ML20042E489

LER 90-005-00:on 900314,determined That Some Class 1E Circuits That Pass Through Containment Electrical Penetrations Do Not Have Adequate Backup Fault Protection. Caused by Inadequate Design control.W/900416 Ltr

ML20042E489
Person / Time
Site:	Davis Besse
Issue date:	04/16/1990
From:	Storz L, Stotz J TOLEDO EDISON CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
LER-90-005, LER-90-5, NP33-90-006, NP33-90-6, NUDOCS 9004230241
Download: ML20042E489 (6)

Text

l EDISON PLAZA  ;

l 330 MADISON AVENUE i

TOLEDO. OHIO 436520001 April 16, 1990 NP 3 90 00 Docket No. 50-346 License No. NFP-3 l

United States Nuclear Regulatory Commission 4 Document Control Desk i Vashington, D. C. 20555 ]

Gentlemen j LER 90-005 -

Davis-Besse Nuclear Power Station, Unit No. 1 Date of Occurrence - March 14, 1990 Enclosed please find Licensee Event Report 90-005 which is being written to provide 30 days notification of the subject occurrence. This report is being submitted in accordance with 10CFR50.73(a)(2)(ii).

Yours truly,  !

V C4 Louis F. Storz Plant Manager Davis-Besse Nuclear Power Station LFS/plf Enclosure cct Mr. A. Bert Davis Regional Administrator USNRC Region III Hr. Paul Byron  ;

DB-1 NRC Sr. Resident _ Inspector  ;

241'900416  ! A 2k'OCK05000346 S <

L

• PDC 5

i

v2 muCLsaR utuLafoRv c0 ..ON f NRc . me

• • • • - u.aovt0 o m o.si,0-eim LICENSEE EVENT REPORT (LER) 00CKET NuhADER W FAM 4 F AcaLITV hassit n)

Davis-Besse Unit No. 1 0 l 5 l 0 l 0 l 0 l 3l 416 1 loFl 015

'"t85 TR Commitment For Primary and Backup Fault Protection for Some Class lE Circuits Not Satisfied IVSNT Daf t (t) LtR NunetR (g) #3P0 elf Daft (7) OTHER f ACILITf tt lefvDLV00 del DOCKEf etvuttRis)

MONTM DAY YtAR vtAR 88$$[,"4 "[$ MONTM DAY vtAR F ACIL8TY 8e AMes 0 181010101 I I

~~ ~~~

0l3 1l 4 90 oh 0l o l5 0l0 ol4 1l 6 9l0 0lsjoloioi l l TMS REPORT 16 tugastTTtD PNANT TO TH4 NIRBt4WTS OP 10 CFR 0 IO.se one w sae9 of M 488swaff HU Orematiese GAODS WI O m seessi So assisi so.T*6 sit *HM 7831 t*

• R 304884eH1HU 90.MleHit 90J86sHtH.) T3J18el n., 0 i Oi0 .. 4n H.i

= = . _

.n H.H. _ g,=,g.g

=** a Ha a=== anansaan*>

~ @"

x m _ _ _

00fahlWW) 9038hHRHMi N

30.406MH HM

}

's' < M eetteH1Hel 98334sH3HM 90J34eHRHal LICSN884 C08tTACT FOR THl3 L9R Hti NApt TELEPMONE NUMetR AREA C004 Jan C. Stotz, Engineer - Maintenance Planning 4,1 ,9 3 ,2,1, ,7,5 ,4 g4 ConsPLETE ONE LINE POR SACH C0eePONENT P A8LURt oteCRittD IN TNie ARPORT Hal CoM*Ch8NT ""yhO ' CAU58 $YtTEM CoM*0NtNT "'y ,Tp a g

}

CAUS$ SYSTEM "fD 8 ,

MM"g*N w" ?s l l l l l l l '

l  ; l l l l l M d6 jNi%ks e

I I I I I I I I I I I I I I SUPPLEMENTAL Reposif EMPtCT801141 MONTH DAY VSAR oggesion "

T] vts ter m e. ,m. turerto svewwou oArts ~~]No Ol7 0l2 910 A=T ACT ru n im . u. ,.. ., m .a, . e-r.. ,. , o si

! On March 14, 1990, during performance of Safety System Outage Modification t

Inspection (SSOMI) by Toledo Edison's Independent Safety Engineering Group,

( it was determined that some Class 1E circuits that pass through containment electrical penetrations do not have adequate backup fault protection. This conflicts with the Updated Safety Analysis Report (USAR) Section 8.3.1.2.29 vbich requires that both primary and backup fault protection be provided for all Class lE circuits entering containment. This condition is applicable to three electrical penetration assemblies (EPAs) involving seventeen Class 1E circuits.

Of the seventeen circuits involved, tvelve are environmentally qualified under 10CFR50.49, Environmental Qualification. One circuit, per Technical Specifica-tions, is required to be depovered while in Modes 1, 2, and 3. The remaining four circuits are installed in accordance with Class 1E requirements but in fact are non-safety-related and are not credited for mitigating any accidents.

