05000263/LER-2005-001

LER-2005-001,

Docket Number
Event date:	02-04-2005
Report date:	06-06-2005
Initial Reporting
ENS 41362	10 CFR 50.72(b)(3)(ii)(B), Unanalyzed Condition
2632005001R01 - NRC Website

Description On February 4, 2005, with the plant operating at 98% power in Run Mode, NMC reviewed an event at Crystal River (#41362) concerning a single failure between essential buses. NMC determined the single point vulnerability was applicable between the 4.16 kV [EA] vital bus circuit breakers 152-610 and 152-511 for MNGP. The 1AR transformer [XFMR] supply breaker [BKR] to Buses [BU] 15 and 16 are 152-511 and 152-610 respectively. The over current relays for these breakers share common circuitry between current transformers and other devices.

Activation of the over current relays [51] will initiate a respective Bus (15/16) lockout. The single failure vulnerability that could cause false activation of the over current relays is a hot short. This single point vulnerability issue was reported under event notification #41374. Technical Specification (TS) 3.9.B.3 was entered for Emergency Diesel Generators (EDGs) [EK] inoperability since these were the most limiting components affected, and an orderly shutdown was initiated. The 1AR transformer and its associated current transformer (CT) circuits were isolated by opening the respective breakers and opening knife switches [89] in the CT circuits thereby restoring operability to associated EDGs. This event was reported in accordance with 10 CFR 50.72 (b)(3)(v)(A, B, C, and D), "Event or Condition that could have Prevented Fulfillment of a Safety Function," and 10 CFR 50.72 (b)(3)(ii)(B), "Any Event or condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety." A plant modification has been completed to correct this 1AR relaying and metering vulnerability.

Further evaluation of the single point vulnerability issue revealed previously undiscovered 10 CFR 50 Appendix R non-compliance implications. The 1AR Auxiliary transformer source (breaker 152-610) to safeguards Bus 16 includes current transformers that are used for over-current protection and ammeter [MTR] indication on Control Room panel C-08. A postulated fire in the Control Room/Cable Spreading Room could cause a hot short of the ammeter circuit on the panel C-08. The hot short has the potential to trip breaker 152-610 and cause a Bus 16 lockout. A transfer to the ASDS [JC] panel control would not override the Bus 16 lockout. Therefore, the Control Room/Cable Spreading Room fire, along with the Bus 16 lockout, would prevent control of Division II equipment from both the Control Room and ASDS panel. This Appendix R non-compliance was reported under event notification #41436 on February 23, 2005. On February 23, 2005, the ASDS Panel was declared inoperable and a Limiting Condition of Operation (LCO) entered per TS 3.13.A.2. Breaker 152-610 (1AR to Bus 16) was racked out and a knife switch was opened removing the hot short potential from the ammeter circuit. The ASDS Panel was declared operable and the LCO was exited. An Engineering Change Notice (ECN) was completed to correct this Appendix R vulnerability.

On April 1, 2005 during an ASDS Functional Test, Operators in the Control Room observed indications of Bus 16 voltage, LC-104 current, #12 EDG frequency and #12 EDG voltage. The Operators questioned these instrument indications. Concurrently, MNGP Engineering personnel were performing a review of the ASDS as part of the corrective actions for Revision 0 of this LER. This ASDS review encompassed the Control Room observed instrument indications. On April 5, 2005 at 1600, with the plant at 0% power in Shutdown Mode, NMC confirmed a second breaker was affected by the same cause as Revision 0 of this LER, an unisolated ammeter circuit. The other indications of Bus 16 and #12 EDG were evaluated and determined to be acceptable. The Control Room Operators and the comprehensive ASDS review independently identified this deficiency with the LC-104 ammeter circuit.

The Bus 16 source (Breaker 152-609) to Load Center #104 had a similar potential vulnerability with the ASDS isolation design that could result in Load Center #104 being locked out in the event of a Control Room or Cable Spreading Room fire. The MNGP Appendix R Safe Shutdown Analysis for Control Room/Cable Spreading fire assumes a loss of control of Division I and II equipment from the Control Room, however safe shutdown is achieved remotely from the ASDS panel. The ASDS design would not impede the ability to safely shutdown and maintain the plant in a shutdown condition in the event of a Control Room/Cable Spreading Room fire using selected Division II equipment.

Contrary to the ASDS design, it was discovered that an unisolated metering circuit from the 152-609 circuit could result in Load Center #104 being locked out in the event of a Control Room/Cable Spreading Room fire. Load Center #104 supplies power to Appendix R credited Motor Operated Valves and other safe shutdown support equipment. The bus lockout was not isolated by the ASDS transfer switches, therefore, this condition could result in failure of Load Center #104 to re-energize during the implementation of the Shutdown Outside Control Room procedure resulting in the loss of credited ASDS shutdown equipment.

