05000334/LER-1997-001, :on 970822,GL 96-01 Inadequate Surveillance Testing of Safety Related Logic Circuits Was Discovered. Caused by Inadequate Development of Safety Related Testing. Declared Subsystem Heaters Inoperable: Difference between revisions

From kanterella
Jump to navigation Jump to search
← Older edit
VisualWikitext
StriderTol Bot change
StriderTol Bot change
 
Line 1: Line 1:
{{Adams
#REDIRECT [[05000334/LER-1997-001]]
| number = ML20210V131
| issue date = 09/17/1997
| title = :on 970822,GL 96-01 Inadequate Surveillance Testing of Safety Related Logic Circuits Was Discovered. Caused by Inadequate Development of Safety Related Testing. Declared Subsystem Heaters Inoperable
| author name = Hart R, Jain S
| author affiliation = DUQUESNE LIGHT CO.
| addressee name =
| addressee affiliation = NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
| docket = 05000334
| license number =
| contact person =
| document report number = GL-96-01, GL-96-1, L-97-033, L-97-33, LER-97-001, LER-97-1, NUDOCS 9709230103
| document type = LICENSEE EVENT REPORT (SEE ALSO AO RO), TEXT-SAFETY REPORT
| page count = 21
}}
{{LER
| Title = :on 970822,GL 96-01 Inadequate Surveillance Testing of Safety Related Logic Circuits Was Discovered. Caused by Inadequate Development of Safety Related Testing. Declared Subsystem Heaters Inoperable
| Plant =
| Reporting criterion = 10 CFR 50.73(a)(2)(i)
| Power level =
| Mode =
| Docket = 05000334
| LER year = 1997
| LER number = 1
| LER revision = 0
| Event date =
| Report date =
| ENS =
| abstract =
}}
 
=text=
{{#Wiki_filter:l Duquesne @ Company g ;vy r ~.< Sii-St@pingport. PA 15071 0004 SUSHIL C. JAIN E74..*.,M7n,,"'','"*"'
rxNUjU$fE um, ~.., o..mo September 17,1997 L-97-033 1
Beaver Valley Power Station, Unit No.1 Docket No. 50-334 License No. DPR-66 LE'R 97-001-05
/
i United States Nuclear Regulatory Commission Document Control Desk Washington, DC 20555 1
In accordance with Appendix A, Beaver Valley Technical Specifications, the following Licensee Event Report is submitted:
i LER 97-001-05, 10 CFR 50.73(a)(2)(i), " Generic Letter 96-01 Inadequate Smycillance Testing of Safety Related Logic Circuits."
l
/
S. C. Jain Attachment f
I Ibh i
DEllVEllNii 9709230103 970917 0UAL17I PDR ADOCK 05000334 S
PDR f,ff!,flff,fhhfffflf
 
-! September 17,1997 L-97-033 Page 2 cc: Mr. H. J. Miller, Regional Administrator United States Nuclear Regulatory Commission Region 1 475 Allendale Road King of Prussia, PA 19406 Mr. D. S. Brinkman BVPS Licensing Project Manager United States Nuclear Regulatory Commission Washington, DC 20555 Mr. David Kern
. BVPS Senior Resident Inspector United States Nuclear Regulatory Commission Mr. J. A. Hultz Ohio Edison Company 76 S. Main Street Akron, OH 44308 i
Mr. Steven Dumek Centerior Energy Corporation 6670 Beta Drive Mayfield Valley, OH 44143
:- INPO Records Center 700 Galleria Parkway Atlanta, GA 30339-5957 Mr. Michael P. Murphy Bureau of Radiation Protection Department of Enviromnental Protection RCSOB-13th FIoor P.O. Box 8469 Hanisburg, PA 17105-8469 Director, Safety Evaluation & Control Virginia Electric & Power Company 5000 Dominion Blvd.
Innsbrook Tech. Center Glen Allen, VA 23060
 
Ike i OR N1.M U N Nt Cl.LAR RtUULAI(IRY COSINilSSION APPROV).1)llY 0%lli NO.3150 0104 (4 95)
LNPIRI S O43098 LSTN ATLD H1 RDrN FLR REhPONSf fD COMPLY % rni nils
.ea IN)'ORMADON COLLEFDON REQUIST 90 0 HRS FORW ARD COMMENT 5 kt GARDING Di*DI N L5nMATI TO THE INIOR M ATION LICENSEE EVENT REPORT (LER)
AND Rsces urn Actum eRANcH mwa m u s NWtt AR REot't.ATURV COMMlSMON. % AMilNJfDN, LC 20MM101. AND TO (Scf TcWsc fut required numlief of digitA tharacleft fut caeh blod)
THE PAPrPWORK RErA CDON PROffri01401040FTICE OF MANAoiMtW AND BUtan % AMHWHA DC Mn r ACILII) N AMt th Lu U i NU\\f tuk Q; PAOLth Bcave, Vallev Power Station Unit 1 05000334 iOr19
!!!LL Generic Letter 96-01 Inadequate Suncillance Testing of Safety Related Logic Circuits EVEN'l DNi1.(5) 1.F R Nt %114 R (6) l RI POR'l DNI F (7) l Of ill R I ACll.lTil S INVol.YF D(x) hEg 1N n AL klVihK A l P AllLff) NAME inA LLI NUMhtk M(WTH DAY YT AR Vf AR M %mF R M %f MR MWrH DAY VF4k u 08 22 97 97 001 05 09 17 97 l Heaver Valle) Power stanon Umt 2 05000412 OPERAl!NU
]
MODE (9) 20 402(by 20.405(e) 50 73(a X2xiv) 717 t(b)
POWER l()()
20 405(a t l yl) 50 36(c WI) 50 73(aW2 xv) 73.7)(c)
: 1. EVE L (10) 20 403(a X IXn) 50 36(cx2) 30 73(ax2Xvu)
OTitLR 20 40$(a (1)hio y
30 73(aX2 xi)
$0 73(aX2 xvinX A)
(s atfy m ataumt r
20 40$(a X l)OV)
SO 73(aX2xn) 30 73(aX2 XvmXil) t=km and m Ton 20.40S(a(iXv)
$0.73(aX 2 x m) 50 73(aX 2Xx)
NRC Fonn man 1.lCLNSLI CONTACT FOR 'l111% 1.F R (12)
NAML TELEPilONE NMil!LR (odwk Ann caki R. D. Ilart. Senior Licensing Supervisor (412) 393-5284 Ct AirllElL ONI l.1NL lOR LACilCONtPONENT I Alll'RE DESCRIHEDIN Tills RLIURT(13)
CAUbt 5)M1M COMPUNtNT MAM4 ACILktR kiPURIABLE l CAUhE S) SitM LUMPUNENT MANLF ALTLktR REPURlABLE r0 NPRD5 To NPRDS I
St TPI LMEN I Al. REPORT ENPI CI LD(14)
LNPLCTLD MOVOI DAY nAR YLS X
NO SUllMISSION orm.cawkt. ExPten o steMisskw DarD DATF(1St Alls I R ACT (Lmuted to i400 spees, e c., approumately 15 imgle-speed typewntten imes) (16)
As a result of reviews being performed in response to Genene Letter 9601, " Testing of Safety Related Logic Circuits," the following conditions have been discovered and determined to be reportaMe pursuant to the requirements of 10 CFR 50 73(a)(2)(i).
: 1. On February 13, 1997, at approximately 17tx) hours, with Beaver Valley Power Station (BVPS) Unit I at 100% reactor power, it was identified that the monthly Operational Surveillance Tests (OSTs) which verify operability of the Control Room Emergency Ventilation Subsystem do not contain adequate acceptance criteria. The OSTs were subsequently revised and were perfonned on Febniary 18,1997, at which time operabihty of the alTected emergency ventilation subsystem was venlied. The details of this condition are found on pages 2 and 3 of this report.
: 2. On April 2,1997, at approximately 1500 hours, with BVPS Umt 1 in Mode 5 at 0% power, it was identified that the OST which tests the Engineered Safety Feature (ESF) auto start circuitry of the Auxihary Feedwater (AFW) pumps tests only one of two control switch parallel paths. The OST was subsequently revised and operability of the AFW pump autostart circmtry was veritied by perfonnance of the OST on April 6,1997. The details of this condition are found on page 5 of this report.
: 3. On April 10,1997, at approximately 1500 hours with BVPS Unit I in Mode 5 at 0% power, it was identified that the ESF Actuation System P-11 interlock function of enabimg/ disabling amomatic actuation of the pressurizer power operated relief valves was not completely tested by existing surveillance procedures. The details of this condition are found on page 7 of this report.
4 On July 7,1997, at approximately 0930 hours, with BVPS Units I and 2 in Mode 5 at 0% reactor power, it was identified that portions of the winng for the Overtemperature Delta T Reactor Trip System Instrumentation Function were not tested by existing sunedlance procedures, This condition was identilied at both Units Additional testing was perfonned at both Umts to address this. The details of this condition are found on page 10 of this report.
: 5. On July 26,1997, at approximately 1530 hours, with BVPS Unit 1 in Mode 5 at 0% reactor power, it was identitied that the surveillance testing of the control circuit logic for the Emergency Diesel Generators'(EDGs') output circuit breaker and for the EDGs' automatic hmding was inadequate. Additional testing was perfonned to adequately address the testing of certain parallel contacts in each ciremt. The details of this condition are found on page 13 of this report.
: 6. On August 22,1997, at approximately I 530 hours, with BVPS Unit I at 100% reactor power, it was identified that the ESF functions " Loss of Power - 4.16LV Emergency Bus and 480V Emergency Bus (Degraded Voltage)" were not adequately tested by ewtmg suneilkmce procedures. Additional testing was performed to adetptately address this condition. The details of this conditwn are found on nage 16 of this report NactORM wat m
 
