IR 05000269/1999010
| ML15261A390 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 01/26/1999 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| To: | |
| Shared Package | |
| ML15261A389 | List: |
| References | |
| 50-269-99-10, 50-270-99-10, 50-287-99-10, NUDOCS 9902090077 | |
| Download: ML15261A390 (16) | |
Text
U.S. NUCLEAR REGULATORY COMMISSION REGION 11 Docket Nos:
50-269, 50-270, 50-287 License Nos:
DPR-38, DPR-47, DPR-55 Report Nos:
50-269/99-10, 50-270/99-10, 50-287/99-10 Licensee:
Duke Energy Corporation Facility:
Oconee Nuclear Station, Units 1, 2, and 3 Location:
7812B Rochester Highway Seneca, SC 29672 Dates:
November 2-6 and 16-20, 1998, and January 11-15, 1999 Inspector:
R. Schin, Senior Reactor Inspector Approved by:
K. Landis, Chief Engineering Branch Division of Reactor Safety Enclosure 9902090077 990126 PDR ADOCK 05000269
EXECUTIVE SUMMARY Oconee Nuclear Station, Units 1, 2, and NRC Inspection Report 50-269/99-10, 10-270/99-10, and 50-287/99-10 This routine inspection included follow-up on an open item regarding emergency feedwater (EFW) potential design vulnerabilitie Operations
A weakness in emergency operating procedures (EOPs) was identified in that EOP action steps were not written clearly or in a consistent format. (Section E8.1; [NEG: 1 B Poor])
A weakness in documenting the EOP basis was identified in that the Emergency Procedures Guideline (EPG) was not updated to include a 1995 EOP change and the EPG Reference Document was significantly out of date. (Section E8.1; [NEG: 1 B Poor])
Licensee actions to resolve a concern with poor operator access to the handwheel of Unit 3 EFW flow control valve FDW-316 were adequate. (Section E8.1; [POS: 5C Adequate])
0Engineerinq
Two unresolved items (URIs) were opened related to EFW system design control and 50.59 safety evaluations:
-
URI 50-269,270,287/99-10-01; EFW System was Designed to Fail During a Main Feedwater Line Break or Non-Seismic Pipe Break (Section E8.1)
-
URI 50-269,270,287/99-10-02; 10 CFR 50.59 Safety Evaluations Incorrectly Implemented the EFW Licensing Basis (Section E8.1)
Resolution of these unresolved items depends on an interpretation of the licensing basis of the EFW system by the NRC. The licensee expressed a different interpretation of the licensing basis, as stated in Section X Report Details 1. Engineering E8 Miscellaneous Engineering Issues E (Open) Inspector Followup Item (IFl) 50-269,270,287/98-08-05, EFW Potential Design Basis Issues Inspection Scope (92903, 37550)
IFI 50-269,270,287/98-08-05, remained open for further NRC review of five concerns with EFW potential design vulnerabilities: 1) a single active failure in the open position of valve C-187 coincident with a main feedwater line break causing a loss of EFW; 2) a main feedwater or auxiliary steam line break in the turbine building causing consequential failures of the EFW system and all three trains of safety-related 4160 volt electrical switchgear; 3) the.reliance on operator action to throttle EFW flow within three minutes while using non-safety related equipment and while the EFW pumps operate with insufficient net positive suction head (NPSH); 4) poor operator access to the handwheel of Unit 3 EFW flow control valve FDW-316; and 5) the licensee's basis for determining that the turbine-driven EFW pumps were operable on September 2, 199 The inspector followed up on these issue Observations and Findings 1)
Further NRC review of concern 1, a single active failure in the open position of valve C-187 coincident with a main feedwater line break, resulted in a preliminary determination that the EFW system was licensed to be able to function during a main feedwater line break and a single active failure, with one exception as described in b.2 below. However, the current design of the EFW system was not able to function during a main feedwater line break and a single active failure of valve C-187. Therefore, the current design was apparently contrary to the approved licensing basis of the EFW system - it represented a potential nonconforming condition and unreviewed safety question. The inspector assessed that current continued plant operation with this potentially nonconforming condition did not represent a significant safety concern because:
