IR 05000341/2003007
| ML032170481 | |
| Person / Time | |
|---|---|
| Site: | Fermi  |
| Issue date: | 07/30/2003 |
| From: | Julio Lara Division of Nuclear Materials Safety III |
| To: | O'Connor W Detroit Edison |
| References | |
| IR-03-007 | |
| Download: ML032170481 (33) | |
Text
uly 30, 2003
SUBJECT:
FERMI 2 NUCLEAR POWER STATION NRC SAFETY SYSTEM DESIGN AND PERFORMANCE CAPABILITY INSPECTION REPORT 50-341/03-07(DRS)
Dear Mr. OConnor:
On June 6, 2003, the US Nuclear Regulatory Commission (NRC) completed an inspection at your Fermi 2 Nuclear Power Station. The enclosed safety system design and performance capability inspection report documents the inspection findings, which were discussed on June 6, 2003, with you and other members of your staff.
The inspection examined activities conducted under your license as they relate to safety and compliance with the Commissions rules and regulations and with the conditions of the license.
The inspectors reviewed selected procedures and records, observed activities, and interviewed personnel. Specifically, the inspection focused on the design and performance capability of the emergency equipment cooling water and the emergency equipment service water systems to ensure that they were capable of performing the required safety-related functions.
Based on the results of this inspection, no findings of significance were identified.
W. OConnor, Jr. -2-In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter, its enclosure, and your response (if any) will be available electronically for public inspection in the NRC Public Document Room or from the Publically Available Records (PARS) component of NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
/RA/
Julio F. Lara, Chief Electrical Engineering Branch Division of Reactor Safety Docket No. 50-341 License No. NPF-43 Enclosure: Inspection Report 50-341/03-07(DRS)
cc w/encl: N. Peterson, Director, Nuclear Licensing P. Marquardt, Corporate Legal Department Compliance Supervisor R. Whale, Michigan Public Service Commission L. Brandon, Michigan Department of Environmental Quality Monroe County, Emergency Management Division Emergency Management Division MI Department of State Police
SUMMARY OF FINDINGS
IR 05000341/2003-007(DRS); Detroit Edison Company; 05/19/03 - 06/06/03; Enrico Fermi
Nuclear Power Station, Unit 2; Routine Baseline Inspection Report.
This report covered a three week period of inspection by regional engineering specialists with both electrical and mechanical consultant assistance. The inspection focused on the design and performance capability of the emergency equipment cooling water and the emergency equipment service water systems to ensure that they were capable of performing their required safety-related functions. No findings of significance were identified. The significance of most findings, when identified, are indicated by their color (Green, White, Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination Process (SDP). Findings for which the SDP does not apply may be Green or be assigned a severity level after NRC management review. The NRC's program for overseeing the safe operation of commercial nuclear power reactors is described in NUREG-1649, "Reactor Oversight Process," Revision 3, dated July 2000.
A. Inspector-Identified and Self-Revealed Findings
Cornerstone: Initiating Events
No findings of significance were identified.
Cornerstone: Mitigating Systems
No findings of significance were identified.
Cornerstone: Barrier Integrity
No findings of significance were identified.
Licensee-Identified Violations
No findings of significance were identified.
REPORT DETAILS
Summary of Plant Status
The Fermi 2 Unit operated at or near full power throughout the inspection period.
REACTOR SAFETY
Cornerstone: Mitigating Systems
1R21 Safety System Design and Performance Capability
Introduction:
Inspection of safety system design and performance capability verifies the initial design and subsequent modifications and provides monitoring of the ability of the selected systems to perform design bases functions. As plants age, the design bases may be lost and important design features may be altered or disabled. The plants risk assessment model was based on the capability of the as-built safety system to perform the intended safety functions successfully. This inspectable area verifies aspects of the mitigating systems cornerstone for which there are no indicators to measure performance.
The objective of the safety system design and performance capability inspection was to assess the adequacy of calculations, analyses, other engineering documents, and operational and testing practices that were used to support the performance of the selected systems during normal, abnormal, and accident conditions.