Toledo Edison is planning to environmentally qualify these four circuits prior to entering Mode 4 following the ongoing refueling outage. In addition, Toledo Edison is further evaluating this condition. A sumary of the evaluation, any l corrective actions which may be deemed necessary, and a schedule for completing

! the corrective actions vill be communicated in a timely manner.

This is reportable under 10CFR50.73(a)(2)(ii)(B) as a condition outside the design basis of the plant.

nwucxu a - _ ._ _

a i

uns eere una u s. soucitan Meutatonv censu.essoa

• * ~ a,eaovep o e ao sis.-eio.

UCENSEE EVENT REPORT (LERI TEXT CONTINUATION ex.ines: swa rao,urr =nen n, ooc =ev au a.em m sin umun i., emos a '!

.... .agr, **

- =

Davis-Besse Unit No. 1 o ls jo lo lo l 3l4 l6 9l0 --

0l0l 5 ._

0 l0 0l2 or 0l5 verr a- . anc a smawnn  ;

1 Description of Occurrence:

On March 14, 1990, with the plant defueled during the Sixth Refueling Outage  ;

(6RFO) .the Independent Safety Engineering Group identified that.some Class 1E circuits which' pass through electrical penetration assemblies (EPAs) are not "

provided with adequate backup fault protection, as required by USAR Section .

8.3.1.2.29. .  ;

Originally, the Davis-Besse Final Safety Analysis Report (PSAR), Revision 0, i did not include any information regarding the design of EPA's-with respect to  :

electrical fault conditions. Intormation on the bei 21ectricai design was  ;

first added in Rev. 10 of the FSAR. This discussion stated  :

t The electrical penetration assemblies are designed and tested to meet the intent of IEEE Std. 317-1971.-

This revision of the FSAR committed Toledo Edicon to testing of prototype lov and medium voltage penetration assemblies to ensure they could withstand, without loss of mechanical integrity, the maximum possible fault current versus time conditions. A brief comparison of hov the EPA's meet Reg. Guide ,

1.63 guidance was also included:

1. IEEE 317-1971 is used instead of IEEE 317-1972 f l 2. Paragraph C.1 is not complied with, as the penetrations do not have l

self-fusing characteristics but are designed to withstand the short l circuit conditions. Also, the overload protections of non-class 1E systems do not comply with IEEE 279-1971.

Several other revisions to this Section of the FSAR occurred prior to the NRC

' issuing the Davis-Besse Safety Evaluation Report and the Operating License.

These revisions added information regarding the testing results and detail on the electrical protection coordination scheme. '

1 The NRC's Safety Evaluation Report (SER) acknowledged the use of IEEE 317-1971 "* ,

in the Davis-Besse design. Regulatory Guide 1.63 was not mentioned in the

• SER. The SER states that the NRC requested Toledo Edison to describe in '

detail the degree of protection provided for both safety and non-safety >

related circuits, and where [ emphasis added) backup protection is'used, to describe the type of devices and justify their' design. Since all-the test l results vere already included in the FSAR, no additional information was included in the FSAR in response to the SER request.

SER Supplement 1, issued in April 1977, documented the NRC acceptance of test t results. The SER Supplement 1 discussion of backup protection mainly focused  ;

on the protective relays used in 13.8 KV circuits, since these devices depend i upon DC power to function. The SER Supplement 1 states that the NRC

4. ... . ...,......,..1 l

==c sen. v4 uco.a nev6.voav comes

'"'~ .aaaovio oa* a'o *'**-o*

UCENSEE EVENT REPORT (LER) TEXT CONTINUATION '

aneines s w ee j

. ,01, n, o a , . .. ... . . . . . . .  :

naa a't'?dt'

. A*a?#

0F Davis-Besse Unit No. 1 0 l5 l0 l 0 l0 l 314 l 6 9l0 -

0l015 -

0l0 0 13 0 l 5_ l vere n . m mac a.-anavnn concluded, based on_their " review of the test results, the analysis design 'I modifications, and the various final design schematics, ... the design of-the i electrical penetration protection is acceptable."

The current Updated Safety Analysis Report (USAR) Section 8.3.1.2.29 states that the electrical system design provides both primary.and backup _ fault protection for the circuits being fed through all electrical penetrations. i Primary protection is instantaneous (typically 12 to 25 times full-load ,

current) whereas the backup is " time delay" (inverse time). However, should the primary protection fail to act. .the backup will act in sufficient time to .

preclude thermal and mechanical damage to the penetration assembly under fault conditions. .

+

Therefore, it was concluded that the plant configuration does not meet the USAR requirement for some Class 1E circuits.

This is reportable under 10CFR50.73(a)(2)(ii)(B) as a condition outside the _

design basis of the plant.

Apparent Cause of Occurrence ,

The primary cause for the difference between the plant's EPA design described in the USAR and the existing plant configuration is inadequate design control ,

during construction in that the maximum current versus time conditions were not properly defined for all Class 1E circuits.

