IR 05000269/2002015
| ML023250552 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 11/21/2002 |
| From: | Plisco L Division Reactor Projects II |
| To: | Rosalyn Jones Duke Energy Corp |
| References | |
| EA-02-243 IR-02-015 | |
| Download: ML023250552 (24) | |
Text
November 21, 2002
SUBJECT:
OCONEE NUCLEAR STATION - NRC INSPECTION REPORT 50-269/02-15, 50-270/02-15, AND 50-287/02-15; PRELIMINARY WHITE FINDING
Dear Mr. Jones:
On November 8, 2002, the NRC completed an inspection at your Oconee Nuclear Station. The enclosed report documents the inspection findings which were discussed on November 13, 2002, with you and other members of your staff.
The inspection examined activities conducted under your licenses as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of your licenses. The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel.
Section 4OA2 of the enclosed report discusses the inadequate installation of connectors on the Unit 3 high pressure injection (HPI) pump emergency power supply cable from the auxiliary service water (ASW) switchgear. Using the significance determination process (SDP), this issue was preliminarily determined to be White (i.e., an issue with some increased importance to safety, which may require additional NRC inspection). As indicated in the attached Phase 3 SDP Analysis, the issue appears to have a low to moderate safety significance because of the potential impact the loose connectors would have on the ability to utilize a Unit 3 HPI pump during high energy line break and/or tornado event recovery.
One apparent violation of Technical Specification 5.4.1 was identified regarding this issue. It involved the failure to properly implement the vendors written instructions for attaching the electrical connectors on the Unit 3 HPI pump emergency power supply cable from the ASW switchgear. This apparent violation is being considered for escalated enforcement action in accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions - May 1, 2000" (Enforcement Policy), NUREG-1600.
Before the NRC makes a final decision in this matter, we are providing you an opportunity to request a Regulatory Conference where you would be able to provide your perspectives on the significance of the issue, the bases for your position, and whether you agree with the apparent violation. If you choose to request a Regulatory Conference, we encourage you to submit your evaluation and any differences with the NRC evaluation at least one week prior to the conference in an effort to make the conference more efficient and effective. If a conference is
DEC held, it will be open for public observation. The NRC will also issue a press release to announce the conference.
Please contact Mr. Robert Haag at (404) 562-4550 within 7 days of the date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision and you will be advised by separate correspondence of the results of our deliberations on this matter.
Since the NRC has not made a final determination in this matter, a Notice of Violation is not being issued at this time. In addition, please be advised that the number and characterization of the apparent violation may change as a result of further NRC review.
In accordance with 10 CFR 2.790 of the NRCs "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
/RA/
Loren R. Plisco, Director Division of Reactor Projects Docket Nos.: 50-269, 50-270, 50-287 License Nos.: DPR-38, DPR-47, DPR-55
Enclosure:
NRC Inspection Report 50-269/02-15, 50-270/02-15, and 50-287/02-15 w/Attachments - (1) Supplemental Information; (2) Phase 3 SDP Analysis; (3) Recovery Consideration; and (4) Dominant Tornado Cutsets
REGION II==
Docket Nos:
50-269, 50-270, 50-287 License Nos:
DPR-38, DPR-47, DPR-55 Report No:
50-269/02-15, 50-270/02-15, 50-287/02-15 Licensee:
Duke Energy Corporation Facility:
Oconee Nuclear Station, Units 1, 2, and 3 Location:
7800 Rochester Highway Seneca, SC 29672 Dates:
October 28, 2002 - November 8, 2002 Inspectors:
M. Shannon, Senior Resident Inspector S. Freeman, Resident Inspector E. Christnot, Resident Inspector Approved by:
Robert Haag, Chief Reactor Projects Branch 1 Division of Reactor Projects Enclosure
SUMMARY OF FINDINGS IR 05000269-02-15, IR 05000270-02-15, IR 05000287-02-15, Duke Energy Corporation, 10/28/2002 - 11/08/2002, Oconee Nuclear Station; Identification and Resolution of Problems.
The inspection was conducted by the resident inspectors. The inspectors identified one finding (preliminarily determined to be White), which was identified as an apparent violation. The significance of most findings is indicated by their color (Green, White, Yellow, Red) using the Significance Determination Process (SDP) found in Inspection Manual Chapter 0609. Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight Process, Revision 3, dated July 2000.
A.
Inspector Identified Findings Cornerstone: Mitigating Systems
(TBD). The inspectors identified an apparent violation of Technical Specification 5.4.1 involving the failure to properly implement the vendors written instructions for attaching the electrical connectors on the Unit 3 high pressure injection (HPI) pump emergency power supply cable from the auxiliary service water switchgear.
This issue preliminarily appears to have a low to moderate safety significance because of the potential impact the loose connectors would have on the ability to utilize a Unit 3 HPI pump during high energy line break and/or tornado event recovery. (Section 4OA2)
B.
