10 CFR 50.90

DWIGHT C. MIMS

Senior Vice President, NuclearRegulatory & Oversight

Palo VerdeNuclear Generating Station

P.O. Box 52034

Phoenix, AZ 85072Mail Station 7605

102-06807-DCM/RKR/JR Tel 623 393 5403December 12, 2013

ATTN: Document Control DeskU.S. Nuclear Regulatory CommissionWashington, DC 20555-0001

Dear Sirs:

Subject: Palo Verde Nuclear Generating Station (PVNGS)Units 1, 2, and 3Docket Nos. STN 50-528, 50-529, and 50-530Supplemental Information Concerning Request forAmendment to Technical Specification (TS) 3.3.6,Engineered Safety Features Actuation System (ESFAS)Logic and Manual Trip

By letter number 102-06775, dated September 27, 2013 [AgencywideDocuments Access Management System (ADAMS) Accession No.ML13280A264], Arizona Public Service Company (APS) submitted a licenseamendment request (LAR) for Palo Verde Nuclear Generating Station(PVNGS), Units 1, 2, and 3. The proposed amendment would reinstate aninadvertently omitted 4-hour completion time within TS 3.3.3, CEACs, andrevise a test frequency note within a Surveillance Requirement under TS3.3.6, ESFAS Logic and Manual Trip.

By e-mail dated November 25, 2013, APS was notified that the NRC staffrequired additional information to complete its acceptance review. Theinformation requested by the NRC was discussed with APS during aconference call on November 26, 2013, and it was agreed that APS wouldrespond by December 18, 2013. By letter dated December 4, 2013 (ADAMSAccession No. ML13331A836), the NRC docketed the request for additionalinformation and provided clarification based upon the November 26, 2013conference call.

The enclosure to this letter provides the APS response to the NRC request.No commitments are being made by this letter and the information providedin this letter does not modify the conclusion that the proposed amendmentdoes not involve a significant hazards consideration under the standards setforth in 10 CFR 50.92(c).

A member of the STARS (Strategic Teaming and Resource Sharing) Alliance

Callaway-Comanche Peak-Diablo Canyon-Palo Verde-San Onofre.South Texas-Wolf Creek

ATTN: Document Control DeskU.S. Nuclear Regulatory CommissionSupplemental Information Concerning Request for Amendment to TechnicalSpecification 3.3.6Page 2

Should you need further information regarding this submittal, please contactRobert K. Roehler, Licensing Section Leader, at (623) 393-5241.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on D 12) 2O' 3(Date)

Sincerely,

W I/?,c

DCM/RKR/JR

Enclosure: Supplemental Information Concerning Request for Amendmentto Technical Specification 3.3.6, Engineered Safety FeaturesActuation System (ESFAS) Logic and Manual Trip

cc: M. L. DapasJ. K. Rankin

A. E. George

M. A. BrownA. V. GodwinT. Morales

NRC Region IV Regional AdministratorNRC NRR Project Manager for PVNGS (electronicand hard copy)NRC NRR Project Manager (electronic and hardcopy)NRC Senior Resident Inspector for PVNGSARRAARRA

ENCLOSURE

Supplemental Information ConcerningRequest for Amendment to

Technical Specification 3.3.6, Engineered SafetyFeatures Actuation System (ESFAS) Logic and

Manual Trip

ENCLOSURE

Supplemental Information Concerning Request for Amendmentto Technical Specification 3.3.6, Engineered Safety Features

Actuation System (ESFAS) Logic and Manual Trip

BACKGROUND

By letter number 102-06775, dated September 27, 2013 [AgencywideDocuments Access Management System (ADAMS) Accession No.ML13280A264], Arizona Public Service Company (APS) submitted a licenseamendment request (LAR) for Palo Verde Nuclear Generating Station(PVNGS), Units 1, 2, and 3. The proposed amendment will reinstate aninadvertently omitted 4-hour completion time within TS 3.3.3, CEACs, andrevise a test frequency note within a Surveillance Requirement under TS3.3.6, ESFAS Logic and Manual Trip.

By e-mail dated November 25, 2013, APS was notified that the NRC staffrequired additional information to complete its acceptance review. Theinformation requested by the NRC was discussed with APS during aconference call on November 26, 2013, and it was agreed that APS wouldrespond by December 18, 2013. By letter dated December 4, 2013 (ADAMSAccession No. ML13331A836), the NRC docketed the request for additionalinformation and provided clarification based upon the November 26, 2013conference call.

This enclosure provides the APS response to the NRC request for additionalinformation. The NRC request is stated first followed by the APS response.

NRC Request

PVNGS Surveillance Requirement (SR) 3.3.6.2 requires the performance ofsubgroup relay tests of each Actuation Logic channel at a Frequency of "Inaccordance with the Surveillance Frequency Control Program (SFCP)." SR3.3.6.2 contains a Note to the Surveillance which states "Relays exempt fromtesting shall be tested each 18 months." APS proposes to change the Noteto replace "18 months" with "In accordance with the Surveillance FrequencyControl Program." APS states that this change should have been addressedin the LAR for Technical Specifications Task Force (TSTF) change travelerTSTF-425, Relocate Surveillance Frequencies to Licensee Control - Risk-Informed Technical Specification Task Force (RITSTF) Initiative 5b. Theallowances of TSTF-425 were approved in Amendment No. 188 (ADAMSAccession No. ML112620293) dated December 15, 2011. The licensee statesthat the proposed change to the Surveillance Note is consistent with theintent of TSTF-425 and therefore is an administrative change.

1

EnclosureSupplemental Information Concerning

Request for Amendment to TS 3.3.6

In accordance with the Notice of Availability published in the Federal Register(74 FR 31996; July 6, 2009) for TSTF-425, the traveler involves time-basedsurveillance frequency relocations to a licensee-controlled program (i.e., theSFCP). However, time-based Surveillances that are either event-driven,controlled by an existing program, or which are condition based cannot berelocated to the SFCP. STS SR 3.3.6.2 shows that subgroup relays aretested at 184 days or in accordance with the SFCP and the SR Note containsa condition-based allowance in that relays exempt from testing duringoperation shall be tested during each MODE 5 entry exceeding 24 hoursunless tested during the previous 6 months.

The NRC staff's acceptance review noted that the PVNGS Surveillance Note toSR 3.3.6.2 is a condition-based change and represents a deviation from theprecedent in NUREG-1432, Revision 4, "Standard Technical Specifications -Combustion Engineering Plants," April 2012 (ADAMS Accession No.ML12102A165), for incorporating TSTF-425. For PVNGS, the Note to SR3.3.6.2 applies a surveillance frequency of 18 months which establishes arefueling interval for testing exempted relays. Thus, the Note to SR 3.3.6.2applies a condition-based frequency for subgroup relays that cannot be de-energized when the plant is operating.

Please provide a technical basis for APS' conclusion that the proposed changeto the Note for SR 3.3.6.2 conforms to TSTS-425 requirements and can,therefore, be relocated to the SFCP because the time-based Surveillance isneither event-driven, controlled by an existing program, or condition based.

APS Response

As stated in the Federal Register Notice of Availability, Technical SpecificationTask Force Traveler (TSTF) 425 (ADAMS Accession No. ML090850642)involves the relocation of time-based surveillance frequencies to a licensee-controlled program, called the Surveillance Frequency Control Program(SFCP), and adds the SFCP to the administrative controls section of theTechnical Specifications (TS). It further states that the SFCP does notinclude surveillance frequencies that are event-driven, controlled by anexisting program, or are condition-based (e.g., battery age-related testing).

The 18-month frequency stated in the PVNGS SR 3.3.6.2 Note, "Relaysexempt from testing during operation shall be tested each 18 months," issolely based upon time (18 months). The Note frequency is not driven by anevent nor is it controlled by an existing program as described in the TSTF-425 exceptions.

The existing PVNGS Note for SR 3.3.6.2 is different than the Note in NUREG1432, Standard Technical Specifications - Combustion Engineering Plants,April 2012, as a result of PVNGS plant specific License Amendment Number117 that was approved by the NRC on May 20, 1998 (ADAMS Accession No.

2

EnclosureSupplemental Information Concerning

Request for Amendment to TS 3.3.6

ML021720060). The change to the 18-month frequency from the previous62-day staggered test basis frequency was based upon NRC approvedCombustion Engineering (CE) Topical Report CEN-403, Revision 1-A(Attached). Topical Report CEN-403 justified the extension of thesurveillance test interval for each ESFAS subgroup relay based on efforts to:

1. Reduce over-testing of plant equipment,

2. Reduce the potential for inadvertent ESF actuations, and

3. Establish test frequencies based on the demonstrated reliability ofthe ESFAS subgroup relays.

As documented in the Topical Report and summarized in the related NRCsafety evaluation, the mean time between failures (MTBF) for ESFASsubgroup relays through 1994 (for PVNGS) was 36 months. The NRC safetyevaluation states that the data supports the conclusion that the smallnumber of failures of the ESFAS subgroup relays justifies extending thesurveillance interval to 18 months. This change in frequency was solelybased upon time and not event-driven, controlled by an existing program norcondition-based.

Based on the above, APS concludes that the proposed change to the Note forSR 3.3.6.2 conforms to TSTF-425, in that it is a time-based surveillancefrequency and does not meet any of the surveillance frequency exceptions -surveillance frequencies that are event-driven, controlled by an existingprogram, or are condition-based. On that basis, APS proposes that thesurveillance frequency in the SR 3.3.6.2 Note be changed to be in accordancewith the SFCP, consistent with the intent of TSTF-425.