1) both a main feedwater line break and a failure of valve C-187 were low probability events, and 2) the licensee's emergency operating procedures could mitigate the event by providing secondary cooling water from another unit, the standby shutdown facility (SSF) auxiliary service water (ASW) pump, or the station ASW pump. Also, high pressure injection (HPI) feed and bleed cooling would be availabl Original Licensing Basis The inspector further reviewed the licensing basis and design history of the EFW system and valve C-187. The original EFW system for each unit included only one pump, which was turbine-driven. Based on NRC review of the EFW licensing and design documents, the inspector's preliminary determination was that, prior to 1979, the EFW system was required to be able to mitigate a main feedwater line break without consideration of a single failur Post-TMI Licensing Basis NUREG-0737 Item II.E.1.1, Auxiliary Feedwater System Evaluation, described the required post-TMI modification of the emergency feedwater (EFW) syste In a letter to the NRC dated May 17, 1979, the licensee stated the following about the Oconee post-TMI upgraded emergency feedwater (EFW) system:
"Sufficient redundancy and valving are provided in the design of the EFW piping system with isolation and cross-connections allowing the system to perform its safety-related function in the event of a single failure coincident with a secondary pipe break and the loss of normal station auxiliary AC power." In a letter to the NRC dated April 3, 1981, the licensee also stated the following about the upgraded EFW system design: "In the event of a postulated break in the main steam or main feed system, coupled with a single active failure of either one of the three emergency feedwater pumps, sufficient flow will occur to provide adeguate core cooling. Any single failure in the three pump-two flowpath EFW system design will not result in only one motor-driven EFW pump available. For a main feedwater line break upstream of the isolation check valve, the transient would have the same response as a loss of main feedwater. A break downstream of the check valve will cause the steam generator to blow down, but will be less severe than a steam line break transient due to less feedwater being delivered to the steam generators. The demand on the EFW system would be for decay heat and reactor coolant pump heat removal via the unaffected steam generator. One motor driven EFW pump has sufficient capacity to perform this function."
The Updated Final Safety Analysis Report (UFSAR) Section 10.4.7 description of the EFW system has included the above underlined statements about the system design since 198 The licensee's controlled design basis documents also incorporated these design requirements. The Design Basis Specification for the Emergency Feedwater and the Auxiliary Service Water Systems, Specification OSS 0254.00-00-1000, Revision 18, dated May 19, 1998, stated: "The EFW system shall be capable of withstanding any credible single failure during certain of the system design basis events." It further stated that the EFW system shall be designed for a main feedwater line break event, and that the main feedwater line break scenario requires consideration of any single active failur The inspector noted that Technical Specifications (TS) for secondary system decay heat removal also were consistent with the post-TMI EFW system design requirements, in that they addressed only EFW system pumps, flowpaths, and automatic initiation circuitry. During 1981 through 1998, TS 3.4, Secondary System Decay Heat Removal, required that three EFW pumps (one steam driven and two motor-driven), two EFW flowpaths, and the automatic initiation circuitry shall be operable for each unit. The TS 3.4 Bases stated: "The EFW system consists of a turbine-driven pump (880 gpm), two motor-driven pumps (450 gpm each), and associated flow paths to the steam generators." TS 3.4 did not address the ability to supply EFW from another unit, from the SSF ASW pump, or from the station ASW pum *
In a Safety Evaluation Report (SER) dated August 25, 1981, the NRC accepted the Oconee post-TMI EFW design and stated that, with respect to a main feedwater line break, "The system is designed so that a single active failure of any of the emergency feedwater pumps or valves will not prevent the operator from directing sufficient flow to the intact steam generator."
In 1979, the licensee installed modification ON 1,2,3-1275; Add Two Motor Driven EFW Pumps; to upgrade the EFW system per post-TMI requirement However, the modification incorrectly retained the original design of valves C-187 and C-176, which was to open and remain open on a low condenser hotwell level. As a result, in the event of a main feedwater line break, the contents of the upper surge tank (UST) would be dumped to the condenser hotwell and out through the break in about two minutes. (C-187 and C-176 were air-operated 12-inch valves in parallel 20-inch lines between the UST and the hotwel Licensee calculation OSC-5267, dated April 25, 1993, determined that there would be a flowrate of 18,963 gpm from the UST to the hotwell with C-187 and C-176 fully open. Also, the TS required minimum amount of water in the UST was 30,000 gallons. Dividing 30,000+ gallons by 18,963 gpm results in about two minutes.)
