1CAN058608, Responds to Open Items Noted in 860331 Safety Sys Functional Insp Rept 50-313/86-01 Re Emergency Feedwater Sys.Corrective Actions:Change Made to FSAR Sections to Expand & Upgrade Discussion of Postulated high-energy Line Breaks
| ML20198N471 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 05/23/1986 |
| From: | Enos J ARKANSAS POWER & LIGHT CO. |
| To: | Taylor J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE) |
| References | |
| 1CAN058608, 1CAN58608, NUDOCS 8606060102 | |
| Download: ML20198N471 (8) | |
Text
.
ARKANSAS POWER & LIGHT COMPANY POST OFFICE BOX 551 LITTLE ROCK, ARKANSAS 72203 (501) 3714000 Flay 23, 1986 1CAN9586p8 Mr. James M. Taylor, Director Office of Inspection and Enforcement U. S. Nuclear Regulatory Commission Washington, DC 20555
SUBJECT:
Arkansas Nuclear One - Unit 1 Docket No. 50-313 License No. DPR-51 Safety System Functional Inspection Report 50-313/86-01 uear fir. Taylor:
By letter dated flarch 31, 1986 (ICNA038603), NRC forwarded the results of a Safety System Functional Inspection (SSFI) of the ANO-1 Emergency Feedwater (EFW) System.
The report noted a number of unresolved and open items and specifically requested our response to selected items noted in Section II of the report. Attached are our responses to these items.
While the in-depth review of the SSFI team did indicate a number of items warranting prompt attention, the ANO-1 EFW system is a highly reliable and well designed system which will function as required in normal and accident conditions.
Efforts are continuing to review and address the open items and concerns noted in the report in order that these items will be satisfactorily resolved.
x Vs y truly yotrs,
[y be n.-
r J. Ted/.nos, tfanager Nuclep Engineering and Licensing JTL/DRil/djm Attachment 8606060102 860023 f
PDR ADOCK ObOO 3
d6 9
MEMoEA MtOOLE SOutM UTILITIES BYGirM
i
=
i ATTACRMENT l
Item II.A.I.a For steam line break accident scenarios, given a single active failure within the electrical power system (i.e., vital power),
the Emergency Feedwater Initiation and Control (EFIC) subsystem 1
did not have the capability to isolate the affected steam generator (SG) from the unaffected SG.
It appeared that this l
could result in the loss of all EFW flow to both SGs.
For a nonisolable steam line break in SG A with a concurrent loss of offsite power, the EFW system and EFIC subsystem rely on onsite power sources.
If the loss of " red" ac power is assumed as the l
single active failure (i.e., failure of " red" diesel to start,
{
fault on bus, etc.), the EFW motor-driven pump is unavailable and motive power is lost to operate CV-2667 (the isolation valve between SG A and the EFW turbine-driven pump). As a consequence, CV-2667 could not be closed and EFIC would have l
unsuccessfully attempted to isolate SG A from SG B.
- Instead, the unaffected SG B would have been cross-connected to the affected SG A through CV-2667 and CV-2617. As a consequence, both SGs could have depressurized through the nonisolable break, and the steam supply to the turbine-driven EFW pump may have becu insufficient, causing a complete loss of EFW.
In addition, the blowdown of two SGs through a nonisolable break inside the containment building was outside the design basis for the containment building (See Figure 1, Page 6).
Subsequent to the inspection, the licensee provided information indicating that, for the main steam line break accident postulated above, sufficient steam would have been available to the EFW turbine until SG pressure dropped to approximately 80 psia.
Response
This event item was the subject of a Licensee Event Report (LER) transmitted via letter dated February 17, 1986 (ICAN028607). As discussed in the report, this was a design discrepancy in that check valves in the steam supply lines to the steam driven EFW pump were 1
not included in the final design of the upgraded EFW system.
Extensive redesign and modification of the ANO-1 EFW system was performed to meet the requirements of NUREG 0737 and extended over a period of several years. The intended purpose of the check valves is to prevent cross-connection of the steam generators under a postulated main steam line break and a single failure of one ES electrical bus.
r Although the check valves were included in early versions of the design, they were later deleted due to concerns over check valve reliability. These concerns were prompted by failures of similar check valves on ANO-2 (reference LERs 50-368/82-031-00 and 50-368/82-031-01). Check valve failures such as described in the referenced LERs have the potential for defeating the capability to i
~ -
supply steam to the turbine driven EFW pump.
Such failures are also described in IE Information Notice 86-01.
Although the deletion of the check valves enhanced the reliability of the system for normal operations and anticipated transients. the potential effect on system performance during one specific accident / single failure scenario was not recognized at the time nor during subsequent reviews performed per 10CFR50.59.
Prompt corrective actions were taken upon discovery of this situation.