3

ENCLOSURE, ATTACHMENT

Combustion Engineering Owners GroupTopical Report CEN-403, Revision 1-A

CEOG LvDrary

Ka\ACOMBUSTION ENGINEERING OWNERS GROUP

CEN-403Revision 1-A

ESFAS SUBGROUP RELAYTEST INTERVAL EXTENSION

FINAL REPORT

CEOG TASK 664/750

prepared for the

C-E OWNERS GROUP

March 1996

© Copyright 1996 Combustion Engineering, Inc. All rights reservedABB Combustion Engineering Nuclear Operations

AitIII"'IPIP

LEGAL NOTICE

This report was prepared as an account of work sponsored by the CEOwners Group and Westinghouse Electric Company, LLC. Neither the

CEOG nor Westinghouse LLC. nor any person acting on their behalf:

A. Makes any warranty or representation, express or impliedincluding the warranties of fitness for a particular purpose ormerchantability, with respect to the accuracy, completeness, orusefulness of the information contained in this report, or that theuse of any information, apparatus, method, or process disclosedin this report may not infringe privately owned rights; or

B. Assumes any liabilities with respect to the use of, or fordamages resulting from the use of, any information, apparatus,method, or process disclosed in this report.

Westinghouse Electric Company, LLC2000 Day Hill Road, P.O. Box 500

Windsor, CT 06095-0500

IV.- '~. : . . ..

(OMBUST1ON ENGINEERING OWNERS GROUPArizona Pulbie Servarce Co Consumers Power Co Maine Yankee Atomic Power Co, Omaha Puolic P0

Palo Verde 1, 2, 3 Palisades Enlergy Operations Irc. Maine Yankee Ft. CaIhcBaltimore Gas & Electric Florida Power& Light Co. ANO 2 Northeast Utilities Sewvice Co. Southern Caltorni

Calven Clilfs 1. 2 St. LuCe 1, 2 WSES Unit 3 Millstone 2 SONGS

wer District•Jna Edison Co.2,3

March 27, 1996CEOG-96-099

Project No. 692

U.S. Nuclear Regulatory CommissionWashington D.C.Attn: Document Control Desk

Subject: C-E Owners Group Submittal of CEN-403 Revision 1-A, "ESFAS

Subgroup Relay Test Interval Extension"

Gentlemen:

This letter submits fifteen (15) copies of C-E Owners Group Topical Report CEN-403Revision 1-A, "ESFAS Subgroup Relay Test Interval Extension." CEN-403 Revision1-A incorporates the NRC's approval letter of February 27, 1996 and the associatedSafety Evaluation.

The C-E Owners Group appreciates the NRC's review of this report.

Very truly yours,

D. F. Pilmer, ChairmanC-E Owners Group

Attachment: CEN-403, Revision 1-A, 15 copies

cc: G. C. Bischoff, ABB*M. Waterman, (NRC)*S. Magruder, (NRC)*D. Crutchfield, (NRC)*B. Boger, (NRC)*CEOG Representatives*

*without CEN-403, Revision 1-A

COMBUSTION ENGINEERING OWNERS GROUP

April 2, 1996CEOG-96-129

CEOG andLicensing SubcommitteeParticipants in Tasks 664/750

Gentlemen:

Subject: Transmittal of the Approved Topical Report for ESFAS SubgroupRelay Test Extension

Attachment: ESFAS Subgroup Relay Test Interval Extension, CEN-403 Revision 1-A

The purpose of this letter is to transmit the NRC approved version of the topicalreport justifying the test interval extension for ESFAS subgroup relays. Included inthe front matter of the report is the Safety Evaluation prepared by NRC staff. The SEapproves the CEOG request to extend the test interval to a refueling basis. Currentlythe test interval is as short as monthly for some CEOG members.

Participants in this task are strongly encouraged to submit license amendmentsreferencing the approved topical report. The non-participating utilities (CPC, MY, andNU) are requested to consider participation in Tasks 664/750. Full participation bythe CEOG would support development of future generic changes to the ImprovedStandard Technical Specifications (ISTS) using the industry ISTS maintenanceprocess.

If you have any questions, please contact me at (860) 285-3115.

Sincerel

Paul '. HijeckAssistant Project ManagerC-E Owners Group

Attachments

cc: G. C. Bischoff, ABB w/o P. W. Richardson, ABB w/oB. Smith, ABB K. Lillie, ABBCEOG Library

ABB Combustion Engineering Nuclear Operations

Grmbustion Engineerirg. Inc. 1000 Prospect Hill Road Telephone (203) 285-2713

Post Otfice Box 500 Fax (203, 285-2337Windsor, Conrveclcul 06095-0500

'3 4-' •'

LSCPage 2

April 2, 1996CEOG-.96-129

COMBUSTION ENGINEERING OWNERS GROUP REPRESENTATIVES

R. Bernier, APS (Palo Verde)W. A. Goodwin, ABB (Windsor)J. Waid, Entergy Operations-ANO (Russellville)R. F. Burski, Entergy Operations-WSES (Killona)K. Craig, FPL (J. Beach)D. Pilmer, SCE (San Clemente)

J. Lippold, BGE (Lusby)J. D. Alderink, CPC (Covert)*J. Hebert, MY (Brunswick)*S. A. Sudigala, NU (Waterford)*R. Jaworski, OPPD (Omaha)

LICENSING SUBCOMMITTEE

J. Provasoli, APS (Tonopah)*C. M. Molnar, ABB (Windsor)E. J. Weinkam III, FPL (Jensen Beach)G. Ashrey, Entergy Operations-ANO (Russellville)P. Caropino, Entergy Operations-Waterford (Killona)W. Hansher, OPPD (Omaha)

S. Bauer, APS (Tonopah)J. Osborne, BGE (Lusby)B. Vincent, CPC (Covert)*J. Brinkler, MY (Brunswick)*M. Robles, Jr., NU (Millstone)*B. Woods, SCE (San Clemente)

* without CEN-403 Rev. 1-A

UNITED STATES

NUCLEAR REGULATORY COMMISSION,WASHINGTON, D.C. 20555-0001

February 27, 1996

Mr. D. F. PilmerChairmanCombustion Engineering Owners GroupSouthern California EdisonMS E-50S.O.N.G.S.P.O. Box 128San Clemente, CA 92672-0128

SUBJECT: REVIEW OF CE OWNERS GROUP TOPICAL REPORT CEN-403, REVISION 1,"ESFAS SUBGROUP RELAY TEST INTERVAL EXTENSION"

Dear Mr. Pilmer:

The NRC staff has reviewed the subject topical report submitted by theCombustion Engineering Owners Group (CEOG) by letter dated November 14, 1995(Ref. 14). The results of our evaluation are in the enclosed safetyevaluation report.

The NRC staff finds that the data and analyses presented in CEN-403, Rev. 1,and supporting documents support the proposed refueling interval staggeredtest basis for ESFAS subgroup relays used in CE-design plants. Therefore, thestaff has approved CEN-403, Rev. I for use by licensees as a basis for changesto plant technical specifications. License application amendments forproposed TS changes referencing CEN-403, Rev. 1 should:

1. Confirm the applicability of the CEN-403, Rev. 1 analyses for theirplant.

2. Confirm that the applicable setpoint calculations account for anyincrease in instrument drift caused by the extended test interval.

As a result of the staff's review of CEN-403, Rev. 1, the staff has determinedthat if two or more ESFAS subgroup relays fail in a 12-month period, thelicensee should reevaluate the adequacy of the surveillance interval. Thereevaluation should consider the design, maintenance, and testing of all ESFASsubgroup relays. If the licensee determines that the surveillance interval isinadequate for detecting a single relay failure, the surveillance intervalshould be decreased. The revised surveillance interval should be such thatthe licensee can detect an ESFAS subgroup relay failure prior to theoccurrence of a second failure.

-2-

Additionally, plants that use Potter and Brumfield (P&B) MDR relays for ESFASsubgroup relay applications should also:

1. Ensure that their commercial grade equipment certification program isadequate for detecting the types of failures that are discussed inReferences 8, 9, 11, and 12 of the enclosed safety evaluation report.

2. Ensure that all pre-1990 P&B MDR dc relays and all pre-1992 P&B MDR acrelays have been removed from ESFAS applications.

Please contact Michael E. Waterman, 301-415-2818, if you have any questions onthis subject.

Bruce A. Boger, DirectorDivision of Reactor Controls

and Human FactorsOffice of Nuclear Reactor Regulation

UNITED STATESSo• NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20555-0001

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION

REVIEW OF CE OWNERS GROUP TOPICAL REPORT CEN-403. REV. 1.

ESFAS SUBGROUP RELAY TEST INTERVAL EXTENSION

1. SUMMARY

The staff has reviewed the Combustion Engineering Owners Group (CEOG) topical

report, CEN-403, Rev. 1, "ESFAS Subgroup Relay Test Interval Extension,"

(Ref. 14) and CEOG responses (Refs. 2 and 3) to two NRC requests for

additional information (RAIs) (Refs. 4 and 5). The CEOG report and RAI

responses provide an acceptable justification for testing the Engineered

Safety Features Actuation System (ESFAS) subgroup relays on a staggered basis

such that the licensee tests each relay at least once during each fuel cycle.

The analysis presented in CEN-403, Rev. 1 is bounding and provides an adequate

basis for Technical Specification (TS) changes to extend the ESFAS subgroup

relay test interval as discussed in this safety evaluation report, subject to

the limitations and conditions presented herein.

Based on the staff's review, the staff has determined that if two or more

ESFAS subgroup relays fail in a 12-month period, the licensee should

reevaluate the adequacy of the surveillance interval. The reevaluation should

consider the design, maintenance, and testing of all ESFAS subgroup relays.

If the licensee determines that the surveillance interval is inadequate for

ENCLOSURE

-2-

detecting a single relay failure, the surveillance interval should be

decreased. The revised surveillance interval should be such that the licensee

can detect an ESFAS subgroup relay failure prior to the occurrence of a second

failure.

2. BACKGROUND

The NRC staff formed a Task Group in August 1983 to investigate problems

concerning surveillance testing required by Technical Specifications (TS), and

to recommend approaches to effect improvements. The results of the study were

published in NUREG-1024, "Technical Specifications - Enhancing the Safety

Impact," in November 1983 (Ref. 6). NUREG-1024 contained recommendations that

the staff review the bases for TS test frequencies; ensure that the TS

required tests promote safety and do not degrade equipment; and review

surveillance tests to ensure that they do not unnecessarily burden personnel.

