IR 05000269/2003011
| ML032190303 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 08/07/2003 |
| From: | Mccree V Division Reactor Projects III |
| To: | Rosalyn Jones Duke Energy Corp |
| Shared Package | |
| ML032190178 | List: |
| References | |
| EA-03-145, IR-02-006 IR-03-011 | |
| Download: ML032190303 (12) | |
Text
ust 7, 2003
SUBJECT:
OCONEE NUCLEAR STATION - NRC INSPECTION REPORT 05000269/2003011, 05000270/2003011, AND 05000287/2003011; PRELIMINARY WHITE FINDING
Dear Mr. Jones:
On March 22, 2002, the NRC completed an annual baseline inspection of the identification and resolution of problems at your Oconee Nuclear Station. The inspection findings were documented in NRC Inspection Report 05000269/2002006, 05000270/2002006, and 05000287/2002006, which was issued on April 19, 2002.
Section 4OA2.c.(2).2 of that report identified Unresolved Item (URI) 05000269,270,287/2002 006-01, which concerned pressurizer ambient heat losses in all three Oconee Units exceeding the pressurizer heater capacity of those heaters powered from the standby shutdown facility (SSF). Upon recognizing this long-standing problem, you declared the SSF auxiliary service water function (i.e., removal of reactor decay heat via the steam generators) inoperable on March 7, 2002. Using the significance determination process (SDP), this issue was preliminarily determined to be White (i.e., an issue with some increased importance to safety, which may require additional NRC inspection). As indicated in the enclosed SDP Phase III Summary, the issue appears to have a low to moderate safety significance because of the importance of the SSF powered pressurizer heaters to maintain a pressurizer steam bubble during events where the SSF is used to achieve safe shutdown. Specifically, without a steam bubble to maintain primary system pressure, reactor coolant system (RCS) subcooling would be jeopardized, and single phase RCS natural circulation would be interrupted due to voiding in the hot leg. Decay heat would then challenge the pressurizer safety relief valves, and a failure of one of these valves to reseat would lead to core damage since the SSF standby makeup pump is of insufficient capacity to recover the resultant loss in RCS inventory.
The finding does not represent a current safety concern because you subsequently developed a modified strategy for operating the pressurizer in a water solid condition; thereby, assuring single phase RCS flow and the SSF auxiliary service water function. This strategy, which was assessed by an NRC Special Inspection Team (Inspection Report 50-269,270,287/02-08), is still in place for the SSF until long-term corrective actions are taken to restore the SSF design basis.
DEC 2 One apparent violation (AV) of 10 CFR 50, Appendix B, Criteria XVI, Corrective Action, was identified regarding the failure to promptly identify and correct this significant condition adverse to quality. Evidence of this condition, which may have existed from the time the SSF was put into service in 1986 until it was discovered in March 2002, included pressurizer insulation problems (since pre-operational testing) and numerous Problem Investigation Process reports (since 1996) identifying pressurizer heater capacity concerns. This apparent violation (identified as AV 05000269,270,287/2003011-01: Failure to Promptly Identify and Correct Insufficient SSF Pressurizer Heater Capacity) is being considered for escalated enforcement action in accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions - May 1, 2000" (Enforcement Policy), NUREG-1600. Accordingly, for administrative purposes, URI 05000269,270,287/2002006-01 is considered closed. The current Enforcement Policy is included on the NRCs website at http://www.nrc.gov/OE.
Before the NRC makes a final decision in this matter, we are providing you an opportunity to request a Regulatory Conference where you would be able to provide your perspectives on the significance of the issue, the bases for your position, and whether you agree with the apparent violation. If you choose to request a Regulatory Conference, we encourage you to submit your evaluation and any differences with the NRC evaluation at least one week prior to the conference in an effort to make the conference more efficient and effective. If a conference is held, it will be open for public observation. The NRC will also issue a press release to announce the conference.
Please contact Mr. Robert Haag at (404) 562-4550 within 7 days of the date of this letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will continue with our significance determination and enforcement decision and you will be advised by separate correspondence of the results of our deliberations on this matter.
Since the NRC has not made a final determination in this matter, a Notice of Violation is not being issued at this time. In addition, please be advised that the number and characterization of the apparent violation may change as a result of further NRC review.