The inspector noted that control room operators would be expected to follo emergency operating procedures (EOPs) during the first several minutes of a main feedwater line break event and to not respond to the numerous individual alarms, such as a low UST level alarm. The EOPs focused operator attention on first ensuring that the reactor was safely shut down - EOPs included no immediate actions related to a low UST leve Since all three EFW pumps were designed to automatically start and take a suction from the UST, the result would be failure of the EFW system when the UST water was lost in about two minutes and probable damage to all EFW pumps. Industry experience has shown that multiple stage centrifugal pumps (like the EFW pumps), when pumping air or steam instead of water, can become damaged within a matter of seconds. The UFSAR stated that a loss of main feedwater or main feedwater line break event would result in the highest need for EFW to cool the reactor and thus would be design basis events for the EFW system. Thus the EFW system was designed so that it would fail during a main feedwater line break, when is was most neede Based on a review of the EFW licensing and design documents, the inspector's preliminary conclusion was that the 1979 EFW system modification failed to assure that regulatory requirements and the design basis were correctly translated into specifications and instructions, as required by 10 CFR 50, Appendix B, Criterion Ill, Design Control. The modification missed an opportunity to correct an existing design deficiency. The design subsequently remained in effect for over 14 years, until 1994. The licensee did not agree that this design was contrary to the approved licensing basis of the plant, for reasons as stated in Section X1 of this report. This issue will remain open and unresolved pending further NRC review. The issue will be identified as the first example of URI 50-269,270,287/99-10-01, EFW System was Designed to Fail During a Main Feedwater Line Break or Non-Seismic Pipe Brea *
Seismic Design Modification The UFSAR Section 3.2 description of seismic classifications stated that the upper surge tank and EFW pumps were required to be designed to withstand a seismic event. Section 3.2 did not require that the main condenser hotwell, condensate lines, or main feedwater lines be able to withstand a seismic even GL 81-14, Seismic Qualification of Auxiliary Feedwater Systems, described criteria for meeting seismic design requirements for the EFW system. In response to GL 81-14, the licensee stated in a letter dated May 7, 1986, that valves relied upon as single EFW seismic boundary valves would meet the existing EFW design criteria; in particular that the EFW system can "perform its safety-related function in the event of a single failure coincident with a secondary pipe break and the loss of normal station auxiliary AC power." The licensee also stated in that letter: "Two hotwell make-up line isolation valves are normally open (C-186, C-191). Modifications at this boundary will be made to protect EFW against single failure."
In 1989, in response to GL 81-14, the licensee installed modification ON 1,2,3 2640; EFW Seismic Upgrade. This modification made air-operated valve C-187 safety-related to support movig the EFW seismic boundary from normally open valves C-186 and C-191 to a single EFW boundary at normally closed valve C 187. The modification similarly made valve C-176 safety-related and a single seismic boundary valve. However, the modification failed to implement the design basis that EFW would be protected against a secondary pipe break or a single failure of a seismic boundary valve. The modification incorrectly left valves C-187 and C-176 designed to open on a low condenser hotwell level (that would result from a break in any of the non-seismic pipes connected to the hotwell or a break in the main feedwater line) and to consequently dump the UST water to the condenser hotwell and fail the EFW syste The EFW system was designed to fail during a non-seismic secondary pipe break which could occur during a seismic event. This design subsequently remained in effect for over four years, until 1994. Based on a review of the EFW licensing and design documents, the inspector's preliminary conclusion was that the 1989 EFW seismic upgrade modification failed to assure that regulatory requirements and the design basis were correctly translated into specifications and instructions, as required by 10 CFR 50, Appendix B, Criterion Ill, Design Control. The modification missed an opportunity to correct an existing design deficiency. The licensee did not agree that this design was contrary to the approved licensing basis of the plant., for reasons as stated in Section X1 of this report. This issue will remain open and unresolved pending.further NRC revie The issue will be identified as the second example of URI 50-269,270,287/99-10 01, EFW System was Designed to Fail During a Main Feedwater Line Break or Non-Seismic Pipe Brea Problem Investiqation Report (PIR)
