ML052910099

Response to Notice of Violation: EA-05-103

ML052910099
Person / Time
Site:	LaSalle
Issue date:	10/07/2005
From:	Landahl S Exelon Nuclear
To:	Document Control Desk, Office of Nuclear Reactor Regulation, NRC/OE
References
EA-05-103, IR-05-010, RA05-79
Download: ML052910099 (6)

Text

Exeln M Exelon Generation Company, LLC www.exeloncorp.com Nuclear LaSalle County Station 2601 North 211'Road Marseilles, IL61341-9757 RA05-79 October 7, 2005 10 CFR 2.201 U. S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, D.C. 20555 LaSalle County Station, Units 1 and 2 Facility Operating License Nos. NPF-11 and NPF-18 NRC Docket Nos. 50-373 and 50-374

Subject:

Response to Notice of Violation: EA-05-103

Reference:

Letter from James L. Caldwell (NRC) to Christopher M. Crane (EGC), "Final Significance Determination for a White Finding and Notice of Violation (NRC Inspection Report 05000373/2005010;05000374/2005010), LaSalle County Station, Units 1 and 2," dated September 7, 2005.

In the referenced letter, the NRC provided Exelon Generation Company, LLC (EGC) with the final significance determination for the inspection activities conducted from February 1 through May 31, 2005.

As a result of the inspection, the NRC identified a violation of 10 CFR 50, Appendix B, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants," Criterion 1II,

'Design Control," and 10 CFR 50, Appendix A, 'General Design Criteria for Nuclear Power Plant Systems," Criterion 17, "Electric Power Systems." The violation was cited as "modifications to the emergency diesel generator (EDG) output circuit breakers that were completed on December 21, 1988, for Unit 2, Division 1; September 26,1989, for Unit 1, Division 1; March 8, 1991, for Unit 1, Division 2; and February 1,1992, for Unit 2, Division 2 that were not subject to design control measures commensurate with those applied to the original design."

Attached is our response to the Notice of Violation. If you have any questions concerning this letter, please contact Mr. Terrence W. Simpkin, Regulatory Assurance Manager, at (815) 415-2800.

Respectfully,

' Susan R. Lan I Site Vice President LaSalle County Station cc: Regional Administrator - NRC Region IlIl NRC Senior Resident Inspector - LaSalle County Station

October 7, 2005 U.S. Nuclear Regulatory Commission Attachment - Response to Notice of Violation Page 1 of 5 Notice of Violation: EA-05-103

'Title 10 CFR Part 50, Appendix B, Criterion l1l, (Design Control) requires, in part, that design changes, including field changes, shall be subject to design control measures commensurate with those applied to the original design.

10 CFR Part 50, Appendix A, General Design Criterion 17, (Electric Power Systems) requires, in part, that onsite electric power supplies, including onsite electric distribution system, shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure.

Contrary to the above, the licensee made modifications to the emergency diesel generator (EDG) output circuit breakers that were completed on December 21, 1988, for Unit 2, Division 1; September 26, 1989, for Unit 1, Division 1; March 8, 1991, for Unit 1, Division 2; and February 1, 1992, for Unit 2, Division 2 that were not subject to design control measures commensurate with those applied to the original design. Specifically, the modifications introduced a single failure vulnerability such that a failure (i.e., open circuit) of the common current transformer circuit would have resulted in a loss of all alternating current, including the EDG supplied feeds, for the Division 1 and Division 2 safety buses on both units."

RESPONSE

Exelon Generation Company, LLC (EGC) concurs with the violation.

1. The reason for the violation.

On January 27, 2005, Crystal River Unit 3 reported a design deficiency in a common metering circuit where a postulated single failure would result in the loss of all offsite and onsite AC power to both Divisions of safety related distribution buses. EGC conducted a fleet-wide review of the Crystal River event and identified that a similar single failure vulnerability existed for LaSalle County Station (LSCS) between the common current transformer (CT) circuits of the divisional safety related buses (i.e., 141Y to 142Y, 241Y to 242Y).

The CT circuits that supply the overcurrent relay scheme for each divisional bus are connected to a common point that supplies control room indication for the total System Auxiliary Transformer (SAT) "Y Phase" winding power (wattmeter) and current (ammeter). An open circuit condition on any of the CT phases downstream of the common point in the circuit would result in an unbalanced current condition.

