Part 21 Report - 1997-581
ACCESSION #: 9709030329
LICENSEE EVENT REPORT (LER)
FACILITY NAME: Clinton Power Station PAGE: 1 OF 6
DOCKET NUMBER: 05000461
TITLE: Control Circuit for Division 1 Emergency Diesel Generator
Feed Breaker Does Not Meet Design Basis Due to Design
Error and Could Prevent Power for Division 1 Safe
Shutdown Equipment During a Main Control Room Fire with
Loss of Offsite Power
EVENT DATE: 09/29/86 LER #: 97-021-00 REPORT DATE: 08/25/97
OTHER FACILITIES INVOLVED: DOCKET NO: 05000
OPERATING MODE: 5 POWER LEVEL: 000
THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR
SECTION:
50.73(a)(2)(ii)
LICENSEE CONTACT FOR THIS LER:
NAME: M. G. McMenamin, Engineering TELEPHONE: (217) 935-8881,
Projects Engineer Extension 3469
COMPONENT FAILURE DESCRIPTION:
CAUSE: SYSTEM: COMPONENT: MANUFACTURER:
REPORTABLE NPRDS:
SUPPLEMENTAL REPORT EXPECTED: NO
ABSTRACT:
Design of a control circuit fed from the 125 volts direct current (DC)
control power fuse for the Division 1 Emergency Diesel Generator (EDG)
feed breaker was not in accordance with the plant's Fire Protection Safe
Shutdown Analysis (SSA). The circuit was routed through the Main Control
Room (MCR), but did not include isolation contacts at the Remote Shutdown
Panel (RSP) transfer switch to allow isolation of the MCR wiring/controls
while operating from the RSP. During a MCR fire, concurrent with a Loss
of Offsite Power, fire could damage the circuit, causing multiple (DC)
ground faults, the loss of control power for the Division 1 EDG feed
breaker, and a loss of power to Division 1 equipment. The lack of
isolation contacts would prevent isolation of the faults when
transfer/isolation of the breaker control circuit from the MCR to the RSP
was attempted. The circuit design is not in accordance with 10CFR50,
Appendix R, Section III.L, and the plant's design basis. The cause of
this event is attributed to a design error. Corrective action for this
event includes rewiring the circuit to add isolation contacts from the
transfer switch at the RSP, and reviewing all circuits routed through the
RSP to ensure that a MCR fire would not prevent operation of those
circuits from the RSP. This condition is also reportable under the
provisions of 10CFR21.
END OF ABSTRACT
TEXT PAGE 2 OF 6
DESCRIPTION OF EVENT
On July 31, 1997, the plant was in mode 4 (COLD SHUTDOWN) for the sixth
refueling outage (RF-6), and reactor [RCT] coolant temperature was being
maintained within a band of 100 to 120 degrees Fahrenheit (F) and
pressure was zero pounds per square inch. Engineers were performing a
vertical slice review of selected safe shutdown components in response to
an audit finding. During the review, the engineers identified that
control cable [CBL] 1DG11U was not in accordance with the plant's Fire
Protection Safe Shutdown Analysis (SSA) described in Appendix F of the
Updated Safety Analysis Report (USAR). Control cable 1DG11U carries a
125 volts direct current (VDC) circuit which is fed by control fuses [FU]
for the Division 1 Emergency Diesel Generator (EDG) [EK] [DG] 4 kilovolt
(KV) 1A1 feed circuit breaker [BKR] 252-DG1KA. Condition Report (CR)
1-97-07-350 was initiated to track an investigation and disposition for
this issue.
At about 1215 hours, engineers identified that control cable 1DG11U is
routed to the Main Control Room (MCR), but the circuit does not include
isolation contacts at Remote Shutdown Panel (RSP) [PL] transfer switch
[HS] 1C61-HS501 to allow isolation of the MCR wiring/controls while
operating from the RSP. During a postulated fire in the MCR, concurrent
with a Loss of Offsite Power, fire could damage MCR cables, causing
multiple direct current (DC) ground faults, the loss of control power for
the Division 1 EDG feed breaker, and a loss of power to Division 1
equipment. The lack of isolation contacts would prevent isolation of the
faults when transfer/isolation of the breaker control circuit from the
MCR to the RSP was attempted. The SSA relies on Division 1 equipment
operated from the RSP to bring the plant to a safe shutdown condition in
the event of a fire in the MCR.
