ML020950889
| ML020950889 | |
| Person / Time | |
|---|---|
| Site: | Point Beach  |
| Issue date: | 04/03/2002 |
| From: | Dyer J NRC/RGN-III |
| To: | Warner M Nuclear Management Co |
| References | |
| EA-02-031 IR-01-017 | |
| Download: ML020950889 (25) | |
See also: IR 05000266/2001017
Text
April 3, 2002
Mr. M. Warner
Site Vice President
Kewaunee and Point Beach Nuclear Plants
Nuclear Management Company, LLC
6610 Nuclear Road
Two Rivers, WI 54241
SUBJECT:
POINT BEACH SPECIAL INSPECTION - NRC INSPECTION
REPORT 50-266/01-17(DRS); 50-301/01-17(DRS), PRELIMINARY
RED FINDING
Dear Mr. Warner:
Your staff notified the NRC of a potential common mode failure, discovered by the Nuclear
Management Company, of auxiliary feedwater pumps at the Point Beach Nuclear Plant. In
response to the notification, the NRC conducted a Special Inspection at the facility. The
reported potential common mode failure met the NRC Management Directive 8.3, NRC
Incident Investigation Program, threshold for a Special Inspection in that the potential common
mode failure could have led to a loss of safety function. The Special Inspection was conducted
December 3, 2001, through February 28, 2002, in accordance with Inspection Procedure 93812, Special Inspection. On February 28, 2002, the NRC discussed with you and members
of your staff, by telephone, the results of the Special Inspection. The enclosed report presents
the results of that inspection.
This report discusses an issue that appears to have high safety significance. As described in
Section 4OA3.1 of this report, your staff identified a potential common mode failure of the
auxiliary feedwater pumps due to inadequate operator actions in response to a loss of
instrument air. Although your staff identified this issue in November 2001, the inspection
identified that inadequate procedure guidance had existed for many years and that there were
seven prior opportunities to identify the issue. The failures to provide adequate procedural
guidance and to take appropriate corrective actions were both apparent violations of 10 CFR Part 50, Appendix B, Criteria V and XVI. This issue was assessed using the applicable
Significance Determination Process and was preliminarily determined to be Red, an issue with
high safety significance that may result in additional NRC inspection. This issue is of high
safety significance because a common mode failure of auxiliary feedwater pumps would result
in substantially reduced mitigation capability for safely shutting down the plant in response to
certain transients. Your staff took prompt corrective actions to revise procedures and train
operators to address the immediate safety concerns associated with the issue. Additionally,
you recently installed backup pneumatic supplies for the recirculation valves to improve the
safety of the auxiliary feedwater system design.
M. Warner
-2-
Two apparent violations of NRC requirements were identified during the inspection and are
being considered for escalated enforcement action in accordance with the "General Statement
of Policy and Procedure for NRC Enforcement Actions" (Enforcement Policy), NUREG-1600.
The current Enforcement Policy is included on the NRCs website at www.nrc.gov.
Before the NRC makes a final decision on these matters, we are providing you an opportunity
to request a Regulatory Conference where you would be able to provide your perspectives on
the significance of the findings, the bases for your position, and whether you agree with the
apparent violations. If you choose to request a conference, we encourage you to submit your
evaluation and any differences with the NRC evaluations at least one week prior to the
conference in an effort to make the conference more efficient and effective. If a conference is
held, it will be open for public observation. The NRC will also issue a press release to
announce the conference.
Please contact Mr. John M. Jacobson at (630) 829-9736 within seven days of the date of this
letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will
continue with our significance determination and enforcement decision and you will be advised
by separate correspondence of the results of our deliberations on these matters.
Since the NRC has not made a final determination in this matter, no Notice of Violation is being
issued for these inspection findings at this time. In addition, please be advised that the number
and characterization of apparent violations described in the enclosed inspection report may
change as a result of further NRC review.
In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter,
its enclosure, and your responses will be available electronically for public inspection in the
NRC Public Document Room or from the Publicly Available Records (PARS) component of
NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at
http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
/RA/
J. E. Dyer
Regional Administrator
Docket Nos. 50-266; 50-301
Enclosure:
Special Inspection Report 50-266/01-17(DRS);
50-301/01-17 (DRS)
See Attached Distribution
M. Warner
-3-
Distribution
cc w/encl:
R. Grigg, President and Chief
Operating Officer, WEPCo
R. Anderson, Executive Vice President
and Chief Nuclear Officer
T. Webb, Licensing Manager
D. Weaver, Nuclear Asset Manager
T. Taylor, Plant Manager
A. Cayia, Site Director
J. ONeill, Jr., Shaw, Pittman,
Potts & Trowbridge
K. Duveneck, Town Chairman
Town of Two Creeks
D. Graham, Director
Bureau of Field Operations
A. Bie, Chairperson, Wisconsin
Public Service Commission
S. Jenkins, Electric Division
Wisconsin Public Service Commission
State Liaison Officer
M. Warner
-2-
Two apparent violations of NRC requirements were identified during the inspection and are
being considered for escalated enforcement action in accordance with the "General Statement
of Policy and Procedure for NRC Enforcement Actions" (Enforcement Policy), NUREG-1600.
The current Enforcement Policy is included on the NRCs website at www.nrc.gov.
Before the NRC makes a final decision on these matters, we are providing you an opportunity
to request a Regulatory Conference where you would be able to provide your perspectives on
the significance of the findings, the bases for your position, and whether you agree with the
apparent violations. If you choose to request a conference, we encourage you to submit your
evaluation and any differences with the NRC evaluations at least one week prior to the
conference in an effort to make the conference more efficient and effective. If a conference is
held, it will be open for public observation. The NRC will also issue a press release to
announce the conference.
Please contact Mr. John M. Jacobson at (630) 829-9736 within seven days of the date of this
letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will
continue with our significance determination and enforcement decision and you will be advised
by separate correspondence of the results of our deliberations on these matters.
Since the NRC has not made a final determination in this matter, no Notice of Violation is being
issued for these inspection findings at this time. In addition, please be advised that the number
and characterization of apparent violations described in the enclosed inspection report may
change as a result of further NRC review.