Licensee Identified Violations None
Report Details 4. OTHER ACTIVITIES 4OA2 Identification and Resolution of Problems a.
Inspection Scope The inspectors performed an in-depth review of an issue that was entered into the licensees corrective action program via Problem Investigation Process report (PIP)
O-02-02972, Failure of High Pressure Injection (HPI) Pump Emergency Power Cable.
The sample selected was within the cornerstone of Mitigating Systems and involved a risk significant system. The inspectors reviewed the actions taken to determine if the licensee had adequately addressed the following attributes:
Complete, accurate, and timely identification of the problem
Evaluation and disposition of operability and reportability issues
Consideration of previous failures, extent of condition, generic or common cause implications
Prioritization and resolution of the issue commensurate with the safety significance
Identification of the root cause and contributing causes of the problem
Identification and implementation of corrective actions commensurate with the safety significance of the issue
Evaluation and disposition of performance issues associated with maintenance effectiveness, including maintenance errors, maintenance practices, work controls, and risk assessment.
b.
Findings
Introduction: The inspectors identified an apparent violation (AV) for the failure to adequately implement the vendors written instructions for attaching the "Elastimold" electrical connectors on the "Black" and "Red" phases of the Unit 3 HPI pump emergency power supply cable from the auxiliary service water (ASW) switchgear.
Consequently, by failing to provide reasonable assurance that the pre-staged HPI pump emergency power supply cable would be available for high energy line break (HELB)
and/or tornado event recovery, this issue was preliminarily determined to be White (i.e.,
an issue with some increased importance to safety, which may require additional NRC inspection).
Description: HELB and tornado event recoveries take credit for the ability to connect a pre-staged 4160 volt alternating current (VAC) emergency power supply cable from the ASW switchgear to an HPI pump after a loss of the associated units essential (colored)
electrical busses and necessary standby shutdown facility (SSF) functions. Providing power and utilizing an HPI pump in such a fashion is addressed in: Section 3.2.2 of the Updated Final Safety Analysis Report (UFSAR); Section 4 of Abnormal Procedure AP/0/1700/006, Natural Disaster; and the Blackout Section of EP/1,2,3/A/1800/001, Emergency Operating Procedure. Critical actions to start an HPI pump need to be performed within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> for an HELB event and 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> for a tornado event.
On May 30, 2002, during maintenance activities, the connector on the "Black" phase of the Unit 3 pre-staged emergency HPI pump power supply cable fell off in a maintenance technicians hand when he picked up the cable. Upon further examination, he also identified that the "Red" phase connector was loose. When disassembled, the Black connector was found to be damaged (i.e., socket end spread apart and showing signs of heating). Had it been necessary to operate the Unit 3 HPI pump during the HELB or tornado event recoveries, the two cable connectors would have overheated and likely failed, causing loss of the HPI pump function. Overheating would have been caused by the lack of mating surfaces between the male and female ends of the connectors and the resulting higher resistance for electrical current flow. The inspectors concluded that both ends of the connector would have to be replaced based on the damage that would likely have occurred. Furthermore, the associated HPI pump motor could have been damaged due to overheating caused inbalance between the three electrical phases or the ASW switchgear protective circuitry could have isolated the HPI motor from the switchgear; also causing a loss of function of the HPI pump.
In addition to correcting the problem in Unit 3, the licensee also inspected the corresponding cable connectors in Units 1 and 2; no further problems were identified.
The licensee stated that their root cause determination was still ongoing, although associated PIP O-02-02972 stated that the damage observed on the Black connector was consistent with improper handling or storage of the cable. Based on inspector observations made during the disassembly of the Unit 3 Red and Yellow phase cable connectors on October 10, 2002, the inspectors determined that: (1) because of the connector design, they could only be damaged/loose if they were not properly installed on the cable (i.e., plug end not fully screwed on the socket end of the connector); (2)
given the cable storage location, it would be highly unlikely that anyone could damage the cable connectors by standing on them; and (3) because the Unit 3 cable was last used during an operational HPI pump run on April 17, 2000, and there was no other recorded maintenance or use of the cable, the connectors on the Black and Red phases had probably been loose (i.e., held in place, but not screwed on) for a significant period of time and the damage to the Black phase connector occurred during the operational pump run. Consequently, an apparent violation of Technical Specification (TS) 5.4.1 has been identified for the inadequate installation of the cable connectors.
