k

AC CELEMYED Ã RJBUTION DEMONS a TJON SYSTEM

REGULATORY INFORMATION DISTRIBUTION SYSTEM (RIDS)

ACCESSION NBR: 8811210120 DOC. DATE: 88/11/15 NOTARIZED- NOFACXL:50-410 Nine Mile Point, Nuclear Station, Unit 2, Niagara Moha

AUTH.NAME AUTHOR AFFILIATIONtARD, K Niagara Mohawk Power Corp.

WXLLXS,J.L. Niagara Mohawk Power Corp.RECXP.NAME RECXPIENT AFFILIATION

DOCKET '805000410

SUBJECT: LER 88-044-01:on 880912,failure to adecpxately separateCategory 1E & Non-Category 1E circuitry.

W/8 ltr.'DISTRIBUTION CODE IE22D COPIES RECEIVED LTR ENCL SIZE'.TITLE: 50.73 Licensee Event Report (LER), Incident Rpt, etc. "'D

NOTES:

RECIPIENTID CODE/NAME

PD1-1 LAHAUGHEY,M

INTERNAL: ACRS MICHELSONACRS WYLIEAEOD/DSP/TPABDEDRONRR/DEST/CEB 8HNRR/DEST/ICSB 7NRR/DEST/MTB 9HNRR/DEST/RSB 8ENRR/DLPQ/HFB 10NRR/DOEA/EAB llNRR/DREP/RPB 10NUDOCS-ABSTRACTRES/DSIR/EIBRGN1 FILE 01

EXTERNAL: 'EG&G WILLIAMS,SH ST LOBBY WARDNRC PDRNSIC MAYS,G

"COPIESLTTR ENCL

1 11 1

1 11 11 11 11 '1 11 11 11 11 12 21 11 11

'

4 41 11 11 1

RECIPIENTID CODE/NAME

PD1-1 PDBENEDICT,R

ACRS MOELLERAEOD/DOAARM/DCTS/DABNRR/DEST/ADS 7ENRR/DEST/ESB 8DNRR/DEST/MEB 9HNRR/DEST/PSB 8DNRR/DEST/SGB 8DNRR/DLPQ/QAB 10NRR/DREP/RAB 10NRR/DRIS/SIB 9A

6 $TTi)P~ 02RES DS%75'RAB

FORD BLDG HOY,ALPDRNSIC HARRIS,J

COPIESLTTR ENCL

1 11 1

2 21 11 11 01 11 11 11 11 11 11 11 11 1

1 11 11 1

S

D

'S

R

I

D'OTE

KO ALL c RIDSn RECIPIENTS

PLEASE HELP US KO REDUCE RAPXZ! CXMIRCT %HE DOGMA CONZBOL DESK,RXM Pl-37 (EXT. 20079) I ELXHINAXBYOUR KLME FROM DXBTRIBUTICSLISTS FOR DXXIMERIS KRJ DONIT HEEDf

A

D,

'TOTAL NUMBER OF COPIES REQUIRED: LTTR 43 ENCL 42

NRC Form 350(94)3)

LICENSEE EVENT REPORT (LER)

U.S, NUCLEAR REGULATORY COMMISSION

APPROVEO OMB NO. 31//04104

EXPIRES: 5/31/BS

FACILITYNAME (1) DOCKET NUMBER l2) PA E 3

0 s 0 o 0 41O i oF O5"""" Failure to Adequately Separate Category lE and Non-Category lE Circuitry Resulting

EVENT DATE (51 LEA NUMBER (5) REPORT DATE (7)

e 1 Ge erator - Inade uate Desi n RevieOTHER FACILITIES INVOLVED IB)

MONTH DAY YEAR YEAR @SEOVENTIAL .sic.

NUMBER 'C.o~REVISIONNUMBER MONTH OAY YEAR FACILITYNAMES

A

DOCKET NUMBER(S)

0 5 0 0 0

OPERATINOMODK lB)

POWERLEVEL

110)

NAME

20,402 (5)

20.405( ~ ) Ill(020.403 (c) (I)I II)

20.405(c) llI IIIII

20A05(c) (1) (lv)

20.405( ~ )ill(vl

20.405(c)

50.30(cl (1)

50.35(c)(2)

50.73(e) (2) (I)

50.734) l2)(B)

50.73(cl(2) lllll

LICENSEE CONTACT FOR THIS LER (12)

50.73(cl(2)(lv)

50.73( ~ )(21(v)

50.73(c) (2((vBl

50.734) I2)(vill)(A)

50.73(c) (2) (vill)(Bl

50.73( ~ )(2)(r)

AREA CODE

THIS REPORT IS SUBMITTED PURSUANT T0 THE REDUIAEMENTBoF 10 cFR (')I Icnrck one or more of tnr fo/foyinp/ (11

0 6 0 0 0

73.71(II)

73.7)(c)

OTHER /Spec/fy in AcrtrecrOr/ow enr/ In Tert, NIIC Form366A/

TELEPHONE NUMBER

Keith Ward, Manager Nuclear DesignCOMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS RKPORT (13)

315 349-4568

CAUSE SYSTEM COMPONENTMANUFAC-

TUREREPORTABLETO NPADS

Ko~0~ r:S ~ir ~ g CAUSE SYSTEM COMPONENT

,+ PN~, Cyr,r,;,8.

wmMANVFAC.