The control circuit for Division 1 EDG feed breaker 252-DG1KA is a 125
VDC circuit with separate fuses for the closing and tripping legs of the
circuit. The design of the RSP and the breaker control circuit has
always included transfer switch contacts to allow isolation of the MCR
wiring/controls while operating from the RSP. The transfer switch
contacts not only isolate the circuit from the MCR but also provide
alternate (different direct current circuit and fuses) control power for
the circuit so fuses blown prior to operation of the transfer switch do
not render the breaker inoperable.
In order to inhibit certain auto-transfer features, Offsite Source
Permissive (OSP) handswitch 1HS-DG214 and its associated blocking relay
[68], 252X1-DG1KA, were added to the Division 1 EDG feed breaker control
circuit. Adding this feature did not initially present a failure path
for the Division 1 EDG feed breaker control power since the positive leg
of the OSP circuit was designed to be isolated by the transfer switch and
the negative leg had the OSP relay load resistance between the load and
the MCR. Prior to installation, the EDG feed breaker control circuit was
modified several times. Despite the schematic for the OSP handswitch
showing an isolation contact for the positive leg of the circuit, the
wiring design for the RSP did not utilize such a contact. At the time of
installation, there were no spare isolation contacts in the transfer
switch for the EDG feed breaker control circuit.
TEXT PAGE 3 OF 6
The MCR wiring for the OSP handswitch is tied by cable 1DG11U to the
positive bus [BU] of the Division 1 DC System [EJ] through the closing
circuit fuses of the Division 1 EDG feed breaker. The EDC feed breaker
failure mode postulated for this circuit was a MCR fire causing. the
circuit to short to ground and also causing a conductor in a separate
circuit connected to the negative bus of the Division 1 DC System (and
not isolated by operation of the RSP transfer switches) to be shorted to
ground. This double ground would then cause the closing circuit fuse for
the EDG feed breaker to blow and prevent the breaker from responding to a
closing signal. Since cable 1DG11U was not isolated from the MCR with
the transfer switch, the positive and negative ground faults would still
be in place when the control of the breaker was transferred to the RGP
and the positive fuse in the closing circuit at the RSP would also blow.
10CFR50, Appendix R, Section III.L, "Alternate and Dedicated shutdown
Capability," requires that alternate safe shutdown capability (achieving
and maintaining hot and cold shutdown from the Remote Shutdown Panel) for
a specific fire area shall be independent of that specific fire area and
shall accommodate both potential post-fire conditions where efforts power
is available and where oftsite power is not available for 72 hours.
Since control of breaker 252-DG1KA is not independent from the RGP for
the fire in the MCR, the requirements of 10CFR50, Appendix R, Section
III.L, and the design basis of the plant were not met.
The design deficiency in the control circuit has existed since initial
plant operation on September 29, 1986, when the plant was in Mode 5
(REFUELING) for initial fuel loading. At that time, reactor coolant
temperature was ambient and pressure was atmospheric.
No automatic or manually initiated safety system responses were necessary
to place the plant in a safe and stable condition. No other equipment or
components were inoperable at the start of this event to the extent that
their inoperable condition contributed to this event.
CAUSE OF EVENT
The cause of this event is attributed to an error in the original design.
The error was not detected during design review and installation.
CORRECTIVE ACTION
Control cable 1DG11U has been rewired at the RSP so the circuit includes
isolation contacts from transfer switch 1C61-HS501. Although the fuses
of the normal control power circuit for EDG feed breaker 252-DG1KA could
still open during the postulated MCR fire due to multiple DC grounds,
operating the transfer switch at the RSP would isolate the faults, and DC
fuses at the RSP would provide control power for the breaker.
TEXT PAGE 4 OF 6
Illinois Power (IP) recently reported LER 97-019 (CR 1-97-07-164) which
discussed a similar event caused by design error. LER 97-019 reported
that the Division 1 Essential Switchgear Heat Removal System fan [FAN]
damper [DMP] control circuit was routed through the MCR and could fail
during a MCR fire, adversely affecting the SSA. On the basis of the
similarity of LER 97-019 and LER 97-021, IP reviewed all circuits routed
through the Remote Shutdown Panel to ensure that a MCR fire would not
prevent operation of those circuits from the RSP. No additional circuit
design error that would prevent operation of components from the RSP were
identified during the review.