The systems and components selected for the inspection were the emergency equipment cooling water (EECW) and the emergency equipment service water (EESW)systems. These systems were selected for review based upon:
- having a high probabilistic risk analysis ranking;
- having had recent significant issues;
- not having received recent NRC review; and
- being interacting systems.
The criteria used to determine the acceptability of the systems performance was found in documents such as:
- applicable technical specifications;
- applicable updated safety analysis report (USAR) sections; and
- the systems' design documents.
The following system and component attributes were reviewed in detail:
System Requirements Process Medium - water, air, electrical signal; Energy Source - electrical power, steam, air; Control Systems - initiation, control, and shutdown actions; Operator Actions - initiation, monitoring, control, and shutdown; and Heat Removal - cooling water and ventilation.
System Condition and Capability Installed Configuration - elevation and flow path operation; Operation - system alignments and operator actions; Design - calculations and procedures; and Testing - level, flow rate, pressure, temperature, voltage, and current Component Level Equipment/Environmental Qualification - temperature and radiation; Equipment Protection - fire, flood, missile, high energy line breaks (HELBs), freezing, heating, ventilation and air conditioning
.1 System Requirements
a. Inspection Scope
The inspectors reviewed the USAR, technical specifications, system descriptions, drawings and available design basis information to determine the performance requirements of the EECW and the EESW systems. The reviewed system attributes included process medium, energy sources, control systems, operator actions and heat removal. The rationale for reviewing each of the attributes was:
Process Medium: This attribute required review to ensure that the selected systems flow paths would be available and unimpeded during/following design basis events. To achieve this function, the inspectors verified that the systems would be aligned and maintained in an operable condition as described in the plants USAR, technical specifications and design bases.
Energy Sources: This attribute required review to ensure that the selected systems motive/electrical source would be available/adequate and unimpeded during/following design basis events, that appropriate valves and system control functions would have sufficient power to change state when required. To achieve this function, the inspectors verified that the interactions between the systems and their support systems were appropriate such that all components would operate properly when required.
Controls: This attribute required review to ensure that the automatic controls for operating the systems and associated systems were properly established and maintained. Additionally, review of alarms and indicators was necessary to ensure that operator actions would be accomplished in accordance with design requirements.
Operations: This attribute was reviewed because the operators perform a number of actions during normal, abnormal and emergency operating conditions that have the potential to affect the selected systems operation. In addition, the emergency operating procedures (EOPs) require the operators to manually realign the systems flow paths during and following design basis events. Therefore, operator actions play an important role in the ability of the selected systems to achieve their safety-related functions.
Heat Removal: This attribute was reviewed to ensure that there was adequate and sufficient heat removal capability for the selected systems.
b. Findings
No findings of significance were identified.
Cornerstone: Public Safety
.2 System Condition and Capability
a. Inspection Scope
The inspectors reviewed design basis documents and plant drawings, abnormal and emergency operating procedures (EOPs), requirements, and commitments identified in the USAR and technical specifications. The inspectors compared the information in these documents to applicable electrical, instrumentation and control, and mechanical calculations, setpoint changes and plant modifications. The inspectors also reviewed operational procedures to verify that instructions to operators were consistent with design assumptions.
The inspectors reviewed information to verify that the actual system condition and tested capability was consistent with the identified design bases. Specifically, the inspectors reviewed the installed configuration, the system operation, the detailed design, and the system testing, as described below.
Installed Configuration: The inspectors confirmed that the installed configuration of the EECW and EESW met the design basis by performing detailed system walkdowns.
The walkdowns focused on the installation and configuration of piping, components, and instruments; the placement of protective barriers and systems; the susceptibility to flooding, fire, or other environmental concerns; physical separation; provisions for seismic and other pressure transient concerns; and the conformance of the currently installed configuration of the systems with the design and licensing bases.
Operation: The inspectors performed procedure walk-throughs of selected manual operator actions to confirm that the operators had the knowledge and tools necessary to accomplish actions credited in the design basis.