In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter,
its enclosure, and your responses will be available electronically for public inspection in the
NRC Public Document Room or from the Publicly Available Records (PARS) component of
NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at
http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
/RA/
J. E. Dyer
Regional Administrator
Docket Nos. 50-266; 50-301
Enclosure:
Special Inspection Report 50-266/01-17(DRS);
50-301/01-17 (DRS)
See Attached Distribution
DOCUMENT NAME: G:DRS\\ML020950889.wpd / *See Previous Concurrence
To receive a copy of this document, indicate in the box: "C" = Copy without attachment/enclosure "E" = Copy with attachment/enclosure "N" = No copy
OFFICE
RIII *
RIII *
E RIII *
RIII
NAME
RLangstaff:sd
KOBrien for
JJacobson
MKunowski for
RLanksbury
BClayton
DATE
03/29/02
03/29/02
03/28/02
4/2/02
OFFICE
RIII
RIII
NAME
JGrobe
JDyer
DATE
4/2/02
4/3/02
OFFICIAL RECORD COPY
M. Warner
-3-
Distribution
cc w/encl:
R. Grigg, President and Chief
Operating Officer, WEPCo
R. Anderson, Executive Vice President
and Chief Nuclear Officer
T. Webb, Licensing Manager
D. Weaver, Nuclear Asset Manager
T. Taylor, Plant Manager
A. Cayia, Site Director
J. ONeill, Jr., Shaw, Pittman,
Potts & Trowbridge
K. Duveneck, Town Chairman
Town of Two Creeks
D. Graham, Director
Bureau of Field Operations
A. Bie, Chairperson, Wisconsin
Public Service Commission
S. Jenkins, Electric Division
Wisconsin Public Service Commission
State Liaison Officer
ADAMS Distribution:
SECY
W. Kane, DEDRP
F. Congel, OE
J. Luehman, OE
C. Nolan, OE
J. Dyer, RIII:RA
D. Dambly, OGC
S. Collins, NRR
R. Borchardt, NRR
M. Johnson, NRR
Enforcement Coordinators
RI, RII, RIII, RIV
T. Frye, NRR
Resident Inspector
S. Gagner, OPA
H. Bell, OIG
F. Combs, OSTP
D. Dandois, OCFO/DAF/LFARB
WDR
BAW
RidsNrrDipmIipb
GEG
PGK1
C. Ariano (hard copy)
DRPIII
DRSIII
PLB1
JRK1
J. Strasma, RIII:PA
R. Lickus, RIII
J. Lynch, RIII
OEMAIL
U.S. NUCLEAR REGULATORY COMMISSION
REGION III
Docket Nos:
License Nos:
50-266; 50-301
Report No:
50-266/01-17(DRS); 50-301/01-17(DRS)
Licensee:
Nuclear Management Company, LLC
Facility:
Point Beach Nuclear Plant, Units 1 & 2
Location:
6610 Nuclear Road
Two Rivers, WI 54241
Dates:
December 3, 2001, through February 28, 2002
Lead Inspector:
R. Langstaff, Senior Reactor Inspector
Mechanical Engineering Branch
Inspectors:
S. Burgess, Senior Reactor Analyst
Division of Reactor Safety
A. Dunlop, Senior Reactor Inspector
Mechanical Engineering Branch
G. ODwyer, Reactor Inspector
Mechanical Engineering Branch
R. Powell, Resident Inspector
Point Beach Nuclear Plant
Approved By:
J. Jacobson, Chief
Mechanical Engineering Branch
Division of Reactor Safety
2
SUMMARY OF FINDINGS
IR 05000266-01-17(DRS), 05000301-01-17(DRS), on 12/03/2001-02/28/2002, Nuclear
Management Company, LLC, Point Beach Nuclear Plant. Special Inspection.
This Special Inspection was conducted by a team of three Region III inspectors, a
Region III senior reactor analyst, and a resident inspector. The inspection identified one
finding preliminarily of high safety significance (Red) with two associated apparent
violations. The significance of this finding is indicated by the color Red using Inspection
Manual Chapter 0609, Significance Determination Process (SDP). The NRCs program
for overseeing the safe operation of commercial nuclear power reactors is described at its
Reactor Oversight Process website at http://www.nrc.gov/NRR/OVERSIGHT/index.html.
A.
Findings
Cornerstone: Mitigating Systems
TBD. Units 1 and 2. The licensee identified a potential common mode failure of
the auxiliary feedwater pumps due to operator actions specified in plant
procedures. The team identified that procedural guidance provided to operators
was inadequate to prevent such a common mode failure. In addition, the team
identified that the licensee had seven opportunities, from 1981 through 1997, to
identify the problem and take appropriate corrective actions. The failures to
provide adequate procedural guidance and to take appropriate corrective actions
are both apparent violations of 10 CFR Part 50, Appendix B, Criteria V and XVI.
This issue has been preliminarily determined to have high safety significance
(Red). A common mode failure of the auxiliary feedwater pumps would result in
substantially reduced mitigation capability for safely shutting down the plant in
response to certain transients. The significance was determined to be high
largely due to the relatively high initiating event frequencies associated with the
involved transients and the high likelihood of improper operator actions due to
the procedural inadequacies. (Section 4OA3.1)
3
Report Details
Summary of Plant Status:
At the beginning of the inspection period, Unit 1 was being operated at approximately
98 percent power for work associated with the plant process computer system (PPCS). Unit 1
continued to be operated at 98 percent power until December 18, when power was reduced to
30 percent to reduce the potential dose to workers for a containment entry to isolate a small
leak on the sensing line for 1PT-420, reactor coolant system (RCS) wide range pressure
detector. Unit 1 was returned to 98 percent power on December 19 and to 100 percent power
on December 24 after the PPCS modification was accepted for Rated Thermal Power
calculation purposes. Unit 1 continued to be operated at or near full power throughout the
remainder of inspection period.
At the beginning of the inspection period, Unit 2 was being operated at approximately
98 percent power for work associated with the PPCS. Unit 2 continued to be operated at 98
percent power until December 7, when power was reduced to 92 percent for condenser steam
dump testing. Unit 2 was returned to 98 percent power on December 19 and to 100 percent
power on December 24 after the PPCS modification was accepted for Rated Thermal Power
calculation purposes. Unit 2 was shutdown on February 22, 2002, to meet a Technical
Specification action statement regarding a safety injection pump. A rotating assembly for a
safety injection pump was replaced and Unit 2 was returned to criticality on February 25, 2002.