NRc toaht 3664 us NUCLEAR ntoutAlony costsussioN (4 95)
,e LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION FACiljTY NAhlE(I)
IX3CKET NUNinER (2)
LLR Nt'AlntR (6) l PAUL (3)
SEQULNTIAL.
REVISION Beaver Valley Power Station Unit 1 05000334 YEAR NUkn3ER NUhtBER 97 001 05 2 OF 19 Trxi orn=..p.a.e.9=w.n. wama e,
.mac ram mu(17;
 
==PLANT AND SYSTEM IDENTIFICATION==
Westinghouse Pressurized Water Reactor (PWR)
Control Room Emergency liabitability System (VI) -
Control Room Emergency Ventilation Subsystem {VI)
Control Room Emergency Ventilation Subsystem heaters "!-E 13 A and VS-E 13B (Vl/EHTR) t Control Room Emergency Ventilation Subsystem filters VS FL-1,2 and 3 {Vl/FLT)
* Energy Industry Identification System (Ells) codes and component function identifict codes appear in the text as (SS/CCC).
CONDITION PRIOR TO OCCURRENCE Unit 1: Mode 1,100% Reactor Powcr Unit 2: Mode 1,100% Reactor Pouct
 
==DESCRIPTION OF EVENT==
On February 13, 1997, at approximately 1700 hours, with Beaver Valley Power Station Unit I at 100% reactor power, it was identified that the monthly Operational Surveillance Tests (OSTs) !OST-44 A.02, " Control Room Ventilation System Test - Train A," and LOST-44A.03," Control Room Ventilation System Test Train B," which verify operability of the Control Room Emergency Ventilation Subsystem (VI) do not contain adequate acceptance criteria. Failure to adequately demonstrate the operability of the Control Room Emergency Ventilation Subsystem (VI) is a condition prohibited by Technical Specifications and is reportable pursuant to the requirements of 10 CFR 50.73(a)(2)(i). This was identified during the performance of reviews in response to Gencric Letter 96-01," Testing of Safety-Related Logic Circuits." Specifically, the OSTs performed to satisfy the surveillance requirements of the Technical Specifications (TS) for the Control Room liabitability System (VI) do not include verification of the operation of the Control Room Emergency Ventilation Subsystem heaters VS-E-13A and VS-E-13B { VI/EHTR) as a part of the TS acceptance criteria. Operation of the electric heaters is necessary to ensure that relative humidity of the influent airstream is maintained at s 70%, to reduce the buildup of moisture on the charcoal adsorbers and HEPA filters, so that the required decontamination efficiency can be achieved during accident conditions. There were no automatically or manually initiated safety system responses as a result of this event.
Control Room Emergency Ventilation Subsystem heaters VS-E 13A and VS-E 13B and associated filter bank VS-FL-1,2 and 3 were determined to be inoperable in accordance with TS requirements on February 13,1997, at 1819 hours. This action rendered one of the three emergency ventilation subsystems of the Control Room Emergency Habitability System for the combined Unit I and Unit 2 Control Room inoperabic. However, the other two cmergency ventilation subsystems remained fully operable. Since the Unit i Technical Specification (TS) Limiting Condition for Operation (LCO) 3.7.7.1 requires two out of three emergency ventilation subsystems to be operable, no entry into a TS action statement was required.
 
==CAUSE OF EVENT==
The cause of this event was the inadequate development of safety related logic testing procedures for the Control Room Emergency Ventilation Subsystem. This process failed to identify the need to include testing of the heaters as part of the monthly TS surveillance test acceptance criteria to verify operability of the Control Room Emergency Ventilation Subsystem.
NRC FUut 306A (491)
~
 
WRC tORM 366A,
U S NUCLEAR REOULA10RY COMMiss!ON -
(o 95)
LICENSEE EVENT REPORT (LER)
TEXT COYTINUATION
+
FACilIIY N AME (1)
[x)CKET NUMnLR (2) 1.ER NUMBER (6)
)
PAGE O)
SEQUENTIAL.
REvlSION Beaver Valley Power Station Unit 1 05000334-YEAR NUMBER NUMBER 97 001 05 3 OF 19 1t XT (H more apose o empmed, see a&btwnsi sopies or MLC Purm MA)(l 7)
ANAL,YSIS OF EVENT 1
Unit i TS Surveillance Requirement 4.7.7.1.1 requires the emergency ventilation subsystem to be demonstrated operabic at least once per 31 days by initiating Dow through the llEPA niter and charcoal adsorber train and verifying that the train operates for 15 minutes. To adequately verify that the train operates for 15 minutes, the operation of the respective emergency ventilation subsystem clectric heater (s) must be verined. That is, VS E 13A and VS-E-138 for the Unit I subsystem must be verified to be operating. The i
Unit i TS do not explicitly require verification of heater operability; howcVer, the heaters are part of the train.
f Review of Licensing documents _ shows that heater operation is necessary to justify the charcoal adsorber decontamination emeiency (95%) used in the DVPS accident analysis for control room habitability. This decontamination emeiency is based on using assigned decontamination emciencies for activated carbon contained in Regulatory Guide 1.52 (Rev. 2), Section C.6 and Table 2. BVPS Unit I committed to meeting these applicable sections of Regulatory Guide 1.52 (Rev. 2) regarding activated carbon testing in submittals to the NRC related to Unit i Technical Specincation Amendraent No 109, the amendment for the common Unit I and Unit 2 control room, which included Unit 1 Technical Specification 3/4.7.7 " Control Room Emergency llaLtability Systems." One of the requirements of the Regulatory Guide for using the 95% decontainination emeiency is maintaining the air stream to the charcoal adsorber at s70% relative humidity Operation of the electric heates, VS-E 13A and VS-E-13B, is necessary to ensure the relative humidity is controlled at s70% during an accident. Without mainnining the relative humidity at 570% during an accident, the respective control room cmergency ventilation subsystem may not be c1pabic of performing its safety function to ensure GDC 19 is met for design basis accidents which impact control room habitability.
Monthly Operational Surveillance Tests (OSTs) IOST-44A.02, " Control Room Ventilation System Test - Train A," and LOST-44A.03," Control Room Ventilation System Test - Train B," do not incluac verifying heater operation as a part of the acceptance 4
criteria. The OSTs do verify a local red indicating light for each heater, labeled " Heater Encruzed," but not as part of the acceptance criteria. Review of applicable engineering drawings, however, shows that the red indicating lights can be illuminated l
without the associated heater being energized. Therefore, this is not an acceptable method to scrify heater operation. An existing 18 month performance test, IBVT 01.44.02, measures the KW output of the heaters and verines that the heat dissipation of each heater j
is within a specine tolerance.
Analogous testing of the BVPS Unit 2 heaters was addressed in a previous Licensec Event Report supplement, LER 2 96-003-01, "Gencric Letter 96-01 Inadequate Testing of Safety Related Logic Circuits," dated January 24,1997.
1
 
==CORRECTIVE ACTIONS==
I, Control Room Emergency Ventilation Subsystem heaters VS-E-13A and VS-E-13B and associated filter bank VS-FL-1,2 and 3 (Vl/FLT) were determined inoperable by failing to meet the requirements of TS 4.7.7.L 1.b on February 13,1997, at 1819 hours.
t
: 2. Operational Surveillance Tests (OSTs) IOST-44A.02 and LOST-44A.03 ure revised by System Engineering on February 14, 1997, and approved for use February 17,1997. The calculated temperature rise across the heaters is included in the new -
acceptance criteria used to verify operability for Control Room Emergency Ventilation Subsystem heaters VS-E-13A and VS-E-
:- 13B.
: 3. Revised tests IOST-44A 02 and IOST-44A.03 were performed on February 18,1997, and operability of the afTected emergency ventilation subsystem was verified.
4 Surveillance testing of safety-related ventilation system heaters for both units has been reviewed and determined to adequately
: address the TS requirements.
}
: 5. In accordance with the Duquesne Light Company response to NRC Generic Letter 96-01 entitled " Testing of Safety-Related Logic Circuits," a comprehensive validation of Unit I and Unit 2 surveillance procedures with regard to satisfying logic testing NeldFORM 30eA H99 i
 
