IR 05000269/1994039

Insp Repts 50-269/94-39,50-270/94-39 & 50-287/94-39 on 941205-09.Noncited Violations Noted.Major Areas Inspected: Unresolved Items & Germane LERs to Design,Operation & Safety Classification of Condenser Circulating Water Sys

ML16222A882
Person / Time
Site:	Oconee
Issue date:	01/06/1995
From:	Peebles T, Rogers W NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II)
To:
Shared Package
ML16154A747	List: IR 05000269/1994039
References
50-269-94-39, 50-270-94-39, 50-287-94-39, NUDOCS 9501170023
Download: ML16222A882 (13)

Text

0-REG(JZ UNITED STATES NUCLEAR REGULATORY COMMISSION

REGION II

101 MARIETTA STREET, N.W., SUITE 2900 ATLANTA, GEORGIA 30323-0199 Report Nos.:

50-269/94-39, 50-270/94-39 and 50-287/94-39 Licensee:

Duke Power Company 422 South Church Street Charlotte, NC 28242 Docket Nos.:

50-269, 50.-270, and 50-287 License Nos.:

DPR-38, DPR-47, and DPR-55 Facility Name:

Oconee Nuclear Station Units 1, 2 and 3 Inspection Conducted: D er 5-9, 1994 Inspector:

(_ _

_

_

_

_

__

_

Walter G. Rogers eam Leader at Signed Accompanying Personnel: D. Prevatte Approved by:

_

_ _ _

_ _

_

_ _ _

Thomas A( Peeb es, Chief Datd Signed Operations Branch Division of Reactor Safety SUMMARY Scope:

A special, announced inspection was conducted on December 5-9, 1994, in the areas of unresolved items and germane LERs to the design, operation, and safety classification of the Condenser Circulating Water system and associated support system Results:

The Condenser Cooling Water and High Pressure Service Water support systems for the Low Pressure Service Water system were not designed, maintained, or properly classifie Consequently, these support systems were not capable of performing their safety functions under certain conditions during several time periods. A major contributor to the support systems not being able to accomplish their safety functions under certain conditions was the licensee's implementation of the definition of safety-related, inconsistent with regulatory requirements imposed upon their acceptance of the operating license. This deficiency was broader than service water system Enclosure PDR ADOCK 05000269 PDR

REPORT DETAILS General Description of LPSW, CCW, and Associated Support Systems The LPSW system provides cooling to the RBCUs, LPI coolers, EFW motors and bearings, HPI motor coolers, control room ventilation, numerous room coolers, and nonsafety-related turbine building loads. Units 1 and 2 share three 15,000 gpm pumps which provide cooling water to the respective units through interconnected supply lines. The pumps take suction on the 42".CCW discharge header within the turbine buildin The Unit 3 system is composed of two pumps also taking suction on the CCW discharge heade The CCW system is essential for LPSW operability. The CCW system takes suction from the Lake Keowee intake cana Twelve pumps (4 per unit)

supply a common 42" discharge header. Up until mid-1993, cross-connect valves on this 42" header, isolated each unit's 4 pump discharge combinations from each other. From this header, numerous other systems take suction including the LPSW system. In the LOOP/LOCA event, the CCW pumps are loadshed (lose power).

Without pump motive force, water from the intake canal is supplied to the LPSW pumps suction via the ECCW system. Depending upon the lake level, the safety-related method of providing water is via siphon or gravity flow. After an hour emergency operating procedures direct licensed operators to energize CCW pump Thus, approximately an hour after the LOCA, the safety-related method of providing the LPSW suction source is via active CCW pump operatio The HPSW system is a support system to the CCW system. The HPSW system normally functions as the site's fire protection system. The system is composed of three pumps, an elevated storage tank, and interconnecting piping to fire protection deluge valves throughout the site and to the CCW pump The three pumps, two 6000 gpm capacity and one jockey, take suction from the 42" CCW discharge header. The jockey pump maintains system pressure. The other two pumps are to make up lost water inventory in the 100,000 gallon capacity elevated storage tank. Also, the HPSW system constantly supplies motor cooling and sealing water to the CCW pumps. Without adequate motor cooling the pumps would overheat and be rendered inoperable. Without adequate sealing water while in the siphon mode, air intrusion into the CCW discharge piping would occur rendering the siphon inoperabl Up until Fall 1993, the vacuum priming system was a support system to the CCW system. Through piping/valves attached to the top of the CCW piping at various points which connected to air ejectors, air was removed from the CCW piping. This ensured that air entrainment would not secure siphon flow when neede Enclosure

