1CAN128601, Responds to Part I of Notice of Violation & Proposed Imposition of Civil Penalty from Safety Sys Functional Insp Rept 50-313/86-01.Check Valves Installed During 860115 Shutdown.Response to Part II Will Follow within 14 Days
| ML20215E421 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 12/12/1986 |
| From: | Enos J ARKANSAS POWER & LIGHT CO. |
| To: | Taylor J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE) |
| References | |
| 1CAN128601, NUDOCS 8612220279 | |
| Download: ML20215E421 (10) | |
Text
--
ARKANSAS POWER & LIGHT COMPANY POST OFFICE BOX 551 UTTLE ROCK. ARKANSAS 72203 (501)371-4000 December 12, 1986 h--@ S DMS 1CAN128601 Obb I O l986 Mr. James M. Taylor, Director Office of Inspection and Enforcement U. S. Nuclear Regulatory Commission Washington, DC 20555
SUBJECT:
Arkansas Nuclear One - Unit 1 Docket No. 50-313 License No. DPR-51 Response to Notice of Violation and Proposed Imposition of Civil Penalty (NRC Inspection Report No. 50-313/86-01)
Dear Mr. Taylor:
The Nuclear Regulatory Commission issued its Notice of Violation and Proposed Imposition of Civil Penalty (NRC Inspection Report No.
50-313/86-01) relating to the Safety System Functional Inspection conducted on January 6-31, 1986 at Arkansas Nuclear One, Unit 1 on November 12, 1986 (1CNA118603). This letter responds to the Notice of Violation and Civil Penalty for Part I of the Notice. A letter is currently scheduled to follow, within fourteen days of this letter, addressing Part II of the Notice. Our response has been separated in this manner in order to fully address NRC concerns with respect to the most significant inspection finding. Our response to Part I is attached.
Very truly yours,
)$()h t
/
. Ted Enos, Manager U Nuclear Engineering and Licensing JTE/MGB/sg Attachment cc: Mr. Robert D. Martin Regional Administrator U. S. Nuclear Regulatory Commission Region IV 611 Ryan Plaza Drive, Suite 1000 g
h, g \\
Arlington, TX 76011 8612220279 861212 h
g%h gDR ADOCK 0500 3
MEMBEA MtOOLE SOUTH UTsufiES SYSTEM
F'
- e 8
ATTACHMENT RESPONSE TO NOTICE OF VIOLATION AND PROPOSED IMPOSITION OF CIVIL PENALTY (NRC INSPECTION REPORT N0. 50-313/86-01)
SAFETY SYSTEM FUNCTIONAL INSPECTION PART I (ICAN128601)
I e
NOTICE OF VIOLATION AND PROPOSED IMPOSITION OF CIVIL PENALTY During an NRC inspection conducted on January 6-31, 1986, violations of NRC requirements were identified.
In accordance with the " General Statement of Policy and Procedure for NRC Enforcement Actions," 10 CFR Part 2, Appendix C (1986), the Nuclear Regulatory Commission proposes to impose a civil penalty pursuant to Section 234 of the Atomic Energy Act of 1954, as amended,
("Act"), 42 U.S.C. 2282, PL 96-295, and 10 CFR 2.205. The particular violations and associated civil penalty are set forth below:
I.
Violation Assessed a Civil Penalty 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires, in Part, that the design control measures shall provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program.
Contrary to the above, design control measures for design change package DCP 82-D-1050 failed to properly assess or verify the adequacy of design regarding the potential for a single failure, loss of one power supply, to cause the simultaneous blowdown of both steam generators during a main steam line break accident, a situation outside the plant's design basis. This condition was caused when the design change package was implemented during the Unit 11984 refueling outage without certain check valves, the purpose of which was to prevent the simultaneous blowdown.
This is a Severity Level III violation (Supplement I).
Civil Penalty - $50,000.