Analysis: A HELB (i.e., a failure of adjacent main feedwater or auxiliary steam lines)
could cause all three colored buses to fail. This would result in the loss all HPI charging/reactor coolant pump (RCP) seal injection, motor driven emergency feedwater (EFW), low pressure injection (LPI), residual heat removal (RHR), and component cooling water to the RCP thermal barriers; thereby, requiring the SSF to be placed into service for RCP seal cooling. Subsequent failure of the SSF (either through failure of its diesel or the associated Unit 3 reactor coolant makeup pump) could result in a small RCP seal loss of coolant accident (LOCA) and the need to makeup the loss by utilizing an HPI pump powered from the ASW switchgear. Consequently, if the HPI pump is not put into service within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, core damage occurs.
Similar to the above, a tornado could also fail the electrical feeders to the colored buses, but leave Keowee hydro units (the emergency power supply) intact. As directed by procedures for a loss of all RCP seal cooling, operators would then take action to place the SSF into service. Subsequent failure of the SSF diesel would require that operators move to
the HPI/tornado pump strategy for secondary side heat removal and RCS makeup to avert core damage. In this scenario, a RCP seal LOCA doesnt occur; but, reactor coolant system (RCS) makeup via an HPI pump powered from the ASW switchgear is necessary to compensate for the resulting RCS shrinkage inherent to placing the tornado pump in service. Consequently, if the HPI pump is not put into service within 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, core damage occurs.
For the one year period that was assessed (1/2 exposure time since April 2000 to May 2002), the change in core damage frequency (CDF), accounting for recovery 80 percent of the time, was preliminarily estimated to be 4E-6 (2.7E-6 [HELB] + 1.3E-6 [TORNADO]).
(See Attachment 2 - Phase 3 SDP Analysis.)
Enforcement: TS 5.4.1 requires that written procedures shall be established, implemented, and maintained as recommended in Regulatory Guide 1.33, Revision 2, Appendix A, February 1978. Regulatory Guide 1.33, Section 9, Procedures for Performing Maintenance, requires that maintenance which can affect the performance of safety-related equipment should be properly preplanned and performed in accordance with written procedures, documented instructions, or drawings appropriate to the circumstances. Contrary to these requirements, at some time prior to April 17, 2000, the licensee failed to adequately implement the vendors written instructions for attaching the "Elastimold" electrical connectors on the "Black" and "Red" phases of the Unit 3 HPI pump emergency power supply cable from the ASW switchgear.
Consequently, on May 30, 2002, the "Elastimold" connectors on these two phases were found to be improperly installed (i.e., not screwed on or loose), leading to observed damage on the "Black" phase connector and possible loss of HPI pump function during high energy line break/tornado event recovery. Pending final significance determination, this failure to meet TS 5.4.1 is identified as AV 50-287/02-15-01: Inadequate Installation of HPI Pump Emergency Power Cable Connectors.
4OA6 Management Meetings Exit Meeting The inspectors presented the inspection results to Mr. R. Jones, Site Vice President, and other members of licensee management at the conclusion of the inspection on November 13, 2002. The licensee acknowledged the findings presented.
The inspectors asked the licensee whether any of the material examined during the inspection should be considered proprietary. No proprietary information was identified.
Attachment 1 SUPPLEMENTAL INFORMATION PARTIAL LIST OF PERSONS CONTACTED Licensee T. Curtis, Reactor and Electrical Systems Engineering Manager G. Edens, Maintenance Support Engineer B. Hamilton, Station Manager R. Jones, Site Vice President L. Nicholson, Regulatory Compliance Manager B. Spear, System Engineer NRC W. Rogers, Senior Reactor Analyst, Region II ITEMS OPENED, CLOSED, AND DISCUSSED Opened 50-287/02-15-01 AV Inadequate Installation of HPI Pump Emergency Power Cable Connectors (Section 4OA2)
Opened and Closed None Previous Items Closed None Items Discussed None LIST OF ACRONYMS ASP
-
Accident Sequence Precursor AV
-
Apparent Violation CFR
-
Code of Federal Regulations CDF
-
Core Damage Probability DEC
-
Duke Energy Corporation
-
-
Emergency Operating Procedure ESF
-
Engineered Safety Feature HELB
-
-
High Pressure Injection LOCA
-
Loss of Coolant Accident LPI
-
Low Pressure Injection NRC
-
Nuclear Regulatory Commission ONS
-
Oconee Nuclear Station PIP
-
Problem Investigation Proess report PORV
-
Power Operated Relief Valve PRA
-
Probabilistic Risk Assessment RCP
-
Reactor Coolant Pump RCS
-
-
Reactor Coolant Makeup SDP
-
Significance Determination Process SPAR
-
Standardized Plant Analysis Risk SSC
-
Structure, System and Component SSF
-
Standby Shutdown Facility TS
-
Technical Specification UFSAR
-
Updated Final Safety Analysis Report VAC
-
Volts Alternating Current
Attachment 2 Phase 3 SDP Analysis - Oconee HPI Pump Auxiliary Service Water Switchgear Cables I.