The Technical Specifications Improvement Program (TSIP) was established in

December 1984 to provide the framework for addressing the NUREG-1024

recommendations, and rewriting and improving the TS. As an element of the

TSIP, TS surveillance requirements were comprehensively examined as

recommended in NUREG-1024. The results of the TSIP effort are presented in

NUREG-1366, "Improvements to Technical Specifications Surveillance

Requirements' (Ref. 7). The study found that, while some testing at power is

essential, safety can be improved, equipment degradation decreased, and

unnecessary personnel burden prevented by reducing the amount of testing at

-3-

power, These three conclusions formed the bases for the four criteria that

justify changes of surveillance intervals as follows:

Criterion 1 -

Criterion 2 -

Criterion 3 -

Criterion 4 -

The surveillance could lead to a plant transient,

The surveillance results in unnecessary wear to equipment,

The surveillance results in radiation exposure to plant

personnel that is not justified by the safety significance

of the surveillance,

The surveillance places an unnecessary burden on plant

personnel because the time required is not justified by the

safety significance of the surveillance.

3.0 APPROACH

The CEOG requested ABB-CE to perform generic comparative analyses of ESFAS

subgroup relay performance in CE plants. The analyses addressed the effect of

ESFAS subgroup relay surveillance test interval extensions on the availability

of the ESFAS for two broad classes of CE plant designs; plants with an ESFAS

designed by CE, and plants with a non-CE ESFAS design. The resulting CEOG

topical report, CEN-403, Rev. 1, summarizes CE plant ESFAS subgroup relay

failure history data for both ESFAS types.

-4-

The staff noted in its first RAI (Ref. 4) that the relay failure history data

for Arkansas 2, Maine Yankee, Palisades, and Waterford 3 were omitted from the

initial CEOG study. The subsequent inclusion of this data did not

significantly change the results of the original CEOG analysis.

The NRC staff requested in its second RAI (Ref. 5) that the CEOG evaluate the

impact of two 10 CFR Part 21 reports on Potter and Brumfield (P&B) relay

failures (Refs. 8 and 9) and address the conclusions of an AEOD special study

report on P&B relays (Ref. 10) on the proposed surveillance interval

extension. In its response, the CEOG concluded that the P&B relay

surveillance interval could be extended to once per fuel cycle as proposed

provided that:

a) Licensee documentation shows that all pre-1990 P&B MDR dc relays

and all pre-1992 P&B MDR ac relays have been removed from ESFAS

applications.

b) Licensee documented maintenance and work controls are in place

that effectively prevent any installation of any pre-1990 P&B MDR

dc relay or any pre-1992 P&B MDR ac relay in any safety-related

application, including ESFAS circuitry.

c) The licensee's plant commercial grade equipment certification

program includes the necessary controls to successfully detect the

over-sized coil problems that were discussed in Combustion

-5--

Engineering TechNote No. 92-05, "Potter and Brumfield MDR-series

Relay Deficiencies," (Ref. 11) as well as controls to detect the

over-sized coil problem that is discussed in the 10 CFR Part 21

report on P&B relay failures (Ref. 9), and ABB-CE Infobulletin 93-

02, "Potter & Brumfield MDR Relay Defect" (Ref. 12).

d) The licensee's plant commercial grade equipment certification

program includes the necessary controls to identify the presence

of rotor return springs that are susceptible to the chloride

stress corrosion cracking that is discussed in the January 13,

1993, 10 CFR Part 21 report on P&B MDR Model 170-1, 7032, 7033,

and 7034 relays (Ref. 8).

The staff finds performance of these additional actions to be an acceptable

approach to permit extending the surveillance intervals of P&B relays to a

refueling cycle interval.

The mean time between failures (MTBF) for ESFAS subgroup relays on a plant-

specific basis through 1994 are shown in Table 1. The MTBF was calculated by

dividing the number of plant operating years by the number of ESFAS subgroup

relay failures, then converting the result into months. The data support the

conclusion that the reliability (small number of failures) of the ESFAS

subgroup relays justifies extending the surveillance interval to an 18-month

refueling interval.

-6-

Increasing the refueling interval to 24 months requires a MTBF greater than 30

months (24-month surveillance interval + 25% permitted by TS). The MTBF values

shown in Table I support a 24-month fuel cycle for all plants except Fort

Calhoun. The Fort Calhoun failure data indicate that a relay failure occurs

approximately once every 23 months. Therefore, a 30-month interval between

surveillances could result in an undetected relay failure prior to the end of

an extended fuel cycle.

The Arkansas 2 licensee replaced the Train A and Train B P&B ESFAS subgroup

relays with P&B relays that have the improvements described in Information

Notice 92-04, "Potter and Brumfield Model MDR Rotary Relay Failures," (Ref.

13). Eight of the nine failures in Table 1 were of the older P&B relays.

Consequently, the failure data shown in Table 1 are not representative of the

current state of the plant. Based on the CEOG analysis of the new P&B relays,

the failure rate of the new relays will be comparable to the rates shown in

Table 1 for SONGS 2 and 3 and Palo Verde 1, 2, and 3.

-7-

TABLE I - ESFAS SUBGROUP RELAY RELIABILITY

Time in No. of MTBF Current

Plant Service Failures (Months) Surveillance

(1994) Interval

Palisades 21 2 126 Refueling

Maine Yankee 20 2 120 Refueling

Fort Calhoun' 4 4 12 Refueling

Calvert Cliffs 1 18 3 72 31 days

Calvert Cliffs 2 16 1 192 31 days

Millstone 2 17 3 68 Refueling

St. Lucie 1 16 6 32 Refueling

St. Lucie 2 9 1 108 6 months

Arkansas 22 14 9 19 Refueling

SONGS 2 3 0 >36 6 months

SONGS 3 3 1 36 6 months

Waterford 33 2 1 24 62 days STB*

Palo Verde 14 3 1 36 62 days STB

Palo Verde 24 3 1 36 62 days STB

Palo Verde 34 3 1 36 62 days STB

-8-

Fort Calhoun relay failures prior to 1991 addressed by changing

maintenance practices and modifying the cabinet filtration system. Data

reflects performance since 1991.

2 Arkansas 2 replaced ESFAS Train A relays in 1992. Train B relays were

replaced in 1994. Eight of the nine failures were the older P&B relays

3 Waterford 3 replaced ESFAS subgroup relays in 1992.

4 Palo Verde and SONGS replaced ESFAS subgroup relays in 1989.

* STB is staggered test basis, i.e., one train is tested every 31 days.

The Waterford 3 plant also replaced the older P & B subgroup relays with the

improved version. Based on the performance of the new subgroup relays in the

SONGS and Palo Verde plants, the Waterford 3 MTBF value is expected to

increase as the time in service of the new relays increases.

3.0 CONCLUSIONS

Based on the staff review of the data and analyses presented in CEN-403,

Rev. 1, and supporting documents, the staff concludes that the failure data

supports the proposed refueling interval staggered test basis for ESFAS

subgroup relays. The staff therefore finds CEN-403, Rev. I acceptable.

However, licensees referencing CEN-403, Rev. 1 as a basis for proposed TS

changes should:

1. Confirm the applicability of the CEN-403, Rev. 1, analyses for their

plant.

-9-

2. Confirm that the applicable setpoint calculations account for any

increase in instrument drift caused by the extended test interval.

In addition, the staff has determined that if two or more ESFAS subgroup

relays fail in a 12-month period, the licensee should reevaluate the adequacy

of the surveillance interval. The reevaluation should consider the design,

maintenance, and testing of all ESFAS subgroup relays. If the licensee

determines that the surveillance interval is inadequate for detecting a single

relay failure, the surveillance interval should be decreased. The revised

surveillance interval should be such that the licensee can detect an ESFAS

subgroup relay failure prior to the occurrence of a second failure.

Additionally, plants that use P&B MDR relays for ESFAS subgroup relay

applications should also:

1. Ensure that their commercial grade equipment certification program is

adequate for detecting the types of failures that are discussed in

References 8, 9, 11, and 12.

2. Ensure that all pre-1990 P&B MDR dc relays and all pre-1992 P&B MDR ac

relays have been removed from ESFAS applications.

- 10 -

4.0 REFERENCES

1. Topical Report CEN-403, "ESFAS Subgroup Relay Test Interval Extension,"July 1991; transmitted to NRC by John J. Hutchinson (CEOG) letter CEOG-91-415, dated July 31, 1991.

2. Raymond Burski (CEOG) letter to Scott Newberry (NRC), datedSeptember 21, 1993, "Response to NRC Questions on CEN-403, 'ESFASSubgroup Relay Testing'."

3. Raymond Burski (CEOG) letter to Jared Wermiel (NRC) datedNovember 2, 1994, "Response to NRC Request for Additional InformationConcerning CEOG Submittals Concerning 'Relaxation of Surveillance TestInterval for ESFAS Subgroup Relay Testing'."

4. Scott Newberry (NRC) letter to Paul Hijeck (ABB), dated July 7, 1992,"Request for Additional Information in Support of the Staff Review ofTopical Report CEN-403, 'ESFAS Subgroup Relay Testing, dated July1991'."

5. Jared Wermiel (NRC) letter to Raymond Burski (CEOG), datedFebruary 14, 1994, "Request for Additional Information Concerning C-EOwners Group Request for ESFAS Subgroup Relay Test Interval Extensions(TAC No. M81374)."

6. NUREG 1024, "Technical Specifications - Enhancing the Safety Impact," inNovember 1983.

7. NUREG-1366, "Improvements to Technical Specifications SurveillanceRequirements," dated December 1992.

8. Steven Toelle (ABB) letter to NRC, dated January 13, 1993, "10 CFR Part21 Report on Potter & Brumfield MDR Model 170-1, 7032, 7033, and 7034Relays."

9. Steven Toelle (ABB) letter to NRC, dated December 23, 1993, "10 CFR Part21 Report on Potter & Brumfield MDR Model 7032, 7033, and 7034 Relays."

10. Office for Analysis and Evaluation of Operational Data Special StudyReport AEOD/S93-06, "Potter & Brumfield Model MDR Rotary RelayFailures," dated December 1993; transmitted to the CEOG by Reference 10.

11. Com~bustion Engineering TechNote No. 92-05, "Potter and BrumfieldMDR-series Relay Deficiencies," dated September 4, 1992.