RESPONSE
History of the Emergency Feedwater System Upgrade Arkansas Power & Light (AP&L) began the design of the Emergency Feedwater (EFW) System upgrade in 1980 in response to NUREG-0737, and was the first Babcock & Wilcox utility to fully implement the Emergency
- Feedwater Initiation and Control (EFIC) System. The design of the Emergency Feedwater System upgrade was complex, involving a number of design changes which were installed over several refueling outages.
The $15.5 million EFW upgrade project involved installation of approximately 900 feet of seismic piping and 25,000 feet of electrical cable, more than 1000 electrical terminations, approximately 40,000 engineering manhours, more than 50,000 craf t manhours and 16 weeks of outage time.
The regulatory objective of the Emergency Feedwater System upgrade was to meet the requirements of NUREG-0737, " Clarification of TMI Action 1
s 1
s i
n Plan Requirements", Sections II.E.1.1, "Auxiiiary Feedwater System E '
Evaluation" and II.E.1.2, " Auxiliary Feedwater System Automatic Initiation and Flow Indication." This was one of a number of design changes required by this NUREG which were coordinated with AP&L initiated modifications aimed at improving the safety, reliability, performance, and maintainability of Arkansas Nuclear One, p
In the course of the reviews of the installation of the EFW upgrade, 4
AP&L submitted sixteen letters to the NRC relating to substantive design issues prior to the October 1983 SER. During this time, refinements were made to the basic design to factor in such considerations as maintenance, reliability and operating experience.
,ss AP&L made every effort to keep the NRC informed of the design (as it i's was evolving) through this series of correspondence.
In fact, drawings were submitted showing the system without check valves although we acknowledge that we did not bring this change explicitly 5
to the NRC's attention.
ti
's v
During the Safety System Functional Inspection (SSFI), the Y
postulated scenario described in the violation was of concern to tne SSFI team.
It became apparont, during the inspection, that the i
designer had considered the main steam line break scenario by the o
original inclusion of the check valves and, concurrent with their deletion, the inclusion of electrical signals to close the motor-operated valves, isolating the affected steam generator.
In-deleting the check valves, the designer did not fully address the consequences (from the postulated scenario) nor did AP&L address this in our safety evaluation.
The intended purpose of the check valves was to prevent cross-connection of the steam generators following a postulated nain steam line break (MSLB).
In the unlikely event of a MSLB in combination j
with a loss of offsite power, and a single failure of a particular Engineered Safeguards electrical bus, the cross-connection.
potentially could result in reduced steam flow to the EFW turbine.
The check valves were deleted from the original design because of reliability problems AP&L had been experiencing with similar valves in the same application on AN0-2.
(IE Infonnation Notice 86-01 later described the check valve failures of concern). Although the 4
design engineer had considered the event of an unisolated r. team leak i
in his design, he did not fully evaluate its potential effect on s
system performance in the event of loss of offsite power.
In essence, he did not recognize the combination of events as a design basis scenario. The scenario was not recognized as a design basis failure scenario during subsequent reviews.
Although the design basis of the EFW system does consider loss of offsite power, the design basis of ANO-1 does not consider MSLB concurrent with loss of offsite power. Therefore, loss of offsite power may not have been thoroughly considered in the evaluation of this event because'tt was not a design basis scenario for the plant.
The EFW system was only recently (1984) upgraded to a completely safety grade system. The design basis of AN0-1 was established on a
[
2
W y a '.,
l, N N,
[i m-non-safety grade auxiliary feedwater ( AFW) system. A review of the ANO-1 design basis shows credit was given for operation of the non-safety grade AFW pump and main feedwater system (MFW) in several design basis scenarios when offsite power was available. Therefore, it would be consistent with our plant's design basis for the given I.
scenario to not consider loss of offsite power and therefore give credit for operation of AFW and MFW. With offsite power available,
,':tM.
sufficient water could be provided to the Steam Generators using the m-A AFW pump and the crosstie between the Steam Generators could be x
isolated.
