ML030730761
| ML030730761 | |
| Person / Time | |
|---|---|
| Site: | Kewaunee, Point Beach  |
| Issue date: | 04/03/2002 |
| From: | Dyer J NRC/RGN-III |
| To: | Warner M Nuclear Management Co |
| References | |
| EA-02-301, FOIA/PA-2003-0094 IR-01-017 | |
| Download: ML030730761 (26) | |
See also: IR 05000266/2001017
Text
April 3, 2002
Mr. M. Warner
Site Vice President
Kewaunee and Point Beach Nuclear Plants
Nuclear Management Company, LLC
6610 Nuclear Road
Two Rivers, WI 54241
SUBJECT:
POINT BEACH SPECIAL INSPECTION - NRC INSPECTION
REPORT 50-266/01-17(DRS); 50-301/01-17(DRS), PRELIMINARY
RED FINDING
Dear Mr. Warner:
Your staff notified the NRC of a potential common mode failure, discovered by the Nuclear
Management Company, of auxiliary feedwater pumps at the Point Beach Nuclear Plant. In
response to the notification, the NRC conducted a Special Inspection at the facility. The
reported potential common mode failure met the NRC Management Directive 8.3, "NRC
Incident Investigation Program," threshold for a Special Inspection in that the potential common
mode failure could have led to a loss of safety function. The Special Inspection was conducted
December 3, 2001, through February 28, 2002, in accordance with Inspection Procedure
93812, "Special Inspection." On February 28, 2002, the NRC discussed with you and members
of your staff, by telephone, the results of the Special Inspection. The enclosed report presents
the results of that inspection.
This report discusses an issue that appears to have high safety significance. As described in
Section 40A3.1 of this report, your staff identified a potential common mode failure of the
auxiliary feedwater pumps due to inadequate operator actions in response to a loss of
instrument air. Although your staff identified this issue in November 2001, the inspection
identified that inadequate procedure guidance had existed for many years and that there were
seven prior opportunities to identify the issue. The failures to provide adequate procedural
guidance and to take appropriate corrective actions were both apparent violations of 10 CFR
Part 50, Appendix B, Criteria V and XVI. This issue was assessed using the applicable
Significance Determination Process and was preliminarily determined to be Red, an issue with
high safety significance that may result in additional NRC inspection. This issue is of high
safety significance because a common mode failure of auxiliary feedwater pumps would result
in substantially reduced mitigation capability for safely shutting down the plant in response to
certain transients. Your staff took prompt corrective actions to revise procedures and train
operators to address the immediate safety concerns associated with the issue. Additionally,
you recently installed backup pneumatic supplies for the recirculation valves to improve the
safety of the auxiliary feedwater system design.
M. Warner
Two apparent violations of NRC requirements were identified during the inspection and are
being considered for escalated enforcement action in accordance with the "General Statement
of Policy and Procedure for NRC Enforcement Actions" (Enforcement Policy), NUREG-1600.
The current Enforcement Policy is included on the NRC's website at www.nrc.qov.
Before the NRC makes a final decision on these matters, we are providing you an opportunity
to request a Regulatory Conference where you would be able to provide your perspectives on
the significance of the findings, the bases for your position, and whether you agree with the
apparent violations. If you choose to request a conference, we encourage you to submit your
evaluation and any differences with the NRC evaluations at least one week prior to the
conference in an effort to make the conference more efficient and effective. If a conference is
held, it will be open for public observation. The NRC will also issue a press release to
announce the conference.
Please contact Mr. John M. Jacobson at (630) 829-9736 within seven days of the date of this
letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will
continue with our significance determination and enforcement decision and you will be advised
by separate correspondence of the results of our deliberations on these matters.
Since the NRC has not made a final determination in this matter, no Notice of Violation is being
issued for these inspection findings at this time. In addition, please be advised that the number
and characterization of apparent violations described in the enclosed inspection report may
change as a result of further NRC review.
In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter,
its enclosure, and your responses will be available electronically for public inspection in the
NRC Public Document Room or from the Publicly Available Records (PARS) component of
NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at
http:/lwww.nrc.gov/readinQ-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
IRA!