Background: As a result of tornados of F2 and greater intensity, offsite power and the normal electrical buses (called the colored buses) powering the engineered safety features (ESF) equipment may be damaged and out of service. The colored buses are susceptible to tornados since their feeder cabling and the buses themselves are located in the unprotected turbine building. Consequently, two accident mitigation strategies could protect against core damage. One is placing the standby shutdown facility (SSF)
into service. The SSF is an independent facility capable of withstanding a tornado, and it provides secondary side heat removal to either or both steam generators, reactor coolant pump (RCP) seal cooling, maintains pressurizer level, and maintains a steam bubble in the pressurizer. All of these functions allow for the unit to remain in hot shutdown with adequate core cooling via natural circulation, provided the reactor coolant system (RCS) remains intact with only minimal RCP seal leakage (<26 gpm total). The key equipment for accomplishing these individual functions are:
the SSF auxiliary service water (ASW) pump taking suction from Lake Keowee via the condenser circulating water header and injecting the lake water into the shell side of either or both steam generators (secondary side heat removal)
the reactor coolant makeup (RCM) pump taking suction from either borated water storage tank or the spent fuel pool and providing RCP seal injection via the normal piping (RCP seal injection/maintains pressurizer level)
a separate bank of heaters in the pressurizer (maintain steam bubble)
a diesel generator housed within the SSF that powers all the equipment/
components
The second strategy involves using a high pressure injection (HPI) pump for RCS makeup and the station ASW (tornado) pump for secondary side heat removal. In this strategy, the Keowee hydro-electric station is the power source for the two pumps and must survive the effects of the tornado. Even though the colored (normal ESF)
electrical buses that power the HPI pumps are out of service, there is the capability to power a HPI pump from the ASW switchgear, provided a Keowee unit is operational.
The power from Keowee passes through a tornado protected circuit (underground cabling and transformer CT-4) to the standby bus (housed in a tornado proof structure),
which is upstream of the colored buses. The standby bus powers the ASW switchgear located in the tornado protected portion of the auxiliary building. To power the HPI pump, the normal motor leads must be disconnected and three leads (one for each phase) from the ASW switchgear must be physically attached to the pumps motor. The tornado pump is already hardwired to the ASW switchgear. The tornado pump is a high capacity/low head pump; therefore, requiring the secondary side of the steam generators to be depressurized to operate. Consequently, the HPI pump is needed for makeup due to RCS shrinkage caused by steam generator depressurization and subsequent cooldown.
Either one of these two strategies would also be used following a high energy line break (HELB) that failed all the "colored" buses for that unit.
On May 30, 2002, during maintenance activities, the Elastimold plug/connector on the
"Black" phase of the Unit 3 pre-staged emergency HPI pump power supply cable fell off in a maintenance technicians hand when he picked up the cable. Upon further examination, he also identified that the "Red" phase connector was loose. The licensee initially attributed these failures to mishandling or improper storage of the cables. The cable had been last tested in April 2000. The licensee stated in the condition adverse to quality report that "If the connector body is stepped on or grasped too close to the cable entrance to the connector, the socket could be sprung open as observed. This would have caused the observed heat damage to the [Black phase] socket." The licensee also stated that "The observed damage to the missing [Black phase] pull-ring and bent socket in the crimp lug is consistent with improper handling or storage." The licensee also identified that the wrong lug size had been used in the connector.
Had it been necessary to operate the Unit 3 HPI pump for any length of time, the two cable connectors would have likely overheated and failed causing loss of the HPI pump function. Overheating would likely have affected both male and female ends of the connectors, requiring replacement of both. Also, the motor or switchgear could have been damaged causing a loss of function of the HPI pump. One of the connectors (Black phase) could have failed on pump start based on the as-found description of it falling off. The other connector (Red phase) could have failed while the pump was running due to its loose condition. The proper parts were not available on site to repair connectors.
The licensee's engineer concluded in the condition adverse to quality report that "I would classify it as not suitable for service as it might fail if used more than a few hours."
Performance Deficiency - The inspectors concluded that the as-found condition of the connectors was a result of the connectors not being properly installed (i.e, two parts of connector not being fully screwed together). By not following the written vendor instructions for proper cable connector installation (which dircets that the two parts of the connector be threaded together until the rotating piece can no longer be turned), the licensee failed to provide reasonable assurance that the pre-staged emergency power supply cable from the auxiliary service water switchgear to an HPI pump would be available for HELB and/or tornado event recovery.
Exposure Time - one year (1/2 exposure time since April 2000 to May 2002)
Date of Occurrence - unknown II.
Safety Impact: White
III.
Risk Analysis/Considerations Assumptions:
1.
Basic event BHPOASWDHE will be the surrogate for the performance deficiency. Base case value is 6E-2.
2.
Recovery credit is credible. (See Attachment 3 - Recovery Consideration)
3.