Design: The inspectors reviewed the mechanical, electrical and instrumentation design of the EECW and EESW to verify that the systems and subsystems would function as required under accident conditions. The review included a review of the design basis, design changes, design assumptions, calculations, boundary conditions, and models as well as a review of selected modification packages. Instrumentation was reviewed to verify appropriateness of applications and set-points based on the required equipment function. Additionally, the inspectors performed limited analyses in several areas to verify the appropriateness of the design values.
Testing: The inspectors reviewed records of selected periodic testing and calibration procedures and results to verify that the design requirements of calculations, drawings, and procedures were incorporated in the system and were adequately demonstrated by test results. Test results were also reviewed to ensure automatic initiations occurred within required times and that testing was consistent with design basis information.
b. Findings
No findings of significance were identified.
.1 Potential Unmonitored Radiation Release Path
Introduction:
On June 1, 2003, the inspectors identified a potential for unmonitored release of effluents during a reactor shutdown and during a reactor accident. This finding was considered to be a possible violation of Section 5.5.2 of the Technical Specification.
Description:
The Residual Heat Removal (RHR) Heat Exchangers at Fermi could be a potential unmonitored release path for radiation since the heat exchangers had not been eddy current tested since plant construction. The condition of the heat exchanger tubes was unknown and could be thinned or leaking.
The contaminated side of the RHR Heat Exchanger was at a higher water pressure than the service water side. As a result, tube leaks would allow contaminated water to flow into the Service Water System and to the Ultimate Heat Sink (UHS). During a Design Basis Accident (DBA) highly radioactive suppression pool water could be pumped into the three million gallons of water of the UHS. The water was covered with steel grating, which allowed a direct path to the environment. In addition, the UHS cooling towers would evaporate potentially radioactive water to cool the remaining water. These releases could exceed 10 CFR Part 100 offsite release limits and control room radiation limits.
Licensee personnel were required by procedure to perform a monthly sample of the UHS to determine if there had been leakage from plant equipment to the UHS. With this method of testing the leakage water is diluted in the three million gallons of UHS water; it is filtered in the UHS and plates out, or evaporates. It would take a substantial leak during reactor shutdown to be detected by this monthly sample. To resolve inspector concerns, licensee stated that they would perform a sample of the service water during Shutdown Cooling to determine if leakage was present.
The inspectors reviewed modification, SPC-13682; RHR Service Water Rad Monitor Setpoint Increase; December 2, 1992, and noted that the current sensitivity of the radiation monitor detectors, D11-N401A and D11-N401B, for the RHR Service Water system required nine gallons of leaking RV water before it would alarm. This method of detecting leaks means that it would take a significant leak to indicate a degraded condition of a RHR Heat Exchanger. This could result in a significant amount of radioactive reactor vessel water going undetected to the UHS during Reactor Shutdown.
The licensee radiation monitors for the RHR Service Water were located in the reactor building. As a result, the radiation monitors could be in a continuous alarm condition during a DBA due to high radiation levels. If the radiation monitors were in continuous alarm, useful information would not be provided to Operations for determination of a RHR Heat Exchanger leak. In addition, the radiation monitor sample line must be turned on and primed during a time when personnel might not be able to enter the Reactor Building due to radiation. Also, the installed Residual Heat Removal Service Water (RHRSW) Radiation Monitors are non-safety, non-seismic, Non-EQ qualified, and not redundant for the RHR System. Licensee personnel stated that sampling of the UHS could supplement the monitors during this time. However, sampling takes approximately two hours and would be of limited use to prevent a large release of contaminated water to the UHS. In addition, the sampling would have to be repeated over and over again during a postulated accident.
The significance of a radioactive release would be increased during a design basis accident because iodine would be dissolved in water in the Suppression Pool as long as the pH was above 7. This was accomplished by boron. The release of this water to the UHS (pH 7) could result in large releases of iodine during an accident.
The inspectors had an additional concern that sampling of the water or use of radiation monitors may not be an acceptable method to determine a degraded condition of the RHR Heat Exchangers. There was not a direct relationship between degraded tubes (thinning) to tube failure, which could occur during an accident.