Analysis of the Design Impacts of Deleting Check Valves During the January, 1986 outage in which the check valves were uN installed, AP&L analyzed the ability of the Emergency Feedwater (EFW) system to provide water to the steam generators should the n
,h postulated scenario have occurred in the absence of the check f
5 valves. This analysis showed that in the event of the postulated
(
s scenario, sufficient steam would be available to operate the EFW t
turbine-driven pump and provide sufficient feedwater flow to the steam generator until the steam pressure reached 80 psia which would not occur for at least 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. During this period plant operators would have several options available to them to terminate the event.
d The Emergency Operating procedure addresses an overcooling event ps, caused by excessive steam flow due to a steam line rupture in the
}J \\
" Overcooling" section and in the " Degraded Power" section. Both j
sections address closure of CV-2667 or CV-2617 (steam supply to EFW pump P7A turbine) to isolate the affected generator.
In one situation under this scenario, the MSLB t ccurs in the penthouse area
)' -
making it impracticable for operators to enter the area to manually
/
close CV-2667.
In this case the electrical power to CV-2667 could be manually shifted to the operable 480V power supply making remote closure possible. Other options available to terminate the event would include powering the " red" motor-driven EFW pump P78 from the
" green" power supply or HPI/PORV cooling. As a result of any of these operator actions, the plant would have achieved safe shutdown.
AP&L's initial evaluation of the potential con equences of the postulated main steam line break (MSLB) focused on the ability of the EFW system to provide feedwater to the steam generators. This addressed the principal concern of the inspection finding, i.e., the s
capability of the upgraded EFW system to meet its design criteria.
3 Secondary consequences of the postulated MSLB include containment pressure effects.
In the event of MSLB inside containment, operators could enter the penthouse area and manually close CV-2667, mitigating these effects. Containment pressure, although it is not specifically analyzed, can be addressed qualitatively. The ANO-1 containment design pressure is 59 psig and the limiting accident
\\
pressure of 53.1 psig results from a loss of coolant accident.
By contrast the peak pressure resulting from MSLB is 36 psig, based on i
an assumed instantaneous release of the entire inventory of one 3
(
steam generator of 62,600 lb and with no crof.it for heat sinks.
Peak containment pressure would only be affected by cross-flow from the intact steam generator if the energy deposition exceeds the containient cooling capability.
TheanaysisperformedtodemonstratetheabilityoftheEFWsystem to provide adequate water to the steam generator, the results of which are discussed above, indicates that containment cooling systems are more than adequate to assure containment integrity.
This analysis was conducted by constructing a computer model of the various steam flow paths (to EFW turbine, cross-flow to break location and steam flow to atmospheric dump valve (ADV)). Steam flow through the network was then analyzed at successively lower steam generator pressures. At each point, the steam flow to the EFW turbine is verified to be sufficient to provide makeup flow to the steam generator at least equal to the total steam outflow.
Iterations on the calculation were repeated until the limiting adequate steam generator pressure was found.
At a given steam generator pressure, equilibrium conditions would exist when (1) decay heat equals the total energy to the EFW turbine, the break and the ADV and (2) EFW pump discharge mass flow rate equals the mass flow rate to the EFW turbine, the break, and the ADY.
By examination of the equilibrium conditions, the energy added to the containment is always less than the core decay heat, since portions of the decay heat removed by the steam generator are 4
lost via the EFW turbine and the ADV. AN0-1 is equipped with automatic redundant 100% capacity containment cooling systems (either two trains of containment spray, two trains of containment coolers, or one train of each are capable of removing full decay heat).
Since the energy input to containment following the MSLB is within the capacity of the redundant containment cooling system and since the Final Safety Analysis Report (FSAR) MSLB pressure response was done in a conservative manner and is not the limiting event for containment response, it can be concluded that the calculated containment peak pressure would not be increased and the postulated scenario is bounded by current FSAR analysis.
