05000395/LER-2011-002
| Virgil C. Summer Nuclear Station Unit 1 | |
| Event date: | 05-03-2011 |
|---|---|
| Report date: | 07-01-2011 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| 3952011002R00 - NRC Website | |
PLANT IDENTIFICATION
Westinghouse - Pressurized Water Reactor
EQUIPMENT IDENTIFICATION:
XEG0001B-E, 'B' Emergency Diesel Generator
IDENTIFICATION OF EVENT
On May 3, 2011 at 0514 hours0.00595 days <br />0.143 hours <br />8.498677e-4 weeks <br />1.95577e-4 months <br />, VCSNS personnel identified a violation of 10 CFR 50 Appendix R, Fire Protection Program for Nuclear Power Facilities, Sections III.G.a and III.G.3 during circuit analysis review for transitioning the Fire Protection Program to NFPA 805. Specifically, VCSNS failed to maintain one train of systems free of fire damage, which are necessary to achieve and maintain Hot Shutdown conditions for postulated fires in the MCR or CSR.
EVENT DATE
May 03, 2011 Condition Report CR-11-02298 was generated to address this violation.
REPORT DATE
July 01, 2011
CONDITIONS PRIOR TO EVENT
De-Fueled, 0% Power
DESCRIPTION OF EVENT
On May 3, 2011 at 0514 hours0.00595 days <br />0.143 hours <br />8.498677e-4 weeks <br />1.95577e-4 months <br />, VCSNS personnel identified a violation of 10 CFR 50 Appendix R during circuit analysis review for transitioning the Fire Protection Program to NFPA 805. Circuits were identified in the Main Control Room (MCR) and Cable Spreading Room (CSR) that impact a control power circuit which could result in the loss of ability to start the 'B' Emergency Diesel Generator (EDG) using local controls.
Design Change (MRF-20788) was initiated and designed by Gilbert/Commonwealth in August 1985 to provide electrical isolation of the control circuits from the Control Building when the REMOTE/LOCAL/MAINT control transfer switch (located in the 'IV EDG Room) was placed in the LOCAL position in response to an evacuation of the MCR due to fire.
This modification was implemented to provide an automatic start of the EDG using "de-energize to actuate" logic in the event that control circuit DGJ96B is damaged by fire (creating a hot short) in fire zones through which it is routed. The design allowed the EDG to start regardless of any type of fire-induced fault to this circuit. This modification created no adverse conditions in the plant.
However, in September 1992, Impel Engineering developed a design change (MRF-21584) in response to an event in which a blown control power fuse in the 'B' EDG start circuit went undetected for a period of time. The intent of this design change was to improve the indication and alarms of control power availability for the various engine and generator control schemes. The modification added a control power monitoring relay to the portion of the control scheme that used "de-energize to actuate" logic, and added contacts from this relay as a start permissive in the EDG start circuit. This change inadvertently defeated the "de-energize to actuate" design of the emergency start circuit put in place by the earlier modification, and created the possibility of a fire-induced fault to this circuit resulting in autostart failure of the 'B' EDG.
CAUSE OF EVENT
A root cause analysis (RCA-11-02298) was conducted to identify the reason MRF-21584 was implemented despite its impact on the ability of the 'B' EDG to automatically start upon loss of control power. The result of this analysis determined that the root cause was a less than adequate (LTA) design change/configuration management process. Specifically, a design change caused the subject vulnerability and the associated Appendix R review (both performed by a vendor for VCSNS) did not ensure the issue was corrected.
ES-416, "Design Modification Change Process and Control," Revision 6, was the VCS design change/configuration management process in place at the time the aforementioned modifications were implemented. ES-416, Revision 6, provided guidance for design considerations, including consideration of impact to Appendix R protected circuits. The issue of hot-shorting of cables and impacts on EDG start capability was identified by the Architectural and Engineering firm (A&E) responsible for the Appendix R review. However, the issue was not resolved by the responsible design organization for the design package. ES-416, Revision 6, at this time did not 1) require detailed reviews and verification of vendor modifications by VCSNS personnel, and 2) provide adequate guidance for post-modification testing of circuits, including verification of functionality of impacted plant equipment. Control of the design modification process has since been significantly improved with the issuance of Design Guide EC-03, "Processing Engineering Change Packages," in 1995. The purpose of the Design Guide is to consolidate guidance related to modification packages in one place. It contains detailed guidelines and checklists to help ensure that plant modifications are properly designed, implemented, tested, and documented. ES-110, "Review and Verification of Controlled Documents," also introduced in 1995, added the requirement for verification of vendor modifications by VCS personnel in 2009. The combination of an enhanced modification process and the relatively recent focus on improving human performance will help ensure that future modification process problems are minimized.
Therefore, no new corrective actions were developed for this legacy design modification issue.
ANALYSIS OF EVENT
A number of circuits routed through fire zones in the Control Building were identified as susceptible to fire damage. If any of these circuits experienced a fire-induced hot short, a fuse in the EDG start circuit could blow, de-energizing control power relay CP4. This relay provides a start permissive for the 'B' EDG start circuit, and if de-energized, prevents the 'B' EDG from being started locally. Because a fire in the Control Building can result in the need to evacuate the MCR, the inability to start the diesel using these local controls, as identified in Station Procedures, could have an adverse effect on the ability to safely shut down the plant.
VCSNS has enforcement discretion for fire issues identified during the transition to NFPA 805 as long as the risk impact of these issues is not 'RED' (Change in Core Damage Frequency (CDF)>1.0E-04/yr) per the guidance in NRC Inspection Manual Chapter 0609, "Significance Determination Process." A PRA Evaluation was conducted to assess the risk significance of both this Appendix R violation and that associated with LER-2011-001-00 to determine if enforcement discretion remains applicable to VCSNS. The results of this evaluation determined that the total CDF increase for both events is below the 'RED' threshold of 1.0E-04/yr. Therefore, enforcement discretion should be maintained.
In anticipation of a situation in which the EDG must be started manually, operators are routinely trained on how to start the EDGs (`A' and 'B') using the Main Air Start Valves. The operator engages a spanner wrench and depresses air start valve XVM010997A or XVM010997B for 5 seconds, and observes that the EDG starts and accelerates to 514 rpm.
CORRECTIVE ACTIONS
Corrective actions included: 1) roving fire watch patrols were established in the fire zones through which impacted circuits are routed until the jumpers were installed, and 2) CR-11-02298, Action 009 (W.O. 1105822-002) installed jumpers to defeat the CP4 relay start permissive contacts. Adding jumpers across the normally open contacts of CP4 removes any impact of a failure on CP4 including open coil or contact failure or any other failure that would result in not successfully energizing CP4. VCSNS will develop a permanent hardware change as part of NFPA 805 implementation.
PRIOR OCCURRENCES
LER-2010-002, "Unanalyzed Condition Due to Wiring Discrepancy in the "B" Emergency Diesel Generator (EDG) Appendix R Isolation Circuitry," identified a conductor that was not removed during the implementation of a design change in 1983. The cause of this deficiency was a design modification implemented in 1983 that did not contain sufficient information to remove the conductor. The circumstances surrounding this deficiency are not similar to the condition described in this LER.