J. E. Dyer
Regional Administrator
Docket Nos. 50-266; 50-301
Enclosure:
Special Inspection Report 50-266/01-17(DRS);
50-301/01-17 (DRS)
See Attached Distribution
-2-
M. Warner
Distribution
cc w/encl:
-3-
R. Grigg, President and Chief
Operating Officer, WEPCo
R. Anderson, Executive Vice President
and Chief Nuclear Officer
T. Webb, Licensing Manager
D. Weaver, Nuclear Asset Manager
T. Taylor, Plant Manager
A. Cayia, Site Director
J. O'Neill, Jr., Shaw, Pittman,
Potts & Trowbridge
K. Duveneck, Town Chairman
Town of Two Creeks
D. Graham, Director
Bureau of Field Operations
A. Bie, Chairperson, Wisconsin
Public Service Commission
S. Jenkins, Electric Division
Wisconsin Public Service Commission
State Liaison Officer
M. Warner
Two apparent violations of NRC requirements were identified during the inspection and are
being considered for escalated enforcement action in accordance with the "General Statement
of Policy and Procedure for NRC Enforcement Actions" (Enforcement Policy), NUREG-1 600.
The current Enforcement Policy is included on the NRC's website at www.nrc.qov.
Before the NRC makes a final decision on these matters, we are providing you an opportunity
to request a Regulatory Conference where you would be able to provide your perspectives on
the significance of the findings, the bases for your position, and whether you agree with the
apparent violations. If you choose to request a conference, we encourage you to submit your
evaluation and any differences with the NRC evaluations at least one week prior to the
conference in an effort to make the conference more efficient and effective. If a conference is
held, it will be open for public observation. The NRC will also issue a press release to
announce the conference.
Please contact Mr. John M. Jacobson at (630) 829-9736 within seven days of the date of this
letter to notify the NRC of your intentions. If we have not heard from you within 10 days, we will
continue with our significance determination and enforcement decision and you will be advised
by separate correspondence of the results of our deliberations on these matters.
Since the NRC has not made a final determination in this matter, no Notice of Violation is being
issued for these inspection findings at this time. In addition, please be advised that the number
and characterization of apparent violations described in the enclosed inspection report may
change as a result of further NRC review.
In accordance with 10 CFR 2.790 of the NRC's "Rules of Practice," a copy of this letter,
its enclosure, and your responses will be available electronically for public inspection in the
NRC Public Document Room or from the Publicly Available Records (PARS) component of
NRC's document system (ADAMS). ADAMS is accessible from the NRC Web site at
http://www.nrc.qov/reading-rm/adams.html (the Public Electronic Reading Room).
Sincerely,
IRA!
J. E. Dyer
Regional Administrator
Docket Nos. 50-266; 50-301
Enclosure:
Special Inspection Report 50-266/01-17(DRS);
50-301/01-17 (DRS)
See Attached Distribution
DOCUMENT NAME: G:DRS\\POI01-17DRS Special lnsp.wpd / *See Previous Concurrence
To recevl
a copy of this document. Indicate In t.her box* C"
Copy without ettechment/enclosue *E'
Copy with attachmenUt
dosure
'N'
No copy
OFFICE
RII
RIll
TIE Rill
!
RIll
NAME
RLangstaff:sd
KO'Brien for
MKunowski for
BClayton
JJacobson
RLanksbury
%
DATE
/0329/02
03/29/02
03/28/02
4/2/02
OFFICE Rill
Ri ll,,I
[NAME
JGrobe
JDyer
DATE
4/2/02
4/3/02
OFFICIAL RECORD COPY
-2-
iv' vv al I tr
Distribution
cc w/encl:
-,5-
R. Grigg, President and Chief
Operating Officer, WEPCo
R. Anderson, Executive Vice President
and Chief Nuclear Officer
T. Webb, Licensing Manager
D. Weaver, Nuclear Asset Manager
T. Taylor, Plant Manager
A. Cayia, Site Director
J. O'Neill, Jr., Shaw, Pittman,
Potts & Trowbridge
K. Duveneck, Town Chairman
Town of Two Creeks
D. Graham, Director
Bureau of Field Operations
A. Bie, Chairperson, Wisconsin
Public Service Commission
S. Jenkins, Electric Division
Wisconsin Public Service Commission
State Liaison Officer
ADAMS Distribution:
SECY
W. Kane, DEDRP
F. Congel, OE
J. Luehman, OE
C. Nolan, OE
J. Dyer, RIII:RA
D. Dambly, OGC
S. Collins, NRR
R. Borchardt, NRR
M. Johnson, NRR
Enforcement Coordinators
RI, RII, Rill, RIV
T. Frye, NRR
Resident Inspector
S. Gagner, OPA
H. Bell, OIG
F. Combs, OSTP
D. Dandois, OCFO/DAF/LFARB
WDR
BAW
RidsNrrDipmlipb
GEG
PGK1
C. Ariano (hard copy)