In accordance with 10 CFR 2.790 of the NRCs "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
//RA//
Victor M. McCree, Deputy Director Division of Reactor Projects Docket Nos.: 50-269, 50-270, 50-287 License Nos.: DPR-38, DPR-47, DPR-55 Enclosure: SDP Phase III Summary w/Reference and Attachments
DEC 3 cc w/encl.:
Compliance Manager (ONS) Peggy Force Duke Energy Corporation Assistant Attorney General Electronic Mail Distribution N. C. Department of Justice Electronic Mail Distribution Lisa Vaughn Legal Department (PB05E)
Duke Energy Corporation 422 South Church Street Charlotte, NC 28242 Anne Cottingham Winston and Strawn Electronic Mail Distribution Mel Fry, Director Division of Radiation Protection N. C. Department of Environmental Health & Natural Resources Electronic Mail Distribution Henry J. Porter, Assistant Director Div. of Waste Mgmt.
S. C. Department of Health and Environmental Control Electronic Mail Distribution R. Mike Gandy Division of Radioactive Waste Mgmt.
S. C. Department of Health and Environmental Control Electronic Mail Distribution County Supervisor of Oconee County 415 S. Pine Street Walhalla, SC 29691-2145 Lyle Graber, LIS NUS Corporation Electronic Mail Distribution Manager Nuclear Regulatory Licensing Duke Energy Corporation 526 S. Church Street Charlotte, NC 28201-0006
DEC 4 Distribution w/encl.:
L. Olshan, NRR OE, MAIL OE, WEB C. Evans RIDSNRRDIPMLIPB PUBLIC PUBLIC DOCUMENT (circle one): YES OFFICE RII:DRP RII:DRS EICS RII:DRP SIGNATURE REC1/FOR REC1/ TELEP SES /FOR AHUTTO/FOR NAME R Haag W Rogers C Evans M Shannon DATE 8/5/2003 8/5/2003 8/5/2003 8/5/2003 E-MAIL COPY? YES NO YES NO YES NO YES NO YES NO YES NO YES NO OFFICIAL RECORD COPY DOCUMENT NAME: C:\ORPCheckout\FileNET\ML032190303.wpd
SDP Phase III Summary I. Background The SSF provides RCP seal injection and secondary side cooling (ASW) to operate all units in natural circulation conditions for Appendix R fires, turbine building flood, station blackout, and security events. The ASW function is supported by the pressurizer heaters. Enough heaters are required to be available to maintain primary system pressure in order to keep the coolant subcooled. This keeps the primary and secondary coupled and provides the conditions for natural circulation.
The performance deficiency concerns a failure to promptly identify and resolve a degradation of the SSF ASW function to remove reactor decay heat via the steam generators during a postulated SSF event. The degraded condition, which resulted from an insufficient number of pressurizer heaters being available from the SSF to maintain a pressurizer bubble and assure natural circulation, was due to long-standing pressurizer insulation problems and non-conservatisms in the licensees design calculation for estimating pressurizer ambient heat loss. Evidence of this condition, which may have existed from the time the SSF was put into service in 1986 until it was discovered in March 2002, included pressurizer insulation problems (since pre-operational testing) and numerous Problem Investigation Process reports (since 1996) identifying pressurizer heater capacity concerns.
For the purposes of this analysis the inspectors assumed that loss of natural circulation constituted a loss of the ASW function of the SSF. Without adequate heaters, the primary system would lose pressure and eventually saturate because procedures required the operators to maintain RCS temperature stable or slightly decreasing (<20° decreasing) by controlling ASW pump flow. Once the system were to saturate, subcooling can only be recovered by injecting high pressure injection (HPI) flow, but in a SSF event, the HPI system would not be available. Therefore, upon loss of subcooling the emergency operating procedure (EOP) would direct the operator to depressurize the primary system to enable core flood to provide inventory. The system would eventually stabilize in boiler-condenser mode of operation and the core would be cooled. However, during the transition there would be no flow in the primary system, it would pressurize due to decay heat, and, because the power operated relief valve (PORV) would be blocked during SSF operation, the pressurizer code safety valves would be challenged.
Exposure Time - one year will be used as the surrogate for this long-standing performance deficiency Date of Occurrence - initial construction of the SSF II. Safety Impact: WHITE Enclosure
III. Risk Analysis/Considerations Assumptions:
1. As a result of the inadequate Pressurizer heat input, natural circulation will be lost and the RCS will experience the boiler-condenser mode of operation.
Transfering into the boiler-condenser mode will re-pressurize the RCS and there will be Pressurizer Safety Relief Valve (SRV) challenges requiring the valve to open and reseat five times.
2. The SSF function is lost when a SRV sticks open. The failure probability per challenge of the valve sticking open is 3E-3 (Reference 2).