TVRERKPORTABLETO NPRDS

"XvXN

~, yr'

%%5%'j 53%~~%+~SUPPLEMENTAL REPORT EXPECTED (14l

EXPECTEDSUBMISSION

DATE (15)

MONTH DAY YEAR

YES Il/yrr, compleN EXPECTED SUBMISSION DATE/ NO

ABBTRAcT ILlmltro fc(x) rpecrL Ir., rpprorimerrly fllteen rlnple.rpece ryprwr/rrrn ined (15)

On September 12 and again on October 17, 1988 it was discovered that Nine MilePoint Unit 2 (NMP2) had a design'inadequacy in the Division I and II EmergencyDiesel Generator (EDG) control circuits. Specifically, a common mode failureof a relay, switch, or Light Emitting Diode (LED) in the non-Category lE manual

start/stop circuit could disable the Category lE emergency start/stop circuitduring a Loss of Offsite Power (LOOP) condition. The NMP2 licensed operatorsdeclared the Division I and II EDGs inoperable and entered the applicableTechnical Specification (TS) action statement. At the time of both discoveriesthe reactor mode switch was in SHUTDOWN (Operational Condition 4).

The root cause of both events is an inadequate design review. An additionalcause of the October 17 event is cognitive personnel error. Engineeringpersonnel did not identify all the components in the non-Category lE manual

start/stop circuit which were involved in the design deficiency.

The corrective actions are; (1) a temporary modification was performed todisconnect the interface between the non-Category lE switches, relays, LEDs,

and the Category 1E emergency stop/start circuit, (2) a request for a permanentmodification has been submitted to Engineering, (3) the operating procedure forthe Division I and II EDGs was revised to allow the EDGs to be shut down fromthe control room after any initiation, and (4) a Lessons Learned Transmittalwill be issued.

NRC Form 355

8811210120 881115PDR ADOCK 05000410S PDC

NRC form 3COA(SS3)

LICENSEE FVENT REPORT (LER) TEXT CONTINUATIONU S NUCLEAR 4EOVLATORY COMMISSION

APPROVEO OMS NO. 3)9)~ISOEXPIRES: 8/31/S3

PACILITYNALIE II) OOCKET NUMBER I2)LE4 NUMBER (5)

yEAR Qyf SEOUENTIAL ~ay'Z rrEVOIONNUMBER ~<:I NUM Err

PAGE I3)

Nine Mile Point Unit 2

VENTP/II:n EoIT> O rst,/3or/, //for//rr/f/ ///IC /ISCS/43/(17)

I. DESCRIPTION OF EVENT

Q 6 Q Q Q 410 88 044 01 02 oF 05

On September 12 and again on October 17, 1988 it was discovered that Nine MilePoint Unit 2 (NMP2) had a design inadequacy in the Division I and II EmergencyDiesel Generator (EDG) control circuits. Specifically, a common mode failure ofa relay, switch, or Light Emitting Diode (LED) in the non-Category lE manualstart/stop circuit could disable the Category 1E emergency start/stop circuitduring a Loss of Offsite Power (LOOP) condition. The NMP2 licensed operatorsdeclared the Division I and II EDGs inoperable and entered the applicableTechnical Specification (TS) action statement. At the time of both discoveriesthe reactor mode switch was in SHUTDOWN (Operational Condition 4) and thereactor was at a power level of (5 rated thermal power. The reactor pressureand temperature was at 4.5 pounds per square inch gauge and 124 degreesFahrenheit, respectively, on September 12, 1988, and at 3 pounds per square inchgauge and at 102 degrees Fahrenheit, respectively, on October 17, 1988.

The sequence of events for this incident is as follows:

On September 1 2, 1988, during a review to update the Failure Modes and EffectsAnalysis (FMEA) for the Emergency Diesel Generators, contractor personneldiscovered a design deficiency in the interface between the non-Category lEmanual start/stop circuit and the Category lE emergency start/stop circuit forthe EDGs. A common mode failure of either a relay or local stop pushbutton inthe manual start/stop circuit could disable the emergency start/stop circuitduring a Loss of Offsi te Power (LOOP) by tripping the emergency start ci rcuitrun'relays. Each Division I and II EDG control cabinet possesses the samedesign deficiency.