DRPIII
DRSIII
PLB1
JRK1
J. Strasma, RIII:PA
R. Lickus, Rill
J. Lynch, Rill
OEMAIL
U.S. NUCLEAR REGULATORY COMMISSION
REGION III
Docket Nos:
License Nos:
Report No:
Licensee:
Facility:
Location:
Dates:
Lead Inspector:
Inspectors:
Approved By:
50-266; 50-301
50-266/01-17(DRS); 50-301/01-17(DRS)
Nuclear Management Company, LLC
Point Beach Nuclear Plant, Units 1 & 2
6610 Nuclear Road
Two Rivers, WI 54241
December 3, 2001, through February 28, 2002
R. Langstaff, Senior Reactor Inspector
Mechanical Engineering Branch
S. Burgess, Senior Reactor Analyst
Division of Reactor Safety
A. Dunlop, Senior Reactor Inspector
Mechanical Engineering Branch
G. O'Dwyer, Reactor Inspector
Mechanical Engineering Branch
R. Powell, Resident Inspector
Point Beach Nuclear Plant
J. Jacobson, Chief
Mechanical Engineering Branch
Division of Reactor Safety
SUMMARY OF FINDINGS
IR 05000266-01-17(DRS), 05000301-01-17(DRS), on 12/03/2001-02/28/2002, Nuclear
Management Company, LLC, Point Beach Nuclear Plant. Special Inspection.
This Special Inspection was conducted by a team of three Region Ill inspectors, a
Region III senior reactor analyst, and a resident inspector. The inspection identified one
finding preliminarily of high safety significance (Red) with two associated apparent
violations. The significance of this finding is indicated by the color Red using Inspection
Manual Chapter 0609, "Significance Determination Process" (SDP). The NRC's program
for overseeing the safe operation of commercial nuclear power reactors is described at its
Reactor Oversight Process website at http://www.nrc.gov/NRRIOVERSIGHT/index.html.
A.
Findings
Cornerstone: Mitigating Systems
TBD. Units 1 and 2. The licensee identified a potential common mode failure of
the auxiliary feedwater pumps due to operator actions specified in plant
procedures. The team identified that procedural guidance provided to operators
was inadequate to prevent such a common mode failure. In addition, the team
identified that the licensee had seven opportunities, from 1981 through 1997, to
identify the problem and take appropriate corrective actions. The failures to
provide adequate procedural guidance and to take appropriate corrective actions
are both apparent violations of 10 CFR Part 50, Appendix B, Criteria V and XVI.
This issue has been preliminarily determined to have high safety significance
(Red). A common mode failure of the auxiliary feedwater pumps would result in
substantially reduced mitigation capability for safely shutting down the plant in
response to certain transients. The significance was determined to be high
largely due to the relatively high initiating event frequencies associated with the
involved transients and the high likelihood of improper operator actions due to
the procedural inadequacies. (Section 40A3.1)
2
Report Details
Summary of Plant Status:
At the beginning of the inspection period, Unit 1 was being operated at approximately
98 percent power for work associated with the plant process computer system (PPCS). Unit 1
continued to be operated at 98 percent power until December 18, when power was reduced to
30 percent to reduce the potential dose to workers for a containment entry to isolate a small
leak on the sensing line for 1 PT-420, reactor coolant system (RCS) wide range pressure
detector. Unit 1 was returned to 98 percent power on December 19 and to 100 percent power
on December 24 after the PPCS modification was accepted for Rated Thermal Power
calculation purposes. Unit 1 continued to be operated at or near full power throughout the
remainder of inspection period.
At the beginning of the inspection period, Unit 2 was being operated at approximately
98 percent power for work associated with the PPCS. Unit 2 continued to be operated at 98
percent power until December 7, when power was reduced to 92 percent for condenser steam
dump testing. Unit 2 was returned to 98 percent power on December 19 and to 100 percent
power on December 24 after the PPCS modification was accepted for Rated Thermal Power
calculation purposes. Unit 2 was shutdown on February 22, 2002, to meet a Technical
Specification action statement regarding a safety injection pump. A rotating assembly for a
safety injection pump was replaced and Unit 2 was returned to criticality on February 25, 2002.
Unit 2 continued to be operated at or near full power throughout the remainder of inspection
period.
4.