12. ABB-CE Infobulletin 93-02, "Potter & Brumfield MDR Relay Defect," datedDecember 23, 1993 and Supplement 1, dated March 18,1994.

13. NRC Information Notice 92-04, "Potter & Brumfield Model MDR Rotary RelayFailures," January 6, 1992.

14. Topical Report CEN-403,Rev. 1, "ESFAS Subgroup Relay Test IntervalExtension," September 1995; transmitted to NRC by D. F. Pilmer (CEOG)letter CEOG-95-609, dated November 14, 1995.

EXECUTIVE SUMMARY

This revision to CEN-403 was prepared to justify extending the ESFAS subgrouprelay surveillance test interval (STI) for Combustion Engineering (CE) NSSSplants. The report was prepared by ABB Combustion Engineering on behalf ofthe Combustion Engineering Owners Group (CEOG).

The study looked at the performance of these relays in plants with a CombustionEngineering designed NSSS. The original CEN-403 looked at all relaysgenerically. Revision 1 differentiates between two types of relays; rotary relays(i.e., Potter Brumfield MDR) and all other mechanical type relays. Revision 1also contains updated information on relay history. Although some relay failureswere found, including some common mode failures, the findings of this reportsupport the recommendations of NUREG-1366 concerning staggered testing ofESFAS subgroup relays.

Current surveillance test intervals (STIs) for ESFAS subgroup relays range frommonthly to refueling cycle, depending on the plant; however, all CE NSSS plantshave some relays that are only tested at refueling intervals as they cannot betested at power.

Based on the findings in this study, it is recommended that the surveillance testinterval (STI) for each ESFAS subgroup relay at any CE NSSS unit that iscurrently tested at an interval of less than the duration of a fuel cycle interval beextended to that longer interval. For those ESFAS subgroup relays that aregaining an STI extension, those relays that are testable at power should be testedon a staggered test basis to provide means for detecting common mode failuremechanisms. The proposed extension of STIs is based on the over-testing of plantequipment from this surveillance, the potential for inadvertent ESF actuations,and the demonstrated reliability of ESFAS subgroup relays.

3

CEN-403

TABLE OF CONTENTS

5ectle MISgc

Executive Summary 3

1.0 Purpose 6

2.0 Background 6

2.1 Developments Since The Original Submittal of CEN-403 62.2 History of Surveillance Test Intervals (STIs) 72.3 Current Surveillance Test Intervals 102.4 ESFAS Description 132.5 Subgroup Relay Description 15

2.5.1 Relay Manufacturers 172.5.2 Relay Operation 182.5.3 Relay Testing 19

3.0 Failure Discussion 23

3.1 Potter & Brumfield MDR Relays 2532 Fort Calhoun Station 27

4.0 Discussion 28

4.1 Reliability 29

4.1.1 All CE NSSS Plants 294.1.2 Arkansas Nuclear One Unit 2 304.1.3 Other "Digital" Plants 304.1.4 Fort Calhoun Station 304.1.5 Probabilistic Risk Analysis 31

4.2 Effectiveness of Surveillance Testing 31

4.2.1 Assumptions 314.2.2 Comparisons 33

4.3 Establishment of Criteria 354.4 Application of Criteria 36

4

CEN-403

TABLE OF CONTENTS

seo itle P80

5.0 Results/Recommendations 40

6.0 References 41

Tables And Figmures

Tables 1 - ESFAS Subgroup Relay Test Effectiveness 12

2 - List of Typically Actuated Equipment 20

Figures 1 - Digital ESFAS Auxiliary Cabinet Simplified Schematic 16

5

1.0 PURPOSE

This revised report was prepared to justify extending the Surveillance TestInterval (STI) for Engineered Safety Features Actuation System (ESFAS)subgroup relays used in Combustion Engineering (CE) Nuclear Steam SupplySystem (NSSS) plants. ESFAS Subgroup relays are the relays in ESFAS systemsthat complete the electrical circuit for the actuation of specific components.

The CEOG recommends that all installed C-E NSSS ESFAS subgroup relays thatare not Potter & Brumfield (P&B) MDR relays be tested at a minimum requiredfrequency of once per fuel cycle. The CEOG endorses that this minimumfrequency testing be performed in conformance with the recommendation inSection 5.2 of NUREG-1366 which states: "Perform relay [slave relay or sub-grouprelay] testing on a staggered test basis over a [fuel] cycle and leave the testscarrying highest risk to a refueling outage or other cold shutdown:'

These CEOG recommendations and endorsements are also applicable to P&BMDR relays that are installed in CE NSSS ESFAS subgroup relay applicationswhen certain additional conditions are established. These additional conditionsare described in Section 3.1.

These recommendations are based in part on reviews of the previous performanceof ESFAS subgroup relays in plants with a Combustion Engineering designedNSSS, that were discussed in References (12) and (14). These recommendationsare also based on reviews of related industry studies that have been publishedsince the original submittal of CEN-403 in July 1991, including NUREG-1366(Reference (8)), Generic Letter 93-05 (Reference (19)), and AEOD/S93-06(Reference (16)).

2.0 BACKGROUND

2.1 Developments Since Original Submittal of CEN-403

Revision 0 of this report was submitted to the NRC in July 1991, Reference (12).Since the o.'iginal submittal of this topical report, several important developmentsassociated with the performance of ESFAS subgroup relays have occurred.

Among thee developments have been the distribution of several NRC documentsconcerning the performance of Potter and Brumfield MDR relays in variousapplications, including ESFAS subgroup relay applications. These reports includeReferences (20), (21), and (22). The NRC's cumulative research and analysisconcerning these relays are discussed in Reference (16), AEOD/S93-06, TPotterand Brumfield MDR Rotary Relay Failures."

6

Another significant development has been the final publication of NUREG-1366(Reference (8)) and the associated Generic Letter 93-05 (Reference (19)). Thesedocuments have endorsed staggered testing of ESFAS subgroup relays that can betested while the plant is at power throughout the refueling cycle.

Additionally, there has been a continuing dialogue between the CEOG and theNRC as the NRC has reviewed CEN-403, Revision 0, in the context of these otherdevelopments.

The NRC first requested additional information concerning the original submittalof CEN403 in July 1992 (Reference (13)). Reference (14) provided the CEOG'sresponse to these questions from the NRC. Subsequently, in Reference (15), theNRC sent additional questions concerning CEN-403, References (12), andReference (14), and in particular, the performance of certain Potter & BrumfieldMDR Model relays, to the CEOG for consideration. Reference (17) provided theCEOG's response to these additional questions. This revised report incorporatesthe CEOG's responses to those requests for additional information.

As these responses have been developed, additional operating experienceinformation concerning the performance of other FSFAS subgroup relay designsat CE NSSS design plants has become available. This additional operatingexperience information is also considered in this report.

The analysis of the operating experience information has demonstrated thevalidity of the recommendations and positions concerning the frequency of ESFASsubgroup relay testing that are discussed in this report.

2.2 History of Surveillance Test Intervals (STIs)

Subgroup (also called auxiliary or slave) relays are the relays downstream of theESFAS logic that actuate groups of components upon receipt of the appropriateESFAS signal.

A semi-annual test frequency for subgroup relays first appeared in the draftRevision 3 to the CE Standard Technical Specifications (STS), Reference (1), in_982. The NRC Committee to Review Generic Requirements (CRGR) spent two

years considering this set of STS. Although, this draft Revision 3 of the STS wasnever formally approved, it became the basis for the semi-annual frequency.The surveillance intervals for San Onofre Units 2 and 3, as well asSt. Lucie Unit 2 are based on this draft Revision 3. Subsequent plants, Le.,Waterford Unit 3 and the three Palo Verde units, were licensed with even morestringent surveillance intervals, 62 days on a staggered test basis (such that onetrain is tested every 31 days).

7

In parallel with the CRGR discussions on the draft Revision 3 to the CE STS,Southern California Edison (SCE) was licensing their first CE NSSS unit,San Onofre (SONGS) Unit 2. During the SONGS licensing process, SCEpresented arguments for a refueling (18 month) test frequency. These argumentswere based on the reliability of the subgroup relays and the cost in having to shutdown the plant to test some of them. A plant shutdown is required to test thesubgroup relays which actuate equipment that cannot be tested at power.Subsequently SCE was granted a license with an 18 month test frequency forthose relays that could not be tested at power, and a 6 month test frequency forrelays that could be tested at power.

Florida Power and light Company (FPL) submitted an amendment (Reference(2)) to the St. Lucie Unit 2 (SL2) operating license to modify the subgroup relaytest frequency in May 1984. This amendment utilized a probabilistic analysis tojustify an increase in the test interval from 6 months to 18 months. This requestwas denied (Reference (3)) based on an evaluation of the FPL analysis performedby EG&G for the NRC. The FPL analysis showed an insignificant (0.03%)decrease in availability due to the proposed increase in test interval.However, the EG&G analysis found an order of magnitude increase inunavailability between the two test intervals, which formed the basis for theNRCs rejection of the FPL amendment request. At an availability of better than.998 for ESFAS systems, these two results are consistent with each other, and aremerely expressed in different forms. As such, the decreased availability, which isto be expected from an increased test interval, is not of so great a magnitude as tojustify rejection of the amendment request.

As early as 1983, the Nuclear Regulatory Commission (NRC) recognized theburden imposed by excessive technical specification surveillance requirements.The NRC staff has evaluated how the technical specifications can be modified orrestructured to reduce the burden on the nuclear power plants and improvereliability without adversely affecting the health and safety of the public.The results of this evaluation are reported in NUREG 1024 (Reference (4)).

This evaluation (NUREG 1024) resulted in establishment of the TechnicalSpecification Improvement Program (ITSIP) in December of 1984 by HaroldDenton, Director of the NRCs Office of Nuclear Reactor Regulation (NRR).This; effort led to the Improved Sta~adard Technical Specifications includingNUFREG 1432 (Reference (18)) and to a series of specific line itemimprovements. As part of this effort the Combustion Engineering Owners Group(CEOG) submitted topical reports proposing changes to surveillance test intervalsand allowed outage times on the Reactor Protection System (RPS) and ESFAS.