Unit 2 continued to be operated at or near full power throughout the remainder of inspection
period.
4.
OTHER ACTIVITIES (OA)
4OA3 Event Follow-Up (93812)
.1
Potential Common Mode Failure of Auxiliary Feedwater Pumps Due To Operator
Actions
.a
Inspection Scope
The potential common mode failure of auxiliary feedwater pumps, reported by the
licensee on November 29, 2001, met the NRC Management Directive 8.3, NRC
Incident Investigation Program, threshold for a Special Inspection in that the potential
common mode failure could have led to a loss of safety function. The team performed
inspection activities as specified by the charter for the Special Inspection. The charter
was outlined in NRC memorandum from John M. Jacobson to Ronald A. Langstaff,
dated November 30, 2001. The charter directed review of the following areas:
Timeline development relating to contributors and discovery of the potential
common mode failure of the auxiliary feedwater (AFW) system due to the loss of
instrument air.
4
Adequacy of licensees operability evaluation and immediate corrective actions
for addressing impact of the loss of instrument air on AFW.
Preliminary determination of risk significance.
Apparent cause of condition resulting in potential loss of AFW upon loss of
instrument air.
Evaluation of pressurizer power operated relief valve (PORV) modifications
impact on operational capability in response to loss of feedwater.
Extent of condition of the adequacy of engineering review of instrument air
system, other air operated valves, and failure modes.
Failure of the original individual plant examination (IPE) to consider AFW
recirculation valve function.
.b
Findings
One finding involving two apparent violations was identified regarding the potential
common mode failure of the AFW pumps due to operator actions. An apparent
violation of 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and
Drawings, was identified for failure to have adequate guidance in emergency operating
procedures to prevent damage to AFW pumps. The second apparent violation was of
10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, and was identified for
failure to promptly identify and correct the significant condition adverse to quality relating
to potential common mode failure of AFW pumps. The finding associated with the
violations was preliminarily determined to be of high safety significance (Red).
(1)
Event Description
The licensee probabilistic risk analysis (PRA) staff identified a vulnerability associated
with AFW recirculation valves. The recirculation valves were air operated valves which
failed closed upon a loss of instrument air. Consequently, in certain transients, such as
a loss of instrument air, a loss of off-site power, a loss of service water, or a seismic
event, the flow path via the recirculation lines would be lost due to the recirculation
valves failing closed upon a loss of instrument air. Closure of the recirculation valves
could result in pump failure under low flow conditions such as when AFW flow was
throttled back to control steam generator level or mitigate RCS overcooling.
The PRA staff identified the vulnerability while updating the Point Beach PRA model for
internal events. The PRA staff originally considered the vulnerability to be a procedural
weakness associated with abnormal operating procedure (AOP) 5B, Loss of Instrument
Air. The original concern was that the steps to restore AFW pump recirculation flow did
not occur sufficiently early in the procedure. Condition Report (CR) 01-2278 was
initiated on July 6, 2001, to document the concern. The PRA staff continued
discussions with operations personnel over the next several months with regards to the
vulnerability. In November 2001, the PRA staff completed their internal events modeling
and determined that the vulnerability resulted in a substantial increase in risk. On
5
November 28, 2001, the PRA staff, engineering personnel, and operations personnel
met to discuss the significance of the vulnerability and potential courses of action. On
November 29, 2001, operations personnel concluded that temporary information tags
and operator briefings were necessary to address the vulnerability. CR 01-3595 was
initiated to document the increased risk and to address the vulnerability. The NRC was
also formally notified (Event Notification 38525) on November 29, 2001. The issue was
subsequently reported by Licensee Event Report (LER) 266/2001-005-00, submitted on
January 28, 2002.
(2)
System Description
Point Beach Nuclear Plant is a two unit site. Each unit has a turbine driven AFW pump
(pumps 1P29 and 2P29) which can supply water to both steam generators. Additionally,
the plant has two motor driven AFW pumps (pumps P39A and P39B) each of which can
be aligned to a steam generator in each unit. The recirculation valves for both the
turbine driven and motor driven pumps would open for the initial 45 seconds after pump
start and would open on low flow conditions. However, the recirculation valves were air
operated valves which failed closed upon a loss of instrument air. The control room had
valve position indication for the recirculation valves, flow indication to individual steam
generators, and flow indication to the steam generators from each pump. However, the
flow element for providing flow indication for each pump was downstream of where the
recirculation line branched off from the discharge line. Consequently, the flow indication
for each pump would not indicate recirculation line flow.
The AFW recirculation lines were installed, as part of original construction, to ensure the
pump would have a flow path to prevent dead-heading the pump, which would damage
the pump. Discussions with licensee engineering staff indicated that a pump could be
damaged within minutes under insufficient flow conditions due to lack of cooling. The
initial lines installed included an orifice that allowed a 30 gallons per minute (gpm) flow
rate. This flow rate was determined by the pump vendor, Byron Jackson, to be sufficient
to prevent pump damage based on pump heat-up when on recirculation flow. The
recirculation lines were subsequently modified in 1988, in response to Bulletin 88-04,
Potential Safety-Related Pump Loss, to accommodate a greater recirculation flow rate
and protect the pump from low flow instabilities.
(3)
Procedural Guidance
Emergency Operating Procedure (EOP)-0.1, Reactor Trip Response, directed
operators to control feedwater flow early in the procedure. Procedure EOP-0.1 was the
procedure which operators would use for most transients. Response not obtained
(RNO) column step 1.c of the procedure directed operators to reduce feed flow if reactor
coolant system (RCS) temperatures were less than 547 degrees () Fahrenheit (F) and
trending lower. Step 4.b directed operators to control feed flow to maintain steam
generator levels between 29 percent and 69 percent. RNO step 4.b directed operators
to stop feed flow to intact steam generators if level continued to rise. If instrument air
had been lost, damage would occur to the AFW pumps by these operator actions to
control feedflow due to the low flow conditions created. The team noted that procedure
OM 4.3.1, AOP and EOP Writers Guide, step 5.4.2 stated, A caution is used to
present information regarding potential hazards to personnel or equipment associated
6
with the subsequent step(s). The emergency operating procedures steps did not
provide any such cautions prior to November 30, 2001.
