Part 21 Report - 1997-581

ACCESSION #: 9709030329 LICENSEE EVENT REPORT (LER) FACILITY NAME: Clinton Power Station PAGE: 1 OF 6 DOCKET NUMBER: 05000461 TITLE: Control Circuit for Division 1 Emergency Diesel Generator Feed Breaker Does Not Meet Design Basis Due to Design Error and Could Prevent Power for Division 1 Safe Shutdown Equipment During a Main Control Room Fire with Loss of Offsite Power EVENT DATE: 09/29/86 LER #: 97-021-00 REPORT DATE: 08/25/97 OTHER FACILITIES INVOLVED: DOCKET NO: 05000 OPERATING MODE: 5 POWER LEVEL: 000 THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR SECTION: 50.73(a)(2)(ii) LICENSEE CONTACT FOR THIS LER: NAME: M. G. McMenamin, Engineering TELEPHONE: (217) 935-8881, Projects Engineer Extension 3469 COMPONENT FAILURE DESCRIPTION: CAUSE: SYSTEM: COMPONENT: MANUFACTURER: REPORTABLE NPRDS: SUPPLEMENTAL REPORT EXPECTED: NO ABSTRACT: Design of a control circuit fed from the 125 volts direct current (DC) control power fuse for the Division 1 Emergency Diesel Generator (EDG) feed breaker was not in accordance with the plant's Fire Protection Safe Shutdown Analysis (SSA). The circuit was routed through the Main Control Room (MCR), but did not include isolation contacts at the Remote Shutdown Panel (RSP) transfer switch to allow isolation of the MCR wiring/controls while operating from the RSP. During a MCR fire, concurrent with a Loss of Offsite Power, fire could damage the circuit, causing multiple (DC) ground faults, the loss of control power for the Division 1 EDG feed breaker, and a loss of power to Division 1 equipment. The lack of isolation contacts would prevent isolation of the faults when transfer/isolation of the breaker control circuit from the MCR to the RSP was attempted. The circuit design is not in accordance with 10CFR50, Appendix R, Section III.L, and the plant's design basis. The cause of this event is attributed to a design error. Corrective action for this event includes rewiring the circuit to add isolation contacts from the transfer switch at the RSP, and reviewing all circuits routed through the RSP to ensure that a MCR fire would not prevent operation of those circuits from the RSP. This condition is also reportable under the provisions of 10CFR21. END OF ABSTRACT TEXT PAGE 2 OF 6 DESCRIPTION OF EVENT On July 31, 1997, the plant was in mode 4 (COLD SHUTDOWN) for the sixth refueling outage (RF-6), and reactor [RCT] coolant temperature was being maintained within a band of 100 to 120 degrees Fahrenheit (F) and pressure was zero pounds per square inch. Engineers were performing a vertical slice review of selected safe shutdown components in response to an audit finding. During the review, the engineers identified that control cable [CBL] 1DG11U was not in accordance with the plant's Fire Protection Safe Shutdown Analysis (SSA) described in Appendix F of the Updated Safety Analysis Report (USAR). Control cable 1DG11U carries a 125 volts direct current (VDC) circuit which is fed by control fuses [FU] for the Division 1 Emergency Diesel Generator (EDG) [EK] [DG] 4 kilovolt (KV) 1A1 feed circuit breaker [BKR] 252-DG1KA. Condition Report (CR) 1-97-07-350 was initiated to track an investigation and disposition for this issue. At about 1215 hours, engineers identified that control cable 1DG11U is routed to the Main Control Room (MCR), but the circuit does not include isolation contacts at Remote Shutdown Panel (RSP) [PL] transfer switch [HS] 1C61-HS501 to allow isolation of the MCR wiring/controls while operating from the RSP. During a postulated fire in the MCR, concurrent with a Loss of Offsite Power, fire could damage MCR cables, causing multiple direct current (DC) ground faults, the loss of control power for the Division 1 EDG feed breaker, and a loss of power to Division 1 equipment. The lack of isolation contacts would prevent isolation of the faults when transfer/isolation of the breaker control circuit from the MCR to the RSP was attempted. The SSA relies on Division 1 equipment operated from the RSP to bring the plant to a safe shutdown condition in the event of a fire in the MCR. The control circuit for Division 1 EDG feed breaker 252-DG1KA is a 125 VDC circuit with separate fuses for the closing and tripping legs of the circuit. The design of the RSP and the breaker control circuit has always included transfer switch contacts to allow isolation of the MCR wiring/controls while operating from the RSP. The transfer switch contacts not only isolate the circuit from the