Report Details 2 Licensee Event Report Follow-up The below listed LERs were reviewed to determine if the information provided met NRC requirements. The determination included:

adequacy of description, compliance with Technical Specification and regulatory requirements, corrective actions taken, existence of potential generic problems, reporting requirements satisfied, and the relative safety significance of each even (Closed) LER 50-269/94-01, Seismic/LOOP Event may result in the Loss of Post Accident Cooling due to Design Deficiency The LER indicated that in 1991/1992, buoyancy restraints were installed on CCW piping. Specifically, the restraints were installed on July 18, 1991, for Unit 1; October 14, 1992, for Unit 2 and June 22, 1992, for Unit 3. These restraints were placed in contact with or immediately next to valves in an instrument tap connected to the CCW main piping. A field change was processed allowing the buoyancy restraint to be notched to allow installation around the instrument line/valves. However, the engineering personnel reviewing the field change did not consider lateral movement in their evaluation. In a maximum hypothetical earthquake, the instrument tap line would damage the

instrument line and allow air into the CCW pipin Enough air could enter the system, defeating siphon operatio During a field walkdown in December 1993, engineering personnel discovered the interferenc Engineering began an evaluation of the situation. On January 20, 1994, engineering completed an evaluation concluding the piping would be damaged during a maximum hypothetical earthquake. The facility was modified on February 11, 1994, for Units 1 and 2 and on February 18, 1994, for Unit 3 such that the interference was eliminated. A system walkdown was conducted of all three CCW intake piping with no problems identified. On February 17, 1994, engineering personnel completed an operability evaluation determining the air intrusion from the postulated pipe damage would defeat siphon operatio The root cause of this situation appeared to be a design oversight when processing a field change during modification activities on the CCW syste FSAR section 3.2.2 states that the Condenser Circulating Water intake piping to the Low Pressure Service Water pumps can withstand the maximum hypothetical earthquake. Table 3-2, "System Component Classification," indicates the Condenser Circulating Water intake pipe is designed for seismic loadin CFR 50, Appendix B, Criterion III, states in part "Measures shall be established to assure that applicable regulatory requirements and the design basis...

are correctly translated into specifications, Enclosure

Report Details

drawings, procedures and instructions."

Failure to design the CCW intake piping to withstand the maximum hypothetical earthquake is NCV 50-269, 270, 287/94-39-01, "Inadequate Field Change to the CCW Intake Piping."

However, this violation will not be subject to enforcement action because the licensee's efforts in identifying and correcting the violation meet the criteria specified in Section VII.B of the Enforcement Polic (Closed) LER 50-269/93-04, "A Postulated Single Failure during a LOCA/LOOP may result in the Loss of Post Accident Cooling due to a Design Deficiency"

This event is discussed in paragraph 3 as part of the of URI 50-69, 270, 287/93-13-04, "LPSW/ECCW Operability." (Open) LER 50-269/94-04, "Post Accident Core Cooling Technically Inoperable due to a Design Deficiency" The LER identified that a support system to LPSW operation had been taken out of service on two occasions when the support system was necessary for LPSW system operability. The support system in question was the HPSW system. A critical component of the HPSW system, the elevated water storage tank, was taken out of service to support maintenance activities in 1985 (August to November) and in 1990 (July to September).

Following a postulated LOCA/LOOP the necessary sealing flow preventing air intrusion into the CCW intake piping would not have been provided without the EWST inventory available. Consequently, the siphon would fail and the suction source for the LPSW system would be lost rendering the LPSW system inoperable. If operators attempted to restart the CCW pumps, cooling flow to the CCW pumps would be lost, eventually rendering the CCW pumps incapable of performing their safety functio A pivotal factor in needing the HPSW system to support the LPSW suction source was Keowee lake leve Gravity flow can provide the necessary water to the LPSW system when lake level was above 798.1'.