On October 17, 1988 during subsequent review and upon finalization of theproblem report for the September 12, 1988 event, FMEA review/update personneldiscovered another component in the non-Category 1E manual start/stop circuitthat could disable the Category lE emergency start/stop circuit for the EDGsduring LOOP conditions. A coranon mode failure of this component, a LightEmitting Diode (LED), could also disable the Category lE emergency start/stopcircuit by tripping the emergency start circuit run relays. Each Division I andII EDG control cabinet possess this LED.

On both dates, the NMP2 licensed operators declared the Division I and II EDGsinoperable and entered Technical Specification action statement 3.8.1.2.a. TSaction statement 3.8.1.2.a suspends core alterations, fuel movement, or anyactions with a potential for draining the reactor vessel. None of these actionswere in progress at the time of the events.

There were no other inoperable and/or failed components which contributed tothese events.

NRC fORM ~4ISAUI o U S GPO.I SSS 0.62o 535 4M

~ NRC Form 330A)083)

LICENSEE EVENT REPORT (LER) TEXT CONTINUATIONUS. NUCLEAR REGULATORY COMMISSION 9

APPROVEO OMB NO. 3I50&104EXPIR ES: 8/3) /88

FACILITYNAME lll OOCKET NUMBER I3)

YEAR

LER NUMBER (8)

N? SEGUENTIAI. NXNUMBER '??F6

REVISIONNUM ER

PAGE I3)

Nine Mile Point Unit 2

7Fil7 CP BBYSOYNO)8~ UBB~ IV)BC ~i 3) IIT)

o 6 o o o 410 88 044 01 03 oF 05

II. CAUSE OF EVENT

The immediate cause of both events is a design deficiency. The root cause ofboth events was an inadequate design review by Architect/Engineer (A/E)personnel. A/E personnel did not implement design requirements previouslyidentified by the EDG supplier. Therefore,'the design was inadequate and wouldallow the Division I and II EDGs to be disabled by a common mode failure of arelay, switch, or LED in the non-Category lE manual stop/start circuit during aLOOP conditions.

An additional cause to the October 17, 1988 event was cognitive personnelerror. Engineering personnel did not recognize that a common mode failure ofthe LED in the non-Category 1E manual start/stop circuit could also disable theCategory lE emergency start/stop circuit during LOOP conditions. Therefore, thetemporary modification performed on September 13, 1988 was not effective becauseit only disconnected the switch and relay, but did not disconnect the LED.

III. ANALYSIS OF EVENT

This event is considered reportable via 10CFR50.73(a)(2)(v) because this eventcould have prevented fulfillment of the EDG safety function by rendering twoindependent EDG trains inoperable.

The worst case scenario for the plant based on a common mode failure of one ofthese non-Category lE devices is as follows:

l. A Loss of Coolant Accident (LOCA) is assumed to occur with a simultaneousLoss of Offsite Power (LOOP).

2. A common mode failure of one of the non-Category 1E components in theautomatic starting circuit for both the Division I and Division II EDGs.This would result in a loss of all service water.

3. The Division III diesel would also be inoperable from the loss of coolingwater heat sink supplied by service water.

This scenario would place the plant in the unanalyzed condition of having noEDG's operable and subsequently, no service water system cooling availableduring a LOCA and a LOOP (assuming a single failure criteria).

The probability of these events occurring simultaneously, however, is remote. Acommon mode failure of one of these non-Category 1E components for both EDGssimultaneously is highly unlikely.

Since a failure of the manual stop/start circuit components never occurred, thesafety function of the Emergency Diesel Generators was never compromised. Itcan be concluded then, that this event did not at any time impact plant orpublic health and safety.

The duration of the design deficiency, from the time the EDG control cabinetswere designed in June 1977, to the day the design deficiency was discovered inOctober 1988, was approximately eleven years.

NRC SORM SNLAISING I oU.S.GPO;1988 0 834 538 455

NRC FonII 388A(883)

LICENSEE EyENT REPORT (LER) TEXT CONTINUATIONU5. NUCLEAR REOULATORY COMMISSION

APPROVED OMS NO. 3150&ICEEXPIRES: 8/31/88

FACILITYNAME III COCKET NUMSER 12)

YEAR

LER NUMSER ISI

iQ$ SEOVENZIALP( ./ NVMSER

REVISIONNVMSER

PACE (3)

Nine Mile Point Unit 2~>O'PV%/SCAPI(S~ ugSIERARI/IH/IC CSI'AJ(ITI

0 0 0 410 88 044 01 04 of 05

However, the reportable duration of this event, from the date of issuance ofNMP2's operating license on October 31, 1986, to the date that the work requestcorrected the design deficiency on October 18, 1988, was approximately sevenhundred and eighteen days.