MCR but also provide alternate (different direct current circuit and fuses) control power for the circuit so fuses blown prior to operation of the transfer switch do not render the breaker inoperable. In order to inhibit certain auto-transfer features, Offsite Source Permissive (OSP) handswitch 1HS-DG214 and its associated blocking relay [68], 252X1-DG1KA, were added to the Division 1 EDG feed breaker control circuit. Adding this feature did not initially present a failure path for the Division 1 EDG feed breaker control power since the positive leg of the OSP circuit was designed to be isolated by the transfer switch and the negative leg had the OSP relay load resistance between the load and the MCR. Prior to installation, the EDG feed breaker control circuit was modified several times. Despite the schematic for the OSP handswitch showing an isolation contact for the positive leg of the circuit, the wiring design for the RSP did not utilize such a contact. At the time of installation, there were no spare isolation contacts in the transfer switch for the EDG feed breaker control circuit. TEXT PAGE 3 OF 6 The MCR wiring for the OSP handswitch is tied by cable 1DG11U to the positive bus [BU] of the Division 1 DC System [EJ] through the closing circuit fuses of the Division 1 EDG feed breaker. The EDC feed breaker failure mode postulated for this circuit was a MCR fire causing. the circuit to short to ground and also causing a conductor in a separate circuit connected to the negative bus of the Division 1 DC System (and not isolated by operation of the RSP transfer switches) to be shorted to ground. This double ground would then cause the closing circuit fuse for the EDG feed breaker to blow and prevent the breaker from responding to a closing signal. Since cable 1DG11U was not isolated from the MCR with the transfer switch, the positive and negative ground faults would still be in place when the control of the breaker was transferred to the RGP and the positive fuse in the closing circuit at the RSP would also blow. 10CFR50, Appendix R, Section III.L, "Alternate and Dedicated shutdown Capability," requires that alternate safe shutdown capability (achieving and maintaining hot and cold shutdown from the Remote Shutdown Panel) for a specific fire area shall be independent of that specific fire area and shall accommodate both potential post-fire conditions where efforts power is available and where oftsite power is not available for 72 hours. Since control of breaker 252-DG1KA is not independent from the RGP for the fire in the MCR, the requirements of 10CFR50, Appendix R, Section III.L, and the design basis of the plant were not met. The design deficiency in the control circuit has existed since initial plant operation on September 29, 1986, when the plant was in Mode 5 (REFUELING) for initial fuel loading. At that time, reactor coolant temperature was ambient and pressure was atmospheric. No automatic or manually initiated safety system responses were necessary to place the plant in a safe and stable condition. No other equipment or components were inoperable at the start of this event to the extent that their inoperable condition contributed to this event. CAUSE OF EVENT The cause of this event is attributed to an error in the original design. The error was not detected during design review and installation. CORRECTIVE ACTION Control cable 1DG11U has been rewired at the RSP so the circuit includes isolation contacts from transfer switch 1C61-HS501. Although the fuses of the normal control power circuit for EDG feed breaker 252-DG1KA could still open during the postulated MCR fire due to multiple DC grounds, operating the transfer switch at the RSP would isolate the faults, and DC fuses at the RSP would provide control power for the breaker. TEXT PAGE 4 OF 6 Illinois Power (IP) recently reported LER 97-019 (CR 1-97-07-164) which discussed a similar event caused by design error. LER 97-019 reported that the Division 1 Essential Switchgear Heat Removal System fan [FAN] damper [DMP] control circuit was routed through the MCR and could fail during a MCR fire, adversely affecting the SSA. On the basis of the similarity of LER 97-019 and LER 97-021, IP reviewed all circuits routed through the Remote Shutdown Panel to ensure that a MCR fire would not prevent operation of those circuits from the RSP. No additional circuit design error that would prevent operation of components from the RSP were identified during the review. ANALYSIS