United States Nuclear Regulatory Commission - Protecting People and the Environment


ACCESSION #:  9709030329

                       LICENSEE EVENT REPORT (LER)



FACILITY NAME:   Clinton Power Station                    PAGE: 1 OF 6



DOCKET NUMBER:  05000461



TITLE:  Control Circuit for Division 1 Emergency Diesel Generator

        Feed Breaker Does Not Meet Design Basis Due to Design

        Error and Could Prevent Power for Division 1 Safe

        Shutdown Equipment During a Main Control Room Fire with

        Loss of Offsite Power



EVENT DATE:  09/29/86   LER #:  97-021-00   REPORT DATE:  08/25/97



OTHER FACILITIES INVOLVED:                          DOCKET NO:  05000



OPERATING MODE:  5   POWER LEVEL:  000



THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR

SECTION:

50.73(a)(2)(ii)



LICENSEE CONTACT FOR THIS LER:

NAME:  M. G. McMenamin, Engineering         TELEPHONE:  (217) 935-8881,

       Projects Engineer                                Extension 3469



COMPONENT FAILURE DESCRIPTION:

CAUSE:      SYSTEM:       COMPONENT:       MANUFACTURER:

REPORTABLE NPRDS:



SUPPLEMENTAL REPORT EXPECTED:  NO



ABSTRACT:



Design of a control circuit fed from the 125 volts direct current (DC)

control power fuse for the Division 1 Emergency Diesel Generator (EDG)

feed breaker was not in accordance with the plant's Fire Protection Safe

Shutdown Analysis (SSA).  The circuit was routed through the Main Control

Room (MCR), but did not include isolation contacts at the Remote Shutdown

Panel (RSP) transfer switch to allow isolation of the MCR wiring/controls

while operating from the RSP.  During a MCR fire, concurrent with a Loss

of Offsite Power, fire could damage the circuit, causing multiple (DC)

ground faults, the loss of control power for the Division 1 EDG feed

breaker, and a loss of power to Division 1 equipment.  The lack of

isolation contacts would prevent isolation of the faults when

transfer/isolation of the breaker control circuit from the MCR to the RSP

was attempted.  The circuit design is not in accordance with 10CFR50,

Appendix R, Section III.L, and the plant's design basis.  The cause of

this event is attributed to a design error.  Corrective action for this

event includes rewiring the circuit to add isolation contacts from the

transfer switch at the RSP, and reviewing all circuits routed through the

RSP to ensure that a MCR fire would not prevent operation of those

circuits from the RSP.  This condition is also reportable under the

provisions of 10CFR21.



END OF ABSTRACT



TEXT                                                          PAGE 2 OF 6



DESCRIPTION OF EVENT



On July 31, 1997, the plant was in mode 4 (COLD SHUTDOWN) for the sixth

refueling outage (RF-6), and reactor [RCT] coolant temperature was being

maintained within a band of 100 to 120 degrees Fahrenheit (F) and

pressure was zero pounds per square inch.  Engineers were performing a

vertical slice review of selected safe shutdown components in response to

an audit finding.  During the review, the engineers identified that

control cable [CBL] 1DG11U was not in accordance with the plant's Fire

Protection Safe Shutdown Analysis (SSA) described in Appendix F of the

Updated Safety Analysis Report (USAR).  Control cable 1DG11U carries a

125 volts direct current (VDC) circuit which is fed by control fuses [FU]

for the Division 1 Emergency Diesel Generator (EDG) [EK] [DG] 4 kilovolt

(KV) 1A1 feed circuit breaker [BKR] 252-DG1KA.  Condition Report (CR)

1-97-07-350 was initiated to track an investigation and disposition for

this issue.



At about 1215 hours, engineers identified that control cable 1DG11U is

routed to the Main Control Room (MCR), but the circuit does not include

isolation contacts at Remote Shutdown Panel (RSP) [PL] transfer switch

[HS] 1C61-HS501 to allow isolation of the MCR wiring/controls while

operating from the RSP.  During a postulated fire in the MCR, concurrent

with a Loss of Offsite Power, fire could damage MCR cables, causing

multiple direct current (DC) ground faults, the loss of control power for

the Division 1 EDG feed breaker, and a loss of power to Division 1

equipment.  The lack of isolation contacts would prevent isolation of the

faults when transfer/isolation of the breaker control circuit from the

MCR to the RSP was attempted.  The SSA relies on Division 1 equipment

operated from the RSP to bring the plant to a safe shutdown condition in

the event of a fire in the MCR.



