involved. There were no component oz system failures involved; therefore, no safety systems were rendered inoperable.

There were no safety system actuations and none were required.

4l 0 LICENSEE EVENT REPORT (LER) TEXT CONTINUATION AQUlYNAME ~ DOCKET NUMBER LER NUMBER PAGE YEAR R NUMBER Palo Verde Unit 1 0 5 0 0 0 5 2 8 9 5 0 0 4 0 1 08of08 EXT CORRECTIVE ACTIONS TO PREVENT RECURRENCE:

On March 31, 1995, temporary modifications were installed in Units 2 and 3 to bring the nine (9) electrical circuits needed for normal power operation back in compliance with the design basis. The remaining affected circuits (those not required for power operation) in Units 2 and 3 were deenergized and aze being modified using permanent design modifications or analytically justified. An approved temporary procedure has been developed to perform a seven (7) day surveillance to verify that the affected circuits not required for normal power operation remain deenergized until they are returned to a configuration in compliance with the design basis. In Units 2 and 3, the thirty-four (34) affected circuits are expected to be returned to service by September 30, 1995.

Five (5) of the original thirty-four (34) affected circuits were subsequently re-evaluated by APS Design Engineering and found to be configured such that no hardware modifications were needed. Components in the existing circuits could be credited as a protective device or the Electrical Penetration Protection calculation could analytically justify that the circuits aze in compliance with the design basis.

The affected circuits in Unit 1 were corrected using permanent modifications or analytically justified prior to returning to MODE 4 following their (fifth) refueling outage (1R5).

The additional six circuits reported in 'this supplemental LER were tested and returned to service as discussed in section 2.

The Calculation Reverification Program will continue to review design calculations. The intent of the program is to confirm the adequacy and compliance of the plant design to the plant design basis. As part of the corrective action plan for the condition reported in revision 0 of this LER, the surveillance procedure that, satisfies TS 4.8.4.1 is being reconciled with the design calculation to ensure that all credited containment overcurrent protective devices are included in the surveillance program. Future findings will be addressed in accordance with the APS Corrective Action 'Program.

7. PREVIOUS SIMILAR EVENTS:

There have been no previous similar events reported pursuant to 10CFR50 73 in

~

the last three years specific to containment penetration overcurrent protective devices. However, findings from the ongoing Calculation Reverification Program have resulted in previously submitted LERs such as LERs 528/93-011-00 and its supplement 528/93-011-01, dated December 25, 1993, and February 6, 1995, respectively. The condition identified in these LERs indicated that it 480V power system.

may be possible to have substandard voltages on the Class 1E Previous corrective actions could not have prevented this event because the condition pre-existed the previous corrective actions.

ig) '

I