There were no equipment failure(s) associated with the identified single point vulnerability or ASDS circuit isolation conditions.

Event Analysis

The initial single failure design deficiency is a noncompliance with 10CFR50 Appendix A, "General Design Criteria for Nuclear Power Plants." The subsequent issues constitute a non-conformance to 10CFR50 Section II I.G.3 Appendix R Safe Shutdown Analysis ASDS design requirements.

In accordance with 10 CFR 50.72 (b)(3)(v)(A, B, C, and D), "Event or Condition that could have Prevented Fulfillment of a Safety Function," and 10 CFR 50.72 (b)(3)(ii)(B), "Any Event or condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety," an eight-hour event notification was made to the USNRC, due to the potential loss of the buses resulting in the potential loss of systems which are required to provide safety functions and due to placing the plant in an unanalyzed condition that could degrade plant safety. Per 10 CFR 50.73 (a)(2)(v)(A, B, C, and D) and 10 CFR 50.73 (a)(2)(ii)(B), a Licensee Event Report is required for this event.

The event is classified as a safety system functional failure.

Safety Significance

The following is an assessment of the safety significance associated with single failure and fire vulnerabilities at the MNGP.

At MNGP, a cable traversing fire zones 14A (TB 931 - Div II 4kV area), 19A & B (TB 931E), and 17 (TB 941 cable way) can cause a lockout of emergency electrical Buses 15 and 16, if a hot short occurs. In addition, a fire in the Control Room (fire zone 8) or Cable Spreading Room (fire zone 9) can also cause Buses 15 and 16 to lockout.

Safety Significance is assessed for fires that could cause these bus lockouts through hot shorts in any of these fire zones. The assessment used an analysis model that included fires and credits Reactor Core Isolation Cooling (RCIC) [BN] manual operation, improved reliability of alternate injection valves, charging division 11250 VDC batteries [EJ] through jumpers from non-emergency diesel generator DG-13, and a fire truck supply to the fire protection system [KP] which can be used as an alternate injection source.

If a propagating fire occurs in the cable spreading room, with an assumed loss of offsite power, a loss of power to High Pressure Coolant Injection [BJ], RCIC, and all Division I equipment is also assumed to occur. However, Division II Core Spray [BM], Residual Heat Removal (RHR) [BO], RHR Service Water [BI], Safety Relief Valves [RV], and the EDG & EDG-Essential Service Water [BI] will remain available. If the lockout of Buses 15 and 16 occurs and remains locked out long term, then the Division II equipment identified above is lost, but manual RCIC operation remains available, and depressurization is available (Division II 250V DC batteries are available and can be charged by the non-essential DG). Because depressurization is available, reliable makeup capability remains available from the diesel fire pump [P] and fire pump truck(s).

The station performed a risk model based on the issue and potential event. The most likely scenarios generated by the model involve a fire that causes a hot short in the turbine building and automatic transfer switch Y21 independently fails or transformer YO1 fails or EDG-11 fails. Therefore, this event results in a change to core damage frequency (CDF) of 9.9 E-8 per year.

Based on this information, the issue of single failure and fire vulnerability of redundant electrical safety buses has been determined to be of low safety significance at MNGP.

Cause

The apparent cause of the single point vulnerability issue was a failure to recognize an original plant construction design was not compliant to 10CFR50 Appendix A "General Design Criteria.

The apparent cause of the Appendix R vulnerabilities was a failure to completely implement the original ASDS design recommended by General Electric Safe Shutdown Analysis reports (1982-1984). The original design recommendation would have isolated these cables.

A contributing cause of the Appendix R vulnerabilities was a failure to recognize Appendix R circuit design noncompliances during the initial implementation of the Appendix R rule by MNGP staff.

Corrective Action An immediate action to isolate the 1AR transformer was performed until the plant could perform a required modification.

A plant modification was completed to remove the 1AR relaying and metering vulnerability.

A plant modification was completed to remove the metering circuit at Load center #104.

An Engineering Change Notice to the plant modification for the single point vulnerability was completed for the ASDS isolation issue by disconnecting cable (A610-008/3) at Bus 16.

An engineering review of the ASDS design has been performed to validate compliance with originally proposed General Electric design recommendation.

Failed Component Identification N/A

Previous Similar Events

A review of the Station Corrective Action Program identified one similar event, "ASDS design deficiency results in vulnerability to a single hot short during Control Room/Cable Spreading Room fire." This issue was identified during an engineering review performed in 2001, hot short vulnerabilities were discovered in the Alternate Shutdown System (ASDS) in the event of loss of offsite power. This condition was reportable, and LER 2001-06 was submitted by MNGP. This was a missed opportunity by the station to identify the issue with ASDS during the extent of condition review for LER 2001-06. As a result, the station has performed a review of the ASDS system to ensure the system complies with the General Electric design recommendation.