In addition, the analysis addressed calcuhting offsite dose consequences of the main steam line break accident scenario. Under the conservative FSAR methodology the calculated offsite dose consequences are less than 7% of the 10 CFR 100 thyroid limits, even assuming no mitigation of the accident prior to 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />.
Cause of the Occurrence Complete consideration of the effects of not having check valves in the EFW turbine steam supply lines and a complete investigation of the nature of the design deficiency have been carried out, in summary, it appears that the design deficiency hinged on the failure 4
to adequately analyze all the consequences of removal of the check valves resulting in inadequately addressing a very remote probability event and one that is not clearly within the design basis. As a result, the decision to delete the check valves to improve overall system reliability was made.
(IE Information Notice 86-01 later described the check valve failures of concern). The review process did not identify the failure scenario because of the complexity of its initiating events and the fact that loss of offsite power is not a design basis event for MSLB. The consequences of check valve deletion were a slightly degraded ability.to supply EFW during one specific very low probability event and increased EFW reliability for anticipated transients. We have concluded, based on analysis conducted following the SSFI, that the.
EFW system would have performed adequately during both anticipated transients and accident scenarios without the check valves.
Admission of Violation While AP&L continues to believe the deletion of the check valves was in the interest of overall EFW system reliability we admit an inadequate safety evaluation was performed to identify the specific EFW single failure scenario discussed previously.
Corrective Actions Prompt corrective actions were taken subsequent to the identification of this situation. Subsequent to identification, the event was reported to the NRC under 10 CFR 50.72(b)(1)(ii). At the time of the notification, the unit was proceeding to cold shutdown conditions for unrelated maintenance activities. The unit was shutdown on January 15, 1986. During this outage a design change was implemented to install check valves. Modifications were completed and the testing of the EFW system was accomplished by February 2, 1986. Concerns relative to check valve reliability were addressed by augmented preventive maintenance.
Further, the swing check valves were replaced by lift check valves during the refueling outage which began in September, 1986 (1R7). The use of lift check valves addresses AP&L concerns related to the reliability of these valves.
Actions to Prevent Recurrence Consideration has been made of actions which might be taken to prevent recurrence. AP&L considers this specific design deficiency to be mitigated by a number of factors including the fact that the design weighed the impacts of deletion of the check valves against valid reliability concerns and the fact that the design basis failure scenario was both remote and difficult to identify due to its complexity. For these reasons, AP&L considers this design deficiency to be somewhat isolated to the specific instance rather than indicative of an overall programmatic failure of the design change process.
5
However, AF&L dues consider that the evert provides a good example of the depth of review that is required in conducting safety evaluations of design changes anu indicates that our process should be enhanced.
Consistent with AP&L's desire for continuing improvements in our design process, we have embarked upon several program changes affecting the 10 CFR 50.59 review process, the design change process, and enhanced training provided to design engineers.
Even prior to this event, AP&L had initiated a program to meet management objectiver to improve the quality, depth and documentation of reviews conducted under 10 CFR 50.59.
10 CFR 50.59 requires a written evaluation of the no unreviewed safety question detennination. AP&L's revised program involves establishment of specific qualifications for personnel performing 10 CFR 50.59 evaluations. Initial training for designated personnel was begun in August of thic year. This program provides guidance for making 10 CFR 50.59 reviews. This program will result in ce-tified 50.59 reviewers who are qualified by meeting applicable ANSI standards for experience and training in their discipline, who receive 10 CFR 50.59 reviewer training, and who pass a qualifying exam. These individuals will be re-qualified every two years. AP&L's policy requiring such qualification has been implemented for design engineers and full implementation is planned for the first quarter of 1987.
It is believed that a more thorough review of AN0's licensing basis documents and the in-depth evaluation which qualified reviewers will be trained to carry out would have identified the specific scenario which was overlooked when the check valves were omitted.