NkC l-ORM M6A U.S NLCLEAR RtOULA10RY CONtNilSSION (445)
LICENSEE EVENT REPORT (LER) 1 ENT CON 11%I'AllON f ACH 1I Y N AN1L (3) th:MT NUNtHER (2) t.tR NUNilitR (6)
PAUL (3) 5EQUENUAL RLvislON Beaver Valley Power Station Unit 1 05000334 YEAR NUMBLk NUNtBER 97 001 05 4 OF 19 i
TWI Of more spme a tegmed. me a&htumal sopus of NRC f arm MM(l 7) requirements of safety relat;d logic circuits is being performed These reviews will be completed as specified in our commitment response.
REPORTAHil.lTY The Unit 1 Technical Specification Definition 1.6," OPERABLE-OPERABILITY" states,"A system, subsystem, train, component or device shall bc OPERABLE or have OPERABILITY when it is capabic of performing its specified function (s). Implicit in this definition shall be the assumption that all necessary attendant instrumentation, controls, normal and emergency clutric power sources, cooling or seal water, lubrication or othc. auxiliary equipment that are required for the system, subsystem, train, component or device to perform its function (s) are also capable of performing their safety related function (s)." Therefore, the operation of the control room cmergency ventilation subsystem heaters must be scrified during the monthly OSTs for Surveillance Requirements.
Since the abose operabihty was not verified, the inadequacy of the surveillance procedures precluded the satisfactory demonstration of control room emergency ventilation subsystem operability. This represents a condition prohibited by TS and is reportable pursuant to the requirements of 10 CFR 50.73(a)(2)(i).
SAFETY IMPI ICATIONS One of the three emergency ventilation subsystems of the Control Room Emergency Habitability System for the combined Unit I and Unit 2 Control Room was declared inoperable as a result of the identified inadequate verification of heater operability, llowever, the other two emergency ventilation subsystems remained fully operable. Since the Unit i Technical Specification (TS) Limiting Condition for Operation (LCO) 3.7.7.1 requires two out of three emergency ventilation subsystems to be operable, no entry into a TS action statement was required.
As discussed, heater operability is required to maintain the humidity of the.upply ventilation s70% under accident conditions, to maintain the efficiency of the charcoal adsorbers and thereby support Control Room habitability. Unit i Emergency Ventilation Subsystem supply heaters ucre verified to be operable via new test criteria on Fet ruary 18,1997. This testing has demonstrated that there was no loss of heater operability. An 18 month preventive maintenance test which measures heater voltage and current has demonstrated heater heat dissipation performance on that frequency. In addition, periodic in-place and laboratory testing of the charcoal adsorber banks and HEPA filters has demonstrated that these components have satisfied the applicable TS surveillance requirements and have remained operable Based on this information, there were no safety implications to the health and safety of the public as a result of this event.
SIMil AR EVENTS There were eight similar events during the last two years regarding inadequate testing of safety related logie:
: 1. LER l 964)o4-00, " Generic Letter 96-01 incorrect Test Frequency of Safety Related Logic," dated April 24,1996
: 2. LER 196-006-00, " inadequate Testing of Safety injection Relays," dated May 15,1996.
: 3. LER l-96-C04-01, " Generic Letter 96-01 incorrect Test Frcquency of Safety Related Logic," dated July 8.1996.
& LER l-96-004-02," Generic Letter 96-01 incorrect Testing of Safety Related Logic Circuits," dated August 6,1996.
: 5. LER l-96-004 03," Generic Letter %01 incorrect Testing of Safety Related Logic Circuits," dated September 6,1996.
: 6. LER 196-0044)4, " Generic Letter 96-01 incorrect Testing of Safety Related Logic Circuits," dated December 20,1996.
: 7. LER 2-96 003-00. " Generic Letter 96-01 Inadequate Testing of Safety Related Logic," dated July 8,1996.
NRC FURM MA (6 9h I
 
l NRC FORht 366A,
(15 NUCLEAR REOUtAlORY CON 1AtlSSION (4 93) -
LICENSEE EVENT REl ORT (LER)
TEXT f OVIINt'ATION I
f ACILITY N AhtL (1)
DOCKET NUhtHER (2)
Lf R NUNtBER(6) i PAGE (3) st.qutxnAL REvlslON Deaver Valley Power Station Unit 1 05000334 YEAR NUhDIER N11MBER 97 001 05 5 OF 19 Ttxt at pas space e reqmrod, me edktitumal supies or Nkt rcem M6A)(I 7)
Pl ANT AND SYSTEM IDENTIFICATION Westinghouse Pressmited Water Reactor (PWR)
Auxiliary Feedwater Pumps :FW P 3 A and 3D (SJ/P)
Main Feedwater Pumps FW-P I A and IB (SJ/P)
* Energy Industry identification System (Ells) codes and component function identifier codes appear in the text as (SS/CCC).
CONDITION PRIOR TO OCCilRRENCE Unit 1: Mode 5,0% Reactor Power Unit 2: Mode 1,100% Reactor Power
 
==DESCRIPTION OF EVENT==
On April 2,1997, at approximately 1500 hours, with Beaver Valley Power Station Unit I in Mode 5 at 0% power, it was identified that the Operating Surveillance Test (OST), IOST 24.6," Auxiliary Feed Pumps Auto Start Test," which tests the Engineered Safety Feature (ESF) auto start circuitry of the Auxiliary Feedwater (AFW) pumps tests only one of two control switch parallel paths. I-OST 24.6 tests the ESF auto start circuitry for the AFW pumps IFW-P-3A and 3B (SJ/P) by tripping an overcurrent relay on the last running Main Feed Water (MFW) pump FW-P-I A and IB (SJ/P) during shutdown. Contacts from the control switches for each MFW pump are parr.llel to each other in the auto-start circuit for the AFW pumps. Tripping the last running MFW pump during plant shutdown only tests one of the two control switch parallel paths. Failure to adequately demonstrate the operability of the Engineered Safety Feature Actuation System Instrumentation is a condition prohibited by Technical Specifications and is reportable pursuant to the requirements of 10 CFR 50.73(a)(2)(i). This was identified during the performance of reviews in response to Generic Letter 96-01," Testing of Safety-Related Logic Circuits."
There were no automatically or manually initiated safety system responses as a result of this event.
CAllSE OF EVENT The cause of this event was the inadequate development of safety related logic testing procedures for the Auxiliary Feedwater System. This process failed to identify the need to include testing of both control switch parallel paths in the ESF auto start circuitry for the AFW pumps.
ANAINSIS OF EVENT Unit i Technical Specification (TS) Surveillance Requirement 4.3.2.1.1 requires each engineered safety feature actuation system instrumentation channel to be demonstrated operable by the performance of the channel check, channel calibration, and channel functional test operations during the mode and at the frequencies shown in Table 4.3-2. Table 4.3-2, item 7.c requires a channel functional test of the AFW pump auto start ESF feature via trip of the MFW pumps on a refueling interval in Modes I,2 and 3. A channel functional test is the injection of a simulated signal into the channel as close to the primary sensor as practicable to verify operability including alarm and/or trip functions. Current channel functional testing of the AFW auto start ESF feature on MFW pump shutdown is inadequate because it only tests one of two AFW pump control switch parallel paths.
The analogous ESF test at Unit 2 is adequate, since both of the parallel paths are tested NRC FURM kmA(+v%
 
kg)RM 366^.
u s nci. tax xtottalogy conuisum LICENSEE EVENT REPORT (LER) i txt rmTist'41:os i ACll.lTY N AMF (1)
IXJCh.EI NUMill R (2) 1.F R NUMHF R f 6) l PAUL (3)
SEQUhVil AL REViSt()N Beaver Valley ower Station Unit 1 050(X)334 YEAR NUMBER NUMBE R p
97 (X)I 05 6 OF 19 TEXT Of nwre spew a sequeed, has aMtumal wress of hKC ionn MA)(l 7)
 
==CORRECTIVE ACTIONS==
1 LOST-24 6 was revised on April 5,1997, to include testing of both AFW pump control switch parallel paths.
: 2. Operability of the AFW pump autostart circuitry was verified by performance of IOST 24 6 on April 6,1997.
: 3. In accordance with the Duquesne Light Company response to NRC Gencric Letter 96-01 entitled " Testing of Safety-Related Logic Circuits," a comprehensive validation of Unit I and Unit 2 surveillance procedures with regard to satisfying logic testing requirements of safety related logic circuits is being performed. These review s will be completed as specified in our commitment response.
REPORTAllII,ITY Failure to adequately demonstrate the operability of the Engineered Safety Feature Actuation System Instrumentation is a condition prohibited by Technical Specifications and is reportable pursuant to the requirements of 10 CFR 50.73(a)(2)(i).
SAFETY IMPI ICATIONS Both AFW pump control switch parallcl paths uere demonstrated to be fully functional. There was no loss of safety function. Based on this information, there wcre no safety implications to the health and safety of the public as a result of this event.
SIMll.AR EVENTS There wcre nine similar events during the last two ycars regarding inadequate testing of safety related logic:
: 1. LER l-964)044)0, " Generic Letter 96-01 Incorrect Test Frequency of Safety Related Logic," dated April 24,1996.
: 2. LER l-96-006-00, " inadequate Testing of Safety injection Relays," dated May 15,1996.
: 3. LER l 96-004-01," Generic Letter 96-01 Incorrect Test Frequency of Safety Related Logic," dated July 8,1996.
: 4. LER l 96-004-02," Generic Letter 96-01 Incorrect Testing of Safety Related Logic Circuits," dated August 6,1996.
: 5. LER l 96-004-03," Generic Letter 96-01 Incorrect Testing of Safety Related Logic Circuits," dated September 6,1996.
: 6. LER l-964)04-04," Generic Letter 96-01 Incorrect Testing of Safety Related Logic Circuits," dated December 20,1996.
: 7. LER 2-96-003-00," Generic Letter 96-01 Inadequate Testing of Safety Related Logic," dated July 8,1996.
: 8. LER 2-96-003-01," Generic Letter 964)I Inadequate Testing of Safety Related 1.ogic Circuits," dated January 24,1997.
: 9. LER l-97-001-00," Generic Letter 964)1 Inadequate Surveillance Testing of Control Room Emergency Ventilation Subsystem Heaters," dated March 10,1997.
NRC FORM JooA(wh
 