As stated in the USAR the maximum symmetrical short circuit current was calculeted and compared against the test results for medium and low voltage penetrations. This analysis shoved that for the calculated fault current the

primary and backup protection vould interrupt the faulted condition before the I penetration vould be damaged. The above analysis establishes the ad6quacy of l the primary and backup protection of the electrical penetrations. However, L the recent analysis has revealed that the maximum symmetrical short circuit l current is significantly less than original calculated values. ., ,,

Analysis of Occurrences There are three EPA's containing seventeen Class IE circuits which do not have adequate backup protection. This means that, while backup electrical protective devices exist in the paths to the EPA's, they do not interrupt the '

current flow prior to the current-time relation exceeding the values included in the prototype testing described in the USAR. Of the three affected EPA's, ,

two contain circuits which are environmentally qualified'(EO) in accordance  ;

with 10CFR50.49. The third EPA has several affected circuits which are also'  ;

E0, but it also has cables which are connected to five non-E0 loads. l l

t i

a e u s opo son +ne sae 4R geomwwea

t mac e men v. uuctian neut. Ton, cou u n= l UCENSEE EVENT REPORT (i.ER) TEXT CONTINUATION anaovioom =o vue '

ex mes:s w a Pa06tify ham 4 su Doct1T WWutem40 ten wyugen ell ca04 tai u..

• b!?.p,^6 :

@J.?

Davis-Besse Unit No. 1 o ls lo lo lc l3l4 l 6 9{0 --

0l0 l 5 --

0l0 0l 4 oF 0l 5

+

veren . = mme wancs mmmam By the requirements of 10CFR50.49, Environmental Qualification.. electrical equipment needed to mitigate design basis accidents needs to be environ- ,

mentally qualified to assure it remains operable under the applicable post-accident environmental conditions. This is applicable to safety-related equipment (Class 1E) and nonsafety-related equipment whose failure could degrade the function of, safety-related equipment.

By meeting the requirements of this regulation, it is assured that accidents and post-accident conditions vill not. induce electrical faults in Class 1E equipment. Since an accident vill not cause a fault on Class 1E, environmentally qualified (EO) equipment, the only fault that must be considered is an electrical fault postulated as a single failure in accordance t

with single failure criteria. By postulating a fault as a single failure, it is not necessary to postulate an additional failure of the electrical circuit's primary fault protection. This means that the primary fault protection vill operate to interrupt the fault current, as designed, prior to any damage to the electrical penetration module. Therefore, backup fault protection is not required in order to protect cleutrical penetrations for

• Class 1E circuits, and the lack of backup protection does not pose any safety concerns.

Of the class 1E, non-E0 circuits, one of the affected components is required

• by Technical Specifications to have its power removed during Mode 1, 2, and 3.

Therefore, the associated EPA modules vill not be subjected to any adverse over current conditions.

Toledo Edison's preliminary evaluation has concluded that:there vould be no significant increase in the penetration's mechanical leakage as a result of the failure of the primary protective device to operate during a faulted 1 l condition. There may be cracking of the module's epoxy due to expansion of l the conductor in the EPA. However, any cracking would be expected to be minor and not result in significant increase in containment leakage.

Toledo Edison is further evaluating the effect of over current conditions on EPA mechanical integrity for the remaining Class 1E, non-E0 circuits. Any additional information regarding this evaluation vill be forwarded.to the NRC in a timely manner.

Therefore, no significant safety concern is believed to exist as a result of ,

this deviation from the facility description in the USAR.

Corrective Action:

The electrical circuits for the four non-E0 circuits vill be qualified to meet L the requirements of 10CFR50.49, Environmental Qualification, during 6RFO. By qualifying these circuits,.the lack of backup protection does not pose any safety concerns.

l L

'o~ . usa.o, .s+.u n. &

GlW Pee h U.S asWC4f aa a499LAT08iv -E LICENSEE EVENT REPORT (LER) TEXT CONTINUATION Amovio owe o sino-o*

inanes s*=

FAC044TV 884418 tit pocast asuaessi tal Patt tai Len esuassen 461 viaa " M - O*,t.

Davis-Besse Unit No. 1 i olslclolcl3l4l6 9l0 -

0 l0 l5 -

0l0 015 0F 0 l5 vert n === === = ==== .am me w an w nn Toledo Edison has also addressed the root causes of this occurrence as a part of the overall management improvement issue which grew out of the June _9,1985 Loss of Feedvater event. Procedures which control the facility's configuration management, design process, and USAR update have been written and implemented to prevent reoccurrences.

Toledo Edison is currently evaluating the need to provide backup protection or justification that the present plant configuration provides an acceptable protection to prevent the loss of containment integrity through a failed electrical penetration assembly. This evaluation and a subsequent revision vill be completed in a timely manner and vill be forwarded to-the NRC.

Failure Data The most recent report of a condition being outside the design basis was LER 89-004. This involved the possibility for a circulating vater line break to cause flooding in the service vater tunnel and loss of the service water pumps. The next previous report was LER 88-016 which involved circuits bridging two or more relay cabinets of different essential channels. Both vere conditions that existed from original construction.

REPORT NO.: NP33-90-006 PCAO NO. 90-0200 l

i i

i l

7*S/ '" **** .uaoaoiees.e.344w4fi