Portions of the EOP-0.1 steps one and four are illustrated below:
STEP
ACTION/EXPECTED RESPONSE
RESPONSE NOT OBTAINED
1
Verify RCS Temperature Control:
Perform the following:
a. Check RCS wide range cold leg
temperatures:
LESS THAN OR EQUAL TO
547 F
AND
STABLE
1. IF RCS cold leg temperature less
than 547 F AND RCS
temperatures are trending lower,
THEN stabilize RCS temperature
as follows:
a) Stop dumping steam.
b) Ensure S/G blowdown
isolations - SHUT
c) IF cooldown continues, THEN
control feed flow:
1) Reduce total feed flow.
2) Maintain total feed flow
greater than or equal to
200 gpm until level greater
than 29 percent in at least
one S/G.
STEP
ACTION/EXPECTED RESPONSE
RESPONSE NOT OBTAINED
4
Stabilize S/G Levels:
a. Check S/G/ levels - GREATER
THAN 29 percent
a. Maintain total feedflow greater
than 200 gpm until level greater
than 29 percent in at least one
S/G
b. Control feed flow to maintain
S/G levels between 29 percent
and 65 percent
b. IF level in intact S/G continues to
rise, THEN stop feed flow to that
S/G.
Based on discussions with licensee engineering staff, the team determined that the time
that the AFW recirculation valves would fail closed due to loss of instrument air could
vary. The engineering staff had determined that the recirculation valves would begin to
drift shut when instrument air header pressure was reduced to 40 pounds per square
inch gauge (psig) and would be fully closed at 25 psig. The instrument air header
pressure was nominally maintained at 100 psig with some variation due to cycling of air
compressors. Based on observations of instrument air header pressure drop between
cycling of air compressors, the engineering staff determined that the instrument air head
pressure would drop approximately 13.5 pounds per square inch in one minute under
normal loads. The engineering staff estimated that the AFW recirculation valves would
7
begin to drift shut approximately six to eight minutes after loss of all air compressors with
complete valve closure one to two minutes thereafter. A loss of instrument air due to a
leak in an airline versus a loss of air compressors would result in different bleed down
rates, depending on the size of the break. Additionally, the instrument air bleed down
rate could be faster due to greater demands on the instrument air system in response to
the transient.
Based on discussions with operating licensee personnel, the preferred method for
controlling AFW flow was by throttling or closing the AFW flow control valves (for the
motor driven AFW pumps) or discharge valves (for the turbine driven AFW pumps)
rather than securing the pumps. The team noted that Section 14.1.12, Loss of All AC
Power to the Station Auxiliaries, of the original Final Facility Description and Safety
Analysis Report (FFDSAR), stated, The reactor operator in the control room can
monitor the steam generator water level and control the feedwater flow with remote
operated AFW control valves. The FFDSAR did not discuss securing AFW pumps as a
means to control steam generator levels. Additionally, the team noted that in some loss
of instrument air scenarios (e.g., those involving RCS overcooling), the recirculation
valves could remain open at the time that operators throttle or close flow control and
discharge valves due to remaining air header pressure. However, the recirculation
valves would subsequently close due to decreasing air pressure. Consequently, the
valves could reposition at a time when an operators attention would not be directly
focused on the AFW pumps.
Operating experience demonstrated that operators would drastically reduce AFW flow
within several minutes of pump start due to RCS overcooling under some transient
conditions. For example, on June 27, 2001, the Unit 2 reactor was manually tripped due
to low and decreasing water level in the Unit 2 circulating water pump bay (reported in
LER 05000301/2001-002-00). Due to subsequent low steam generator water levels, the
Unit 2 turbine driven AFW pump and both motor driven AFW pumps initiated and began
feeding the Unit 2 steam generators. One steam generator in a unit nominally requires
200 gpm feedwater flow for decay heat removal. However, with three AFW pumps
running, approximately 800 gpm of feedwater flow - approximately four times the
required flow, was provided to the Unit 2 steam generators. Consequently, the reactor
coolant system was cooled down at an excessive rate. Approximately three minutes
after the reactor was tripped, operators closed either the flow control valves or the
discharge valves to stop flow from the motor driven AFW pumps. Approximately four
minutes after the reactor was tripped, operators closed the discharge valves from the
Unit 2 turbine driven AFW pump stopping all AFW flow to the steam generators. The
AFW pumps were not secured until approximately eight minutes after the reactor was
tripped when feed flow using main feedwater was partially restored. In this particular
event, the AFW recirculation valves were functional because instrument air had not been
lost. However, had instrument air not been available, as would happen in transients
such as loss of instrument air, loss of off-site power, and loss of service water events, all
AFW pumps could have been damaged.
Procedure AOP-5B, Loss of Instrument Air, provided operators guidance for loss of
instrument air. However, the team noted that, during these transients, operators would
typically be using emergency operating procedures, such as EOP-0.1, in their initial
response to a transient. After plant conditions stabilized, abnormal operating
8
procedures, such as AOP-5B, would be used to restore equipment. The team reviewed
procedure AOP-5B and determined that procedural steps were provided to secure open
the AFW pump recirculation valves. However, guidance to secure open the valves did
not appear until step 1 of Attachment R, Auxiliary Feed, located on page 36 of the
procedure. Operators were directed to Attachment R by step 26 (located on page 14) of
the procedure. Step 26 simply directed operators to check plant systems status per
attachments A through Z. Consequently, although procedure AOP-5B had steps which
addressed the recirculation valves, the team determined that operators would likely
damage all AFW pumps by following the emergency operating procedures given the
transient timelines described above.