Analysis:
The inspectors determined that the failure to ensure that the potential leakage from the RHR Heat Exchangers was monitored through design of radiation monitors, with appropriate sensitivity or periodic sampling, was an issue requiring further NRC review. Specifically, further NRC evaluations are necessary to determine if the licensee was complying with NRC requirements including Technical Specification 5.5.2.
Section 5.5.2 of the Fermi Technical Specification required, in part, that a program be established to provide controls to minimize leakage from portions of systems outside containment that could contain highly radioactive fluids during a serious transient or accident to levels as low as practicable. Licensee personnel placed this issue in the corrective action program by initiated CARD 03-11844; however, the issue remains unresolved pending additional NRC review of the issue and the action taken.
(URI 50-341/03-07-01)
.2 Undervoltage Relay Timing
Introduction:
The inspectors reviewed the reliability and availability of electrical systems used for operation of the EECW and EESW Systems. The 4160V voltage system to assess vulnerabilities due to loss of the preferred offsite source and the standby onsite sources (diesel generators) was also reviewed. In particular, the team evaluated the adequacy of undervoltage protection and vulnerability to spurious separation from the offsite source. To perform this task, single line drawings, load flow calculations, grid stability studies, protective device selection and coordination calculations, setpoint calculations, and design basis documents were reviewed.
The inspectors reviewed the Emergency Diesel Generators (EDGs) with respect to their function as a source of electric power as well as with respect to their requirements for electric power from supporting systems. Diesel electrical loading calculations were reviewed to assess margins with respect to worst case accident loading requirements.
AC and DC power requirements for diesel support systems were reviewed to assure that the diesels would be maintained in a ready to start condition, and that control and field flashing power was available for emergency starting. This review included AC load flow calculations, battery sizing calculations, and voltage drop calculations.
The inspectors reviewed electrical elementary diagrams to assure that proper control and protection logic was applied to system equipment and supporting electrical systems.
Logic was reviewed for the EECW and EESW Pumps, EECW initiation logic, and EECW MOVs. In addition, the undervoltage protection scheme for the safety related 4160V and 480V buses and control circuits were reviewed for proper operation as described in the licensing and design bases, and for proper isolation and separation to assure the independence of redundant circuits.
The inspectors questioned the adequacy of the time delay settings of the offsite power undervoltage relays. Specifically, the team was concerned that the existing time delays of 41.8 sec. and 46.2 sec. (Division 1) and 20.33 sec. and 22.47 sec. (Division 2)
(TS Table 3.3.8.1-1) from the detection of a sustained degraded voltage condition until the vital busses were transferred to the EDGs was longer than the time allowed by the 10 CFR 50.46. Loss of Coolant Accident (LOCA) analysis sequential loading time of
<13 sec. (TS Table 6.3.7) following receipt of a LOCA signal.
Description:
The inspectors referenced NRC Branch Technical Position PSB-1 Section B.1 which states that a second level of undervoltage protection should be provided with two separate time delays, the first time delay would be of short duration (no longer than a motor starting transient), with a subsequent LOCA signal causing separation from the offsite source. The team believed that the degraded voltage scheme should be suitable to protect safety-related equipment if a LOCA signal initiated at the same time that a degraded voltage condition existed. In addition, the team reviewed an NRC letter dated June 2, 1977 (sent to all operating plants at that time)which stated that the allowable time delay for the degraded voltage protection scheme, including margin, shall not exceed the maximum time delay that is assumed in the UFSAR accident analysis.
Licensee personnel were unable to demonstrate that during a LOCA with degraded voltage the 13-second time delay limit cited for the availability of power from the diesel generators could be met. During this delay ECCS pumps might fail to start and the MOVs might fail to move to their required positions. The licensee acknowledged the apparent discrepancy and initiated CARD 03-11847 to reconcile it. The CARD noted that, although Calculation DC-0919 stated that it was not a design basis for the degraded grid protection to function during a LOCA, Fermis response to PSB-1 stated that Fermi was in compliance with this requirement.