Therefore, siphon flow or forced CCW pump flow is needed below 798.1', which is when the HPSW system is needed to support the LPSW suction sourc Beyond what was discussed in the LER, there were numerous other times that critical HPSW system components necessary to support the LPSW suction source were out of service, and the LPSW TS 3. LCO action statement or the motherhood TS 3.0 was not entere However, in most of those cases either Keowee lake level would have supported gravity flow, or the component was returned to service before the action statement expired. Other examples when Enclosure

Report Details

the HPSW system was degraded and/or not able to perform its support system function were:

From 1982 to November 1986 when the jockey pump's discharge check valve was installed backward *

From November 1986 to January 1987 when the jockey pump's discharge check valve had been removed from the syste *

September 1987 when the each section of the Unit 1 main feeder bus was taken out of service for maintenance and inspectio Once the licensee recognized in 1994 that the LPSW support system a

functions of HPSW must be maintained to keep the LPSW system operable, engineering personnel immediately verified the lake level was such that the HPSW system was not necessary to support LPSW operability. Other corrective actions included taking actions to revise the HPSW and CCW system DBDs and other engineering documents and performing a single failure analysis of the HPSW system. However, engineering personnel classified the altitude valve as a passive device even though it performed an active function. The HPSW check valves and the altitude valve were to be placed in the ASME Section XI test progra Also, the licensee implemented a Selected Licensee Commitment (SLC) to cover the HPSW system as a support system to LPSW. There were deficiencies within the SLC such as there was no applicable

"LCO Action Statement" when either half of Unit 1's main feeder bus is taken out of service (the power source for the HPSW pumps).

The licensee indicated that a modification was being planned that would eliminate the need for the siphon mode of CCW system operation and the need for the HPSW system to perform a safety related functio The root cause of these situations appeared to be the organizational lack of understanding that taking certain portions of the HPSW system out of service placed the licensee in the LPSW system (TS 3.3.7) LCO action statement or the motherhood (TS 3.0)

LCO action statemen Technical Specification 3.3.7 required the LPSW system to be operable when RCS pressure is greater than 350 psig. Technical Specification 3.0 required that in the event a Limiting Condition for Operation cannot be satisfied the affected unit shall be placed in at least Hot Shutdown within the 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, and in at least Cold Shutdown within the following 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Technical Specification Definition 1.3, "Operable," stated in part, "A system...

shall be considered OPERABLE when it is capable of Enclosure

Report Details

performing its intended safety functions. Implicit in this definition shall be the assumption that all essential auxiliary equipment required in order to assure performance of the safety function is capable of performing it related support function(s).

Auxiliary equipment includes...

, cooling and seal water, instrumentation and controls, etc."

Further NRC review is necessary to fully assess the regulatory and safety implications of this situation. Therefore, this is URI 50-269, 270, 287/94-39-02, "HPSW Out of Service Rendering LPSW Inoperable." Follow-up on Previously Identified Items The following outstanding issues were reviewed using licensee reports, inspection record review, and discussions with licensee personnel, as appropriate: (Open) URI 50-269, 270, 287/93-13-04, LPSW/ECCW Operability:

On April 5, 1993, the NRC resident inspectors determined that all four CCW pump discharge valves could go closed on a loss of CCW pumps if one of several single failures occurred in the discharge valves control logic. The licensee was informed. On April 8, 1993, after completing an engineering review of the situation, the licensee concluded the LPSW systems were unable to withstand a design basis accident and a single failure within the CCW discharge valves control logic. The applicable TS LCO action statement was entered, and the appropriate 10 CFR 50.72 and 50.73 notifications were accomplished within the allotted time The licensee opened the unit CCW cross-connect valves on April 9, 199 With the cross-connect valves open, two additional siphon paths not affected by the single failure were available to provide water to the LPSW suction source. This action eliminated the single failure vulnerabilit From initial licensing until November 12, 1982, the licensee maintained the CCW cross-connect valves between units ope However, due to internal turbine building flooding concerns, the units' cross-connect valves were close Eventually, the electrical circuit was modified to be single failure-proof in and of itsel The root cause of this inadequate design appeared to be a design oversight during the inception of the electrical control logic for the CCW discharge valve There was at least one reasonable opportunity to identify the design deficiency. The 1987 Self Initiated Technical Audit (SITA) on the LPSW system did identify general concerns associated with single failure vulnerabilities with the sipho However, the licensee considered the design consistent with regulatory requirement Enclosure