The control circuit for Division 1 EDG feed breaker 252-DG1KA is a 125

VDC circuit with separate fuses for the closing and tripping legs of the

circuit.  The design of the RSP and the breaker control circuit has

always included transfer switch contacts to allow isolation of the MCR

wiring/controls while operating from the RSP.  The transfer switch

contacts not only isolate the circuit from the MCR but also provide

alternate (different direct current circuit and fuses) control power for

the circuit so fuses blown prior to operation of the transfer switch do

not render the breaker inoperable.



In order to inhibit certain auto-transfer features, Offsite Source

Permissive (OSP) handswitch 1HS-DG214 and its associated blocking relay

[68], 252X1-DG1KA, were added to the Division 1 EDG feed breaker control

circuit.  Adding this feature did not initially present a failure path

for the Division 1 EDG feed breaker control power since the positive leg

of the OSP circuit was designed to be isolated by the transfer switch and

the negative leg had the OSP relay load resistance between the load and

the MCR.  Prior to installation, the EDG feed breaker control circuit was

modified several times.  Despite the schematic for the OSP handswitch

showing an isolation contact for the positive leg of the circuit, the

wiring design for the RSP did not utilize such a contact.  At the time of

installation, there were no spare isolation contacts in the transfer

switch for the EDG feed breaker control circuit.



TEXT                                                          PAGE 3 OF 6



The MCR wiring for the OSP handswitch is tied by cable 1DG11U to the

positive bus [BU] of the Division 1 DC System [EJ] through the closing

circuit fuses of the Division 1 EDG feed breaker.  The EDC feed breaker

failure mode postulated for this circuit was a MCR fire causing.  the

circuit to short to ground and also causing a conductor in a separate

circuit connected to the negative bus of the Division 1 DC System (and

not isolated by operation of the RSP transfer switches) to be shorted to

ground.  This double ground would then cause the closing circuit fuse for

the EDG feed breaker to blow and prevent the breaker from responding to a

closing signal.  Since cable 1DG11U was not isolated from the MCR with

the transfer switch, the positive and negative ground faults would still

be in place when the control of the breaker was transferred to the RGP

and the positive fuse in the closing circuit at the RSP would also blow.



10CFR50, Appendix R, Section III.L, "Alternate and Dedicated shutdown

Capability," requires that alternate safe shutdown capability (achieving

and maintaining hot and cold shutdown from the Remote Shutdown Panel) for

a specific fire area shall be independent of that specific fire area and

shall accommodate both potential post-fire conditions where efforts power

is available and where oftsite power is not available for 72 hours.

Since  control of breaker 252-DG1KA is not independent from the RGP for

the fire in the MCR, the requirements of 10CFR50, Appendix R, Section

III.L, and the design basis of the plant were not met.



The design deficiency in the control circuit has existed since initial

plant operation on September 29, 1986, when the plant was in Mode 5

(REFUELING) for initial fuel loading.  At that time, reactor coolant

temperature was ambient and pressure was atmospheric.



No automatic or manually initiated safety system responses were necessary

to place the plant in a safe and stable condition.  No other equipment or

components were inoperable at the start of this event to the extent that

their inoperable condition contributed to this event.



CAUSE OF EVENT



The cause of this event is attributed to an error in the original design.

The error was not detected during design review and installation.



CORRECTIVE ACTION



Control cable 1DG11U has been rewired at the RSP so the circuit includes

isolation contacts from transfer switch 1C61-HS501.  Although the fuses

of the normal control power circuit for EDG feed breaker 252-DG1KA could

still open during the postulated MCR fire due to multiple DC grounds,

operating the transfer switch at the RSP would isolate the faults, and DC

fuses at the RSP would provide control power for the breaker.



TEXT                                                          PAGE 4 OF 6



Illinois Power (IP) recently reported LER 97-019 (CR 1-97-07-164) which

discussed a similar event caused by design error.  LER 97-019 reported

that the Division 1 Essential Switchgear Heat Removal System fan [FAN]

damper [DMP] control circuit was routed through the MCR and could fail

during a MCR fire, adversely affecting the SSA.  On the basis of the

similarity of LER 97-019 and LER 97-021, IP reviewed all circuits routed

through the Remote Shutdown Panel to ensure that a MCR fire would not

prevent operation of those circuits from the RSP.  No additional circuit

design error that would prevent operation of components from the RSP were

identified during the review.