Analysis:
The Division 2 time delay of 20.33 sec. and 22.47 sec. was intended to allow sufficient time to start two RHR pumps and two Core Spray pumps without casing separation from the off site source. The Division 1 time delay of 41.8 sec. and 46.2 sec.
was intended to allow sufficient time to start two RHR pumps and two Core Spray pumps, and also to allow the automatic load tap changer on transformer S.S. 64 to improve voltage sufficiently to prevent separation from the offsite source.
The inspectors determined that applying a potentially non-conservative acceptance limit for the time delay relay did not assure the availability of the vital buses. The undervoltage relay time delay setpoint requirements, to assure compliance with 10 CFR 50 General Design Criterion 17, needs appropriate evaluations and resolution of the design and licensing basis. This matter is an unresolved item pending further NRC review and evaluation of the licensee position to determine the adequacy of the existing setpoint. (URI 50-341/03-07-02)
.3 Components
a. Inspection Scope
The inspectors performed a field walkdown of the EECW and EESW pump motors, EDGs, 480V MCCs, EECW MOVs and their environs, to assess whether the installed configuration had not significantly degraded and would support system functions under accident conditions. The equipment was cursory inspected for material condition, absence of hazards, conformance of installed components and configurations with design documents. MCCs were inspected for adequacy of component identification, and the status of required enclosure fasteners and latches.
System health reports were reviewed for the EECW and EESW Systems, the 4160V and 480V Systems, DC Systems and Vital Power System to identify possible chronic maintenance problems or impairment of system readiness. Scheduled tasks and procedures for selected electrical systems and components, including 480V switchgear, MOVs, and System Station Transformers were reviewed to assess the timelines and prioritization of maintenance activities.
b. Findings
No findings of significance were identified.
OTHER ACTIVITIES (OA)
4OA2 Problem Identification and Resolution (PI&R)
.1 Review of Condition Assessment Resolution Documents
a. Inspection Scope
The inspectors reviewed a sample of problems associated with the EECW and the EESW systems that were identified and entered into the corrective action program by licensee personnel. The inspectors reviewed these issues to verify an appropriate threshold for identifying issues and to evaluate the effectiveness of corrective actions related to design issues. In addition, condition assessment resolution documents written on issues identified during the inspection were reviewed to verify adequate problem identification and incorporation of the problem into the corrective action system.
The specific corrective action documents that were sampled and reviewed by the team are listed in the attachment to this report.
b. Findings
No findings of significance were identified.
4OA6 Meetings, Including Exit
.1 Exit Meeting
On June 6, 2003, the inspectors presented the inspection results to Mr. W. OConnor and members of his staff. The licensee acknowledged the findings presented. The inspectors noted that no materials reviewed or discussed during the inspection were designated or indicated as proprietary. The inspectors discussed the likely content of the inspection report and requested that any proprietary information discussed be identified. Licensee personnel did not indicate any proprietary or possible proprietary information presented.
.2 Interim Exit Meetings
No interim exits were conducted.
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee
- W. OConnor, Vice President, Nuclear Generation
- S. Berry, SSDI Technical Coordinator
- D. Cobb, Plant Manager
- R. Libra, Director, Nuclear Engineering
- W. Miller, Manager Engineering
- J. Pendergast, Principal Engineer Licensing
- N. Peterson, Manager, Nuclear Licensing
- S. Stasek, Director, Nuclear Assessment
- E. Stoltz, Systems Engineer
Nuclear Regulatory Commission
- S. Campbell, Senior Resident Inspector
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened
50-341/03-07-02(DRS) URI Non-conservative Acceptance Limit for the Time Delay Relay Did Not Assure the Availability of the Vital Buses 50-341/03-07-01(DRS) URI Possible Failure to Provide a Program with Controls to Measure and Minimize Leakage of Highly Radioactive Fluids Outside Containment During a Serious Transient or Accident
Opened and Closed
None.
Closed
None.
Discussed
None.
Attachment