Related to RPS and ESFAS testing, CEN-327 "RPSEFAS Extended-TestInterval Evaluation" (Reference (5)), justified extension of the surveillanceintervals for the RPS and ESFAS functional tests to 90 days. The NRC

a

evaluation of CEN-327 is presented in Reference (6). CEN-327 was approved bythe NRC in November 1989. Subsequently, CEOG Task 620 (Reference (7)) wasapproved by the CEOG to justify an extension of the test frequency to 120 dayson a staggered test basis (one channel out of 4 every 30 days).

Extension of the test interval for the subgroup relays actuating the ESFAScomponents was specifically excluded from the CEN-327 effort. Including thesubgroup relays would require a different generic grouping of the plants. Toevaluate the different generic grouping, given the large number of subgroup relayswould require a very large and plant-specific PRA.

As part of the TSIP, the NRC staff performed a comprehensive study of technicalspecifications surveillance requirements, as recommended in NUREG 1024. Theresults of this study are contained in NUREG 1366 (Reference (8)). Individualtypes of components, their failure history and the consequences of testing wereevaluated during the development of NUREG 1366. This examination was basedon the following three recommendations from NUREG 1024. These threerecommendations are as follows:

Recommendation 1:

Recommendation 2:

Recommendation 4:

The testing frequencies in the technical specificationsshould be reviewed to assure that they are adequatelysupported on a technical basis and that risk to thepublic is minimized.

The required surveillance tests should be reviewed toassure safety equipment is not degraded as a result oftesting and that such tests are conducted in a safemanner and in the appropriate plant operational modeto ensure that risk to the public is minimized.

The surveillance test requirements should be reviewedto assure that they do not consume plant personneltime unnecessarily or result in undue radiationexposure to plant personnel without a commensuratesafety benefit in terms of minimizing public risk.

These three recommendations were used by the NRC in developing four criteriathat are used to determine if a surveillance test interval (STI) could be changed.These four criteria, found in NUREG 1366, are the following:

Criterion 1 -

Criterion 2 -

The surveillance could lead to a plant transient,

The surveillance results in unnecessary wear to equipment,

9

Criterion 3 - The surveillance results in radiation exposure to plantpersonnel which is not justified by the safety significance ofthe surveillance.

Criterion 4 - The surveillance places an unnecessary burden on plantpersonnel because the time required is not justified by thesafety significance of the surveillance.

In Section 4.0, these four criteria will be compared with the criteria established inthis study.

Section 5.2 of NUREG 1366 addresses ESFAS slave relay testing. The term"slave relay" is more commonly known as "auxiliary relay" or "subgroup relay" atCEOG member plants. The term "subgroup relay" in this report refers to the"slave relays" of Section 5.2 of NUREG 1366.

NUREG 1366 outlined two findings: 1) subgroup relay reliability is generallygood, 2) testing at power contributes to the frequency of inadvertent starts ofsafety equipment and reactor trips. Equipment reliability was not one of the fourcriteria originally set forth in NUREG 1366, but was suggested as a basis forrelaxation.

The concluding recommendation of the NRC staff in Section 5.2 of NUREG-1366is the following:

"Perform relay [slave relay or sub-group relay] testing on a staggered testbasis over a [fuel] cycle and leave the tests carrying highest risk to arefueling outage or other cold shutdown."

2.3 Current Surveillance Test Intervals (STIs)

Approximately two thirds (2/3) of the collective set of ESFAS subgroup relays atCE NSSS plants have a minimum surveillance test interval of once-per-fuel cycle;and the majority of these tests are performed coincident with refueling outages.These subset of the collective ESFAS sub-group relays include all such relays atmany of the CE NSSS plants that were licensed prior to 1982. This subset alsoincludes the ESFAS subgroup relays that can not be tested during poweroperations without the actual actuation of Engineered Safety Features.The remainder of ESFAS sub-group relays at CE NSSS plants are currently testedat intervals that are shorter than the duration of a refueling cycle. It is thereforelikely that each of these remaining sub-group relays will be routinely tested duringon-line power operations.

10

Table 1 summarizes information on the testing, failure history, surveillance testintervals, and number of ESFAS subgroup relays at domestic CE NSSS plants.It incorporates information that was provided in Reference (12), Revision 0 ofCEN-403, and Reference (14), CEOG-93-461. Table 1 shows that several plantshave surveillance test intervals of once per quarter or longer while a number ofplants have a more restrictive monthly test interval. These shorter currentsurveillance test intervals are believed to originally have been based onengineering judgement.

The first 8 units that are listed in Table 1 are the CE NSSS units with EngineeredSafety Features Actuation Systems (ESFAS) designed by their respective architectengineers (referred to as the "Analog" plants). The last 7 units that are listed arethe CE NSSS units with ESFAS designed by ABB Combustion Engineering(referred to as the *Digital" plants). Each of the seven "Digital" plants use Potter& Brumfield (P&B) MDR relays in ESFAS subgroup relay applications.

From Table 1, the CE NSSS units that have surveillance test intervals of less than18 months for some ESFAS subgroup relays can be placed in three differentSurveillance Test Interval (STI) Categories: a) STI = 1 month, b) STI = 2months, c) STI = 6 months.

The CE NSSS units with an STI of 1 month for some ESFAS subgroup relays are:

Fort Calhoun StationCalvert Cliffs Unit 1Calvert Cliffs Unit 2

The CE NSSS units with an ST1 of 2 months for some ESFAS subgroup relaysare:

Waterford 3Palo Verde 1Palo Verde 2Palo Verde 3

Tb~ese units are 4 of the 7 "Digital" phmts.

The CE NSSS units with an STI of 6 months for some ESFAS subgroup relaysWe:

SONGS 2SONGS 3St. Lucie 1

The first two of these plants are 2 of the 7 "Digital" plants.

11

TABLE I - ESFAS SUBGROUP RELAY TEST EFFECTIVENESS

Plant Time In No. of Surv No. of No. of Tests per FailuresService Failures Interval Relays Tests' Failure Detected(Years) (Months) During

Sun?(A) (B) (C) (D) (E) (F) (G) (H)

Palisades 21 2 18 200* 2800 1400 0.14

Maine Yankee 20 2 18 200* 2800 1300 0.15

Fort Calhoun 19 41 1 200 16872 412 0.18

Calvert Cliffs I 18 3 1 200 16068 5356 0.01

Calvert Cliffs 2 16 1 1 200 14194 14194 0.01

Millstone 2 17 3 18 200 2200 733 0.27

St. Lucie 1 16 6 18 200 2000 333 0.60

St. Lucie 2 9 1 6 200 2004 2004 0.06

Arkansast 14 9 18 109 981 109 1.00

SONGS2 3 0 6 109 366 N/A 0

SONGS3 3 1 6 109 366 366 0.17

Waterford 3• 2 1 :f 109 516 516 0.08

Palo Verde 17 3 1 114 836 836 0.06

Palo Verde L7 3 1 114 836 836 0.06

Palo Verde3 3 1 2P 109 810 810 0.06

15 Plants 167 73 2373 63449 869 0.19

* Estimated number of relays, based on typical non-CE ESFAS design.

Number of tests Is based on 2/3 of the relays being tested on an 18 month intervalF= (NT(2*E/.3)*INT(B*12/18)) + ((E-INT(2*E/3))*INT(B*12/D))

2 Tests per Faflure=F/C3 Failures Detected During Surveillance Process-C/INT(B*12/D)4 Arkansas 2 replaced ESFAS Train A relays in 1992. Train B relays were replaced In 1994. The

failure data reflects the performance of the older relays.5 Waterford 3 replaced ESFAS subgroup relays in 1992.s One Train Is tested every 31 days on a staggered basis.7 Palo Verde and SONGS replaced ESFAS subgroup relays In 1989. The time in service is the

number of yeurs in operation with the new relays.

12

2.4 ESFAS Description

The primary purpose of the ESFAS is to initiate automatic operation of certain plantequipment. This equipment aids in mitigating and terminating Design Basis Accidents(DBAs) in order to protect the health and safety of the public.

The following descriptions are of a generic nature only, since there is large diversitybetween the ESFAS at plants with CE NSSS designs.

Each ESFAS includes the following three types of subsystems: 1) initiation, 2) matrixlogic, and 3) actuation of equipment. (The subgroup relays are part of the third type ofsubsystem, actuation of equipment.) The following paragraphs provide a briefdescription of the these ESFAS subsystems.

Initiation Subsytem

Each of four independent initiation channels monitors a process parameter. The fourchannels actuate independently when their monitored variables reach predeterminedlevels. Typical process parameters that monitored in these initiation channels include:

Containment pressurePressurizer pressureRefueling water tank levelSteam generator pressureSteam generator levelContainment radiation

Initiation relay contacts are opened when any two-out-of-four sensor relays detect aprocess parameter beyond their bistable's setpoint.

Matrix Logic

Six trains of matrix logic monitor the input from the four initiation channels.Each matrix logic train monitors a different combination of two of the four initiationchannels. Whenever two of the four initiation channels of a monitored parameter areactuated, one of the trains of matrix logic will be actuated in turn. Actuation of anymatrix logic train will initiate the appropriate ESFAS signal (e.g., SIAS, for theparameters monitored. Any ESFAS signal that is generated by actuation of matrix logicis an input signal to the two independent actuation subsystems.

13

Actuation Subsystem

This Report is primarily concerned with the actuation subsystem of Engineered SafetyFeatures Actuation Systems (ESFAS). The two redundant and independent actuationsubsystem trains monitor the matrix logic trip outputs and actuate their respective trainsof equipment via the subgroup relays. Each actuation subsystem train is designed tocontrol sufficient equipment to ensure adequate protection of the public health andsafety in the event of a design base accident (DBA).

Specific initiation and actuation channels are arranged to produce signals which initiateequipment operation consistent with the type of protective action required.

The actuation channels of the Safety Injection Actuation System (SIAS), ContainmentSpray Actuation System (CSAS), Containment Isolation Actuation System (CIAS) andbus under voltage signal are subdivided into multiple parts. This subdivision allowsconvenient and flexible periodic testing. In addition, this subdivision reduces the amountof equipment actuated by a single relay.