The unbalanced current condition initiates a trip of the associated SAT feed breakers for the applicable buses (i.e., 141Y and 142Y, 241Y and 242Y). The current unbalance would actuate the ground fault relays resulting in the operation of the SAT feed breaker lockout relays on both divisions. Following a trip of the bus feed breakers; the lockout relay for the respective bus would initiate a trip of the other bus breakers and prevent any closure of these breakers. The result would be a loss of all onsite and offsite AC power sources to both Division 1 and 2 safety related buses. Specifically, no EDG or offsite power source would be permitted to close onto the respective Division 1 and 2 safety buses. The condition

October 7, 2005 U.S. Nuclear Regulatory Commission Attachment - Response to Notice of Violation Page 2 of 5 was reported to the NRC in accordance with 10 CFR 50.72, "Immediate notification requirements for operating nuclear power reactors."

Investigation by the LSCS Root Cause Team identified that the common metering circuitry existed since initial construction for LSCS. The root cause of the CT circuit affecting two separate 4.16 kV divisional buses is an existing latent design deficiency that was not identified during design reviews as the bus functional requirements were modified allowing the systems to continue to be deficient for a common single failure. The condition was compounded by a modification to the EDG circuit breakers in the late 1980s.

The EDG feed breaker's interlocks have gone through several changes from original construction to the current configuration. The original construction-stage design had the EDG breaker lockout relays bypassed by an accident signal resulting in the single point vulnerability. The lockout relay interlocks were removed from the EDG circuits prior to the LSCS initial startup, which removed the single point vulnerability for both the offsite power and the EDG feed breakers. A failure (i.e., open circuit) of the common CT circuit would have resulted in the safety buses being de-energized and offsite power sources prevented from closure due to the lockout relays. This would have been a single failure affecting both offsite power sources. However, the EDG breakers would have closed and energized the safety buses.

In the late 1980s, modifications were made to block breaker closure on a bus lockout signal from the SAT feed breaker with a bypass signal during an accident.

Later, modifications were made to inhibit the EDG breaker closure on a bus lockout condition during an accident. These modifications re-introduced the single point of vulnerability into the CT circuits.

A contributing factor was that various programmatic reviews conducted at LSCS failed to identify this single failure vulnerability because these reviews were limited in scope and did not evaluate the system protection logic.

The design processes in place at the time that the vulnerabilities were introduced have been enhanced by process improvements; therefore, current methods would have prevented this design deficiency from occurring. These improvements are the result of the Modification Improvement Process initiative and are incorporated into procedures CC-AA-102, "Design Input and Configuration Change Impact Screening," and CC-AA-103, "Configuration Change Control". Additionally, a Technical Human Performance Root Cause Analysis (RCA) added additional barriers and tools to the modification process to minimize human performance errors and were incorporated in procedure HU-AA-1 212, 'Technical Task Risk /

Rigor Assessment, Pre-Job Brief, Independent Third Party Review, and Post-Job Brief."

October 7, 2005 U.S. Nuclear Regulatory Commission Attachment - Response to Notice of Violation Page 3 of 5

2. The corrective steps that have been taken and results achieved.

a. The single point vulnerability was promptly removed from both Units 1 and 2 CT circuits. Switches were opened in the common metering circuits to isolate the two affected divisions on both units. Appropriate administrative controls were initiated until permanent modifications are fully implemented. This was accomplished by opening knife switches 1(2)XS-AP196 as an immediate corrective action under an out-of-service to eliminate the potential single point vulnerability that could result in the loss of on-site and off-site power to safety related busses 141Y, 142Y (Unit 1) and 241Y, 242Y (Unit 2).

b. The design processes in place at the time that the vulnerabilities were created have been enhanced by process improvements; therefore, current methods would have prevented this design deficiency from occurring. This is a result of the Modification Improvement Process initiative and incorporated into procedures CC-AA-102, "Design Input and Configuration Change Impact Screening," and CC-AA-103, 'Configuration Change Control." Additionally, a Technical Human Performance Root Cause Analysis (RCA) added additional barriers and tools to the modification process to minimize human performance errors and were incorporated in procedure HU-AA-1212, "Technical Task Risk / Rigor Assessment, Pre-Job Brief, Independent Third Party Review, and Post-Job Brief."

c. A review of Alternating Current (AC), Direct Current (DC) and EDG systems was conducted to identify similar latent design deficiency conditions. The review included all emergency buses (AC and DC) and buses analyzed or credited in the Post-fire Safe Shutdown (FSSD) Analysis. No other vulnerabilities were identified.

d. Failure Modes Effect Analyses were performed on the identified systems from item 2(c) above containing CT circuits and determined that postulated failures would not result in the loss of more than one division of electrical power.

e. A review of systems identified in 2.c above was conducted to determine if all cables, relays, and other devices are included in the FSSD analysis. These components were evaluated to ensure that the potential to trip or lockout would not prevent closure of the circuit breakers relied upon in the FSSD analysis. The following issues were identified:

(1) Four cables (1HP160,1 HP162, 2HP160 and 2HP162) associated with High Pressure Core Spray (Division 3) were not included in the Fire Protection Report as safe shutdown equipment.