._.___.m
.. ~. _ _ _ _. _ _. -
4 NRC FORhl 366A,
U.h Nt'Cl. EAR kli)ULAIORY CONtAtissK)N (4 93)
LICENSEE EVENT REPORT (LER) 1 EXT (UNTINt!ATION F ACH.lTY NANtl(1)
IM K1F!r NUNim R (2) 1.LH NUNinLH (6) l PAOF (3) l SEQUEM LAL REvlslON l
Beaver Valley Power Station Unit 1 05000334 YEAR NL%ER NUhtHER 97 001 05 7 or 19 TEXT (if mase speca e requared, use addatuwasi spes of NRC Form le6A)( l 7)
 
==PLANT AND SYSTEM IDENTIFICATION==
Westinghouse Pressurized Water Reactor (PWR)
Solid State Protection System {JE)
Engineered Safety Features Action System {JE)
* Energy Industry identification System (Ells), system and component function identifier codes appear in the text as (SS/CCC)
CONDITION PRIOR TO OCCURRENCE Unit 1: Mode 5,0% Reactor Power Unit 2: Mode 1,100% Reactor Power
 
==DESCRIPTION OF EVENT==
On April 10,1997, at 1500 hours with Beaver Valley Power Station Unit 1 in Mode 5 at 0% power, it was identified that the Engineered Safety Feature Actuation System (ESFAS) {JE) P-il interlock function of enabling / disabling automatic actuation of the pressurizer power operated relief valves (PORVs) was not completely tested by existing surveillance procedures. Specifically, the output contacts from slave relay K628 in the Solid State Protection System (SSPS) (JE) which provide the enabling / disabling of the automatic actuation of the pressurizer PORVs was not tested.
The Unit i Technical Specification (TS) Table 3.3 3, " Engineered Safety Feature Actuation System Instrumentation," includes item 8.b., ESF INTERLOCKS - Pressurizer Pressure, P-ll. The TS BASES Section 3/4.3.1 and 3/4.3.2, " PROTECTIVE AND ENGINEERED SAFETY FEATURES (ESP) INSTRUMENTATION" identifies the functions performed by the ESFAS P ll interlock. This includes:- (above P-11) enabling auto actuation of the pressurizer PORVs and (below P 11) automatically disabling auto actuation of the pressurizer PORVs, unless the Reactor Vessel Over Pressure Protection System is in service. Without testing the output contacts of SSPS slave relay K628 associated with the PORV automatic actuation circuitry, the functionality of this particular P-il function was not adequately verified. Since Unit I was in Mode 5 at the time the condition was discovered, no immediate Limiting Condition for Operation (LCO) action statements wcrc applicable.
It was also determined that Unit 2 was not affected by this event. The Unit 2 ESFAS P-li mterlock functions do not include enabling / disabling the Unit 2 pressurizer PORV automatic actuation circuitry. Therefore, no corrective action was required at Unit 2.
There were no automatically or manually initiated safety system responses as a result of this event.
 
==CAUSE OF EVENT==
The cause of this event was the inadequate development of snrveillance procedures. In the development of the Technical Specification Surveillance Requirement (TSSR) test procedures for the ESF Interlock P-il functions (TSSR 4.3.2.1.1, Table 4.3 2, item 8 b.) completc testing of the enabling / disabling of the auto actuation of the pressurizer PORVs was not included.
unuunmm>
 
.-_ _-- -. ~ - -..~ _ _ _ - _,- _ - -. _., - -. -
- ~
- - - ~ -. - - _..
3 NkC l-ORM M6A.
U.S. NUCt1AR REOUt AIO3Y COMMisslON R
(4 9$)
LICENSEE EVENT REPORT (LER)
TIWT r'OVIINt'AllON F ACllIIY NAME (1)
DOCKET NUMHt R (2) 1.ER NUMHER (6) l PAGE (1)
SEWENTIAl.
REvlSION Beaver Valley Power Station Unit 1 05000334 YEAR NUMBER NUMilER -
97 001 05 8 OF 19
~
n xT orm..p me..a.
.m..i.,
of MC Fann MAXl7)
ANAL,YSIS OF EVENT Unit i TSSR 4.3.2.1.1 requires cach ESFAS instrumentation channel to be demonstrated operable by the performance of the channel 3
check, channel calibration and channel functional test operations during the modes and at the frequencies shown in Table 4.3-2.
Table 4.3 2, Item 8.b, "ESF INTERLOCKS, P II," requires a channel functional test on a quarterly frequency and a channel calibration test on a refueling frequency in Modes 1,2 or 3. The suncillance tests which perform these TSSRs do not test the output contacts from slave relay K628, in the SSPS, which provide enabling / disabling of the automatic actuation of the pressurizer PORVs, based on the status of the ESFAS P-il interlock. This ESFAS P il interlock function is listed in the Unit i TS Bases Section 3/4.3.1 and 3/4.3.2, " PROTECTIVE AND ENGINEERED SAFETY FEATURES (ESP) INSTRUMENTATION" However, tids specific function of the P-il interlock is not a separate TS ESFAS channel function.
 
==CORRECTIVE ACTIONS==
l. Temporary Operating Procedure ITOP 97-1I was developed, approved and used on April 11,1997 to test the K628 relay output contactr in the auto actuation circuit for the pressurizer PORVs. The relay comacts were determined to be operating properly.
: 2. Operating Manual Change Requests were written on April 23,1997 to revisc Operating Surveillance Tests to include routine testing of the K628 relay output contacts associated with the P-il interlock function of enabling / disabling auto actuation of the pressurizer PORVs. Appropriate procedure changes were scheduled to be completed prior to the next quarterly performance of TSSR 4.3.2.1.1, item 8 b. which was due on July 11,1997. The procedure changes were completed by Junc 6,1997,
: 3. In accordance with the Duquesne Light Company response to NRC Generic Lettet 96-01 entitled " Testing of Safety-Related Logic Circuits," a comprehensive validation of Unit I and Unit 2 surveillance procedures uith regard to satisfying logic testing requirements of safety related logic circuits is being performed. These reviews will be completed as specified in our commitment response.
 
==REPORTABILITY==
This event is being reported as a failure to adequately demonstrate the operability of the ESFAS Instrumentation, a condition prohibited by Technical Specifications, pursuant to the requirements of 10 CFR 50.73(a)(2) (i).
SAFETY IMPLICATIONS The ESFAS P-ll interlock function of enabling / disabling the auto actuation of the pressurizer PORVs was demonstrated to be operable by the additional testing performed in procedure ITOP-97-11 on April 11,1997 with Unit I still in Mode 5. There was no loss of ESFAS interlock function. Based on this information, there were no safety implications to the health and safety of the public as a result of this event.
SIMil,AR EVENTS There were ten similar events during the last two years regarding inadequate testing of safety related logic:
1.
LER M6-004-00, " Generic Letter 96-01 Incorrect Test Frequency of Safety Related Logic," dated April 24,1996, 2.
LER l 96-006-00, " Inadequate Testing of Safety injection Relays," dated May 15,1996.
3.
LER l-96-004-01," Generic Letter 96-01 incorrect Test Frequency of Safety Related Logic," dated July 8,1996.
RC DURM hA W99 m -
 
N"p iURM M^ -
63 s Nt cl. TAR Rtout.NioRY coMxussioN LICENSEE EVENT REPORT (LER) 1 LNT CONTI%I'ATION I ACll.iIY NAML(1) l Ix YJhi i NUMBIR (2) 1.tR NUMitLR m) l PAut (1) avutxnAt.
utvisioN Beaser Valley Power Station Unit 1 05000334 Yt^n saatta seui3tn 97 001 05 9 or 19 n v w
..9.e
.u,w,.im, asacs.m443t17)
~~
4.
LER l 96-004-02," Generic Letter 964)! Incorrect Testing of Safety Related Logic Circuits," dated August 6,1996.
5.
LER l-96-0044)3, " Generic Letter 96-01 Incorrect Testing of Safety Related Logic Circuits," dated September 6,1996.
6.
LER 196-004-04,"Gencric Letter 964)1 Incorrect Testing of Safety Rclated Logic Circuits," dated December 20,1996.
7.
LER 2-964)o3-00, " Generic Letter 96-01 Inadequate Testing of Safety Related Logic," dated July 8,1996.
1 8.
LER 2 96-003-01," Generic Letter 96-01 Inadequate Testing of Safety Related Logic Circuits," dated January 24,1997.
1.ER l-97-001-00," Generic Letter 96-01 Inadequate Surveillance Testing of Control Room Emergency Ventilation Subsystem 9.
llcaters," dated March 10,1997.
: 10. LER l 97-001-01," Generic Letter 96 01 Inadequate Surveillance Testing of ^uxiliary Feedwater Pump Auto Start Circuitr3"*
dated May 2,1997.
l I
i Nac nmst neeAis 99
 