IV. CORRECTIVE ACTIONS

The immediate corrective actions were to declare the Division I and II EDGs

inoperable and enter TS action statement 3.8.1.2.a.

An additional corrective action was to issue Temporary Modification Request No.88-912, and Work Request No. 146398, to disconnect the interface between thenon-Category 1E components (the switch and the relay) and the Category lEemergency start circuit. This work was completed on September 13, 1988.

Temporary Modification No. 88-206 and Work Request No. 146147 were issued todisconnect the interface between the non-Category lE LED and the Category lEemergency start circuit. This work was completed on October 18, 1988.

A Lessons Learned Transmittal will be issued to the Design Engineering and SiteEngineering departments cautioning personnel to adequately identify the scope ofproblems before proceeding with corrective actions.

To accommodate Temporary Modification Request No. 88-912-, procedure N2-0P-100A,"Standby Diesel Generators" was revised on September 13, 1988. The revisioninco'rporates the requirement to use the control switch and Loss of CoolantAccident (LOCA) bypass switch in the control room to shut down the Division Iand II EDGs after any initiation.

The long term corrective action will be to permanently correct the designdeficiency through a plant modification. Modification request N2-88-174 hasbeen submitted to perform this work by the end of the first NMP2 refuelingoutage.

V. ADDITIONAL INFORMATION

There have been other problems identified by the FMEA Analysis Update but noneof them are similar to this event.

LER 88-52 discusses an event where a non-Category 1E Agastat timer relay wasincorrectly installed in a Category 1E Motor Control Center. The root cause ofthis event was attributed to a design deficiency because the design drawingspecified (incorrectly) the use of the non-Category 1E relay. Failure of thisnon-Category lE relay could have prevented the Service Water discharge motoroperated valves (MOV) from opening after a Loss of Offsite Power condition.Failure of these MOVs in the closed position would have disabled the associatedService Water pumps. The corrective action for this event was to replace thenon-Category 1E agastat relays with Category lE relays, and to revise the designdrawings to reflect the use of the Category 1E relays. The two LERs (LER 88-44,Revision 1 and LER 88-52) are not similar because the root cause for LER 88-44,Revision 1 is an inadequate design review while the root cause for LER 88-52 isa design deficiency.

NNC FORM OSSA1883l Ru.s opo:Ieee o e2A s38 Ass

INC Penn ESA(083) U.S. NUCLEAR REGULATORY COMMISSION

APPROVEO OMS NO. 3)50W104EXPIRES: 8/31I88

PACILITYNAME 11)

Nine Mile Point Unit 2< mT674~ 4P344)4~~ UPP MESINRAIIYRC 3354'4) 117)

OOCKET NUMSER 12)

o s o o o 4l0

YEAR

88

LER NUMBER IS)

8884 SEOUENTIAL:.N6NUMSER

044

REVISIONNUMEER

01

PACE 13)

05 oF 05

Failed component identification: None

Identification of Components Referred to in this LER

ComponentIEEE 803EIIS Funct

IEEE 805System ID

RelaySwitchDiesel GeneratorSolenoidCircuitLight Emitting Diode

RLYHS

DG

SOLN/AN/A

EK

EKEK

EK

EK

EK

NAC PORM 344A(94)3) 4 U.S.OPO:1988 0 624 538/455

7 NIAGARALl MOHAWK NMP41663

NINE MILEPOINT—UNIT2/P.O. BOX 63, LYCOMING, NY 13093/TELEPHONE (315) 343.2110

November 15, 1988

United States Nuclear Regulatory CommissionDocument Control DeskWashington, DC 20555

RE: Docket No. 50-410LER 88-44Revision 1

Gentlemen:

In accordance with 10 CFR 50.73, we hereby submit the followingLicensee Event Report:

LER 88-44 Is being submitted in accordance with 10 CFR 50.73Revision 1 (a)(2)(v), "Any event or condition that alone could have

prevented the fulfillment of the safety function ofstructures or systems that are needed to: (A) Shut downthe reactor and maintain it in a safe shutdown condition;(B) Remove residual heat; (C) Control the release ofradioactive material; or (D) Mitigate the consequences ofan accident."

This report was completed in the format designated in NUREG-1022,Supplement 2, dated September 1985.

Very truly yours,

J. L. Wi1 lisGeneral SuperintendentNuclear Generation

JLW/PCJB/mjd

Attachments

cc: Regional Administrator, Region 1

Sr. Resident Inspector, W. A. Cook

990

p p