3. A breaker failure resulting in Pressurizer Heater loss will be used as the surrogate for the conforming condition with a failure probability approximately 3 magnitudes less than the non-conforming condtion (i.e., generic failure probability of a breaker to fail open). Therefore, for purposes of calculating the delta core damage frequency (CDF) the conforming condition can be ignored.
4. Previous risk analysis have shown that F5 tornadoes provided a very small risk contribution with respect to the other tornadoes. Therefore, the F5 tornadoes will be excluded from quantification.
5. Given a full compartment fire in any of the designated areas, the licensee would evacuate the control room and operate the SSF as the mitigation strategy to prevent core damage. Once the control room is evacuated no equipment except SSF equipment will affect, alter or modify a process parameter in the primary or secondary portion of the plant. This situation parallels the requirements of 10 CFR 50, Appendix F. It is recognized that numerous systems or portions of systems may continue to function after control room evacuation and accomplish an SSF function (secondary side heat removal, reactor coolant pump (RCP) seal cooling, RCS makeup, core cooling via natural circulation) within the plant proper. However, portions of the control & instrumentation systems (Once-Through Steam Generator level, Pressurizer level, Pressurizer pressure, Letdown Storage Tank level, associated interlocks) for these functions such as RCS makeup via an HPI pump, RCS pressure control via Pressurizer heaters, etc. may be directly affected by the fire, affected by hot shorts, or require operator action to properly accomplish an SSF function. Some of these functions could be defeated by Engineered Safeguards Feature actuation from failed instrumentation or spurious signals. Also, due to these same affects the equipment that normally performs an SSF function may inhibit or negate the SSF function through improper or spurious operation. The collective effects can not be reasonably quantified.
Probabilistic Risk Assessment (PRA) Model used for basis of the risk analysis: The licensees full scope model was used for the majority of internal and external events.
Hand calculations were used for the fire portion of external events (based primarily upon Headquarters Phase III analysis from a previous performance deficiency). A hand
calculation was used for an initiating event not included in any PRA model dealing with high energy line breaks (HELB).
Significant Influence Factor(s) [if any]: Number of SRV challenges when boiler-condenser mode happens.
IV. Calculations Phase II The ASW function was selected as the surrogate for this loss of function which resulted in a Yellow characterization. However, the undersized SSF pressurizer heaters do not cause a direct loss of ASW function. The performance deficiency does increase the failure probability of the SSF function and is quantified as 5 * 3E-3 = 1.5E-2. This would equate to an additional 2 points under the Phase II framework and change the color to Green. However, given the numerical result, external event initiators are to be considered.
Phase III 1. Internal Events & Internal Flooding NON-CONFORMING/ CDF CASE a. The SPAR output (3i) was 5.22E-8/yr. This was derived by modifying the SSF fault tree to include a new basic event with a failure probability of 1.5 E-2. See Attachment 1 for the results. The basic event was inserted into an OR gate such that its failure caused the loss of the SSF ASW function. However, by cutset inspection and then fault tree and event tree review, it was apparent that only the Loss of Offsite Power initiating event included the SSF function in the derivation of core damage. The licensees EOPs and licensing basis use the SSF function to mitigate core damage in a large number of accident conditions. Therefore, the SPAR results will not be used in this Phase III analysis.
b. The licensees full scope model was evaluated by slicing out of the cutsets containing the basic event NACSFDGDGM, SSF Diesel Generator in Maintenance ( failure probability of 4.28E-2). Then the cutsets were pruned for those that were exclusively a loss of AC to the colored buses in the plant proper without AC recovery factors. Finally, the CDF contribution was calculated. The NACSFDGDGM basic event was selected as the surrogate for the cutsets that required a failure of the SSF to reach core damage. Inclusive in the full scope model is the external initiating event of internal building flooding. The details are shown in Attachment 2. The resulting CDF was 2.64E-6. A new failure mechanism was then inserted in place of the SSF DG in Maintenance.
That failure mechanism was the success of the SSF equipment to operate with degraded heater capacity and the failure of an RCS SRV to
reseat upon going to the boiler-condenser mode. That failure probability was 0.65 * 1.5E-2. Therefore, the non-conforming CDF is:
1.46E-6 * (1.5E-2)(.65)/4.28E-2 = 3.3E-7 c.. The colored bus HELB sequence was not included in either model. It is included as a hand calculation. The initiating event frequency of a HELB in the turbine building failing all the 4.16 KV safety related buses (colored buses) was previously developed in another risk analysis (see exert of this analysis identified as Attachment 3).