Two initiating events of primary concern. These are a HELB causing a failure of the "colored" buses on Unit 3 and a tornado of varying intensity affecting the site.
4.
The HPI pump can only mitigate small break RCP seal LOCAs or stuck open pressurizer safety valves and to support the station ASW pump (tornado pump).
5.
High temperature RCP seals or their equivalent are installed.
Probabilistic Risk Analysis (PRA) Model used for basis of the risk analysis: Licensee full scope model was used for the tornado initiator. Standardized Plant Analysis Risk (SPAR) does not model external events. No high energy line break initiator exists in the Phase II notebook. Therefore, a HELB failing the 4160 Vac essential buses was developed. Initiating frequency was derived from a 1999 Accident Sequence Precursor (ASP) analysis for this particular break. Basic event data was derived from updated licensee basic event information. The event tree was developed from an understanding of plant and operator responses based upon emergency operating procedures (EOPs)
and a 1999 ASP analysis. A specially designed SPAR with accompanying analysis used in the "ASP analysis of February 1999 Operational Condition at Oconee" dated September 18, 2001, was used as a confirmatory evaluation for the high energy line break analysis.
Significant Influence Factor(s) [if any]: The capability to recover the HPI function before the onset of core damage.
IV.
Calculations A.
BASE CASE The dominant accident sequences were:
HELB [3.5E-4]* OA/DG SSF [.24] * LOCA [.21] * -SLOCA [.69] * HPI [6E-2] =
7.3E-7 The main feedwater line or the auxiliary steam line adjacent to the "colored" buses fails causing all three colored buses to fail (lose all HPI, charging, motor driven EFW, LPI, RHR, component cooling water) [HELB]. Initially, the turbine driven EFW pump successfully operates and provides secondary side heat
removal [-EFW]. This also keeps RCS pressure below the setpoint for the pressure relief devices (i.e., power operated relief valve (PORV) & code safeties). However, with the loss of HPI/charging (RCP seal injection) and component cooling (RCP thermal barrier cooling), plant procedures direct the operators to place the SSF into service. In this sequence operators proceed to place the SSF into service before a RCP seal LOCA occurs. However, operators are not successful or the SSF diesel generator fails to start or run (most likely the diesel fails to run) [OA/DG SSF]. Consequently, a RCP seal LOCA ensues consistent with the assumptions of the Rhodes model (seal LOCA approx. 20%
of the time) [LOCA]. To mitigate the RCS inventory loss due to the seal LOCA, an HPI pump must be placed into service. Also, the seal LOCA must be a small seal LOCA for a HPI pump to makeup the loss [-SLOCA]. This is estimated at 69% of the time, given a seal LOCA has occurred. To place the HPI pump into service it must be powered from the ASW switchgear which requires the motor rewiring and other operator actions. In this sequence operators fail to place the HPI pump into service [HPI] resulting in core damage.
HELB [3.5E-4] * -OA/DG SSF [.76] * SSFRCM [7.2E-2] * LOCA [.21] * -SLOCA
[.69] * -SSFASW [.92] * HPI [6E-2] = 1.53E-7 In this accident sequence, the same high energy line break failing the colored buses occurs, requires the SSF to be placed into service. The SSF is placed into service and everything works except the SSF RCM pump (dominant failure includes operators fail to put it in service properly, filters clogging, and the pump failing to start or out of service for maintenance). With its failure, a small seal LOCA ensues, just like in the accident sequence above. Therefore, the HPI pump powered from the ASW switchgear is needed. Consequently, the HPI pump is not placed into service, resulting in core damage.
NON-CONFORMING CASE In the non-conforming case the base case HPI failure probability of 6E-2 is altered to always failing or 1.0.
HELB [3.5E-4] * OA/DG SSF [.24] * LOCA [.21] * -SLOCA [.69] * HPI [1] =1.2E-5 HELB [3.5E-4] * -OA/DG SSF [.76] * SSFRCM [7.2E-2] * LOCA [.21] * -SLOCA
[.69] * -SSFASW [.92]* HPI [1] = 2.55E-6 Conformation using the ASP 1999 event tree - For the major accident sequence the only real difference between the two analyses is the use of an additional partitioning factor for the RCP seal LOCA in the regional analysis. Only the seal LOCA portion that falls into the small break LOCA region is applied; or 69%.
However, the additional partitioning does not change the color.
DELTA CDF FOR EXPOSURE TIME (1.2E-5 + 2.55E-6) = 1.45E-5
(7.3E-7 + 1.53E-7) = 8.8E-7 1.45E-5 - 8.8E-7 = 1.36E-5 * RECOVERY (0.2; see Attachment 3 - Recovery Consideration) = 2.7E-6 B.