Following notification of AP&L personnel by the SCFI team and subsequent evaluation by AP&L personnel, the event was reported to NRC per 10CFR50.72(b)(1)(ii). At the time of this notification the unit was proceeding to cold shutdown conditions for an unrelated maintenance activity. The unit was shut down on January 15, 1986.
During this outage a design change was implemented to install check valves as originally designed. Modifications were completed and the testing of the EFW system was accomplished by February 2, 1986.
Concerns relative to check valve reliability were addressed by augmented preventive maintenance.
Although prompt and extensive corrective measures were taken to address the situation, it should be noted that this event represented a minimal potential for degradation of the level of protection for i
the public health and safety. The specific postulated failure scenario has an extremely low probability of occurrence.
In addition, subsequent analysis demonstrated that even had such a scenario occurred, the EFW systen would have performed its intended i
function without reliance on the subject check valves.
Computer analysis of the actual steam piping sizes and configuration, assuming a postulated main steam line break and no isolation between the EFW 3
steam supply lines, indicate sufficient steam flow was available to remove decay heat for a period in excess of forty-eight hours. This time frame is more than sufficient to allow corrective actions to assure long-term decay heat removal.
t j
In addition to specific corrective actions discussed above, other actions of a more generic nature have been completed or are underway.
Since the design and installation of the EFW modifications took place over several years, there were modifications to the design system r
l sent to NRC in the early stages. Such changes were reviewed per the provision of 10CFR50.59 prior to installation.
I Prior to the event, AP&L had undertaken the development of a program i
to improve the quality and depth of design reviews conducted per 1
10CFR50.59. This program involves establishment of specific qualifications, including augmented training, for personnel performing such reviews. The necessary training material is currently being prepared and implementation of this new program is expected by the fall of the year. This will represent a major change in our methods of performing reviews of proposed plant modifications and will provide rignificant improvement in this area.
Item II.A.1.b No design analysis was found evaluating the consequences of high-energy line breaks (such as a main steam line break within the penthouse area) on the EFW system concurrent with a single active failure, even though the steam supply piping and valve arrangement was modified.
Likewise, the team found no design analysis performed to assess the impact of high-energy breaks i
within the EFW steam supply piping on other safety-related equipment.
1 The team found that the EFW system will function properly in response to anticipated transients such as loss of offsite power concurrent with a turbine trip and loss of main feedwater events. However, as evidenced by the deficiencies identified above, the team found that the system may not have been i
adequately protected from abnormal events such as high-energy l
line breaks and earthquakes (see Observation II.B.2).
j i
Response
l The design effort related to the modification of the turbine driven EFW pumps steam supply piping did not include specific high-energy line break calculations. The original high-energy line break evaluation of this system contained in the ANO-1 FSAR did not rely on 3pecific line break calculations but rather on the fact that there
- iere no safety-related components near the subject piping which could be impacted by such a break.
l The modifications to the piping did not alter this basis, nor were components critical to the required functions of the EFW system a,dded in the area. Thus, specific high-energy line break calculations were not required.
In order to clarify the documentation of this item, a change has been prepared to the applicable FSAR sections to expand j
and upgrade the discussion of postulated high-energy line breaks in i
this system. This change has been reviewed and approved internally and will be included in the next FSAR update submittal.
.I l
Item II.A.2 The team identified the following safety concerns with the licensee's program for maintenance and testing of EFW system motor-operated valves (MOVs).
a.
Licensee personnel were generally unaware that EFW MOV torque switches for ANO-Unit I were only bypassed during initial valve movement and that, as a consequence, improper torque switch operation could prevent the EFW system from completing its safety function. This lack of understanding was apparently due to a design difference in MOVs between Unit I and Unit 2.
In ANO-Unit 2, MOV torque switches are typically bypassed for full valve travel.
i
b.
Torque switch settings were made without reference to the minimum recommended values provided by the vendor. The team reviewed selected MOV torque switch settings and found them to be set low; in one case, the setting was below the minimum value used for manufacturer testing.
c.
MOV limit switches appeared to be set to bypass torque switches for an insufficient amount of initial valve travel. The purpose of these limit switches was to bypass the torque switch until the valve was fully off its shut I
seat, thereby providing some assurance that the torque switch would not prematurely stop valve motion.
d.
EFW system MOVs located in the pump discharge piping were J
not tested under flow conditions to ensure that they would operate as expected in emergency situations, e.
Several discrepancies in the MOV maintenance procedures were identified. These discrepancies could cause confusion among personnel performing maintenance.
In summary, the licensee could not verify, by test results, engineering evaluation or vendor input that current torque switch and limit switch settings were adequate to permit proper MOV operation under expected flow conditions for all operating scenarios. Most EFW system MOVs are not required to reposition under normal circumstances for EFW initiation. However, EFW system MOVs would be expected to operate against design differential pressure if a steam generator isolation signal was received during EFW operation, if EFW water supply sources were required to be shifted from the condensate storage tank to service water, or if EFW initiation occurred during system flow testing.