(4)
Regulatory Issue Associated With Procedure Guidance
10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures, and Drawings,
requires, in part, that activities affecting quality be prescribed by documented
instructions, procedures, or drawings, of a type appropriate to the circumstances. As of
November 29, 2001, procedures EOP-0.1 Unit 1, Reactor Trip Response, Revision 24,
and EOP-0.1 Unit 2, Reactor Trip Response, Revision 23, addressing activities
affecting quality, were not of a type appropriate to the circumstances. Specifically, the
procedures did not provide adequate guidance to operators regarding the potential to
damage AFW pumps while controlling AFW flow upon low instrument air header
pressure, which would cause the recirculation valves to fail closed. Because the
procedures did not include instructions to ensure the recirculation valves were open, the
AFW pumps could be damaged under low flow conditions such as when the flow is
throttled back to control steam generator level or to mitigate RCS overcooling. This
issue is considered an apparent violation (AV 50-266/01-17-01; 50-301/01-17-01).
(5)
Operator Training
The team reviewed licensed operator training lesson plans and simulator scenarios for
training conducted prior to November 29, 2001, and interviewed licensed reactor
operators and senior reactor operators to evaluate the emphasis placed on the effect of
loss of instrument air on AFW operability prior to November 29, 2001. The team
determined:
Operators were trained on and knowledgeable of the fail-safe position of air
operated valves including the AFW recirculation valves. No emphasis, however,
was placed on the consequence of the fail-closed AFW recirculation valves.
Lesson Plan 2672, Instrument Air and Service Water Review, outlined training
on the loss of instrument air PRA initiating event. The outline addressed the loss
of instrument air effect on secondary cooling. The lesson plan stated that the
turbine-driven AFW pump would be available for feeding the steam generator -
loss of instrument air had no effect and that the pressure control valves for the
motor-driven AFW pumps fail open upon a loss of pneumatic supply providing a
flow path from the motor-driven AFW pumps to the steam generators. The team
noted that the training only addressed the forward flow aspect of AFW to feed
the steam generators. The training did not address the consequences of the
fail-closed recirculation valves causing pump damage.
9
No simulator training scenario, including loss of offsite power and loss of
instrument air, had included the failure of an AFW pump due to loss of
recirculation flow. The licensee's training staff informed the team that the
simulator, as modeled, would not fail an AFW pump due to low flow conditions
as would likely occur in the plant.
(6)
Operability Evaluation
The team reviewed the licensee's initial operability determination screen completed by a
senior reactor operator on November 29, 2001. The documented basis for system
operability was satisfactory completion of required surveillance testing. The team noted
that the operability determination screen did not address the potential simultaneous
failure of all AFW pumps due to loss of instrument air and procedurally directed operator
actions (the specific issue identified by the CR). The site resident inspectors engaged
licensee management (duty shift supervisor and operations manager) on the adequacy
of the operability determination screen. Licensee management assured the resident
inspectors that extensive discussions of system operability were conducted involving
both operations and engineering and the operability determination was adequate. After
questions by the resident inspectors, the licensee initiated a formal engineering
operability determination on November 30, 2001. The team reviewed Revision 1 of the
formal engineering operability determination. The operability determination concluded
that the AFW system was operable but nonconforming and specified necessary
procedural revisions.
(7)
Licensee Corrective Actions
The licensee revised procedures EOP 0, Reactor Trip or Safety Injection, and
EOP 0.1, Reactor Trip Response, on November 30, 2001, to provide additional
guidance to operators. The foldout pages for both procedures were revised to state:
IF any AFW pump mini-recirc valve fails shut, THEN maintain minimum
flow or stop the affected AFW pump as necessary to control S/G levels.
P-38A minimum flow - GREATER THAN 50 GPM
P-38B minimum flow - GREATER THAN 50 GPM
P-29 minimum flow - GREATER THAN 75 GPM
The above guidance addressed overfilling of steam generators which would, generally,
take longer than 10 minutes after the transient initiated. Consequently, under such
circumstances, had instrument air failed, it would have likely bled down to the point of
failing the recirculation valves shut before operators would have taken actions to
drastically control AFW flow. As such, the operators would have had the opportunity,
when controlling AFW flow, to observe that the recirculation valves had failed shut.
The licensee PRA staff subsequently identified that operator action to control AFW flow
could be required much earlier in a transient due to RCS overcooling before the
10
recirculation valves would shut due to a loss of instrument air. In response to this issue,
the licensee revised the foldout page for procedures ECA-0.0, Loss of all AC Power,
EOP 0, and EOP 0.1, on December 20, 2001, to state:
IF any AFW pump mini-recirc valve fails shut OR annunciator C01 A 1-9,
INSTRUMENT AIR HEADER PRESSURE LOW in alarm, THEN monitor
and maintain minimum AFW flow or stop the affected AFW pump as
necessary to control S/G levels.
P-38A minimum flow - GREATER THAN 50 GPM
P-38B minimum flow - GREATER THAN 50 GPM
P-29 minimum flow - GREATER THAN 75 GPM
The team reviewed an operations notebook entry, dated December 27, 2001, and
determined that operations staff had also changed the annunciator for low instrument air
header pressure to a green color. The change was made to make the annunciator tile
stand out if a large number of alarms are received at one time. The majority of
annunciator tiles were the color white.
(8)
Failures to Identify Significant Condition Adverse to Quality
The team identified a number of opportunities which the licensee had prior to 2001 to
identify that the failure mode of the AFW recirculation valves conflicted with operating
practice. The specific instances were as follows:
1981
In Generic Letter (GL) 81-14, Seismic Qualifications for Auxiliary Feedwater
Systems, the NRC requested that the licensee perform a walk-down of the non-
seismically qualified portions of their AFW systems to identify apparent and
practically correctable deficiencies that may exist. The GL specifically identified
instrument air for AFW control valves as a potential issue. In Attachment 1,
Section IV, of their response, dated May 4, 1982, the licensee documented that
the AFW recirculation valves are now normally open and fail close. The
licensee did not address the impact that the valves failing closed could have on
the system.
1988
GL 88-14, Instrument Air Supply System Problems Affecting Safety-Related
Equipment, requested that licensees perform a design verification of the entire
instrument air system including an analysis of current air operated component
failure positions to verify that they were correct for assuring required safety
functions. The licensees response, dated February 20, 1989, stated under
action item 2 that Abnormal Operating Procedure AOP-5B, Loss of Instrument
Air, provided operators with a listing of component failure positions due to loss
of instrument air and the actions that might be necessary for various systems
and/or components. The licensee failed to recognize that the emergency
operating procedures did not include appropriate guidance.