Tornado BASE CASE - The licensees full scope model was solved and the sequences involving basic event BHPOASWDHE were extracted. The resulting CDF was 2.07E-5. The dominant cutsets are shown on the excel spreadsheet in Attachment 4. To better understand the excel spreadsheet results, the top three accident sequences are explained below:
1.
An F3 intensity tornado strikes the Oconee facility [F3TORNAD]. Due to the path and intensity of the tornado, the electrical feeders from the main feeder bus located in the tornado protected blockhouse to the colored buses fail. These electrical feeders are located in that part of the tornados path that would be equivilant to an F2 intensity [BTOF3F2DEX].
The intensity of the tornado dissapates the further from the center of the tornado, therefore, Keowee survives the tornado [-BACKHF3DEX]. The turbine-driven EFW pump initially starts keeping the pressurizer PORV and code safeties from being challenged but eventually fails due to a loss of suction source due to tornado effects. At the F3 intensity there is always a loss of the recirculation line leading to this loss of suction. As directed by procedures for loss of all RCP seal cooling, operators place the SSF into service. However, the diesel generator fails to run
[NACSFDGDGR]. Consequently, operators move to the HPI/tornado pump strategy to avert core damage. Although the RCP seals are not being cooled for an extended period of time, there is not a seal LOCA.
Operators place the tornado pump into service and, due to its very low success probability (36% of the time), is included in the accident sequence. However, there is a failure to place the HPI pump into service from the ASW switchgear [BHPOASWDHE]. This leads to core damage.
2.
Essentially the same accident sequence as #1 but, damage is due to an F4 intensity tornado striking Oconee [F4TORNAD].
3.
An F2 intensity tornado strikes Oconee [F2TORNAD] failing the electrical feeders to the colored buses [BTOF2F2DEX], but leaves Keowee intact [-
BACKHF2DEX]. The turbine-driven EFW pump provides initial secondary side heat removal and keeps the pressurizer PORV and code safeties from being challenged. However, EFW fails due to loss of suction since 50% of the time the tornado damages the recirculation line.
In the mean time, as directed by procedures for a loss of all RCP seal cooling, operators place the SSF into service with a subsequent run failure of the SSF diesel [NACSFDGDGR]. Therefore, operators move to the HPI/tornado pump strategy for secondary side heat removal and RCS makeup to avert core damage. Although the RCP seals are not being
cooled for an extended period of time, there is not a seal LOCA.
Operators place the tornado pump into service and, due to its very low success probability (36% of the time), is included in the accident sequence. However, there is a failure to place the HPI pump into service from the ASW switchgear into service [BHPOASWDHE]. Without RCS makeup core damage ensues.
NON-CONFORMING CASE - The CDF increased to 2.72E-5 with the HPI pump from the ASW switchgear basic event, BHPOASWDHE, being modified DELTA CDF FOR EXPOSURE TIME 2.72E-5 - 2.07E-5 = 6.5E-6 * RECOVERY (0.2) = 1.3E-6 C.
Summary - Delta CDF 2.7E-6 [HELB] + 1.3E-6 [TORNADO] = 4E-6 V.
Conclusions/Recommendations - Risk increase over the base case was > 1E-6
Attachment 3 RECOVERY CONSIDERATION It is assumed that personnel would have installed either one or both damaged connectors and energized the HPI motor causing failure. It is highly possible that the damaged black" connector would have been recognized and repaired prior to the motor being energized. There is a high probability of repairing the damaged black connector given that diagnostic actions are not needed to identify the damage and that ample time is available to accomplish the task.
However, the same situation does not hold for the red connector because this could have easily been installed without identification. Repair of the red connector would of been required after numerous other equipment or actions had failed increasing the stress level and with minimal lighting.
Once there is an HPI failure, numerous equipment damage states could occur. A loose connector could lead to motor failure, actuation of motor protection relays and/or cause connector failure. Symptoms such as failure of the motor to start, motor overheating, relay actuation, or connector vaporization could occur. This would place the licensee in a diagnostic mode of operation. Motor overheating or tripping of the relays could greatly increase the diagnostic time. Failure of the connector would have increased the time necessary to make repairs.
For the licensee to ascertain exactly what caused the failure and repair the damage would require diagnostic actions of a troubleshooting nature and without a clearly defined procedure.
This would rely upon the experience and training of the electricians onsite. Provided there was no damage to the ASW switchgear, there would be credible repair methods for the cables. If the HPI motor was damaged there is another HPI motor/pump that could be used even if the cables were cut and stripped back to connect directly to the motor terminals. Clearly, these troubleshooting and repair activities would be complex and under stress. Fortunately, there would be ample time (on the order of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />) in the dominant accident sequences in which to affect a successful repair.
There are numerous uncertainties involved in this recovery determination. These include:
In the tornado sequences, having electricians available in auxiliary building or the ability to acquire any needed spare parts may be impaired by the tornado effects on the warehouse.