ANALYSIS OF EVENT
This event is reportable under the provisions of 10CFR50.73 (a)(2)(ii)(B)
because the design of the control circuit for circuit breaker 252-DG1KA
is not in accordance with the design basis of the plant.
An assessment of the safety consequences and implications of this event
identified that this event has potential nuclear safety significance.
During a postulated fire in the MCR, concurrent with a Loss of Offsite
Power, fire could damage the MCR cables, causing multiple ground faults,
the loss of control power for the Division 1 EDG feed breaker, and a loss
of power to Division 1 equipment. The SSA relies on Division 1 equipment
operated from the RSP to bring the plant to a safe shutdown condition in
the event of a fire in the MCR.
ADDITIONAL INFORMATION
No equipment or components failed as a result of this event.
Clinton Power Station recently submitted LER 97-019 which reported that
the Division 1 Essential Switchgear Heat Removal System fan discharge
damper control circuit was routed through the MCR and could fall during a
MCR fire, adversely affecting the Safe Shutdown Analysis. The event
reported in LER 97-019 was caused by design error. The CORRECTIVE ACTION
section of LER 97-021 discusses the actions IP has taken to address the
similarity of the events reported in LER 97-019 and LER 97-021.
For further information regarding this event, contact M. G. McMenamin,
Engineering Projects Engineer, at (217) 935-0881, extension 3469.
TEXT PAGE 5 OF 6
10CFR21 Report 21-97-040
On August 19, 1997, during preparation of this Licensee Event Report, the
circuit design issue discussed herein was determined to be potentially
reportable under 10CFR21. IP has evaluated this Issue and concludes that
it is reportable under the provisions of 10CFR, Part 21.
IP is providing the following information in accordance with
10CFR21.21(c)(4). Initial notification of this matter will be provided
by facsimile of this letter to the NRC Operations Center in accordance
with 10CFR21.21(c)(3) within 2 days of the date the responsible officer
approves this report.
(i) Wayne D. Romberg, Assistant Vice President of Illinois Power
Company, Clinton Power Station, Highway 54, 6 Miles East,
Clinton, Illinois, 61727, is informing the NRC of a condition
reportable under the provisions of 10CFR21 by means of this
report.
(ii) The basic component involved in this report is the design of
the control circuit for Division 1 Emergency Diesel Generator 4
kilovolt 1A1 feed circuit breaker 252-DG1KA. In accordance
with the SSA and 10CFR50, Appendix R, Section III.L, the
control circuit for the breaker to required to be designed to
allow isolation of the MCR wiring/controls and operation of the
breaker from the RSP during a fire in the MCR.
(iii) The control circuit design was supplied by Sargent & Lundy.
(iv) As discussed in the DESCRIPTION OF EVENT portion of this
report, the nature of the deficiency in the absence of
isolation contacts in the design of the offsite Source
Permissive handswitch circuit. Since the circuit includes a
cable in the MCR, it should be isolatable to assure operability
of the EDG feed breaker while placing the plant in safe
shutdown from the RSP. During a postulated fire in the MCR,
concurrent with a Loss of Offsite Power, fire could damage MCR
cables, causing multiple ground faults, the lose of control
power for the Division 1 EDG feed breaker, and a loss of power
to Division 1 equipment. The SSA relies on Division 1
equipment operated from the RSP to bring the plant to a safe
shutdown condition in the event of a fire in the MCR.
(v) On July 31, 1991, IP identified that the control circuit was
routed through the MCR, without having isolation contacts at
the RSP transfer switch. IP determined that this issue was
potentially reportable under 10CFR21 on August 19, 1997.
(vi) This issue potentially affected all circuits routed through the
Remote Shutdown Panel. Two circuits were identified to be
deficient in design, the control circuit for breaker 252-DG1KA
discussed in this LER and the control circuit for the Division
1 Essential Switchgear Heat Removal System fan damper reported
in LER 97-019. IP is not aware of other facilities that would
be affected by this deficiency.
TEXT PAGE 6 OF 6
(vii) The corrective action that IP is taking for this event is
discussed in the CORRECTIVE ACTION section of this report.
(viii) IP has no additional information to offer.
*** END OF DOCUMENT ***
Page Last Reviewed/Updated Wednesday, March 24, 2021