As was briefly mentioned in Section 2.1, the ESFAS at plants with a CE suppliedNuclear Steam Supply System (NSSS) can be divided into two classes based on source ofESFAS design, they are:

o Plants that utilize an ESFAS designed by Combustion Engineering (CE),

and

CA Plants that utilize a non-CE ESFAS design.

The CE NSSS design units with CE designed ESFAS are generally plants with morerecent licenses. They are generally referred as "digital" because they have CoreProtection Calculators (CPCs). CPCs use digital computer programs to calculate andgenerate certain reactor trips.

The CE NSSS design units with non-CE designed ESFAS are generally plants withearlier license dates. These designs of these plants do not include CPCs. These plantsare designated "analog" because they use analog signals and mathematical modules tocalculate reactor trip setpoints. A variety of vendors.designed and built the analogESFAS cabinets.

Interpretation of the terms "analog" and "digital" may vary depending on technicaldiscipline (engineer, I&C technician, operations personnel, etc.); however, in this report,the distinction between these two terms is based on the presence or lack of CPCs.

14

ESFAS systems of the CE design are present at the following CE NSSS units:

Arkansas Nuclear One Unit 2San Onofre Units 2 and 3Waterford Unit 3Palo Verde Units 1, 2 and 3.

ESFAS systems of other design are present at the following CE NSSS units:

PalisadesMaine YankeeFort CalhounCalvert Cliffs Units I and 2Millstone Unit 2St. Lucie 1 and 2

The CE ESFAS design is standard among the plants utilizing it. The non-CE ESFAShave been built by a variety of vendors, and as such they are unique in design andoperation. The plant-specific FSARs should be referred to for a complete description othe ESFAS system.

2.5 Subgroup Relay Description

As shown in Figure 1, subgroup relays are the closest relays in the circuit before theactuated equipment. As such, upon deenergization, each subgroup relay initiates theproper signal to supply power in order to actuate the associated components.(Note: Most subgroup relays are energized in the non-actuated state. However, thedesign of ESFAS is such that a few subgroup relays, such as those used for theRecirculation Actuation Signal (RAS), are deenergized in their non-actuated state.)

Figure 1 shows a typical digital ESFAS cabinet schematic for one signal, e.g., SIAS.When a monitored parameter reaches a predetermined level, it will open the ESFASinitiation relay contacts.

The number of subgroup relays per plant varies. The analog plants typically haveapproximately 100 subgroup relays per ESFAS cabinet. There are two cabinets for atotal of approximately 200 subgroup relays. In contrast, the total number of ESFASsub-group relays for one of the digital plants typically ranges between 109 and 114.This number will vary because there were usually "spare" locations provided for additionof more subgroup relays as a result of design changes. Plants may or may not be usingthese "spare" locations depending, in part, on the design upgrades they haveincorporated.

The subgroup relays are actuation relays and not initiation relays.

15

FIGURE 1

DIGITAL ESFAS AUXIUARY CABINET SIMPLIFIED SCHEMATIC(shown energIzed)

MlIX~ 6W WOV WFJIM CruIIAClI I

-T I T-

1O VA41=1 40 "1101

16

2.5.1 Relay Manufacturers

The manufacturers of ESFAS subgroup relays used in CE NSSS plants are(a) Potter & Brumfield (P&B), (b) General Electric, (c) Genicom (formerly GeneralElectric), (d) Deutsch/Couch, and (e) Westinghouse. The following sections identify therelay types provided by each manufacturer at each CE NSSS plant.

Potter Brumfield

Potter & Brumfield (PB) MDR Series 7032, 7033, 7034 and 136-1 rotary relays(commercially available items) are used in ESFAS subgroup relay applications at allplants with a CE designed ESFAS. These plants are the following:

Arkansas 2San Onofre 2San Onofre 3Waterford 3Palo Verde 1Palo Verde 2Palo Verde 3

MDR series 7032, 7033 and 7034 comprise the majority of relays used. These are usedin all non-cycling applications (i.e., all except for actuation of Auxiliary Feedwater(AFW) systems). Series 136-1 relays are cycling relays typically used for AFW.)

The basic construction of these relays consists of a rotary actuator mechanism withcontact sections mounted in isolated rings. They are non-latching and are normallyenergized in the non-actuated position during operation (as opposed to 'latching' relayswhich hold their position once energized to actuate). These relays fail in the actuatedposition on a loss of dc control power.

Table 1 reflects the operating history of "replacement" P&B MDR relays for the "digitalplants that effectively completed the recommendations of AEOD/S 93-06 (Reference(16)) during the period of 1989 through 1993. Additional information concerning theperformance of P&B MDR relays in ESFAS subgroup relay applications is discussed inSection 3.1.

General Electric

General Electric (GE) series HFA, HEA, CR120, and HAG mechanical relays are usedin ESFAS subgroup relay applications at Palisades and Fort Calhoun Station.

17

Series CR120 relays are generally two and four pole, which may contain two or four poleadders, to give a maximum of twelve poles. These relays generally have self cleaningcontacts.

Table 1 shows a relatively large number of recorded failures of relays in theseapplications at Ft. Calhoun Station compared to other CE NSSS plants. The operatingexperience related to this failure rate is discussed in Section 3.2.

Geniom

Genicom (formerly General Electric) series 3SAA1383A2 mechanical relays are used inESFAS subgroup relay applications at Calvert Cliffs Units 1 and 2. (Informationconcerning these relays (including NPRDS information) is usually found under GE.)These relays are miniature, canned, plug-in, 25V DC relays.

Deutsch/Couch

Deutsch Series ZAP-X1596 relays are used in ESFAS subgroup relay applications atMillstone Unit 2.

Couch model number KEN 431A, part number 4CP AF, relays are used in ESFASsubgroup relay applications at St. Lucie Units 1 and 2.

Westinghouse type BFD mechanical relays are in ESFAS subgroup relay applications atMaine Yankee.

2.5.2 Relay Operation

During normal operation, the ESFAS'actuation relay contacts (Figure 1) are normallyclosed. When the two power (subgroup) circuit breakers are closed and the lockoutrelay contact reset is depressed, the subgroup relays and lockout relays becomeenergized. The trip legs for the auxiliary relay cabinet are then operative and are readyto respond to an initiation signal. Upon receipt of proper initiation "two-out-of-four"signals, the contacts de-energize opening both trip legs. This causes the subgroup relaysto become de-energized. The contacts on these relays then actuate various valve andpump controllers.

As a res•llt of the trip, each de-energized lockout relay opens a set of contacts in serieswith the actuation relays. This arrangement prevents the trip legs from inadvertently

18

re-energizing until the operator manually resets the lockout relay. Pressing eitherLockout Reset button energizes the lockout and subgroup relays in both trip legs.

There is a pair of trip legs similar to the ones shown on Figure I for each subgroupfunction, e.g., SIAS. During normal operation, all of these trip legs are operative andready to respond to their separate set of two-out-of-four signals that the PPS supplies.

2.5.3 Relay Testing

Note: For the purposes of this report, it is assumed that, in order for a subgroup relay t,meet a surveillance requirement, all components connected to it must actuatewhen the relay is de-energized. The provided description of the testing sequenceis generic. Plant surveillance procedures and technical manuals should beconsulted for plant-specific testing methods.

The subgroup relays are tested using a remote test module. Generally, several rotaryswitches are mounted on the front panel of the test module. These switches provide forselection of any particular subgroup relay for testing.

Once the desired subgroup relay is chosen and the initiate action button is depressed,the test relay contacts will open, de-energizing the subgroup relay. This in turn actuatesthe ESFAS equipment. A list of typical actuated equipment (one train) actuated as aresult of this test is summarized in Table 2.

The relay-component alignments are very plant-specific. In general pieces of equipmentthat can not be tested together at power will not be grouped on the same subgroup relaw(for example, a Low Pressure Safety Injection (LPSI) pump and a LPSI discharge valvecould result in inadvertent safety injection flow to the reactor coolant system).Most components can be actuated together as long as they are not part of the sameESFAS function. If two components (for example a High Pressure Safety Injection(H-PSI) pump and a HPSI discharge isolation valve) are actuated from the same relayand can not be tested concurrently, then the relay testing is usually performed in twosteps. One piece of equipment is blocked (possibly by opening or racking out itsbi;eaker) and then the relay is de-energized. Then, the lineup is reversed. This verifiesall the contacts on the relay are tested. These tests require time for planning,i•stallation and removal of blocking. As a result, these tests increase the possibilities fo)miman errors that result in inadvertent equipment operation, damage or personal injury.

19

Actuation Subsystem1) SIAS

TABLE 2UST OF TYPICALLY ACTUATED EQUIPMENT

Starts SWS air compressorsStarts HPSI pumpsStarts LPSI pumpsStarts component cooling pumpsStarts SRW pumpsStarts salt water pumpsStarts diesel generator(s)Closes cntmnt hot water heat isolation valveCloses cnrtnt waste gas header vent valveCloses RC loop hot leg sample valveCloses SI tank bleedolf valveCloses RC sample containment Isolation valveCloses SI loop leakage check valvesCloses VCT makeup flow valveCloses turbine building SRW Isolation valveCloses turb lube oll & EHC oNl dr Isol vlvCloses RCP seals bleedolf cntmnt isol valvesCloses VCT discharge valvesCloses letdown line cntmnt Isolation valvesCloses comp cooling HX salt water Inlet valveCloses comp cooling HX salt water outlet valvesCloses circ water pump room air cooler salt

water Isolation valvesCloses diesel generator feeder breakerCloses cntrnnt normal sump drain Isolation valveCloses cntmrnt purge air supply Isolation valveCloses crtm purge air exhaust Isolation valveCloses ctnmrt waste gas header vent valveCloses cntmrt normal sump drain isolation valveCloses cntmnt purge air supply isolation valveCloses cntnat purge air exhaust Isolation valveCloses cntmnt purge air sampling Isolation valveCloses pressurizer vapor sampling valveCloses pressurizer liquid sampling valvesCloses ROOT pump discharge cntrnnt Isol valveCloses pzr quench tank oxygen sample valveCloses hydrogen purge exhaust valvesOpens containment spray header isolation valvesOpens HPSI valvesOpens HPSI redundant header valvesOpens Auxilary HPSI valves