Subsequent to the issuance of the oesign packages reviewed by the SSFI team but prior to the SSFI, AP&L had initiated extensive design modification process changes. One of the thrusts of these design modification process changes was to provide improved training and improved standards for review for design changes. During 1986, for example, training was conducted on site-specific ASME Sections III and XI and on specifications for pre-design and post-installation walkdowns of piping systems. The site modification function has been reorganized and the new reorganization has been staffed during 1986. Additionally AP&L initiated independent reviews of selected design change packages which were performed prior to 1986.
Selection criteria were Principally based on design complexity, multi-disciplinary involvement and safety significance. Changes in procedures and operating instructions have been accomplished to improve the overall technical adequacy and completeness of the Nuclear Design Change Packages.
Design procedures have been revised for consistency between the plant and Generation Engineering organizations. Section specific procedures have been expanded to further define discipline-specific design criteria, process guidelines and design input control measures. Enhanced instructions have been provided to reinforce design calculation procedures and to 6
stress the importance of design verification. Procedures have been revised to reference industry operating experience as design inputs.
Future plans include integration of design process procedures, issuance of a piping design guide, and providing improved design information and training in regulatory requirements relating to the design process. Our Plant Modifications Manual program document has been completed, which specifies modification requirements and responsibilities from preplanning and prioritization to closeout of documentation following implementation.
It has recently been issued for implementing procedure development. These procedures are currently scheduled to be complete by the end of the first quarter of 1987. An Individual Development Program is being implemented which will establish training needs for engineers and provide appropriate training for the Generation Engineering design group.
The Individual Development Program has been partially implemented at this time with initial emphasis on nuclear design requirements. The improved training and level and depth of review to be provided by these changes are also expected to help prevent recurrence of a similar problem in the future.
Statement of Compliance AP&L achieved full compliance with the correction of the design deficiency in early 1986 and is in the process of implementing ongoing programs which are expected to prevent recurrence of a design deficiency such as the subject of this violation.
It should be noted that many of the actions to prevent recurrence were initiated by AP&L prior to the SSFI.
We believe this demonstrates that AP&L had self-identified the need for improvement in our design and 50.59 programs by voluntarily undertaking extensive corrective actions.
e c
7
ANSWER TO THE CIVIL PENALTY
-This answer to the Civil Penalty-incorporates by reference the response to the Category III Violation set out above.
AP&L has admitted the violation and sets forth the following facts which should mitigate the civil penalty:
The potential design discrepancy identified in the SSFI was immediately reviewed, by AP&L. When reviewing the concerns which related to assumption of non-design basis loss of offsite power (and without credit for AFW and MFW), a determination was made identifying it as a design discrepancy.
Immediate notification was made to the NRC in accordance with 10 CFR 50.72(b)(1)(ii).
Immediate action was taken to correct the problem upon discovery by placing swing check valves in the steam supply lines. This action resolved the NRC concerns relating to the postulated scenario.
In addition, procurement and design efforts were promptly initiated to obtain lift check valves in order to address our reliability concerns in an expeditious manner.
Prompt corrective action was also taken to prevent recurrence.
In addition to immediately adding check valves to the system while taking action to minimize reliability concerns, extensive corrective action was taken to address programmatic concerns. AP&L had previously recognized the need to improve the nuclear modification process and 50.59 review program and initiated major improvements in these areas. As described in the response to the violation, programs of an extensive nature were already scheduled and being initiated at the time this problem was identified.
Good performance in the general area of design control is indicated by the conclusion of the SSFI team that the design of the EFW system was sound. The SSFI technique is the most thorough, detailed and comprehensive inspection approach NRC has undertaken at operating facilities and we were pleased that the team found the AN0-1 EFW system design to be sound. Also, it appears that AP&L has compared favorably to the results of SSFIs performed at other utilities. AP&L has taken the initiative to make extensive improvements in the design modification process, in the 50.59 review process, and in the training of engineers as l
outlined in the response to the violation. These initiatives had been undertaken prior to the identification of the design deficiency at issue and are believed to be changes that will lead to exemplary programs.
For the reasons set forth above, we request mitigation of the civil penalty.
8