1989
In their April 17, 1989, submittal to the NRC in response to 10 CFR 50.63, Loss
of All Alternating Current, (i.e., the station blackout rule), the licensee stated that
no air-operated valves are required to operate to cope with a station blackout for
one hour.
11
1991
The original PRA performed in response to GL 88-20, Individual Plant
Examination for Severe Accident Vulnerabilities, did not model the recirculation
valves failing closed upon loss of instrument air. Consequently, the interaction
between the instrument air system and the AFW system was not fully evaluated.
1994
The design basis document (DBD) for the AFW system, DBD-01 dated April
1994, stated that recirculation valves had a safety function to open and remain
open. However, the identified safety function for the valves to open was not
reconciled with the valves failure mode to fail closed upon a loss of instrument
air.
1997
In March 1997, the licensee identified an AFW system failure mode due to
instrument air (reported by LER 97-014-00). Specifically, the flow control valves
for the motor driven AFW pumps were air operated valves which failed open. In
certain scenarios, such as a main steam line break coincident with a loss of
instrument air, the motor driven AFW pumps could be in a run-out condition and
trip the circuit breakers for the pumps. As a result of identifying this vulnerability,
the licensee installed nitrogen back-up for the motor driven pump flow control
valves. However, the licensee did not adequately review the function of other air
operated valves in the AFW system such as the recirculation valves.
1997
In October 1997, a contractor working on the revision of the licensees inservice
testing (IST) program identified the discrepancy between the IST background
document and the AFW system DBD for the safety function of the valves in the
recirculation line. The IST background document stated the check valves did not
have a safety function to open since there was always adequate flow to the
steam generator such that the recirculation flow path was not needed to protect
the pump. The AFW system DBD stated that the recirculation valves, and,
hence, the recirculation lines, did have a safety function to open to protect the
pumps. The issue was documented on CR 97-3363 and investigated. In their
investigation, the licensee focused on ensuring that the AFW system would
provide adequate flow to the steam generators. For the turbine-driven pumps,
the valve lineup was such that there was normally a flow path to the generator.
The only power-operated valves in the line were motor-operated valves (MOVs)
to each steam generator that were normally in the throttled position. For the
motor-driven pumps, although there were normally closed valves (one control
valve and an MOV to each steam generator) in the discharge path, these valves
received an open signal on pump start to provide an adequate flow path. The
dead-heading of the motor-driven pump could occur if the control valve or MOV
failed to open. Based on single failure criteria, this type of failure would only
affect one of the two motor-driven pumps. Based on this evaluation, the licensee
deleted the open safety-function of the recirculation valves from DBD-1.
However, the licensee failed to address operator actions which could be taken to
control AFW flow to prevent overcooling of the RCS or overfilling the steam
generators. As such, the licensee failed to identify that multiple AFW pumps
(both turbine driven and motor driven) could be damaged by the failure mode of
the AFW recirculation valves.
12
(9)
Regulatory Issue Associated With Failures to Identify Significant Condition Adverse to
Quality
10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, requires, in part, that
measures be established to assure that conditions adverse to quality are promptly
identified and corrected. In the case of significant conditions adverse to quality, the
measures shall assure that the cause of the condition is determined and corrective
actions taken to preclude repetition. As of November 2001, the licensee failed to identify
that the AFW system was not capable of performing its safety function under certain
conditions. Specifically, all AFW pumps would be subject to a common mode failure
involving dead-heading of AFW pumps following a loss of instrument air, loss of offsite
power, loss of service water, or a seismic event due to the closure of the recirculation
valves upon loss of the non-safety grade, non-seismically qualified instrument air system
and prescribed operation actions to control feedwater flow in response to transient
conditions. On seven occasions between 1981 and 1997, the licensee was made aware
of the susceptibility of the AFW system to this type of vulnerability, but the licensee failed
to identify this significant condition adverse to quality. This issue is considered an
apparent violation (AV 50-266/01-17-02; 50-301/01-17-02).
(10) Pressurizer PORV Impact on Operational Capability
The pressurizer PORVs were air operated valves which were provided with a backup
nitrogen supply. However, since 1979, the back-up nitrogen supply has been isolated,
by procedure, during power operation. A containment entry was required to restore the
back-up nitrogen supply. Consequently, upon a loss of instrument air, the PORVs would
not be available. The safety injection pumps do not provide sufficient discharge
pressure to lift the reactor coolant system safety relief valves. Although the positive
displacement charging pumps provide sufficient discharge pressure to lift and pass
coolant through the code safety relief valves, the charging pumps do not provide
sufficient flow for adequate decay heat removal. Consequently, a loss of instrument air
would result in the loss of effective feed and bleed capability. A loss of auxiliary
feedwater combined with a loss of instrument air, which would also involve a loss of
main feedwater, would result in a loss of decay heat removal capability.
(11) Extent of Condition
The team reviewed the configuration of other significant systems, such as safety
injection, to verify that the recirculation lines did not have air-operated valves which
failed closed upon of loss of instrument air. The team did not identify any other systems
in which a similar vulnerability existed.
(12) Safety Significance
The team evaluated the finding using the Phase 2 process described in Inspection
Manual Chapter 609, Appendix A, Significance Determination of Reactor Inspection
Findings for At-Power Situations. The site specific worksheets for the Point Beach
Nuclear Plant were used. These site specific worksheets had been benchmarked
against the licensees current PRA model for the plant. Based on this review, the team
determined that the most limiting scenario was loss of instrument air. The following
assumptions were made:
13
The exposure time was greater than 30 days.
The initiating event frequency was 1 x 10-3 for loss of instrument air.
No credit for any AFW was applied. The emergency operating procedures used
by operators did not provide adequate guidance to address recirculation valve
closure. Additionally, operators were not trained to specifically recognize the
potential for AFW recirculation valve closure and the consequences. The
licensees PRA staff performed informal calculations which showed overall
human error probabilities in the range of 0.3 to 0.5 (depending on the
calculational method used) for operator actions in response to steam generator
overfill. For operator response to RCS overcooling, the licensees PRA staff
assumed that operator actions would result in failure of the AFW pumps.
For loss of instrument air, feed and bleed capability using the pressurizer PORVs
was not credited because of the reliance upon instrument air.