Report Details

The FSAR section 9.2.2.1 stated that the Condenser Circulating Water, High Pressure Service Water and Low Pressure Service Water Systems were designed so no single component failure will curtail normal station or impair emergency safeguards operatio FSAR section 9.2.2.2.3, stated in part, "The Low Pressure Service Water system provides sufficient flow to the Low Pressure Injection coolers and Reactor Building Cooling Units to ensure sufficient heat transfer capability following a design basis accident and a single active failure."

10 CFR 50, Appendix B, Criterion III, stated in part "Measures shall be established to assure that applicable regulatory requirements and the design basis...

are correctly translated into specifications, drawings, procedures and instructions."

From November 12, 1982, until April 9, 1993, the CCW was not capable of performing its safety function following e

one single active failure. Further NRC review is necessary to fully assess the regulatory and safety implications of this situation. Therefore, this matter remains unresolve (Open) URI 50-269,270, 287/93-13-03, ECCW System Design and Testing:

The item as documented in IR 93-13 and amplified in IR 93-25, contained four basic parts. These dealt with (1) whether the ECCW system should meet single failure criteria and whether there was sufficient water inventory in the upper surge tanks and condenser hotwell to relieve steam to the atmosphere, (2) the lack of seismic qualification of portions of the CCW/ECCW and support systems, (3) the acceptability of taking credit for the nonsafety related, CCW pumps to mitigate the consequences of a design basis accident, as well as nonsafety-related support systems, and (4)

the acceptability of ECCW system testing with regards to the continuous vacuum priming syste With respect to part (1), the first siphon portion (suction source for the LPSW pumps) of the ECCW system must be single failure proof. The second siphon portion of the ECCW was eliminated from the licensing basis in the fall of 199 This portion of the ECCW system was applicable to decay heat removal from the secondary side of the facility. However, the acceptability of adequate water inventory in the upper surge tanks and condenser hotwell under the new decay heat removal configuration was not evaluated during this inspection period. Therefore, this aspect of the unresolved item remains ope With respect to part (2), portions of the CCW/ECCW system lacked seismic qualification as did the vacuum priming and HPSW support system Enclosure

Report Details

The power and control cables for the CCW pumps and the CCW pump discharge valves were not seismically protected. These cables were located in a common trench going to the pumps and valve The metal cover plates on top of the trench were not seismically restrained. In an earthquake, the plates could fall and sever some the cables below. The licensee indicated that a modification would be implemented securing the trench cover The HPSW system was not designed to withstand an earthquake (non Class I system).

The piping was designated class "G" or nonseismic as discussed in Table 3-1 of the FSAR. The licensee had performed an analysis of the EWST and concluded the tank could withstand the maximum hypothetical earthquake. The rest of the system was considered seismically "rugged."

However, the system had not been qualified for earthquake in accordance with FSAR criteri The vacuum priming system piping was not qualified for an earthquak Its piping was also designated as class "G."

In the fall of 1993, the licensee seismically qualified the vacuum priming system from the CCW piping to the first valve and closed these valves. An analysis performed prior to this corrective action confirmed that operation of the CCW pumps would "sweep away" any entrained air in the CCW piping that would inhibit siphon performance. However, prior to isolating these "isolation" valves, loss of piping integrity or separation of the lines due to an earthquake would not only secure vacuum priming operation but would also allow air into the piping. Air intrusion would cause loss of the siphon to the LPSW pumps if called upon to functio Therefore, this condition existed from initial licensing until the fall of 199 The 1987 service water SITA brought up some of the philosophical questions on what was required to be seismically supported. Also, although it took six years, the SITA was the initiation point from which the seismic inadequacy of the vacuum priming system was resolved (i.e., removal from service as it relates to the first siphon).