OTHER ACTIVITIES (OA)
40A3 Event Follow-Up (93812)
.1
Potential Common Mode Failure of Auxiliary Feedwater Pumps Due To QOerator
Actions
.a
Inspection Scope
The potential common mode failure of auxiliary feedwater pumps, reported by the
licensee on November 29, 2001, met the NRC Management Directive 8.3, "NRC
Incident Investigation Program," threshold for a Special Inspection in that the potential
common mode failure could have led to a loss of safety function. The team performed
inspection activities as specified by the charter for the Special Inspection. The charter
was outlined in NRC memorandum from John M. Jacobson to Ronald A. Langstaff,
dated November 30, 2001. The charter directed review of the following areas:
Timeline development relating to contributors and discovery of the potential
common mode failure of the auxiliary feedwater (AFW) system due to the loss of
instrument air.
3
0
Adequacy of licensee's operability evaluation and immediate corrective actions
for addressing impact of the loss of instrument air on AFW.
0
Preliminary determination of risk significance.
a
Apparent cause of condition resulting in potential loss of AFW upon loss of
instrument air.
0
Evaluation of pressurizer power operated relief valve (PORV) modifications
impact on operational capability in response to loss of feedwater.
Extent of condition of the adequacy of engineering review of instrument air
system, other air operated valves, and failure modes.
Failure of the original individual plant examination (IPE) to consider AFW
recirculation valve function.
.b
Findinqs
One finding involving two apparent violations was identified regarding the potential
common mode failure of the AFW pumps due to operator actions. An apparent
violation of 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and
Drawings," was identified for failure to have adequate guidance in emergency operating
procedures to prevent damage to AFW pumps. The second apparent violation was of
10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," and was identified for
failure to promptly identify and correct the significant condition adverse to quality relating
to potential common mode failure of AFW pumps. The finding associated with the
violations was preliminarily determined to be of high safety significance (Red).
(1)
Event Description
The licensee probabilistic risk analysis (PRA) staff identified a vulnerability associated
with AFW recirculation valves. The recirculation valves were air operated valves which
failed closed upon a loss of instrument air. Consequently, in certain transients, such as
a loss of instrument air, a loss of off-site power, a loss of service water, or a seismic
event, the flow path via the recirculation lines would be lost due to the recirculation
valves failing closed upon a loss of instrument air. Closure of the recirculation valves
could result in pump failure under low flow conditions such as when AFW flow was
throttled back to control steam generator level or mitigate RCS overcooling.
The PRA staff identified the vulnerability while updating the Point Beach PRA model for
internal events. The PRA staff originally considered the vulnerability to be a procedural
weakness associated with abnormal operating procedure (AOP) 5B, "Loss of Instrument
Air." The original concern was that the steps to restore AFW pump recirculation flow did
not occur sufficiently early in the procedure. Condition Report (CR) 01-2278 was
initiated on July 6, 2001, to document the concern. The PRA staff continued
discussions with operations personnel over the next several months with regards to the
vulnerability. In November 2001, the PRA staff completed their internal events modeling
and determined that the vulnerability resulted in a substantial increase in risk. On
4
November 28, 2001, the PRA staff, engineering personnel, and operations personnel
met to discuss the significance of the vulnerability and potential courses of action. On
November 29, 2001, operations personnel concluded that temporary information tags
and operator briefings were necessary to address the vulnerability. CR 01-3595 was
initiated to document the increased risk and to address the vulnerability. The NRC was
also formally notified (Event Notification 38525) on November 29, 2001. The issue was
subsequently reported by Licensee Event Report (LER) 266/2001-005-00, submitted on
January 28, 2002.
(2)
System Description
Point Beach Nuclear Plant is a two unit site. Each unit has a turbine driven AFW pump
(pumps 1 P29 and 2P29) which can supply water to both steam generators. Additionally,
the plant has two motor driven AFW pumps (pumps P39A and P39B) each of which can
be aligned to a steam generator in each unit. The recirculation valves for both the
turbine driven and motor driven pumps would open for the initial 45 seconds after pump
start and would open on low flow conditions. However, the recirculation valves were air
operated valves which failed closed upon a loss of instrument air. The control room had
valve position indication for the recirculation valves, flow indication to individual steam
generators, and flow indication to the steam generators from each pump. However, the
flow element for providing flow indication for each pump was downstream of where the
recirculation line branched off from the discharge line. Consequently, the flow indication
for each pump would not indicate recirculation line flow.