Based on use of the Point Beach Nuclear Plant site specific worksheets for loss of
instrument air, the finding was preliminarily determined to be of high safety significance
(Red). The dominate sequences involved the loss of instrument air and the loss of
The team also evaluated the finding using the loss of off-site power site specific
worksheets. The assumptions used were similar to those above with the following
exceptions:
The initiating event frequency was 1 x 10-2 for loss of off-site power.
Instrument air would be initially lost upon loss of off-site power because the air
compressors would be automatically stripped from the safeguards power buses.
The initial loss of instrument air would result in damage to the AFW pumps due
to operator actions.
Credit for feed and bleed capability was applied because instrument air could be
restored by manual operators actions. The necessary operator actions were
proceduralized.
Credit for high pressure recirculation was applied because neither safety
injection nor residual heat removal was affected by the finding.
Based on use of the Point Beach Nuclear Plant site specific worksheets for loss of off-
site power, the finding was preliminarily determined to be of high safety significance
(Red). The dominate sequences involve the loss of off-site power and AFW with either
feed and bleed capability or high pressure recirculation being available.
In addition, the finding was evaluated using the loss of service water worksheets.
However, the significance due to loss of service water was not as great as the loss of
instrument air and loss of off-site power transients as described above.
14
.2
Licensee Event Reports
LER 50-266/2001-05; 50-301/2001-05 (Open): PRA assessment of AFW system
reveals procedural vulnerability related to loss of instrument air. The subject of this LER
is discussed in Section 4OA3.1 and two apparent violations were identified. This LER
will remain open pending future inspection review.
4OA6 Meeting(s)
Exit Meeting
On December 13, 2001, at the conclusion of the on-site inspection activities, the lead
inspector presented the initial findings to Mr. Reddemann and other members of
licensee management at Point Beach Nuclear Plant. On February 28, 2002, the team
presented the findings to Mr. Warner and other members of licensee management. The
licensee representatives acknowledged the findings presented. The team identified the
proprietary information reviewed during the inspection and noted that the information
would be handled accordingly. The licensee did not identify any other material reviewed
during the inspection as being proprietary.
15
KEY POINTS OF CONTACT
Licensee
J. Anderson, Manager, Production Planning
F. Cayia, Director, Kewaunee - Point Beach Site
R. Mende, Director, Kewaunee - Point Beach Engineering
M. Reddemann, Vice President - Engineering, Nuclear Management Company
J. Strharsky, Assistant Manager, Operations
M. Warner, Vice President, Kewaunee - Point Beach Site
T. Webb, Manager, Kewaunee - Point Beach Regulatory Affairs
NRC
J. Grobe, Director, Division of Reactor Safety, Region III
J. Jacobson, Chief, Mechanical Engineering Branch, Region III
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened
50-266/01-05
LER
PRA Assessment of Auxiliary Feedwater System Reveals
50-302/01-05
Procedural Vulnerability Related to Loss of Instrument Air
50-266/01-17-01
Potential Common Mode Failure of Auxiliary Feedwater Pumps
50-301/01-17-01
Due to Inadequate Procedural Guidance
50-266/01-17-02
Failure to Identify and Correct Problem Associated With
50-301/01-17-02
Potential Common Mode Failure of Auxiliary Feedwater Pumps
16
LIST OF ACRONYMS USED
Degrees
Abnormal Operating Procedure
Apparent Violation
CFR
Code of Federal Regulations
CR
Condition Report
Design Basis Document
Division of Reactor Projects
Division of Reactor Safety
Enforcement Action
Emergency Operating Procedure
F
Fahrenheit
FFDSAR
Final Facility Description and Safety Analysis Report
GL
Generic Letter
GPM
Gallons Per Minute
Individual Plant Examination
IR
Inspection Report
In Service Testing
LER
Licensee Event Report
Limited Liability Company
Motor Operated Valve
Nuclear Management Company, LLC
NRC
U.S. Nuclear Regulatory Commission
Power Operated Relief Valve
Plant Process Computer System
Probabilistic Risk Analysis
Pounds per Square Inch Gauge
RNO
Response Not Obtained
Significance Determination Process
S/G
17
LIST OF DOCUMENTS REVIEWED
The following is a list of licensee documents reviewed during the inspection, including
documents prepared by others for the licensee. Inclusion on this list does not imply that NRC
team reviewed the documents in their entirety, but, rather that selected sections or portions of
the documents were evaluated as part of the overall inspection effort.