FSAR 3.2.2 stated, "A maximum hypothetical earthquake will not result in a loss-of-coolant accident, but the simultaneous occurrence of these events will not result in loss of function to vital safety-related components or systems."

10 CFR 50, Appendix B, Criterion III, stated in part, "Measures shall be established to assure that applicable regulatory requirements and the design basis...

are correctly translated into specifications, drawings, procedures and instructions."

The licensee did not translate this seismic requirement into the design for portions of Enclosure

Report Details

the CCW system, HPSW system necessary to support first siphon operation, and the vacuum priming system. This matter remains unresolved pending further NRC revie With respect to part (3), safety related equipment was required to mitigate the consequences of an acciden The HPSW system did perform a safety-related function but was not classified by the licensee as safety-related nor was the quality assurance program applied to the system. Also, although the ultimate power source of the jockey pump was safety-related, the buses, load centers, cables, etc. from the main feeder bus to the jockey pump were nonsafety-related. The DC circuits from the safety-related power source were nonsafety-related. Due to the e

lack of safety-related designation for the HPSW system, the HPSW pumps, the altitude valve, and the pumps' discharge check valves were not included in the IST pump and valve program. In addition, maintenance was performed on the these and other critical components without QC involvement, and replacement parts from the non-QA procurement program were use Nowhere in any licensing documents did the licensee inform the NRC that the HPSW system performed a safety-related function and was necessary to mitigate the consequences of a LOOP/LOCA. The original FSAR described the HPSW system as the source of fire protection throughout the station. In addition, the current revision of the FSAR did not indicate the safety-related support system function of HPS Portions of the CCW system necessary to supply the suction source for the LPSW pumps were not designated safety-related even though they performed this safety-related function. One area was the discharge valve electrical logic. Consequently, the modification to rectify the single failure vulnerability in the discharge valves' electrical logic was designated nonsafety-related as well as the work request to accomplish the modificatio The licensee indicated, as corrective action to a previous violation in this area of safety classification, that the Quality Standards Manual (Q List) was revised identifying the CCW pumps as performing a safety-related function (This does not necessarily mean the components are safety-related).

Procedures were being prepared to upgrade operation/maintenance/testing on the applicable part of the CCW system to safety-relate The licensee also indicated that a modification was planned to upgrade the applicable portion of the CCW system to safety related. On a broader viewpoint, the licensee was preparing a program called QA 5. If a piece of equipment was classified QA 5 all but the procurement and design requirements would be placed Enclosure

Report Details

upon the use/maintenance of that equipment. However, such an approach would require a change to the licensee's present QA topical repor CFR 50, Appendix B, "Introduction," stated that this appendix applies to those structures, systems, and components that prevent or mitigate the consequences of postulated accident CFR 50, Appendix B, Criterion II, "Quality Assurance Program," stated in part, "The applicant shall identify the structures, systems and components to be covered by the quality assurance program."

This aspect of the unresolved item remains outstanding pending further NRC revie Beyond the safety classification deficiencies two CCW support systems, HPSW and vacuum priming, were not single failure proof:

The failure of valve HPSW-25 (commonly referred to as the altitude valve) to open would eliminate the EWST volume from us Until a HPSW pump could be started, the EWST volume would be the only available cooling and sealing source available to the CCW pump The automatic start of a HPSW pump on low EWST level was dependent upon a single level indicator. Failure of the level indicator high would eliminate the auto-start featur Prior to the licensee opening the CCW unit cross-connect valves in 1993, the failure of specific valves within the vacuum priming system would render the unit specific siphon

'incapable of performing its safety function. Licensee calculation OSC-5409, "Single Failure Analysis of the ECCW System Supply to the LPSW Supply," Rev. 0, documented these single failure Examples included the steam supply valve (MS-46) to the ESAE, the swap-over valve (V-82) to the ESAE, the CCW intake mid and high point vent valves (CCW-26 through CCW-29).