.~-.__
z-
- ~. _ ~.._.- _ _.
. _.. ~ _ -. _ _.,. _ _ _
WRC rORM 3664,
U.s. NUCt1AR RLOULA'iORY COMMISSION (4 93),;
LICENSEE EVENT REPORT (LER)
TEXT MWilNt'ATION l
I ACll.IlY NAML (1)
IXXVI NUMnLR(2)
I LR NUMnER (6) l PAGE (3)
SEQtMIIAL RtvislON Deaver Valley Power Station Unit 1 05000334 GAR NW mER NUMBER 97 001 05 10 OF 19 l
1 1Wr Of more spese a esquud une sahtumal supies of MtC hwm b6A)(l 7) i
 
==PLANT AND SYSTEM IDENTIFICATION==
n j
Westinghouse Pressurized Water Reactor (PWR)
Reactor Trip System (RTS) {JC)*
j Encore Nuclear Instrumentation System (NIS) (IG)*
g Power Range Neutron Flux Detectors (IG/DET)*
J CEnergy Industry Identification Sptem (Ells), system and component function identiGer codes appear in the text as { SS/CCC)
CONDITION PRIOR TO OCCURRENCE Unit 1: Mode 5,0% Reactoi Power Unit 2: Mode 5,0% Reactor Power
 
==DESCRIPTION OF EVENT==
On July 17, 1997, at approximately 0930 hours, with the Beaver Valley Power Station (BVPS) Units I and 2 in Mode 5 and 0%
reactor pmver, reviews for NRC Generic Letter 96-01: " Testing of Safety Related Logic Circuits" identified that portions of the wiring that are part of the Unit i Overtemperature Delta T Reactor Trip System (RTS) (JC) Instrumentation Function were not being tested dering the periodic sutveillance performed for the channel calibration testing of this function. It was also identified that the corresponding wiring for the Unit 2 Ove: temperature Delta T RTS Function was not being tested duriag the Unit 2 Surveillance for the channel calibration testing of this function. The Technical Specification Surveillance Requirements (TSSR) not being adequately met for chamiel calibration testing were TSSR 4.3.1.1.1 Table 4.3 1, item 7, Overtemperat ire Delta T, for both Units.
The Generic Letter 96-01 resiews being performed for Unit 1 identified portions of wiring in the Excore Nuchar Instrumentation System (NIS) (IG) power range neutron flux detectors' (IG/DET) signal path, which are inputs to both the Overtemperature Delta T and Cverpowcr Delta T RTS Instrumentation Functions and were not being verified as functional by the existing coannel calibration surveillance testing for these two functions. The calibration testing is performed at a frequency of at least once c'ery 18 months, Both RTS Instrumentation Functions provide variable reactor trip setpoints which are continuously calculated based on the value of a number of input variables as def'med in an equation in each Unit's Tecnnical Specification Table 2.2-1. Both RTS Instrumentation Functions initiate a reactor trip on a 2 of 3 channel coicidence F One of the inputs is a neutron flux signal from three of the four excore power range neutron flux detectors. Each power rangt.icutron flux detector provides two signals corresponding to the neutron flux in the upper and in the lower sections of a reactor core quadrant. The difference in the neutron flux between the upper and lower sections of each power range detector provides a measure of axial power imbalance which is used to limit the Overtemperature Delta T setpoint at both Units. The neutron flux values are also input to the Overpower Delta T RTS function at both Units; however, in accordance with the equation in Technical Specification Table 21 1 for each Unit the neutron flux values are not used to adjust the Overpower Delta T setpoints. Additionally, the Overpower Delta T RTS function cannot be affected by the inputs from the power range neutron flux detectors regardless of their values or failure modes. Therefore, it is not necessary to test this wiring to verify the functionality of the Overpower Delta T RTS function at either Unit.
The wiring which was not oeing functionally verified in each NIS channel included wiring from the output of an individual isolation amplifier for each upper flux and lower flux signal (generically designated NM3% for the upper flux signal and NM307 for the lower flux signal) in the Nuclear Instrumentation Rack (RK-NUC-INS) to a test toggle switch for each upper flux and lower flux signal located in the Primary Process Racks. The wiring involved consisted of three sections for each upper and lower flux signal path: a length of wire in RK-NUC-INS from the output of each isolation amplifier to a terminal board, a length of wire from the terminal board in the RK-NUS-INS loct.ted in the control room to a terminal board in the Primary Process Rack located in the Service Building at Elevation 713 feet, and a length of wire from the Primary Process Rack terminal board to the test toggle switch.
hRC FORM 3e6A (4M)
 
NucIORxt M A U S NL CLLA6f OlMIORY CONthilhSION (4-91) 1.lCENSEE EVENT REPORT (1.ER)
TENT CONilNt'AllON F ACILI rY N AME (1) lx nl:T NU\\llit R (2) 1.t R NUNint R ((q J
P AGE (1)
MMUlWilAl REV]slON Deaver Valley Power Station Unit 1 05000334 YEAR NUhutEk NUNtBER 97 001 05 11OF19 nrror
.w..m.o.m.%
auc w mit17)
The extent of the wiring not functionally tested at Unit 2, was nearly identical. It included a length of wiring internal to the Nuclear Instrumentation Rack (RK 2NUC-INS) from the output of isolation amphriers Nht-306 and Nhi 307, respectively, to a terminal ble:k; and a second length of wiring from the terminal block in RK 2NUC-INS located in the control room to a terminal block in the Primary Process Control Panel located in the control building at elevation 707 fect. All applicable wiring internal to the Primary Process Control Panel was being functionally scrined at Unit 2.
Failure to verify the functionality of this wiring at both Units I and 2 constituted a failure to adequately meet the requirements of Technical Specification 3.3.1.1, " Reactor Trip System Instrumentation" at both Umts I and 2 and constitu;cd a failure to meet the Limiting Conditions of Operation for the Overtemperaturc Dcita T RTS Instrumentation function. Since this RTS function is only required in Modes 1 and 2 and both Units were in Mode 5 when this condition was identified, no specific immediate action was required in accordance with the Technical Speci0 cations a restriction on entering hiode 2 at cach Unit was established imtil this condition was corrected at that Unit.
Condition Report 971224 was written to document the identincation of this event.
 
==CAUSE OF THE EVENT==
The apparent cause of this event at both Units was thq inadequate development of suncillance procedures for the channel calibration testing of the Overtemperature Delta T RTS Instrumentation Function.
At both Units the procedures used to perform the testing of this RTS Instrumentation function lacked sufficient overlap testing to test all the wiring that is part of this function.
ANAINSIS OF EVENT The TSSR 4.3.1.1.1 for both Units I and 2 requires cach reactor trip system instrumentation channel to be demonstrated operable by the performance of the channel check, channel calibration and channel functional test operations during the modes and at the frequencies shown in their respective Technical Specification Table 4.3-1. Table 4.3-1, item 7 for both Units requires a channel calibration of the Overtemperature Delta T function at least once every 18 months in hiodes I and 2. A channel calibration shall encompass the entire channel including the sensor and alarm and/or trip functions. It may be performed by any series of sequential, overlapping or total channel steps such that the entire channel is calibrated.
At both Units the existing surveillance procedures did not contain sulTicient overlap testing to functionally verify a portion of the wiring for the Overtemperature Delta T function. Therefore, the operability of the entire channel was not venned at either Unit.
 