Number
Title
Revision/Date
Procedures
Loss of Instrument Air
Revision 18
AOP-10A Unit 1
Safe Shutdown - Local Control
Revision 32
CSP-H.1 Unit 1
Red
Response to Loss of Secondary Heat Sink
Revision 21
ECA-0.0 Unit 1
Loss of All AC Power
Revision 29
ECA-0.0 Unit 2
Loss of All AC Power
Revision 30
EOP-0 Unit 1
Reactor Trip or Safety Injection
Revision 35
EOP-0 Unit 2
Reactor Trip or Safety Injection
Revision 36
EOP-0.1 Unit 1
Reactor Trip Response
Revision 24
EOP-0.1 Unit 2
Reactor Trip Response
Revision 23
IT 10
Test of Electrically-Driven Auxiliary Feed Pumps
and Valves (Quarterly)
July 5, 2001
OM 4.3.1
Revision 3
Temporary Changes
2001-0871
EOP-0 Unit 1, Reactor Trip or Safety Injection
November 30,
2001
2001-0872
EOP-0 Unit 2, Reactor Trip or Safety Injection
November 30,
2001
2001-0873
EOP-0.1 Unit 1, Reactor Trip Response
November 30,
2001
2001-0874
EOP-0.1 Unit 2, Reactor Trip Response
November 30,
2001
2001-0911
ARP C01 A 1-9, Instrument Air Header Pressure
Low
December 20,
2001
18
2001-0912
ECA-0.0 Unit 1, Loss of All AC Power
December 20,
2001
2001-0913
EOP-0.1 Unit 2, Reactor Trip Response
December 20,
2001
2001-0914
EOP-0 Unit 2, Reactor Trip or Safety Injection
December 20,
2001
2001-0915
EOP-0 Unit 1, Reactor Trip or Safety Injection
December 20,
2001
2001-0916
EOP-0.1 Unit 1, Reactor Trip Response
December 20,
2001
2001-0917
ECA-0.0 Unit 1, Loss of All AC Power
December 20,
2001
Design Basis Documents
Auxiliary Feedwater System
Revision 0
Auxiliary Feedwater System
Revision 1
Instrument & Service Air
Revision 2
DBD-T-46
Station Blackout
Revision 0
Updated Final Safety Analysis Report Sections
4.2
RCS System Design and Operation
June 2000
8.8
Diesel Generator (DG) System
June 2000
9.7
Instrument Air (IA) / Service Air (SA)
June 2000
10.2
Auxiliary Feedwater System (AF)
June 2000
Calculations
N-91-007
Steam Generator Inventories 5 Minutes After an
November 7, 1991
N-91-031
1 & 2 P29 Mini-Recirc Line System
Characteristics
March 19, 1991
N-91-032
Comparison of Nominal Flow Rates from 2P-29
to 2HX-1A and 2HX-1B with the Recirc Line
Open
March 19, 1991
19
Correspondence
NRC Generic Letter No. 81-14, Point Beach
Nuclear Plant, Units 1 and 2
July 16, 1981
Additional Response to NRC Generic Letter 81-14, Point Beach Nuclear Plant, Units 1 and 2
May 4, 1982
Seismic Qualification of the Auxiliary Feedwater
System, Point Beach Nuclear Plant, Units 1 and
2
December 15,
1982
Final Resolution of Generic Letter 81-14,
Seismic Qualification of Auxiliary Feedwater
System, Point Beach Nuclear Plant, Units 1 and
2
April 26, 1985
VPNPD-88-335
Response to NRC Bulletin 88-04
June 28, 1988
VPNPD-88-090
Response to Generic Letter No. 88-14,
Instrument Air System Problems Affecting
Safety-Related Equipment, Point Beach Nuclear
Plant, Units 1 and 2
February 20, 1989
VPNPD-89-216
Response to 10 CFR 50.63, Tac. Nos. 68586
and 68587, Loss of All Alternating Current
Power, Point Beach Nuclear Plant, Units 1 and 2
April 17, 1989
Response to NRC Bulletin 88-04
May 26, 1989
Minimum Flow Analysis
August 7, 1989
VPNPD-95-056
Generic Letter 88-20, Supplement 4, Summary
Report on Individual Plant Examination of
External Events for Severe Accident
Vulnerabilities
June 30, 1995
NPL 97-0186
Licensee Event Report 97-014-00, Auxiliary
Feedwater System Inoperability Due to Loss of
Instrument Air
April 18, 1997
Licensee Event Report 301/2001-002-00,
Manual Reactor Trip Due to Decreasing Water
Level in Circulating Water System
August 17, 2001
NRC Memorandum From John M. Jacobson to
Ronald A. Langstaff, Special Inspection Charter
for Point Beach Potential Common Mode Failure
November 30,
2001
20
Licensee Event Report 266/2001-005-00,
PRA Assessment of Auxiliary Feedwater System
Reveals Procedural Vulnerability Related to Loss
of Instrument Air
January 28, 2002
Condition Reports
97-0930
Questions and Concerns About the use of
Operator Action to Control AFW Flow
March 20, 1997
97-3363
IST Program Design Basis for AFW Minimum
Flow Recirculation Valves
October 15, 1997
98-2575
P-38A AFW Pump Recirc Valve Found Failed
Shut
June 29, 1998
QCR 99-0115
Code Testing Conflict with the Aux Feedwater
Mini-Flow Recirc Check Valves
May 24, 1999
99-3091
Aux Pump Recirc Line Leakage Acceptance
Criteria Questioned
December 3, 1999
01-2278
Auxiliary Feedwater Probabilistic Risk
Assessment (PRA) Model for Loss of Instrument
Air
July 6, 2001
01-3595
Potential common mode failure for all auxiliary
feed pumps under certain initiating events.
November 29,
2001
01-3641
Modifications that had potential to identify
concern
December 4, 2001
01-3654
The development and revision of DBD-01
appears to have been a missed opportunity to
identify a design weakness in the AFW system.
December 6, 2001
Evaluations
RCE 98-148
P-38A AFW Pump Recirc Valve Found Failed
Shut
January 29, 1999
Drawings
M-201, sheet 1
Main & Reheat Steam System
January 20, 2001
M-209, sheet 1
Service Air
May 12, 2001
M-209, sheet 2
Service Air
November 18,
2000
M-209, sheet 3
Instrument Air
November 18,
2000
21
M-209, sheet 4
Instrument Air
October 25, 2001
M-209, sheet 11
Instrument Air
January 19, 1998
M-217, sheet 1
Auxiliary Feedwater System
September 29,
2001
M-217, sheet 2
Auxiliary Feedwater System
February 3, 2001
M-2201, sheet 1
Main & Reheat Steam System
January 20, 2001
Modifications
97-038*A
AFW Motor Driven Pump Discharge Control
Valve Modification
March 24, 1998
97-038*B
AFW Discharge Valve AF-04012 & AF-04019
Modification
June 26, 1998
88-099, Common
AFW Recirc Line Modification
March 27, 1991
88-099*A,
Common
AFW Recirc Line Modification
February 14, 1992
88-099*C,
Common
AFW Recirc Line Modification
February 14, 1992
88-099*D,
Common
AFW Recirc Line Modification
July 1, 1992
Miscellaneous Documents
LP3178
Auxiliary Feedwater System
June 15, 2001
Mod Request IC-
274
Making AFW Recirc Valves Normally Open
Procedure Change
OP-1A,Major
Cold Shutdown to Low Power Operation
December 26,
1978
Procedure Change
OP-1A,Major
Cold Shutdown to Low Power Operation
July 26, 1979
IST Background
Valve Data Sheet
May 17, 2000
97-201
Setpoint Change to the Auxiliary Feedwater By-
pass Control Valves Time Delay Relay Setpoints
(1/2-NC005, 62-P38A and 62-P38B)
December 4, 1997
Action Items Associated with GL 88-14
September 17,
1991
Final Facility Description and Safety Analysis
Report
Original