Licensee PIR 4-89-0111, dated June 30, 1989, identified the condition wherein the loss of condenser hotwell level would result in automatic opening of valves C 187 and C-176, draining the UST to the hotwell, and losing the water supply to
- the EFW pumps. The licensee evaluated this condition as not affecting operability and not being reportable, and consequently did not report the condition to the NRC. The licensee's basis for operability was that they had recently assessed that the condenser hotwell and associated piping could withstand a seismic event even though they were not seismically designed. This assessment was based on application of Seismic Qualification Users Group (SQUG) seismic margin techniques. The licensee had concluded that there was no realistic seismic/non-seismic boundary between the UST and the hotwel In response to this PIR, the licensee isolated C-176 by closing a manual valve in series with it and left C-187 in service for operational reasons. The licensee subsequently continued to operate all three units for over four years with C-187 in service, and designed to cause the EFW system to fail during a main feedwater line break or a nonseismic pipe break, before taking corrective action in the form of a modificatio Based on a review of the EFW licensing and design documents, the inspector's preliminary conclusion was that the licensee's corrective action, as required by 10 CFR 50, Appendix B, Criterion XVI, Corrective Action, was not timely. The corrective action was also not complete, as described in the following paragrap In addition, the inspector concluded that the licensee's failure to report this condition, as required by 10 CFR 50.72 and 50.73, effectively denied the NRC an opportunity to be aware of the condition and to require more prompt or complete corrective action. The licensee did not agree that this design was t contrary to the approved licensing basis of the plant, that they were required to report the condition, or that they were required to correct it more promptly. The licensee's reasons for disagreement were as stated in Section X1 of this repor This issue will remain open and unresolved pending further NRC review. This issue will be identified as the third example of URI 50-269,270,287/99-10-01, EFW System was Designed to Fail During a Main Feedwater Line Break or Non Seismic Pipe Brea Corrective Action for 1989 PIR In 1993 and 1994, as corrective action for PIR 4-89-0111, the licensee installed modification ON 1,2,3-2911; UST Makeup to Hotwell Control Valves. ON 1,2,3 2911 modified air-operated valve C-187 to automatically close at a low UST level of seven feet to protect the EFW pumps' suction water source. The inspector assessed that this modification substantially improved the reliability of the EFW system. However, the modification left C-187 vulnerable to a single failure in that there was still a single C-187 valve with a single air solenoid valve actuator which could cause the EFW system to fail. Also, valve C-187 was still relied upon as a single EFW seismic boundary valv The licensee's probabilistic risk assessment (PRA) recognized that a single failure of valve C-187 was one of the top contributors to a potential EFW system failure. The PRA stated: "If a main feed line break is assumed, the UST could be drained into the hotwell, thereby failing EFW's initial suction source."
- Based on a review of the EFW licensing and design documents, the inspector's preliminary conclusion was that this modification did not completely correct the EFW system design nonconformance By leaving EFW vulnerable to a single failure of valve C-187, the modification increased the probability of occurrence of a malfunction of equipment important to safety (the EFW pumps and EFW system) over that previously evaluated in the safety analysis report. However, the licensee's 10 CFR 50.59 safety evaluations for the modification, which were dated December 30, 1993; April 7, 1994; and August 4, 1994; for units 3, 1, and 2, respectively, concluded that this modification did not involve an unreviewed safety question (USQ). These safety evaluations were missed opportunities to identify EFW system design nonconformances. The licensee did not agree that this design was contrary to the approved licensing basis of the plant, for reasons as stated in Section X1 of this report. This issue will remain open and unresolved pending further NRC review. This issue will be identified as the first example of URI 50-269,270,287/99-10-02, 10 CFR 50.59 Safety Evaluations Incorrectly Implemented the EFW Licensing Basi November 1998 UFSAR Revision On November 18, 1998, in response to these issues, the licensee approved a revision to the UFSAR. The revision, which was approved without prior NRC