OF EVENT This event is reportable under the provisions of 10CFR50.73 (a)(2)(ii)(B) because the design of the control circuit for circuit breaker 252-DG1KA is not in accordance with the design basis of the plant. An assessment of the safety consequences and implications of this event identified that this event has potential nuclear safety significance. During a postulated fire in the MCR, concurrent with a Loss of Offsite Power, fire could damage the MCR cables, causing multiple ground faults, the loss of control power for the Division 1 EDG feed breaker, and a loss of power to Division 1 equipment. The SSA relies on Division 1 equipment operated from the RSP to bring the plant to a safe shutdown condition in the event of a fire in the MCR. ADDITIONAL INFORMATION No equipment or components failed as a result of this event. Clinton Power Station recently submitted LER 97-019 which reported that the Division 1 Essential Switchgear Heat Removal System fan discharge damper control circuit was routed through the MCR and could fall during a MCR fire, adversely affecting the Safe Shutdown Analysis. The event reported in LER 97-019 was caused by design error. The CORRECTIVE ACTION section of LER 97-021 discusses the actions IP has taken to address the similarity of the events reported in LER 97-019 and LER 97-021. For further information regarding this event, contact M. G. McMenamin, Engineering Projects Engineer, at (217) 935-0881, extension 3469. TEXT PAGE 5 OF 6 10CFR21 Report 21-97-040 On August 19, 1997, during preparation of this Licensee Event Report, the circuit design issue discussed herein was determined to be potentially reportable under 10CFR21. IP has evaluated this Issue and concludes that it is reportable under the provisions of 10CFR, Part 21. IP is providing the following information in accordance with 10CFR21.21(c)(4). Initial notification of this matter will be provided by facsimile of this letter to the NRC Operations Center in accordance with 10CFR21.21(c)(3) within 2 days of the date the responsible officer approves this report. (i) Wayne D. Romberg, Assistant Vice President of Illinois Power Company, Clinton Power Station, Highway 54, 6 Miles East, Clinton, Illinois, 61727, is informing the NRC of a condition reportable under the provisions of 10CFR21 by means of this report. (ii) The basic component involved in this report is the design of the control circuit for Division 1 Emergency Diesel Generator 4 kilovolt 1A1 feed circuit breaker 252-DG1KA. In accordance with the SSA and 10CFR50, Appendix R, Section III.L, the control circuit for the breaker to required to be designed to allow isolation of the MCR wiring/controls and operation of the breaker from the RSP during a fire in the MCR. (iii) The control circuit design was supplied by Sargent & Lundy. (iv) As discussed in the DESCRIPTION OF EVENT portion of this report, the nature of the deficiency in the absence of isolation contacts in the design of the offsite Source Permissive handswitch circuit. Since the circuit includes a cable in the MCR, it should be isolatable to assure operability of the EDG feed breaker while placing the plant in safe shutdown from the RSP. During a postulated fire in the MCR, concurrent with a Loss of Offsite Power, fire could damage MCR cables, causing multiple ground faults, the lose of control power for the Division 1 EDG feed breaker, and a loss of power to Division 1 equipment. The SSA relies on Division 1 equipment operated from the RSP to bring the plant to a safe shutdown condition in the event of a fire in the MCR. (v) On July 31, 1991, IP identified that the control circuit was routed through the MCR, without having isolation contacts at the RSP transfer switch. IP determined that this issue was potentially reportable under 10CFR21 on August 19, 1997. (vi) This issue potentially affected all circuits routed through the Remote Shutdown Panel. Two circuits were identified to be deficient in design, the control circuit for breaker 252-DG1KA discussed in this LER and the control circuit for the Division 1 Essential Switchgear Heat Removal System fan damper reported in LER 97-019. IP is not aware of other facilities that would be affected by this deficiency. TEXT PAGE 6 OF 6 (vii) The corrective action that IP is taking for this event is discussed in the CORRECTIVE ACTION section of this report. (viii) IP has no additional information to offer. *** END OF DOCUMENT ***

Page Last Reviewed/Updated Friday, January 31, 2020