==CORRECTIVE ACTIONS==
1.
hiaintenance Work Requests (h1WR) 064442, 064443 and 064444 were untien to test the winng not tested by existing surveillance procedures at Umt 1. htWRs 064456,064457 and 064458 were written to test the wiring not tested by existing surveillance procedures at Umt 2.
Following the successful completion of this testing, the respective Unit Nuclear Shift Supervisor operationally accepted the associated equipment on July 23,1997, at Unit I and on July 20,1997, at Unit 2. Each Unit was still in Ntode 5 at the time of operational acceptance.
2 Existing survei!!ance procedures were revised at both Units [N!aintenance Surveillance Procedures (NISP) INISP-2.03-1, lhtSP-2 04-1 and IhtSP-2.05-1 at U'ut I and 2h1SP-2.03-1,2htSP-2.04-1 and 2htSP-2.05-I at Unit 2l to mcorporate the testing of the wiring in question during the regular performances of the channel calibration testing for the Overtemperature Delta T RTS Instnamentation function. These procedure revisions were completed by July 25,1997.
uc m w m,
 
4 NRCiOlQtM 3, U S NUClLAR RLOUlAIORY CON!hilSSION l (4-93)
:- LICENSEE IVENT REPORT (LER)
TEXY(UNTINUATION P ACilJIY N AML(1)
IN iCKET NUAlnF R (2) 1.tk NUhtnl R (6)
H PAGE (1) sLQUEKHAL RLvisiON Beaver Valley Power Station Unit 1 05000334 YEAR m mER m inLR 97 001 05 12 or 19 TEXT Of nuwe spese a sequued, une adetumal uties of NRC Farin h6A)(l 7)
: 3. In accordance with the Duquesne Light Company response to NRC Generic Letter 96-01 entitled " Testing of Safety Related Logic Circuits," a comprehensive validation of Unit I and Unit 2 surveillance procedures with regard to satisfying logic testing rcquirements of safety related logic circuits is being performed. These reviews will be completed as specified in our commitment response.
REPORTABil.lTY Failure to adequately demonstrate the operability of all the wiring associated with the Overtemperature Delta T Reactor Trip System Instrumentation is a condition prohibited by Technical Specifications and is reportable pursuant to the requirements of 10 CFR 50.73(a)(2)(i) at both Units.
S AFETY IMPI.lCATIONS Additional testing at Units I and 2 demonstra'ed the wiring not previously tested by existing surveillance procedures to be fully functional. There was no loss of safety function.13ased on this information, there were no safety implications to the health and safety of the public as a result of this event.
SIMil.AR EVENTS There were cleven similar events during the last two years regarding inadequate testing of safety related logic:
1.
LER l-96-004 00, " Generic Letter 96-01 incorrect Test Frequency of Safety Related Logic," dated Ap-24,1996.
2.
LER 196-006-00, " Inadequate Testing of Safety injection Relays," dated hiay 15,1996.
3.
LER l 96-004 01," Generic Letter 96-01 Incorrect Test Frequency of Safety Related Logic," dated July 8,1996.
4.
LER l-96-004-02," Generic Letter 96 01 Incorrect Testing of Safety Related Logic Circuits," dated August 6,1996.
5.
LER 1 96-004-03, " Generic Letter 96-01 incorrect Testing of Safety Related Logic Circuits," dated September 6,1996.
6..
LER l 96-004-04, " Generic Letter 96-01 Incorrect Testing of Safety Related Logic Circuits," dated December 20,1996.
7, LER 2-96-003-00, " Generic Letter 96-01 Inadequate Testing of Safety Related Logic," dated July 8,1996.
8.
LER 2-96-003-01, " Generic Letter 96-01 Inadequate Testing of Safety Related Logic Circuits," dated January 24.1997.
: 9. - LER l-97-001-00," Generic Letter 9641 Inadequate Surveillance Testing of Control Room Emergency Vcutilation Subsystem
)
Heaters," dated h1 arch 10,1997.
J
: 10. LER l-97-001-01," Generic Letter 96-01 Inadequate Surveillance Testing of Auxiliary Feedwater Pump Auto Start Circuitry",
dated hiay 2,1997.
: 11. z LER l 97-001-02, " Generic Letter 96-01 Inadequate Surveillance Testing of Engineered Safety Feature P-Il Interlock Function," dated Niay 7,1997.
I hRC FORM keAp.9N
:- l
)
 
NRC l ulf Al %6A, t r S hl'Cl.1 AR kl OUl.AlORY CONtNilSSION (445)
LICENSEE EVENT REPORT (LER) uxi ( os11s t'A1:Us F ACll. fly N ANtL(1)
IM K M i Nt'Nnu R (2) 1 I R Nt'NinFR (M PAUt (3)
SLvCFMIAL RLvislON Beaver Valley Power Station Unit 1 05000334 YFAR nuu;R Nt 'h!DLR 97 001 05 13 or 19 11NT Of nuws spete a rapwat ime e&hrwel wnes of hkr hem M,(l 7)
Pl ANT AND SYSTEM IDENTIFICATION Westinghouse Pressuri/cd Water Reactor (PWR)
Emergency Dicscl Generators (EDGs) (EK)*
4.160 Voh Circuit Breakers (EA/52)*
OEnergy industry identification System (Ells), system and component function identifier codes appear in the text as (SS/CCC)
CONDITION PRIOR TO OCCURRENCE Unit 1: Mode 5,0% Reactor Powct
 
==DESCRIPTION OF EVENT==
On July 26,1997, at approximately 1530 hours, with Beaver Valley Power Station (BVPS) Unit 1 in Mode 5 at 0% reactor powcr, it l
was identified during the Generic Letter (GL) 96-01 review ciTort that the surveillance testing of the control circuit logic for the Emergency Diesci Generators' (EDGs') { EK) output circuit breaker and for the EDGs' automatic loading was inadequate.
Review of the specific surveillance testing performed for EDG automatic loading at an 18 month frequency, IOST-36.3 for EDG EE-EG-1 and IOST-36.4 for EDG EE-EG-2, found that certain parnllel circuit paths existed in the EDG output circuit breaker (EA/52) circuit and in the EDG automatic loading circuit for each EDG, which were not individually verified as functional by the test method used. The subject circuit paths associated with each EDG imolved auxiliary switch contacts in parallel from two 4,160 volt circuit breakers, one from a non safety related circuit breaker on the 4,160 volt non-emergencv bus and one from a safety-related circuit breaker on the 4,160 volt emergency bus. These circuit breakers, arranged in series, normally function to energize a 4:160 volt emergency bus. Specifically,4,160 volt non-safety related circuit breaker I A10 on the non cmergency bus l A normally energi/cs the I AE cmcrgency bus through safety-related feeder breaker IE7 on the I AE bus and 4,160 solt non-safety related circuit breaker IDIO on the non-cmergency bus ID nonnally energizes the IDF emergency bus through safety-related feeder breaker IF7 on the IDF bus. The surveillance testing did verify that the control circuit logic for the EDG output circuit breaker and for the EDG automatic loading had at least one functional circuit path through each parallel circuit in question (i.e., it verined that at least one of the two parallel paths through the auxiliary switch contacts from the 4,160 volt breakers had continuity). However, the testing method did not identify which circuit path was functional. The GL 96-01 review concluded that only the circuit paths utilizing the safety-related circuit breaker contact should be credited for satisfying thc applicable Technical Specification Surveillance Requirements (TSSRs).
For the subject circuit paths a closed auxiliary switch contact represents: (1) the associated 4,160 volt circuit breaker being open. (2) the associated 4,160 volt emergency bus being de-energized from its normal 4,160 volt non-cmcrgency bus and (3) satisfying one of H
Therefore, the testing did functionally verify that the portion of Unit i TSSR 4.81.1.2.b.3.a requiring " verifying de-energization of the emergency busses" was satisfied and that the portion of TSSR 4.8.1.1.2.b.3 b requiring " verifying the diesel, energizes the emergency busses.. (and).. energizes the auto-connected emergency loads through the load sequencer.. " was satisifed. Howeser, the lack ofinformation provided by the surveillance testing concerning the functionality of individual portions of the parallel paths through the contact from the safety-related circuit breaker was inconsistent with adequate testing of the logic function.
NkC K)RM W i4.W
 
hKC l ORh! M4A, tu N('cllAR Ri ocl.Alogy coystissios (4-93)
LICENSEE EVENT REPORT (LER)
'I ENT COYIINt' ATION i ACn.Il Y N AMI-O )
lx CM ~l Ntatnl R (2) 11R NL Tint R (f.)
l l>Aut p)
ShyULVilAL RLV!SION Beaser Valley Power Station Unit 1 0$(KK034 YF.AR NUNUE R NUhttitR 97 001 05 14 or 19 TFYhlt more speu o respared une sikktamal ri3*nn of Mtc Form inoAi(l 7)
Based on this information, Condition Report 971296 was written to document identification of inadequate surveillance testing and the control room was notified At the time of notification Unit I was in Mode 5 with both EDGs already declared inoperable due to another condition.
The corresponding Unit 2 control circuits for the EDG output circuit breaker and the EDG automatic loading were resiewed. No similar problem exists, since those circuits do not have similar parallel circuit paths.
CAUSE OF Tile EVENT The apparent cause of this event is that during the development of surveillance procedures IOST-36.3 and LOST ^i6.4, it was apparently not considered necessary to individually test cach portion of the parallel circuit paths in question.
ANAINSIS OF EVEPiT Unit i TSSR 4.8.1.1.2b.3.a requires, in part, that "cach diesel generator shall be demonstrated OPERABLE at least once per 18 months during shutdown by simulating a loss of o!Tsite power in conjunction with a safety injection signal and verifying de-energitation of the emergency busses., "
Unit i TSSR 4.8.1.1.2b.3.b requires, in part, that "cach dicscl generator shall be demonstrated OPERABLE at least once per 18 months during shutdown by simulating a loss of offsite power in conjunction with a safety injection signal and verifying the dicsci
. energizes the emergency busses.. (and).. energizes the autxonnected emergency loads through the load sequencer.. "
The existing surveillance testing performed in IOST-36.3 for EE-EG-1 and in IOST-36.4 for EE-EG-2 did demonstrate that the above TSSRs were functionally met. Ilowever, it did not specifically identify whether the circuit path through the safety related circuit breaker contact was functional and therefore was inadequate to use for satisfying the TSSR. This led to the conclusion that the existing testing was inadequate.
 