.approval, no longer stated that the EFW system was designed to withstand the single failure of any EFW pump or valve. The approved UFSAR revision instead stated that the EFW system was designed to withstand only the single active failure of an EFW pump or flow control valve. The UFSAR was also changed to no longer require that the EFW system be able to mitigate a secondary pipe break coincident with a single failure. The approved UFSAR revision instead stated: "In the case of a secondary pipe break coincident with a single failure, the emergency feedwater function may be provided by another unit's EFW pumps, the SSF ASW pump, or the station ASW pump." However, the TS did not provide for reliance on these alternate sources of emergency feedwate Based on a review of the EFW licensing and design documents, the inspector's preliminary conclusion was that the UFSAR change involved a USQ in that it eliminated most of the single failure design requirements for the EFW syste Consequently, the change increased the probability of occurrence of a malfunction of equipment important to safety (the EFW pumps and EFW system)
over that previously evaluated in the safety analysis report. The UFSAR change also involved a change in TS, in that it invoked a reliance on equipment not currently addressed in TS for mitigation of design basis events. However, the licensee's 10 CFR 50.59 safety evaluation, dated November 18, 1998, concluded that this change did not involve a USQ or a change in the TS. The licensee did not agree that this UFSAR change was contrary to the approved licensing basis of the plant, for reasons as stated in Section X1 of this report. This issue will remain open and unresolved pending further NRC review. This issue will be identified as the second example of URI 50-269,270,287/99-10-02, 10 CFR 50.59 Safety Evaluations Incorrectly Implemented the EFW Licensing Basi Concern 1 is close )
Inspector followup of concern 2, a main feedwater or auxiliary steam line break in the turbine building causing consequential failures of the EFW system and all three trains of safety-related 4160 volt electrical switchgear, was discussed in inspection report (IR) 50-269,270,287/98-15. This concern involved an approved exception to the UFSAR statement that the EFW system could function during a main feedwater line break and a single active failure. In this exception, prior to December 1973, a main feedwater or auxiliary steam line break could disable the EFW system. After December 1973, this event would not disable the turbine driven EFW pump but could disable the automatic starting of the pump. This event also could disable the motor-driven EFW pumps, which were installed in 197 The results of that follow-up inspection included an apparent violation for an inadequate procedure for connecting alternate emergency power to a high pressure injection pump, an apparent violation with three examples of inadequate safety evaluations for changes to emergency operating procedures related to providing alternate emergency power to a high pressure injection pump, a violation involving failures to update the UFSAR description of the emergency feedwater system, and a weakness with the licensee's UFSAR Review Project in that it lacked the necessary thoroughness to identify the UFSAR update issue During this inspection, the inspector requested licensee records of adequately testing the HPI pumps of each unit when powered from the ASW switchgear to demonstrate that all of the related equipment (e.g., electrical breakers, cables, and connections) relied on to mitigate this event actually worked. The licensee recalled having performed such testing with one HPI pump in the past and may have tested others, but was unable to locate the test records during the inspection. New IFI 50-269,270,287/99-10-03, Testing HPI Pumps when Powered from ASW Switchgear, is opened to review the records obtained from the licensee's searc During a review of EOPs relied on to mitigate this event, the inspector noted that EP/1/A/1800/01, Emergency Operating Procedure, Rev. 26, included an immediate manual action that was not clearly wriften. EOP Step 4.1.3, which was the third immediate manual action following a reactor trip, stated "Verify seal injection or CC available." The purpose of the step was to refer operators to AP/0/A/1700/025, Standby Shutdown Facility Emergency Operating Procedure, and have them initiate reactor coolant pump (RCP) seal injection with the SSF makeup pump, if no RCP seal cooling was already being supplied. This action was required to be completed within 10 minutes to prevent an RCP seal loss of coolant accident (LOCA).