- The black connector may be repaired prior to pump start and then the pump fail due to the red connector without enough time to complete repairs before core damage.
- The black connector may not be identified prior to pump start and then the motor damaged. After repairing the black connector, the other pump started and the motor fail due to the red connector. This would leave no viable success path.
- The actual damage may not be repairable.
Notwithstanding these uncertainties, the diagnostic/troubleshooting actions appear to be the highest contributor to recovery failure. Therefore, using the most current Accident Sequence
Error Worksheet the baseline failure probability for a Processing Task is 1E-2. The Performance Shaping Factors include:
for expansive time to accomplish a complex activity under high threat and stress
no adjustment for experience and training, ergonomics, fitness for duty or crew dynamics
no procedures Summary:
1E-2 [PROCESSING BASELINE] * 2 [EXPANSIVE TIME FOR COMPLEX ACTION UNDER HI STRESS] * 10 [NO PROCEDURES] = 2E-1 Therefore, a failure probability of 0.2 will be assigned for recovery in the event of the HPI pump failure due to the multiple deficiencies noted with the connectors.
Attachment 4 DOMINANT TORNADO CUTSETS
Inputs Description Event Prob Prob 1 F3TORNAD Annual Frequency Of An F3 Intensity Tornado Striking Oconee Unit 3 4.12e-05 4.60e-07 Sequence-BACKHF3DEX F3 Tornado Hits Keowee Hydro Station and Fails Emergency Power To CT4 8.45e-01 TB23U BHP0ASWDHE Crew Fails to Recover Power To HPI Pump From ASW Switchgear 1.00e+00 EFW = FTR BTOF3F2DEX F-3 Tornado Causes F-2 Damage to the Oconee Powerhouse 2.79e-01 SSF ASW =
FTR NACSFDGDGR SSF Diesel Generator Fails To Run 1.70e-01 EFW FAILS TO RUN 1.00e+00 TORNADO PUMP SUCCESSFUL 3.60e-01 RCS INTEGRITY MAINTAINED 7.90e-01 EFW SUCCESSFULLY STARTS STOPPING PSV LIFT 9.80e-01 2 F4TORNAD Annual Frequency Of An F4 Intensity Tornado Striking Oconee Unit 3 3.59e-05 3.47e-07 Sequence-BACKHF4DEX F4 Tornado Hits Keowee Hydro Station And Fails Emergency Power To CT4 7.76e-01 TB23U BHP0ASWDHE Crew Fails to Recover Power To HPI Pump From ASW Switchgear 1.00e+00 EFW = FTR BTOF4F2DEX F-4 Tornado Causes F-2 Damage to the Oconee Powerhouse 2.63e-01 SSF ASW =
FTR NACSFDGDGR SSF Diesel Generator Fails To Run 1.70e-01 EFW FAILS TO RUN 1.00e+00 TORNADO PUMP SUCCESSFUL 3.60e-01 RCS INTEGRITY MAINTAINED 7.90e-01 EFW SUCCESSFULLY STARTS STOPPING PSV LIFT 9.80e-01 3 F2TORNAD Annual Frequency Of An F2 Intensity Tornado Striking Oconee Unit 3 5.37e-05 3.45e-07 Sequence-BACKHF2DEX F2 Tornado Hits Keowee Hydro Station and Fails Emergency Power To CT4 9.38e-01 TB23U BHP0ASWDHE Crew Fails to Recover Power To HPI Pump From ASW Switchgear 1.00e+00 EFW = FTR
Inputs Description Event Prob Prob BTOF2F2DEX F-2 Tornado Causes F-2 Damage to the Oconee Powerhouse 2.89e-01 SSF ASW =
FTR NACSFDGDGR SSF Diesel Generator Fails To Run 1.70e-01 EFW FAILS TO RUN DOMINATED BY RECIRC LINE FAILURE 5.00e-01 TORNADO PUMP SUCCESSFUL 3.60e-01 RCS INTEGRITY MAINTAINED 7.90e-01 EFW SUCCESSFULLY STARTS STOPPING PSV LIFT 9.80e-01 4 F3TORNAD Annual Frequency Of An F3 Intensity Tornado Striking Oconee Unit 3 4.12e-05 1.73e-07 Sequence-BACKHF3DEX F3 Tornado Hits Keowee Hydro Station and Fails Emergency Power To CT4 8.45e-01 TB23U BHP0ASWDHE Crew Fails to Recover Power To HPI Pump From ASW Switchgear 1.00e+00 EFW = FTR BSF1ASWDEX Cond. Prob. of Failure to Align SSF ASW Given Failure During First 16 minutes 2.67e-01 SSF ASW =