20

1) SIAS (continued)Opens LPSI valvesOpens BAST gravity valveOpens BAST recrc valvesOpens BA pump makeup bypass valveOpens pressurizer backup heater breakersOpens comp coding S/D cooling HX outlet valvesOpens SRW HX sait water outlet valveStops cntmnt purge air sampling isolation valveStops cntmnt purge ak exhaust fanStops cntmnt purge air supply fan

2) CSAS Starts containment coolersCloses containment cooler SRW outlet valvesCloses Spent Fuel Pool cooler SRW outlet valvesCloses containment spray pumpsCloses Feedwater Isolation valvesCloses Main steam isolation valvesTrips Heater drain pumpsTrips Main feedwater pumpsTrips Condensate booster pumps

3) CIS Starts containment charcoal filter unitStarts penetration room exhaust fansDe-energizes penetration room filtersCloses Instrument air cntmnt Isolation valveCloses RCP comp coding cntmnt isolation valveCloses liquid waste evaporator

4) CRS Closes cntmnt purge air supply Wso valvesCloses cntmnt purge air exhaust isol valvesCloses hydrogen purge exhaust valvesStops cntmnt purge air exhaust fans

5) RAS Returns to auto component cooling HXReturns to auto SRW HXOpens component cooling water HXOpens cntmnt sump discharge valveCloses CS & SI pumps recirc valvesStops LPSI pumps

5) SGIS Closes SG isolation valvesCloses MSIVTrips Heater drain pumpsTrips Main feedwater pumpsTrips Condensate booster pumps

21

Certain actuation tests of subgroup relays are concurrently performed with otherrequired tests for corresponding systems, structures and components (SSCs) such as;

Bleedoff Isolation ValvesService Water Isolation ValvesVolume Control Tank (VCr) Discharge ValvesLetdown Stop ValvesComponent Cooling Water (CCW) to Reactor Coolant Pump (RCP)CCW from RCPMain Steam Isolation Valves (MSIVS)Main Feedwater Isolation Valves (MFIVS)Instrument Air Containment Isolation Valves.

These tests of SSCs cannot be tested at power without danger of damaging equipment orcausing a plant trip.

The subject surveillance tests are referred to as Channel Functional Tests in thecorresponding Surveillance Requirements of the CE NSSS Standard TechnicalSpecifications of both NUREG 1432 and NUREG 0212.

NUREG-1432, Revision 0, Section 3.3.5, ESFAS Logic and Manual Trip (Analog),includes Surveillance Requirement SR 3.3.5.1 which states:

-- -NOTES--

1. Testing of Actuation Logic shall include verification of the properoperation of each initiation relay.

2. Relays associated with plant equipment that cannot be operated duringplant operation are only required to be tested during each MODE 5 entryexceeding 24 hours unless tested during the previous 6 months.

Perform a CHANNEL FUNCTIONAL TEST on each ESFAS logic channel."

This SR has a plant-specific frequency

22

NUREG-1432 Section 3.3.6, ESFAS Logic and Manual Trip (Digital), includesSurveillance Requirement SR 3-3.6.2 which states:

NOTE--Relays exempt from testing during operation shall be tested during each MODE !entry exceeding 24 hours unless tested during the previous 6 months.

Perform a subgroup relay test of each Actuation Logic channel, which includes thde-energization of each subgroup relay and verification of the OPERABILITY ofeach subgroup relay."

This SR has a plant-specific frequency.

In comparison, SR 4.3.2.1 from NUREG 0212 reads;

"4.3.2.1 Each ESFAS instrumentation channel shall be demonstrated operable bythe performance of the CHANNEL CHECK, CHANNEL CALIBRATION, andCHANNEL FUNCTIONAL TEST operations for the MODES and at thefrequencies shown in Table 4.3-2."

Table 4.3-2 of the NUREG 0212 STS lists the individual functional units separating theautomatic actuation logic, manual trips, and measured parameters. The automaticactuation logic has a note stating:

"A subgroup relay test shall be performed which shall include theenergization/de-energization of each subgroup relay and verification of theOPERABIUTY of each subgroup relay."

A semiannual frequency is given for each functional unit.

3.0 FAILURE DISCUSSION

This section discusses the relay failure modes, methods of detecting such relay failures,and the consequences of relay failures. The ESFAS subgroup relay failure informationthat is provided in Table I was collected through the use of the INPO NPRDS (for theperiod of 1984 through 1992), plant maintenance records, and contact with plantpersonnel.

ESFAS subgroup relays generally fail in either an actuated position or an "as-is" position.Generally, if a relay fails in the actuated position, the associated ESFAS equipment willstart, thereby alerting the operator to the failure. This is a conservative failure.

23

Generally, if the relay fails in the "as-is" position, the associated ESFAS equipment willnot actuate due to the relay failure. Additionally, with such a relay failure,the associated ESFSAS would not actuate on demand. The operator will not be awareof such a non-conservative failure until the relay is tested or a demand is made for theassociated ESFAS equipment operation.

The causes of these relay failures are generally attributed to one of the followingcategories:

* Aging (including cyclic fatigue)* Dirt, corrosion or other contaminaants* Damaged contacts (pitting or burning)

These relay failures can be identified during:

* Surveillance testing

" Maintenance* Random observation* Demand signals to associated ESFAS equipment

The following observation concerning the failure of ESFAS subgroup relays is includedin Section 5.2 of Reference (8), NUREG-1366:

"NUREG/CR-4715 examined the failure modes of relays of various types(undervoltage, control, timing, and protective) and concluded that although thefailure data showed age-related failure trends for relays, the data available to datedo not indicate a high failure rate. The normalized license event report (LER)and Nuclear Plant Reliability Data System (NFRDS) data indicate an averagefailure rate of fewer than two reportable relay failures per year per plant, which issmall in comparison to the number of relays in the plant."

A comparison of this observation with the information in Table 1 results in the followingobservations:

1) Table 1 shows that the only "digital" CE NSSS plant with an cumulativeESFAS subgroup relay failure rate approaching even 1 failure/calendaryear of licensed operation is Arkansas Unit 2. Table 1 also shows that theArkansas Unit 2 was the only "digital" CE NSSS plant that had noteffectively completed the recommendations of References (16) and (17)concerning P&Bl MDR relays in ESFAS applications at the time thatTable 1 was compiled.

24

2) Table 1 shows that the only CE NSSS plant (analog or digital) with ancumulative ESFAS subgroup relay failure exceeding 2 failures/calendaryear of licensed operation is Fort Calhoun Station. In Section 2.3.1, it w&;stated that General Electric (GE) series HFA, HEA, CR120, and HAGmechanical relays are used in ESFAS subgroup relay applications atFort Calhoun Station.

These observations warrant further discussion of the failure history of:(a) Potter & Brumfield MDR relays in ESFAS subgroup relay applications, and(b) the failure history of ESFAS subgroup relays at Fort Calhoun Station.

3.1 Potter & Brumfield MDR Relays

In the past, there have been a number of failures of P&B MDR relays in both safety-related and nonsafety-related applications at various nuclear power plant units.Reference (16), AEOD/S93-06, provides a comprehensive operating history of theserelays in these applications during the period from 1984 through 1992. This operatinghistory included information on the performance of P&B failures of MDR relays inESFAS applications including subgroup relay applications. The operating historyinformation in Reference (16) includes the operating experiences of these relays that arcdiscussed in the CEN-403, Revision 0, Reference (12), and Reference (14).

The following observations concerning the operating history of P&B MDR relays at CE

NSSS digital plants were made in Section 2.3.1 of CEN-403, Revision 0:

"In the past, there were many failures of the PB relays. These relay failures have

been failures associated with the heat resulting from either continuousenergization or the application of excessive voltage. These relays are 24 V-dcdevices (operated at an increased voltage of 36 V-dc, because of downstreamvoltage losses, to assure that minimum voltage is maintained).

To investigate this specific problem in 1988, Arizona Nuclear Power Projects(ANPP), operator of Palo Verde Units 1, 2 and 3 contracted two laboratories,Scanning Electron Analysis Laboratories, Inc. (SEAL) and FI REL The labsdetermined a major'ty of the failures could be attributed to excessive heat anddegassing of the vanish coating. Contaminants would plate out or corrosionwould occur on the internal motor surfaces causing the relays to stick in the(open) position. Tb : corrosion buildup prevented full rotor movement andthereby prevented the contacts from changing state and actuating the associatedequipment.

The problems identified were resolved by the manufacturer and ANPP with thedevelopment of a new style of relay. This new style of relay has an epoxy resincoating instead of varnish. Additionally, some brass components were replaced

25

with stainless steel; and other material changes were made (9) [Reference (9) inthis report]. The newer model initially had problems caused by an improperlycured coating on a batch of the relays. This problem is also believed to be solved.

Palo Verde Units 1, 2 and 3 and San Onofre Units I and 2 have completelyreplaced the older model Potter & Brumfield relays with the newer model. Thenewer model of relay has proven to have an excellent operating history, with noreported failures since their installation."

These problems and the related corrections are discussed in Reference (16).

Reference (14) identified 5 specific failures of replacement P&B MDR relays thateffectively meet the replacement recommendations of AEOD/S93-06, Reference (16).In each of these cases, the subject relay was either installed as an ESFAS subgroup relayor could have been installed in such an application. Only three of these failuresoccurred in actual subgroup relay applications. (The causes of these failures are alsodiscussed in Reference (16).) An observation in Reference (14) was that, even if all ofthese 5 failures were in ESFAS subgroup relay applications, the failure rate per hour ofthe new relays would have been less than the average relay failure rate for the industry.(Reported failure rate of 3.8 E-8 /hour compared to an average failure rate of5.0 E-7/hour.)

The following observations concerning the operating history of P&B MDR relays atnon-CE NSSS plants were made in Section 2.3.1 of CEN-403, Revision 0:

"Carolina Power & Light's (CP&L's) Shearon Harris nuclear plant received ashipment of refurbished PB relays. These refurbished relays were found to bematerially and functionally substandard. The Discrepancies were identified priorto installation, through receipt inspection and testing at the PB factory. Thisoccurrence was addressed in NRC Information Notice 90-057 (10) [Reference (10)in this report]."