However, the required action, to initiate RCP seal injection, was not clearly stated. Also, the reference to AP/0/A/1700/025 was not included. The verb "verify" as defined in the licensee's EOP Writers Guide meant only to check.the status - it did not mean to initiate any followup actio Step 4.1.3 was not clearly written and deviated substantially from the licensee's EOP Writers Guide. The EOP Writers Guide had been established in response to a post-TMI action item requirement, to ensure that EOPs were written clearly and consistentl Through discussions with operators and training personnel, the inspector verified that operators had been properly trained on and were aware of the needed actions in response to EOP step 4. The inspector also noted that the licensee had added step 4.1.3 to the EOPs with Change 23 to EP/1/A/1800/01, Emergency Operating Procedure, dated December 5, 1995. The reason stated in Change 23 documentation for adding the step was "to provide a faster procedural prompt for this OMP 2-1 required memory action. Activation of the SSF must be performed within 10 minutes of a loss of seal injection to prevent RCP seal damage and a reactor coolant system (RCS) leak." The inspector reviewed Operations Management Procedure 2-1, Duties and Responsibilities of On Shift Operations Personnel. Enclosure 4.8, Procedural Items which all Licensed Operators Shall Have Committed to Memory, included three pages of items from EOPs and one page of items from OPs, PTs, etc. The OMP 2-1 required memory action for EOP step 4.1.3.was not included under items from EOPs, but was included under items from OPs, PTs, etc. The item stated: "If CC and HPI are lost to the RCPs, then establish RCP seal flow with the SSF Makeup Pump within 10 minutes." In response to inspector concerns about other EOP required actions that may not be written in the EOPs, the licensee verified that each item of the three pages of OMP 2-1 EOP memory items was actually stated in the EOP The inspector found that the action intended by EOP step 4.1.3 was written in different forms in other places in the EOPs. EP/1/A/1800/01 Subsequent Action 5.15 stated:
Evaluate the need to station personnel at the SSF:
-
Fire
-
Natural Disaster
-
Security Event
-
Loss of HPI and CC AP/1/A/1700/11, Loss of Power, Immediate Manual Action 4.1 stated:
IF CC and HPI Seal Injection are lost to the RCPs, THEN Establish RCP seal flow with the SSF Makeup Pump within 10 minute REFER TO AP/0/A/1700/25, STANDBY SHUTDOWN FACILITY EMERGENCY OPERATING PROCEDURE The inspector noted that each of these steps was written in a different format and that only one, AP/1/A/1700/11 step 4.1, followed the EOP Writers Guid The licensee did not consider the writing in Step 4.1.3 to be a deficiency and had not written a Problem Investigation Process report (PIP) or entered this issue into the corrective action program. However, they had previously identified Step 4.1.3 for enhancement and showed the inspector the plans to change the
- wording to more closely conform to the EOP Writers Guide during the next procedure revisio The inspector noted that another example of operator action steps not being clearly written in the EOPs had been recently identified by the NRC and documented in NRC Examination Report 50-269,270,287/98-301, dated December 24, 1998. In that example, the EOPs did not clearly direct operators to trip RCPs more that two minutes after a loss of RCS subcooling margi However, operators followed training guidance to perform that action during simulator drill The inspector concluded that these examples represented a weakness in EOPs in that certain action steps were not written clearly or in a consistent format. IFI 50-269,270,287/99-10-04, EOP Steps Not Written Clearly or in a Consistent Format, is opened for further followup of this concern and for further review of the related regulatory requirements. Concern 2 is close )
The inspector followed up on concern 3, the licensee's reliance on operator action to throttle EFW flow within three minutes while using non-safety related equipment and while the EFW pumps operate with insufficient NPSH. Further NRC review determined that the NRC had accepted, in a Safety Evaluation Report (SER) dated August 25, 1981, an EFW design reliance on manual operator action to respond to a main steam or feedwater line break coupled with a single active failure. The description of this operator action included no time limitations. Therefore, the licensee's reliance on operator action within three minutes was determined to be within the licensing basis of the plant. In 1986, the licensee recognized that this throttling action would need to be accomplished very quickly to avoid EFW pump damage due to runout during a main steam line break. The NRC was aware of this new information through a 1986 EFW Safety System Functional Inspection (SSFI) and through LER 50-269/86-10, Potential for Loss of Emergency Feedwater Due to Pump Runout for Certain Transient To perform the throttling action, the operators would use the air-operated EFW flow control valves. However, the air operators for these valves were