FTR BSF1ASWDHE Operators Fail To Align The SSF ASW System For Operation (within 16 minutes)
2.40e-01 BTOF3F2DEX F-3 Tornado Causes F-2 Damage to the Oconee Powerhouse 2.79e-01 EFW FAILS TO RUN 1.00e+00 TORNADO PUMP SUCCESSFUL 3.60e-01 RCS INTEGRITY MAINTAINED 7.90e-01 EFW SUCCESSFULLY STARTS STOPPING PSV LIFT 9.80e-01 5 F4TORNAD Annual Frequency Of An F4 Intensity Tornado Striking Oconee Unit 3 3.59e-05 1.31e-07 Sequence-BACKHF4DEX F4 Tornado Hits Keowee Hydro Station And Fails Emergency Power To CT4 7.76e-01 TB23U BHP0ASWDHE Crew Fails to Recover Power To HPI Pump From ASW Switchgear 1.00e+00 EFW = FTR BSF1ASWDEX Cond. Prob. of Failure to Align SSF ASW Given Failure During First 16 minutes 2.67e-01 SSF ASW =
FTR BSF1ASWDHE Operators Fail To Align The SSF ASW System For Operation (within 16 minutes)
2.40e-01 BTOF4F2DEX F-4 Tornado Causes F-2 Damage to the Oconee Powerhouse 2.63e-01 EFW FAILS TO RUN 1.00e+00 TORNADO PUMP SUCCESSFUL 3.60e-01 RCS INTEGRITY MAINTAINED 7.90e-01
Inputs Description Event Prob Prob EFW SUCCESSFULLY STARTS STOPPING PSV LIFT 9.80e-01 6 F2TORNAD Annual Frequency Of An F2 Intensity Tornado Striking Oconee Unit 3 5.37e-05 1.30e-07 Sequence-BACKHF2DEX F2 Tornado Hits Keowee Hydro Station and Fails Emergency Power To CT4 9.38e-01 TB23U BHP0ASWDHE Crew Fails to Recover Power To HPI Pump From ASW Switchgear 1.00e+00 EFW = FTR BSF1ASWDEX Cond. Prob. of Failure to Align SSF ASW Given Failure During First 16 minutes 2.67e-01 SSF ASW =
FTR BSF1ASWDHE Operators Fail To Align The SSF ASW System For Operation (within 16 minutes)
2.40e-01 BTOF2F2DEX F-2 Tornado Causes F-2 Damage to the Oconee Powerhouse 2.89e-01 EFW FAILS TO RUN DOMINATED BY RECIRC LINE FAILURE 5.00e-01 TORNADO PUMP SUCCESSFUL 3.60e-01 RCS INTEGRITY MAINTAINED 7.90e-01 EFW SUCCESSFULLY STARTS STOPPING PSV LIFT 9.80e-01 TORNADO PUMP SUCCESSFUL 3.60e-01 RCS INTEGRITY MAINTAINED 7.90e-01 7 F3TORNAD Annual Frequency Of An F3 Intensity Tornado Striking Oconee Unit 3 4.12e-05 1.03e-07 Sequence-BACKHF3DEX F3 Tornado Hits Keowee Hydro Station and Fails Emergency Power To CT4 8.45e-01 TB23U BHP0ASWDHE Crew Fails to Recover Power To HPI Pump From ASW Switchgear 1.00e+00 EFW = FTR BTOF3F2DEX F-3 Tornado Causes F-2 Damage to the Oconee Powerhouse 2.79e-01 SSF ASW =
FTR NSSFSYSTRM SSF Is In Maintenance 3.80e-02 EFW FAILS TO RUN 1.00e+00 TORNADO PUMP SUCCESSFUL 3.60e-01 RCS INTEGRITY MAINTAINED 7.90e-01 EFW SUCCESSFULLY STARTS STOPPING PSV LIFT 9.80e-01 8 F2TORNAD Annual Frequency Of An F2 Intensity Tornado Striking Oconee Unit 3 5.37e-05 1.09e-07 TQsU-BACKHF2DEX F2 Tornado Hits Keowee Hydro Station and Fails Emergency Power To CT4 9.38e-01
Inputs Description Event Prob Prob BHP0ASWDHE Crew Fails to Recover Power To HPI Pump From ASW Switchgear 1.00e+00 BTOF2F2DEX F-2 Tornado Causes F-2 Damage to the Oconee Powerhouse 2.89e-01 NSF0RCMDHE Operators Fail To Align The SSF RCM System For Operation 5.40e-02 T0SMALLDEX RCP LOCA Is Small 1.44e-01 EFW SUCCESSFULLY STARTS STOPPING PSV LIFT 9.80e-01 SSF ASW SUCCESS,EFW SUCCESS, TORNADO PMP SUCCESS 1.00e+00 CDF INCREASE FOR DOMINANT CUTSETS 0.00000
DELTA CDF FOR DOMINANT CUTSETS = 1.8E-6 - 1.8E-6
- 6E-2 = 1.7E-6