Also, there was a manual valve in the single line going to all 12 CCW pumps. This valve was located in the trench with the electrical cables and was not locked ope The present revision of the Final Safety Analysis Report section 9.2.2.1, stated that the Low Pressure Service.Water Systems and portions of the Condenser Circulating Water system were designed so no single component failure would curtail normal station or impair emergency safeguards operation. This aspect of the unresolved item remains outstanding pending further NRC revie Enclosure

Report Details

The root cause of these deficiencies appeared to be the failure of the engineering organization to properly design and classify support systems for the Low Pressure Service Water systems as safety-related at initial licensing. The systems involved were CCW, HPSW, and Vacuum Primin With respect to part (4), in the Fall of 1993 the vacuum priming system was eliminated from operation for that portion of the ECCW system presently required as part of the licensing basis of the facility in the postulated LOOP/LOCA. Testing of that portion of the system was inspected in IR 94-31 and determined to be inadequate. Consequently, VIO 50-269, 270, 287/94-31-04 was issued. Therefore, the ECCW system testing portion of this unresolved item is close.

Exit Interview The inspectors conducted an exit meeting on December 9, 1994, at the Oconee Nuclear Power Station to discuss the major areas reviewed during the inspection, the strengths and weaknesses observed, and the inspection result Licensee representatives and NRC personnel attending this exit meeting are documented in Attachment A of this report. The inspectors also discussed the likely informational content of the inspection report. The licensee did not identify any documents or processes as proprietary. The licensee indicated a thorough review of the inspection findings would be necessary to ascertain the appropriate responses or corrective actions to the issues identifie Acronyms and abbreviations included in this report are identified in Attachment ITEM NUMBER STATUS PARAGRAPH DESCRIPTION 94-39-01 Closed NCV - Inadequate Field Change to the CCW Intake Piping 94-39-02 Open URI -

HPSW Out of Service Rendering LPSW Inoperable 93-13-04 Open LPSW/ECCW Operability 93-13-03 Open ECCW System Design and Testing Enclosure

0I DUKE NUCLEAR POWER PLANT PERSONS CONTACTED

L. Azzarello, Mechanical Engineering

D. Coyle, Mechanical Systems Manager

J. Davis, Engineering Manager

W. Foster, Safety Assurance Manager R. Harris, Mechanical.Systems Engineering G. McAninch, Mechanical Systems Engineering

D. Nix, Regulatory Compliance

B. Peele, Station Manager

J. Smith, Regulatory Compliance U.S. Nuclear Regulatory Commission

P. Harmon, Senior Resident Inspector

• Peebles, Operations Branch Chief

K. Poertner, Resident Inspector

D. Prevatte, Powerdyne Corporation

W. Rogers, Team Leader

• Indicates those present at the exit meeting on December 9, 1994

Enclosure, Attachment A

LIST OF ACRONYMS AND ABBREVIATIONS ASME -

American Society of Mechanical Engineers CCW

-

Condenser Circulating Water CFR

-

Code of Federal Regulations DBD

-

Design Basis Document ECCW -

Emergency Condenser Cooling Water ESAE

-

Emergency Steam Air Ejector EWST -

Elevated Water Storage Tank FSAR -

Final Safety Analysis Report GPM

-

Gallons Per Minute HPI

-

High Pressure Injection HPSW -

High Pressure Service Water IR

-

Inspection Report

IST

-

Inservice Test

LCO

-

Limiting Condition for Operation

LER

-

Licensee Event Report

LOCA -

Loss of Coolant Accident

LOOP

-

Loss of Offsite Power

LPI

-

Low Pressure Injection

LPSW -

Low Pressure Service Water

NCV

-

Non-Cited Violation

PSIG -

Pounds per Square Inch Gauge

QC

-

Quality Control

QA

-

Quality Assurance

QSM -

Quality Standards Manual

RBCU

-

Reactor Building Cooling Unit

RCS

-

Reactor Coolant System

SLC

-

Selected Licensee Commitments

SITA -

Self Initiated Technical Audit

SWS

-

Service Water System

TS

-

Technical Specification

URI

-

Unresolved Item

VIO

-

Violation

Enclosure, Attachment B