Reference (16) includes additional information concerning the replacement of theserelays.

Following a review of the cumulalive operating history of P&B MDR relays provided inthe References including Reference (16), the CEOG established a set of conditions thathave to met at a subject CE NSSS digital plant before consideration of extending the STIfor ESFAS subgroup relays at the ;ubject plant. These conditions as stated in Reference(17) are as follows:

a) Documentation shows that all pre-1990 P&B MDR dc relays and all pre-1992P&B MDR ac relays have been removed from all ESFAS applications [Thiscorresponds to meeting the replacement recommendations from AEOD/S93-06,Reference (16). At the time of the development of Table 1, these

26

recommendations had been effectively implemented at all CE NSSS digital plantswith the exception of Arkansas Nuclear One (ANO) Unit 2. Full implementatiorof these recommendations was met at ANO Unit 2 at the completion of theplant's 1994 refueling outage.]

b) Documented maintenance and work controls are in place that effectively preventany installation of any pre-1990 P&B MDR dc relay or any pre-1992 ac P&BMDR relay in any safety-related application including ESFAS circuitry.

c) The applicable plant's commercial grade equipment certification program includethe controls that successfully detected the over-sized coil problems that werediscussed in Reference (1) [Reference (23) in this report], CombustionEngineering TechNote 92-05, "Potter and Brumfield MDR-series RelayDeficiencies" as well as controls to detect the over-sized coil problem that isdiscussed in References (E) [Reference (24) in this report] and (F) [Reference(25) in this report].

d) The applicable plant's commercial-grade equipment certification program includecontrols to identify the presence of rotor return springs that are susceptible tochloride stress corrosion cracking that is discussed in Reference (H) [Reference(26) in this report.]

3.2 Fort Calhoun Station

As previously mentioned, the cumulative failure rate of ESFAS subgroup relays at FortCalhoun Station is greater than same failure rate at any other CE NSSS plant. This isreflected by the information that is provided in Table 1. During the period from 1986 ti1989, the rate of identified ESFAS subgroup relay failures increased from 1 relay failureper calendar year to 5 relay failures per calendar year.

The staff of Fort Calhoun Station identified the causes of this increasing relay failurerate as a combination of aging and design factors. The identified causes have beencorrected or eliminated through a series of changes in maintenance practices and thedesigns of installed and replacement relay inventories.

The changes in maintenance practices have included:

a) replacement of relays with demonstrated relay coil failures rather thanreplacement of only the failed relay coil.

b) preventative replacement or cleaning of subgroup relays prior to failurebased on equipment aging estimates/evaluations.

27

Since the initiation of these maintenance practice changes, the staff of Fort CalhounStation has not identified any failure of an ESFAS subgroup relay that had any of theserevised practices as a cause.

Augmenting these changes in maintenance practices have been design changes in theHEA relays and modifications in the filtration of cooling air in the equipment panelsthat house the ESFAS subgroup relays.

In particular, the addition of a pivot point on relay paddle arms allowed the use of relaycoils with weaker flux fields to be used for relay tripping functions. The addition of nutsto tie bolts helped reduce the potential of relay binding by preventing clearance changesresulting from loose tie bolts.

Additionally, the potential for binding of relays by foreign materials was reduced by theinstallation of filters in the ventilation systems for the panels housing the subgrouprelays.

During and since the implementation of these changes at Fort Calhoun Station, theimproved reliability of the ESFAS subgroup relays has been demonstrated by the trendin the rate of identified ESFAS subgroup relay failures per calendar year. Over theperiod from 1989 to 1990, this failure rate decreased from 5 relay failures/calendar yearto 2 relay failures/calendar year. Over the period from 1990 to 1991, the failure ratecontinued to decrease from 2 relay failures/calendar year to 1 relay failure/calendaryear. Since 1991 (Calendar Years: 1991, 1992, 1993, & 1994), this failure rate hasremained at 1 relay failure per year.

4.0 DISCUSSION

This section discusses the following:

A) ESFAS subgroup relay reliability,

B) Effectiveness of Surveillance Testing,

C) The establishment of criteria for determining an acceptable test interval,

D) Application of the criteria.

28

4.1 Reliability

Section 5.2 of NUREG-1366 states:

'The reliability of slave [subgroup] relays is a reasonable basis for relaxing thetesting requirements."

In discussing the reliability of these relays throughout the industry, the same section ofNUREG-1366 includes the following statement:

"NUREG/CR-4715 examined the failure modes of relays of various types ofundervoltage, control, timing, and protective) and concluded that although thefailure data showed age-related failure trends for relays, the data available to datedo not indicate a high failure rate. The normalized licensee event report (LER)and Nuclear Plant Reliability Data System (NPRDS) data indicate an averagefailure rate of fewer than two reportable failures per year per plant, which issmall in comparison to the number of relays in the plant."

4.L1 All CE NSSS Plants

Similar comparative analysis of ESFAS subgroup relay failures/operating period/plantvalues has been performed on the information that is provided in Table 1.Table 1 shows that there had been 167 service years of operation with the ESFASsubgroup relay configurations that existed at the point in time when Table 1 wascompleted. There had been 73 reported failures of subgroup relays with the same set ofESFAS subgroup relay configurations. These values provide the following generalaverage:

0.44 failures/operating year (73/167)

Out of the 73 relay failures that are listed in Table 1, 50 (over 68%) occurred at twoplants, Fort Calhoun Station and ANO Unit 2. When the relay failures and operatingyears for these two units are excluded, the following general average results:

0.17 failures/operating year (23/134)

Fo2r the 2064 relays in Table 1 for which this value is applicable, the averaged failurerate of any specific ESFAS subgroup relay is 9 E-9 failures/relay/hr. This value issignificantly less than the industry average of 5.0 E-7 failures/relay/hr that is mentionedin Reference (14).

29

4.L2 Arkansas Nuclear One (ANO) Unit 2

Nine (9) of the 73 relay failures that are listed in Table 1 (8%) occurred at ArkansasNuclear One Unit 2. At least 8 of these 9 failed relays were P&B MDR relays that werein classes of P&B MDR relays that were recommended for replacement in References(16) and (17). Based on the information in Table 1, the cumulative failure rate forESFAS subgroup relays for Arkansas Nuclear One Unit 2 was 0.64 failures/operatingyear. At the time of the development of Table 1, the classes of P&B relay that wererecommended for replacement had been replaced in one of the two ESFAS trains atANO Unit 2; and the replacement of the similar relays in the second ESFAS train wasscheduled for the 1994 refueling outage.

(Even after the completion of ESFAS subgroup relays at ANO Unit 2, all of theremaining conditions for extensions of STIs for ESFAS subgroup relays at digital plantsthat were discussed in Section 3.1 are also applicable.)

4.1.3 Other "Digital' Plants

Table 1 demonstrates the following cumulative failure rate for ESFAS subgroup relaysmeeting the recommendations of References (16) and (17) for CE NSSS digital plants:

0.29 failures/operating year (5/17)

For the 664 relays meeting the replacement recommendations of References (16) and(17), this co•rresponds to a failure rate of 5 E-8 failures/relay/hr. This failure rate is oneorder of magnitude less than the industry average of 5.0 E-7 failures/relay/hr that ismentioned in Reference (14).

(While these relays meet the recommendations of References (16) and (17), all of theremaining conditions for extensions of STIs for ESFAS subgroup relays at digital plantsthat were discussed in Section 3.1 are also applicable.)

4.1.4 Fort Calhoun Station

Forty one (41) of the 73 relay failures that are listed in Table 1 occurred at FortCalhoun Station. Based on the information in Table 1, the cumulative failure rate forESFAS sui.group relays for the entire operating history of Fort Calhoun Station was 2.15failures/operating year. Section 3.2 of this report discusses a series of activities toimprove the reliability of ESFAS subgroup relays at Fort Calhoun Station.The resulting improved reliability of these relays has been demonstrated by the trend ofsubgroup relay failures/calendar year during the period from 1989 through 1994.

30

The cumulative ESFAS subgroup relay failure rate at Fort Calhoun Station for the lastfour calendar years (1991 through 1994) has been 1.0 failure/operating year. The rate olESFAS subgroup relays in each of these calendar years has remained consistent at 1.0failure/calendar year.

From these analyses, the following conclusions can be made concerning the reliability ofESFAS subgroup relays at CE NSSS units:

a) The cumulative reliability of subgroup relays at all analog CE NSSS plantswith the exception of Fort Calhoun Station equals or exceeds the industryaverage value of reliability that was mentioned in Section 5.2 ofNUREG-1366.

b) The recent reliability of subgroup relays at Fort Calhoun Station(1991-1994) equals or exceeds the industry average reliability that wasmentioned in Section 5.2 of NUREG-1366.

c) The cumulative reliability of installed P&B MDR relays that meet thereplacement recommendations of References (16) and (17) exceeds theindustry average reliability that was mentioned in Section 5.2 ofNUREG-1366. The CEOG projects that the reliability of similarreplacement P&B MDR relays in subgroup relay applications atANO Unit 2 will match or exceed the demonstrated reliability of theinstalled "replacement" relays at the other CE NSSS digital plants.

4.1.5 Probabilistic Risk Analysis

The original study that was performed during the development of CEN-403, Revision 0included a probabilistic risk analysis of ESFAS subgroup relay reliability at a set of 13CE NSSS units. No firm conclusions could be drawn from the results of this analysis.

4.2 Effectiveness of Surveillance Testing

4.2.1 Assumptions

The information in Columns (G) and (H) of Table 1 is provided in order to evaluate therelative effectiveness of various surveillance test intervals in detecting ESFAS subgrouprelay failures. Table 1 includes footnotes that describe the formulas and assumptionsthat were used in the development of a value for "tests per failure" and "detectedFailures per surveillance test interval" for each of the 15 CE NSSS units. In order todevelop normalized values of "detected failures per surveillance interval" (Column (H)),several important assumptio