3.9E-4 * 0.76 (1 - OA & DG FAILURES) * 0.93 (1 - SSF RCM FAILURE) * 0.92 (1 - SSF ASW FAILURE) * 0.998 (1 - EFW INITIAL FAILURE) * 1.5E-2 (SRV FAIL TO RESEAT) * 6E-2 (HPI ALT FAILURE) = 2.3E-7 Internal Events Summary CDF 3.3E-7 + 2.3E-7 = 5.6E-7 2. External Events a. Earthquake NON-CONFORMING/ CDF CASE Attachment 4 contains an edit of the dominant cutsets as derived from the licensees seismic portion of their current external events PRA. The cutsets were pruned to only include those containing the basic events NACSFDGR, SSF Diesel Generator Fails to Run, and TOSMALLDEX, RCP Seal LOCA is Small. By dividing the failure probabilities associated with these two basic events from the total CDF all accident sequences requiring SSF operation to mitigate core damage are derived. Then by multiplying the success of the SSF {1 - [2E-1(SSF DG & OPREATOR FAILURE) + 6.6E-2(SSF ASW FAILURE) + 9E-2(SSF RCM FAILURE)] =
0.65} and the probability of a SRV sticking open (1.5E-2) the appropriate CDF involving the performance deficiency is identified.
5.83E-6 [3 from Attachment 4] * 0.65 [ssf success] * 1.5E-2 [SRV sticks open / 1.7E-1 [NACSFDGR] * 1.44E-1 [TOSMALLDEX] =
2.3E-6
³CDF = 2.3E-6
b. Tornado NON-CONFORMING/ CDF CASE The licensees full scope model was evaluated by setting the basic event NSSFSYSTRM, SSF Is In Maintenance, to 1.0. Then the resulting CDF (7E-5) was modified to include the success of the SSF (0.65) and the performance deficiency with a failure probability of a safety relief valve sticking open of 1.5E-2 when the RCS transitions to the boiler condenser mode. The dominant ten cutsets are provided as Attachment 5.
7E-5 * 0.65 * 1.5E-2 = 6.82E-7 c. Fire NON-CONFORMING/ CDF CASE IE Development of those fires requiring the SSF to prevent core damage The compartments involved would be the MCR, Cable Spread Room, Cable Chase, Turbine Building, and Electrical Equipment Room. All but the turbine building and the entire MCR were analyzed under a previous risk evaluation. The applicable fully developed fires requiring the SSF function were:
3.8E-5/yr in Cable Shaft @ 796 elevation 4.0E-5/yr in Cable Shaft @ 809 elevation 3.8E-6/yr in Cable Spread Room for fixed ignition sources 6.4E-5/yr in Cable Spread Room for transient ignition sources 1.0E-4/yr in Electric Equipment Room 6.46E-5/yr in Main Control Room Unit 1/2 3.23E-5/yr in Main Control Room Unit 3 1.7E-5/yr in Turbine Building Attachment 6 provides the details of full compartment fire development.
Including the success of the SSF and the performance deficiency into calculating the CDF:
Unit 1 or 2 3.3E-4 * .65 * 1.5E-2 = 3.2E-6 Unit 3 3E-4 * .65 * 1.5E-2 = 2.9E-6 d. External Flood There is only one cutset. It involves a random failure of the JoCassee Dam with flood waters that render the plant proper out of service, induce a LOSP and does not exceed the flood barrier surrounding the SSF.
1.3E-5 (Dam Failure) * 0.8 (SSF intact) * 0.65 (SSF functions successful) * 1.5E-2 (SRV sticks open) = 1.25E-7 External Events Summary CDF Unit 1 or 2 2.3E-6 [earthquake] + 6.82E-7 [tornado] + 3.2E-6 [fire] +
1.25E-7 [flood] = 6.3E-6 Unit 3 2.3E-6 + 6.82E-7 + 2.9E-6 + 1.25E-7 = 6.0E-6 V. Conclusions/Recommendations Risk increase over the base case was > 1E-6 but < 1E-5 for all three units Unit 1 or 2 6.3E-6 + 5.6E-7 = 6.9E-6 Unit 3 6.0E-6 + 5.6E-7 = 6.6E-6 VI. References 1. Phase I Screening Sheets (not included)
2. Special Study, PWR Pressurizer Safety Valves and Main Steam Safety Valves and BWR Safety/Relief Valves Performance, December 1998 [DRAFT]
VII. Attachments 1. SPAR Output 2. Full Scope Output 3. Colored Bus HELB 4. Earthquake 5. Tornado 6. Fire Initiating Event Analyst: W. Rogers Date: 5/23/03 Reviewed By: R. Bernhard Date: 6/3/03