not safety related, as correctly stated in the UFSAR. The NRC was aware that the air operators were not safety-related and were not designed to withstand a seismic event. (At Oconee, all equipment that was safety-related was also designed to withstand a seismic event.) In a 1986 SER on the seismic design of the EFW system, the NRC accepted the fact that the air supplies to the EFW flow control valves were not seismically designed. Instead, the NRC required the licensee to perform an analysis or inspection of the air supplies to assure that they appeared sufficiently rugged to withstand a seismic event. In summary, the inspector concluded that the fact that the air operators and air supply for the EFW flow control valves were not safety-related was within the plant licensing basi The inspector noted that the licensee's reliance on EFW pumps operating at runout during a main steam line break event was essentially mitigated by the main steam line break protection instrumentation. That instrumentation would stop the turbine-driven EFW pump at a low steam generator pressure of 500 psig and protect the pump from operating at runout. The ability of the motor-
driven EFW pump supplying the faulted steam generator to operate at runout was previously addressed by violation 50-269,270,287/98-09-01, No QA Records to Assure the Ability of EFW Pumps to Operate at Runout. New IFI 50-269,270, 287/99-10-05, Ability to Throttle EFW Within Three Minutes, is opened for further NRC review of the licensee's ability to throttle EFW within three minute Concern 3 is close )
The inspector followed up on concern 4, poor operator access to the handwheel of Unit 3 EFW flow control valve FDW-316. In response to this concern, the licensee instructed operators to use a safety harness when operating the handwheel of this valve and permanently stationed a safety harness near the valve. Also, all non-licensed operators received training in the proper use of a safety harness. During this inspection, an operator demonstrated his ability to safely climb to the valve while wearing a safety harness and anti-contamination clothing. The operator also demonstrated his ability to appropriately tie off the safety harness such that he could operate the valve with both hands. Licensee safety personnel determined that this climbing was reasonably safe and within the site personnel safety rules. The inspector concluded that the licensee's corrective actions were adequate. Concern 4 is close )
The inspector followed up on concern 5, the licensee's basis for determining that the turbine-driven EFW pumps were operable on September 2, 1998. The licensee decided to rely on the main steam line break protection instrumentation and to add that to the licensing and design basis of the plant, and documented that decision in PIP 0-098-4124. The PIP stated that a new calculation to support this decision should be documented. A new IFI is opened to track the licensee's planned submission of a license amendment request: IFI 50-269,270, 287/99-10-06, Licensing Basis Revision to Credit Main Steam Line Break Protection Circuit for Protecting Turbine-Driven EFW Pump From Insufficient Net Positive Suction Head. Concern 5 is close Conclusions IFI 50-269,270,287/98-08-05, EFW Potential Design Basis Issues, had five open concerns. This IFI and each of the five concerns were closed and several new items were opened as described below:
Concern 1; a single active failure in the open position of valve C-187 coincident with a main feedwater line break causing a loss of EFW, was closed and replaced with two new URIs. The two new URIs are: URI 50-269,270,287/99 10-01; EFW System was Designed to Fail During a Main Feedwater Line Break or Non-Seismic Pipe Break and URI 50-269,270,287/99-10-02; 10 CFR 50.59 Safety Evaluations Incorrectly Implemented the EFW Licensing Basi Concern 2; a main feedwater or auxiliary steam line break in the turbine building causing consequential failures of the EFW system and all three trains of safety related 4160 volt electrical switchgear; was previously addressed in IR 50-269, 270,287/98-15. That IR identified two apparent violations, one violation, and one weakness. This inspection opened IFI 50-269,270,287/99-10-03, Testing HPI Pumps when Powered from ASW Switchgear, to review the records obtained
from the licensee's search. A weakness in writing EOPs was identified in that action steps were not written clearly or in a consistent format. Also, a weakness in documenting the EOP basis was identified in that the Emergency Procedures Guideline (EPG) was not updated to include a 1995 EOP change and the EPG Reference Document was significantly out of date. IFI 50-269,270,287/99-10-04, EOP Steps Not Written Clearly or in a Consistent Format, was opened for further followup of this concern and for review of the related regulatory requirement Concern 2 was close Concern 3; the reliance on operator action to throttle EFW flow within three minutes while using non-safety related equipment and while the EFW pumps operate with insufficient NPSH; was closed. IFI 50-269,270,287/99-10-05, Ability to Throttle EFW