(a) Corrective actions were identified to ensure that the identified cables are included in the Fire Protection Report to ensure that the cables associated with Division 3 SAT feed breaker CT circuit are addressed (see 3.a below).

October 7, 2005 U.S. Nuclear Regulatory Commission Attachment - Response to Notice of Violation Page 4 of 5 (2) Four cables (1RH013,1 RH019, 2RH013 and 2RH019) to safe shutdown loads with CT circuits used for control room ammeter indications did not have formal hot short dispensations. These cables were included in the Fire Protection Plan.

(a) Corrective actions were identified to ensure that the identified cables are included in a formal hot short dispensation (see (3)(b) below).

(3) Four cables (1AP097, 1AP123, 2AP097 and 2AP123) associated with buses 141Y(241Y) and 142Y(242Y), relied upon for safe shutdown, were not included in the FSSD analysis.

(a) Procedures were revised to include steps to remove the circuit trip fuses for the SAT feed breakers on 141 Y(241 Y) and 142Y(242Y) and to reset the lockout device to enable closure of the EDG output breakers in the event of a fire in the main control room.

(b) Corrective actions were identified to ensure that the identified cables are included in a formal hot short dispensation (see 3.b below).

f. Unit 2 EDG closure breakers were modified. The modification isolated the metering circuits for busses 241Y and 242Y by breaking the connection between the metering circuits at the test switch (2XS-AP1 96). The cables feeding from bus 242Y to switch 2XS-AP196 were disconnected and abandoned at both ends. Jumpers were installed on the remaining connected circuitry at the Division 2 end to ensure proper operation of the CTs. This action restored the required separation of Division 1 and Division 2 wiring.

In addition, proper segregation was established between safety related Division 1 and the non-safety related circuits downstream of switch 2XS-AP1 96. All wires downstream of test switch 2XS-AP1 96 were lifted and all equipment in the formerly common measuring circuit were permanently abandoned. The output of the downstream side of test switch 2XS-AP1 96 was jumpered to ensure proper operation of the CT.

3. The corrective steps that will be taken to avoid further violations.

a. During the review to identify additional devices that could result in similar single point vulnerabilities, four cables (1HP160,1 HP162, 2HP160 and 2HP162) associated with High Pressure Core Spray (Division 3) were not included in the Fire Protection Report as safe shutdown equipment.

Corrective actions were identified to ensure that the identified cables are included into the Fire Protection Report to ensure that the cables associated with Division 3 SAT feed breaker CT circuit are addressed.

b. During the review for additional devices that could result in similar single point vulnerabilities, four cables (1AP097, 1AP123, 2AP097 and 2AP123)

October 7, 2005 U.S. Nuclear Regulatory Commission Attachment - Response to Notice of Violation Page 5 of 5 associated with buses 141Y(241Y) and 142Y(242Y), relied upon for safe shutdown, were not included in the FSSD analysis. Four other cables (1RH01 3, 1RH01 9, 2RH01 3 and 2RH01 9) to safe shutdown loads with CT circuits used for control room ammeter indications did not have formal hot short dispensations. These cables were included in the Fire Protection Plan.

Corrective actions were identified to ensure that the identified cables are included in a formal hot short dispensation.

c. Unit 1 EDG closure breakers will be modified during the next refueling outage. The modification will be completed by March 19, 2006, coincident with the completion of Unit 1 refueling outage. The modification will isolate the metering circuits for busses 141 Y and 142Y by breaking the connection between the metering circuits at test switch 1XS-AP196. The cables feeding from Bus 142Y to switch 1XS-AP196 will be disconnected and abandoned at both ends. Jumpers will be installed on the remaining connected circuitry at the Division 2 end to ensure proper operation of the CTs. This action will restore the required separation of Division 1 and Division 2 wiring.

In addition, proper segregation will be established between safety related Division 1 and the non-safety related circuits downstream of switch 1XS-AP196. All wires downstream of test switch 1XS-AP196 will be lifted and all equipment in the formerly common measuring circuit will be permanently abandoned. The output of the downstream side of test switch 1XS-AP196 will be jumpered to ensure proper operation of the CT. This modification will be a permanent corrective action and will eliminate the current temporary actions noted in 2.a above.

4. The date when full compliance will be achieved.

Full compliance will be achieved on March 19, 2006, coincident with the completion of Unit 1 refueling outage, upon completion of items 3.a, b and c above.