Response
4 The items identified in the report are also addressed in NRC's IE Bulletin 85-03 which was issued prior to this inspection.
Similar concerns were also previously identified by AP&L and other utilities during reviews of recent incidents at other facilities. AP&L is devoting significant resources to the task of assuring that M0V torque and limit switch settings are properly selected and maintained. AP&L's initial response to this bulletin was forwarded to the NRC in our letter to Mr. Martin dated hay 14, 1986 (0CANp58693). Actions are proceeding on an expedited schedule and the majority of the items associated with the bulletin are expected to be completed during the upcoming refueling outage (August, 1986).
Efforts related to this bulletin will fully address the concerns j
identified by the SSFI team, i
i
Item II.A.3.a The condensate storage tank (CST) level indication transmitter, LIT-4203, had apparently not been calibrated after installation during the 1984 refueling outage. The licensee also had no routine surveillance procedure to ensure that this instrument is periodically calibrated. This instrument is used by operators to make the determination to manually shift EFW pump suction from the non-safety-related CST to the safety-related service water backup.
Response
Although calibration records could not be found for LIT-4203, the instrument was found to be in calibration when checked. The instrument was apparently properly calibrated following installation.
Under review are methods of assuring that instruments added as the result of plant modifications are integrated into the surveillance program and actions will be taken as necessary to prevent recurrence following completion of this review.
Item II.A.3.b
~
Eight valves in the EFW system that required routine in-service testing were not periodically testing.
These valves included four check valves in the EFW pump suction line from the CST, one check valve in each EFW pump minimum recirculation line, and one 3-way valve downstream of each EFW pump that allows recirculation flow when the EFW pump is discharging at high i
pressure. The proper operation of these valves apparently cannot be verified without the installation of additional instrumentation.
Response
As stated in the report, the applicable procedure which accomplishes the inservice valve testing will be revised to identify specific testing and documentation for the valves, as deemed necessary.
Item II.B.1 Problems were noted in the ANO-1 mechanical design change process. The team identified instances where modifications were done without significant mechanical design activities being performed, completed, or documented. The team believes that these oversights should have been corrected during the design verification and supervisory reviews.
The fact that these omissions were not detected indicated an apparent lack of design experience and/or a lack of supervisory attention.
O
/
Response
Design omissions relative to EFW pump steam supply check valves, high-energy line breaks and seismic design are discussed elsewhere in this response.
AP&L recently completed an extensive evaluation of our design change process. Portions of the recommendations resulting from this evaluation were implemented during recent organizational changes and procedure revisions are currently underway. The concerns identified by the SSFI team relative tc completeness of design work and extent of configuration control will be integrated into this effort.
Item II.B.2 4
ANO-Unit 1 did not routinely consider the effect of equipment that is not designed to meet maximum design basis earthquake requirements (Seismic Class 2) on equipment that is designed to meet maximum design basis earthquake requirements (Seismic Class 1).
The team determined that evaluations of potential i
seisnic interaction, Seismic Class 2 over Class I situations, were not being routinely considered when preparing the civil portions of design-change packages.
The lack of consideration for seismic interaction could have a significant effect on the operability of all safety systems at ANO-Unit I during a seismic event. Seismic Class 1/ Class 2 interaction is apparently fully considered at ANO-Unit 2.
Response
With regard to the concern relative to Seismic Class 2 and Class 1 interaction, this issue has been addressed in detail in AP&L letter to Mr. John Stolz dated April 11, 1986 (ICAN048605).
As stated in that letter, the potential effects of such seismic interactions were properly considered during the design and construction of ANO-1 in l
accordance with applicable regulations.
We also conclude that our current design practices are appropriate and prudent, in many cases exceeding the minimum requirements for facilities of this vintage.
These design practices adequately assure the operabliity of safety systems during postulated seismic event.
Item II.B.3 The team found several samples of controlled design documents with incorrect or misleading information.
Based on the number and types of discrepancies, the team believes that the implementation of configuration control activities was weak.
4
Response
Many of the specific instances cited related to the " normal" position of valves as shown on P& ids.
Such indication of valve position.is not used as design input nor is it used by the operafinns staff to control valve positions. The "no rmal" position 9f valves is many times a function of plant conditions and as such cannot be accurately shown on P& ids.
The other noted discrepancies are being reviewed and corrected as neces sa ry.
The seneric aspects of this item are addressed above.
It should be noted that AP&L recently completed walkdowns of plant systems to identify discrepancies between P& ids and the as'-built configuration of the plant.
Discrepancies identified during this effort are in the process of final review and resolution. The resolutica process for these discrepencies involves the integrated review and revision (as needed) of 3pplicable pcoce: lures and design documents. This effort will result in significant improvements in the quality of these drawings.
i s
I e
s
/
4
-. _ _