==CORRECTIVE ACTIONS==
: 1. Upon control room notification of this event, a prohibition was placed on Unit i entering Mode 4 until resolution of this event.
At the time of notification, the Unit was in Mode 5 with both EDGs already declared inoperable due to other issues. The ACTION statement for Technical Specilication 3.8.1.2, " Electrical Poner Systems (Shutdown)" was already in efTect.
: 2. Temporary Operating Procedures ITOP-9718, "4KV Emergency Bus I AE Tic Breaker Pallet Test," and ITOP-9719, "4KV Emergency Bus IDF Tic Breaker Pallet Test" were written, approved and performed by July 28, 1997, to perform additional testing to fully verify the parallel circuit paths in question. No problems were identified by this additional testing. Following completion of this testing EDG EE-EG-1 was declared OPERABLE on July 28,1997, at 0442 hours and EDG EE-EG-2 was declared OPERABLE on July 28,1997, at 1337 hours.
: 3. Appropriate resisions will be made to the surveillance procedures to adequately test the parallel circuit paths in question during routine surveillance testing. These revisions will be completed by October 17,1997.
: 4. In accordance with the Duquesne Light Company response to NRC Generic Letter 96-01 entitled " Testing of Safety-Related Logic Circuits " a comprehensive validation of Unit I and Unit 2 surveillance procedures with regard to satisfying logic testing requirements of safety related logic circuits is being performed. These reviews will be completed as specified in our commitment response W
wmum
 
m
,,,,_,_ _ _ _ _ _ __, l FORM W U.s NUCLEAR REGUlAlORY CONtNilSMON
)
LICENSG EVENT REPORT (LER) 1 F.XT CONTINt'ATION
)
:- t ACll.1 ry NAML(l)
DOCMff NUMlif R(2) 1.ER N1lAttiLR(6)
I l' AGE (3)
ShQUENTIAL khylSION 4
Beaver Valley Power Station Unit 1 05000334 YFAR NUMittk NUMllER 97 001 05 15cr19 nrror
,=4.-m.w
.rwac n-wr>p 73
)
REPORTABil.ITY a
Based on the Generic Letter 96-01 review, this event is being reported as a failure to adequately demonstrate the operability of the control circuit logic for the EDG catput circuit breaker and for the EDG automatic loading. This is a condition prohibited by l
Technical Specifications and is reportable pursuant to the requirements of 10 CFR 50.73(a)(2)(i).
y SAFETY IMPLICATIONS l
1 l
Additional testing of the EDG related control circuit logic circuitry was performed and demonstrated that all logic circuitry was i
functional. There was no loss of safety function. Based on this information, there were no safety implications to the health and y
j safety of the public as a result of this event.
+
SIMil.AR EVENTS y
There were twelve similar events during the last two years regarding inadequate testing of safety related logic:
j 1.
LER 1964)044)0, " Generic Letter 96-01 Incorrect Test Frequency of Safety Related Logic," dated April 24,19%.
2.
LER l 96-006-00, " inadequate Testing of Safety injection Relays," dated May 15,1996.
3.
LER l 964)04-01, " Generic Letter 96-01 Incorrect Test Frequency of Safety Related Logic," dated July 8,1996.
i 4.
LER I.96-004-02," Generic Letter 96-01 Incorrect Testing of Safety Related Logic Circuits," dated August 6,1996.
j-5.
LER.1-96-0044)3," Generic Letter 96-01 Incorrect Testing of Safety Related Logic Cinemts " dated September 6,1996, 6.
LER 196-004-04," Generic Letter 96-01 Incorrect Testing of Safety Related Logic Circuits," dated December 20,1996.
7.
LER 2 96-003 00, " Generic Letter 96-01 Inadequate Testing of Safety Related Logic " dated July 8,1996.
f j
8.
LER 2-96-003-01, " Generic Letter 96 01 Inadequate Testing of Safety Related Logic Circuits," dated January 24,1997.
9.
LER l 97-00100," Generic Letter 964)1 Inadequate Surveillance Testing of Control Room u.nergency Ventilation Subsystem l
Heaters," dated March 10,1997.
l10. LER l-97-001-01," Generic Letter 96-01 Inadequate Surveillance Testing of Auxiliary Feedwater Pump Auto Start Circuitry",
i dated May 2,1997.
{
11; _ LER l 97-001-02, " Generic Lettu 96-01 Inadequate Surveillance Testing of Engmeered Safety Feature P-il Interlock Function," dated May 7,1997.
: 12. LER 197-0014)3, " Generic Letter 96-01 Inadequate Surveillance Testing of Safety Related Logic Circuits," dated August 14,
}_
1997.
hRd FORM MA(+9b 4
5 1
 
N HC F Ol( Al %6 A,
U h. Nt'ClJ AR Ri Ut IA1OR) COMNil5 MON (4 93)
I.lCENSEE EVENT REPORT (LFR)
'I FMT CONTINJA IlON I ACll.1h N AMF (1) lx nt i NnlMy (2)
{ J R Nnmt R g,y j
g,4gygy SEQULKnAL RLvislON Beaver Valley Power Station Unit 1 050(x034 WR Nanak NL'MW R 97 001 05 16 or 19 I
n rt (n im== spm a i.qim t u.e mmnul smen orNRc Form uA>( l 7)
 
==PLANT AND SYSTEM IDENTIFICATION==
Westinghouse Pressuriicd Water Reactor (PWR)
Engineered Safety Features (ESP) Actuation System {JE)*
Emergency Buses 4.16 kilovolt and 480 volt (EB)*
Emergency Bus Relay (ED/RLY)*
* Energy industry identincation System (Ells), system and component function identifier codes appear in the text as (SS/CCC).
CONDITION PRIOR TO OCCURRENCE Unit 1: hiode I,100% Reactor Power DESCRIPTION OF EVEN [
On August 22,1997, at approximately 1530 hours, with the Beaver Valley Power Station (BVPS) Unit 1 in hiode I at 100 percent reactor power, it was identified by the Generic Letter (GL) 96-01 review effort that the surveillance procedures for the Engineered Safety Features (ESF) Actuation System (JE) functions " Loss of Power - 4.16kV Emergency Bus and 480V Emergency Bus (Degraded Voltage)" were inadequate. The existmg surveillance tests as written, did not ensure the operability of the entire control circuit associated with these functions would be verified. As a result, the last performance of channel calibration testing for the Train "A" cmergency buses (i e., the 4.16kV Bus AE and the 480 volt Bus 8N) {EB) completed on April 28,1996, did not verify the operability of the entire degraded grid voltage control circuit for the Train "A" cmergency buses. The last performance of the channel calibration testing for the Train "B" emergency buses (i.e., the 4.16kV Bus DF and the 480 volt Bus 9P) completed on April 10,1996, however, was adequate. As a result, all of the Train "A" degraded voltage channels - two per 4.16kV Emergency Bus and two per 480 volt Emergency Bus - wcre inadequately tested and therefore inoperable.
The Unit i Technical Specification Surveillance Requirement (TSSR) 4.3.2.1.1, Table 4.3-2, Item 6 b, " Loss of Power - 4.16kV and 480V Emergency Bus Undenoltage (Degraded Voltage)" requires a channel calibration to be performed at least once every 18 months. Implicit in this requirement is the verification that the entire safety function is operable. hiaintenance Surveillance Precedures (htSPs) are performed at an 18 month frequency to calibrate the undervoltage relays (EB/RLY) and time delay relays asscciated with these functiens. These respectise htSPs calibrate cach relay by removing the relay from its installed location and placing it in a relay test case for calibration. Once the calibration is complete, the relay is reinstalled in its operating location.
Ilowever, neither the htSPs not any other existing suncillance procedure ensures the functionality of the degraded soltage control circuit or its trip functions will bc verified.
The N1SPs require relay " trip checks" to be performed following restoration of the relays to their operating location. The purpose of relay trip checks, which are performed as a common practice at BVPS following relay calibrations, is to verify that cach utilized relay contact performs its function. This does scrify the functionality of a portion of the degraded voltage control circuitry, but not the entire circuit. The portion containing an auxiliary time delay relay and that relay's function of tripping the feeder breakers to the 4.16kV Emergency Bus are not procedurally required to be functionally verified. Based on discussions with relay personnel and review of associated documentation, it appears these relay trip checks were never considered nor intended to satisfy a requirement to verify the overall operability of the safety function.
NRL (UKM hoA g4%
 
Nuc toust uA, o s M rt. lax nw"t.Aiony costsussioN
(&93)
LICENSEE EVENT REPORT (LER) 1LVI CON 11NIWIION I AtlLIIY N AhtF(l)
Im GL1 Nt%nu R (2) 1.1 R M%ttu R u,)
l PAut(
si yt wnAt RLvistoN Beaver Val ey Power Station Unit 1 05000334 YEAR stmumu Ntstm R 97 001 05 17 of 19 n vr m no.r
. %=.4. - m+v-me t-wa> 0 7)
If a scheduled t>us outage uas in progress during the performance of the hiSP for that respective emergency bus, the functionality of the entire degraded voltage control circuit was probably verified even though it was not procedurally required by the A1SPs. The conunon practice in performing relay trip checks is to verify the functionality of the entire control circuit, if possible, depending on the ability to trip the actuated equipment based on plant status. The MSPs are scheduled to be performed during the Unit refueling outages. Historically, both Trams of emergency buses have usually had scheduled outages during the Unit refueling outages. The latest performance of the degraded soltage MSPs occurred during the last Unit I refueling outage ( IRI1 ). However, a bus outage was only scheduled for the Train "B" emergency buses. Therefore, the opportunity to casily " trip check" the entire Train "A" degraded voltage circuit was not available and was not donc, The Unit 2 surveillance procedures for the " Loss of Power - 4.16kV Emergency Bus and 480V Emergency Bus (Degraded Voltage)"
ESF Functions were also reviewed and no similar deficiencies were identified.
 