Within Three Minutes, was opened for further NRC review of the licensee's ability to throttle EFW within three minute Concern 4; poor operator access to the handwheel of Unit 3 EFW flow control valve FDW-316; was closed. Licensee actions to resolve this concern were adequat Concern 5; the licensee's basis for determining that the turbine-driven EFW pumps were operable; was closed. IFI 50-269,270,287/99-10-06, Licensing Basis Revision to Credit Main Steam Line Break Protection Circuit for Protecting Turbine-Driven EFW Pump From Insufficient Net Positive Suction Head, was opened to track the licensee's planned license amendment reques II. Management Meetings X1 Exit Meeting Summary The inspectors presented the inspection results to members of licensee management on November 20, 1998, and January 14, 1999. No proprietary information was identified to the inspector The licensee had dissenting comments related to URI 50-269,270,287/99-10-01, EFW System was Designed to Fail During a Main Feedwater Line Break or Non-Seismic Pipe Break and URI 50-269,270,287/99-10-02, 10 CFR 50.59 Safety Evaluations Incorrectly Implemented the EFW Licensing Basis. The licensee did not agree with the inspector's preliminary conclusions regarding the licensing basis of the. EFW system, for the following reasons: The diversity of the Oconee design includes alternate methods of providing emergency cooling water to the once-through steam generators (OTSGs),
including EFW from other units, lake water from the "tornado" station auxiliary service water (ASW). pump, and lake water from the standby shutdown facility (SSF) ASW pump. Therefore, the safety function of secondary cooling was designed to withstand a single failur The August 25, 1981, NRC SER on the upgraded EFW system focused on the new EFW flowpaths, from the two new motor-driven EFW pumps to the OTSGs,
and did not require that the old EFW suction sources be designed against a single failure. The SER stated that, in the event of a main feedwater line break,
"The (EFW) system is designed so that a single active failure of any of the emergency feedwater pumps or valves will not prevent the operator from directing sufficient flow to the intact steam generator." The licensee contended that the word "valves" in that statement referred only to the two EFW flow control valves on the discharge side of the EFW pump The NRC approved the EFW system design with recognition that it was not designed to be single failure proof for three events: high energy line break, turbine building flood, and tornad Partial List of Persons Contacted Licensee L. Azzerello, Design Basis Engineering Manager E. Burchfield, Regulatory Compliance manager T. Coutu, Operations Superintendent J. Forbes, Station Manager W. Foster, Safety Assurance Manager W. McCollum, Site Vice President, Oconee Nuclear Station M. Nazar, Manager of Engineering NRC D. Billings, Resident Inspector E. Christnot, Resident Inspector S. Freeman, Resident Inspector K. Landis, Chief, Engineering Branch, Division of Reactor Safety V. McCree, Deputy Director, Division of Reactor Safety M. Scott, Senior Resident Inspector Other licensee employees contacted during the inspection included engineers, operators, regulatory compliance personnel, and administrative personne Inspection Procedures Used IP 37550:
Engineering IP 92903:
Followup - Engineering
Items Opened, Closed, and Discussed Opened Item Number Type Description and Reference 50-269,270,287/99-10-01 URI EFW System was Designed to Fail During a Main Feedwater Line Break or Non-Seismic Pipe Break (Section E8.1)
50-269,270,287/99-10-02 URI 10 CFR 50.59 Evaluations Incorrectly Implemented the EFW Licensing Basis (Section E8.1)
50-269,270,287/99-10-03 IFI Testing HPI Pumps when Powered From ASW Switchgear (Section E8.1)
50-269,270,287/99-10-04 IFI EOP Steps Not Written Clearly or in a Consistent Format (Section E8.1)
150-269,270,287/99-10-05 IFI Ability to Throttle EFW Within Three Minutes (Section E8.1)
50-269,270,287/99-02-06 IFI Licensing Basis Revision to Credit Main Steam Line Break Protection Circuit for Protection of the TD EFW Pump From Insufficient NPSH (Section E8.1)
Closed Item Number Type Description and Reference 269,270,287/98-08-05 IFI EFW Potential Design Basis Issues (Section E8.1)
Discussed Item Number Type Description and Reference None List of Acronyms AC
- Alternating Current ASW
- Auxiliary Service Water CC
- Component Cooling EFW
- Emergency Feedwater
.
- Emergency Operating Procedure HPI
- High Pressure Injection IFI
- Inspector Followup Item IR
- Inspection Report
LER
- Licensee Event Report LOCA
- Loss of Coolant Accident NPSH
- Net Positive Suction Head OP
- Operating Procedure PIP
- Problem Investigation Proces PT
- Performance Test PRA
- Probabilistic Risk Analysis RCP
- Reactor Coolant Pump RCS
- Quality Assurance SER
- Safety Evaluation Report SQUG
- Seismic Qualification Utility Group SSF
- Standby Shutdown Facility SSFI
- Safety System Functional Inspection TS -.
- Technical Specifications UFSAR
- Updated Final Safety Analysis Report URI
- Unresolved Item USQ
- Unreviewed Safety Question IST
- Upper Surge Tank