ANALYSIS OF EVENT



This event is reportable under the provisions of 10CFR50.73 (a)(2)(ii)(B)

because the design of the control circuit for circuit breaker 252-DG1KA

is not in accordance with the design basis of the plant.



An assessment of the safety consequences and implications of this event

identified that this event has potential nuclear safety significance.

During a postulated fire in the MCR, concurrent with a Loss of Offsite

Power, fire could damage the MCR cables, causing multiple ground faults,

the loss of control power for the Division 1 EDG feed breaker, and a loss

of power to Division 1 equipment.  The SSA relies on Division 1 equipment

operated from the RSP to bring the plant to a safe shutdown condition in

the event of a fire in the MCR.



ADDITIONAL INFORMATION



No equipment or components failed as a result of this event.



Clinton Power Station recently submitted LER 97-019 which reported that

the Division 1 Essential Switchgear Heat Removal System fan discharge

damper control circuit was routed through the MCR and could fall during a

MCR fire, adversely affecting the Safe Shutdown Analysis.  The event

reported in LER 97-019 was caused by design error.  The CORRECTIVE ACTION

section of LER 97-021 discusses the actions IP has taken to address the

similarity of the events reported in LER 97-019 and LER 97-021.



For further information regarding this event, contact M. G. McMenamin,

Engineering Projects Engineer, at (217) 935-0881, extension 3469.



TEXT                                                          PAGE 5 OF 6



10CFR21 Report 21-97-040



On August 19, 1997, during preparation of this Licensee Event Report, the

circuit design issue discussed herein was determined to be potentially

reportable under 10CFR21.  IP has evaluated this Issue and concludes that

it is reportable under the provisions of 10CFR, Part 21.



IP is providing the following information in accordance with

10CFR21.21(c)(4).  Initial notification of this matter will be provided

by facsimile of this letter to the NRC Operations Center in accordance

with 10CFR21.21(c)(3) within 2 days of the date the responsible officer

approves this report.



(i)       Wayne D.  Romberg, Assistant Vice President of Illinois Power

          Company, Clinton Power Station, Highway 54, 6 Miles East,

          Clinton, Illinois, 61727, is informing the NRC of a condition

          reportable under the provisions of 10CFR21 by means of this

          report.



(ii)      The basic component involved in this report is the design of

          the control circuit for Division 1 Emergency Diesel Generator 4

          kilovolt 1A1 feed circuit breaker 252-DG1KA.  In accordance

          with the SSA and 10CFR50, Appendix R, Section III.L, the

          control circuit for the breaker to required to be designed to

          allow isolation of the MCR wiring/controls and operation of the

          breaker from the RSP during a fire in the MCR.



(iii)     The control circuit design was supplied by Sargent & Lundy.



(iv)      As discussed in the DESCRIPTION OF EVENT portion of this

          report, the nature of the deficiency in the absence of

          isolation contacts in the design of the offsite Source

          Permissive handswitch circuit.  Since the circuit includes a

          cable in the MCR, it should be isolatable to assure operability

          of the EDG feed breaker while placing the plant in safe

          shutdown from the RSP.  During a postulated fire in the MCR,

          concurrent with a Loss of Offsite Power, fire could damage MCR

          cables, causing multiple ground faults, the lose of control

          power for the Division 1 EDG feed breaker, and a loss of power

          to Division 1 equipment.  The SSA relies on Division 1

          equipment operated from the RSP to bring the plant to a safe

          shutdown condition in the event of a fire in the MCR.



(v)       On July 31, 1991, IP identified that the control circuit was

          routed through the MCR, without having isolation contacts at

          the RSP transfer switch.  IP determined that this issue was

          potentially reportable under 10CFR21 on August 19, 1997.



(vi)      This issue potentially affected all circuits routed through the

          Remote Shutdown Panel.  Two circuits were identified to be

          deficient in design, the control circuit for breaker 252-DG1KA

          discussed in this LER and the control circuit for the Division

          1 Essential Switchgear Heat Removal System fan damper reported

          in LER 97-019.  IP is not aware of other facilities that would

          be affected by this deficiency.



TEXT                                                          PAGE 6 OF 6



(vii)     The corrective action that IP is taking for this event is

          discussed in the CORRECTIVE ACTION section of this report.



(viii)    IP has no additional information to offer.



*** END OF DOCUMENT ***





Page Last Reviewed/Updated Thursday, March 29, 2012