==CAUSE OF EVENT==
The apparent cause of this event is the inadequate development of surveillance procedures to verify the operability of the " Loss of Power - 4.16kV Emergency Bus and 480V Emergency Bus (Degraded Voltage)" ESF functions.
While the surveillance procedures adequately performed the calibration of the associated undervoltage relays and time delay relays, l
they did not require the operability of the entire safety function to be verified.
1 AN AINSIS OF EVENT The ESF functions " Loss of Power - 4.16kV Emergency Bus and 480V Emergency Bus (Degraded Voltage)" were added to the Unit i Technical Specifications by Amendment No. 40 to the Unit 1 Operating Licensee w hich was effective March 30,1981. This amendment was the result of an NRC generic letter dated June 3,1977, which requested Unit I to propose plant modifications and technical specification changes, as necessary, to meet NRC staff positions contained in the generic letter regarding the design of the facility emergency power systems.
The purpose of these additional design features and corresponding additional technical specifications was, in part, to ensure the onsite emergency power systems were protected from inadequate voltage conditions which could result in common mode failures of the Unit Emergency Bus electrical equipment. One of the conditions to protect against was a sustained degraded voltage condition.
This event identified that the last surveillances to serify the operability of the degraded voltage protection function on the Train "A" Emergency Buses, which were completed on April 28, 1996, were inadequate. As a result, this ESF function on the Train "A" Emergency Buses should have been considered inoperable. Subsequent additional testing demonstrated that the Train "A" Emergency Bus degraded voltage ESF function was operable and no actual loss of safety function had occurred if required, the Train "B" Emergency Bus degraded voltage ESF function was also available.
 
==CORRECTIVE ACTIONS==
: 1. Upon control room notification of this event, all channels associated with the Train "A" ESF function " Loss of Power - 4.16 kV Emergency Bus and 480 V Emergency Bus (Degraded Voltage)" were considered inoperable as of 1530 hours on August 22, 1997 In accordance with the Limiting Condition for Operation and the associated Action Statement, Technical Specification (T.S ) 3.0.3 was considered applicable as of 1530 hours T.S. 3.0.3 requires that within one hour action shall be initiated to place the Unit in a Mode in which the applicable specification does not apply (i c., in this case Mode 5). T.S. 4.0.3. however, allows up to 24 hours to complete a missed surveillance before the required action of T.S. 3.0.3 must be initiated w tou wa m
 
i NRC l Olpt EA h US NL Ct.LAk RHW1.AIORY CONINtlSSION (4 95)
LICENSEE EVENT REPORT (LER) 1FT l MMllNt'ATION 1 ACn.llY N AMI.(I)
IM O VT N1Ttut R (2)
I t R NL thtnt R (6)
PAut ( 4) l SI WF.NHAL RLvlSION Beaver Valley Power Station Unit 1 050(ND34 YEAR NutBI:R Nt'Mn!.R 97 (X11 05 18 OF 19 M AT Of more ogwe a req wd une e4htwueel copes of NkC ham keA){ l 7)
: 2. On August 22, 1997, additional testire. of the Train "A" degraded voltage circuits was performed via MWR 065772 which demonstrated the Train "A" ESF degraded voltage function was operable. Following completion of this testing and review of the results, the Train "A" degraded voltage channels uere considered operable and T.S 3.0.3 was exited at 2228 hours on Augnt 22, 1997.
: 3. Surveillance tests IOST-36.3 and LOST-36.4 will be resised to include additional testing at an 18 month frequency suf3cient to verify the functionality of the control circuitry for the Unit I ESF function " Loss of Power - 4.16 LV Emergency Bus and 480 V Emergency Bus (Degraded Voltage)." This will be completed by October 17,1997.
: 4. In accordance with the Duquesne Light Company response to NRC Generic Letter 96-01 entitled " Testing of Safety-Related Logic Circuits," a comprehensive validation of Unit I and Unit 2 surveillance procedures with regard to satisfying logic testing requirements of safety related logic circuits is being performed. These reviews will be completed as specified in our commitment response.
RI'PORTAllil.ITY Based on the Generic Letter 964)I review, this event is being reported as a failure to adequately demonstrate the operability of the Loss of Power - 4.16kV Emergency Bus and 480V Emergency Bus (Degraded Voltage) ESF functions for the Unit i Train "A" cmcrgency buses. This is a condition prohibited by Technical Specifications and is reportable pursuant to the requirements of 10CFR50.73(a)(2)(i).
SA FETY IM Pl.ICATIONS Additional testing of the Unit i Train "A" cmergency bus degraded voltage circuitry was performed on August 22,1997 and demonstrated that the entire control circuit was functional. There was no loss of safety function. Based on this information, there were no safety implications to the health and safety of the public as a result of this event.
SIMll AR EVENTS There were thirteen similar events during the last two ycars regarding inadequate testing of safety related logic:
1.
LER l 96-004-00, " Generic Letter 96-01 Incoacct Test Frequency of Safety Related Logic," dated April 24.1996.
2.
LER l-964N)6-00, " inadequate Testing of Safety injection Relays." dated May 15,1996.
3.
LER l-96-004-01," Generic Letter 96-01 Incorrect Test Frequency of Safety Related Logic," dated July 8,1996.
4.
LER l-96-004-02, " Generic Letter 964)1 Incorrect Testing of Safety Related Logic Circuits " dated August 6,1996.
5.
LER l-964)04-03 " Generic Letter 96-01 Incorrect Testing of Safety Related Logic Circuits," dated September 6,1996, 6.
LER l-96-004-04, " Generic Letter 96-01 incorrect Testing of Safety Related Logic Circuits " dated December 20,1996.
7.
LER 2-%-003 00," Generic Letter 96-01 Inadequate Testing of Safety Related Logic," dated July 8,1996.
ft.
LER 2-96-0034)l," Generic Letter 96-01 Inadequate Testing of Safety Rclated Logic Circuits," dated January 24,1997.
m >om w m
 
Nke s opt 3ard l' h NL Cl 3 ^" k!"Ul*1"kY COMMihh3"N (4 95) 4 LICENSEE EVENT REPORT (LER) 1 LNT CovilN t'ATioN f Allt.Il Y NAML(1)
IM ICkl.'l Nt ' Mill R (2) 1.I R Nt'\\ fili R (6) l PAGI (3)
SLQt1N MAL Rt.vlSloN Bea\\ct Valley Power Station Unit 1 050(X)334 YMR NUMBER NtJMill'.R 97 (Kil 05 19 or 19 TIVI fli n we i;we as maparet, une aihe<W &qw of NRC Fonn hA)(17) 9.
LER l 97-001-00, " Generic Letter 964)I Inadequate Suncillance Testing of Control Room Emergency Ventilation Subsystem fleaters," dated March 10,1997.
: 10. LER l 97-001-01," Generic Letter 96-01 Inadequate Surveillance Testing of Ausiliary Feedwater Pump Auto Start Circuitry",
dated May 2,1997
: 11. 1.ER l 97-001-02, " Generic Letter 96-01 Inadequate Surveillance Testing of Engineered Safety Feature P il Interlock Function," dated May 7,1997.
: 12. LER l 97 001-03, " Generic Letter 96-01 Inadequate Suncillance Testing of Safety Related Logic Circuits," dated August 14, 1997.
: 13. LER l 97-00104, " Generic Letter 96-01 Inadequate Surveillance Testing of Safety Related Logic Circuits," dated August 22, 1997.
Nactunu w.im,
}}
 
{{LER-Nav}}

Latest revision as of 21:38, 24 May 2025

Redirect to:

Retrieved from "https://kanterella.com/w/index.php?title=05000334/LER-1997-001,_:on_970822,GL_96-01_Inadequate_Surveillance_Testing_of_Safety_Related_Logic_Circuits_Was_Discovered._Caused_by_Inadequate_Development_of_Safety_Related_Testing._Declared_Subsystem_Heaters_Inoperable&oldid=5492791"