The AFW recirculation lines were installed, as part of original construction, to ensure the
pump would have a flow path to prevent dead-heading the pump, which would damage
the pump. Discussions with licensee engineering staff indicated that a pump could be
damaged within minutes under insufficient flow conditions due to lack of cooling. The
initial lines installed included an orifice that allowed a 30 gallons per minute (gpm) flow
rate. This flow rate was determined by the pump vendor, Byron Jackson, to be sufficient
to prevent pump damage based on pump heat-up when on recirculation flow. The
recirculation lines were subsequently modified in 1988, in response to Bulletin 88-04,
"Potential Safety-Related Pump Loss," to accommodate a greater recirculation flow rate
and protect the pump from low flow instabilities.
(3)
Procedural Guidance
Emergency Operating Procedure (EOP)-0.1, "Reactor Trip Response," directed
operators to control feedwater flow early in the procedure. Procedure EOP-0.1 was the
procedure which operators would use for most transients. Response not obtained
(RNO) column step 1.c of the procedure directed operators to reduce feed flow if reactor
coolant system (RCS) temperatures were less than 547 degrees (0) Fahrenheit (F) and
trending lower. Step 4.b directed operators to control feed flow to maintain steam
generator levels between 29 percent and 69 percent. RNO step 4.b directed operators
to stop feed flow to intact steam generators if level continued to rise. If instrument air
had been lost, damage would occur to the AFW pumps by these operator actions to
control feedf low due to the low flow conditions created. The team noted that procedure
OM 4.3.1, "AOP and EOP Writers' Guide," step 5.4.2 stated, "A caution is used to
present information regarding potential hazards to personnel or equipment associated
5
with the subsequent step(s)." The emergency operating procedures steps did not
provide any such cautions prior to November 30, 2001.
Portions of the EOP-0.1 steps one and four are illustrated below:
STEP
ACTION/EXPECTED RESPONSE
1
Verify RCS Temperature Control:
a. Check RCS wide range cold leg
temperatures:
"* LESS THAN
5470 F
AND
"* STABLE
OR EQUAL TO
STEP
ACTION/EXPECTED RESPONSE
4
Stabilize S/G Levels:
a. Check S/G/ levels - GREATER
THAN 29 percent
b. Control feed flow to maintain
S/G levels between 29 percent
and 65 percent
RESPONSE NOT OBTAINED
Perform the following:
1. IF RCS cold leg temperature less
than 5470 F AND RCS
temperatures are trending lower,
THEN stabilize RCS temperature
as follows:
a) Stop dumping steam.
b) Ensure S/G blowdown
isolations - SHUT
c) IF cooldown continues, THEN
control feed flow:
1) Reduce total feed flow.
2) Maintain total feed flow
greater than or equal to
200 gpm until level greater
than 29 percent in at least
one S/G.
RESPONSE NOT OBTAINED
a. Maintain total feedf low greater
than 200 gpm until level greater
than 29 percent in at least one
S/G
b. IF level in intact S/G continues to
rise, THEN stop feed flow to that
S/G.
Based on discussions with licensee engineering staff, the team determined that the time
that the AFW recirculation valves would fail closed due to loss of instrument air could
vary. The engineering staff had determined that the recirculation valves would begin to
drift shut when instrument air header pressure was reduced to 40 pounds per square
inch gauge (psig) and would be fully closed at 25 psig. The instrument air header
pressure was nominally maintained at 100 psig with some variation due to cycling of air
compressors. Based on observations of instrument air header pressure drop between
cycling of air compressors, the engineering staff determined that the instrument air head
pressure would drop approximately 13.5 pounds per square inch in one minute under
normal loads. The engineering staff estimated that the AFW recirculation valves would
6
begin to drift shut approximately six to eight minutes after loss of all air compressors with
complete valve closure one to two minutes thereafter. A loss of instrument air due to a
leak in an airline versus a loss of air compressors would result in different bleed down
rates, depending on the size of the break. Additionally, the instrument air bleed down
rate could be faster due to greater demands on the instrument air system in response to
the transient.
Based on discussions with operating licensee personnel, the preferred method for
controlling AFW flow was by throttling or closing the AFW flow control valves (for the
motor driven AFW pumps) or discharge valves (for the turbine driven AFW pumps)
rather than securing the pumps. The team noted that Section 14.1.12, "Loss of All AC
Power to the Station Auxiliaries," of the original Final Facility Description and Safety
Analysis Report (FFDSAR)," stated, "The reactor operator in the control room can
monitor the steam generator water level and control the feedwater flow with remote
operated AFW control valves." The FFDSAR did not discuss securing AFW pumps as a
means to control steam generator levels. Additionally, the team noted that in some loss
of instrument air scenarios (e.g., those involving RCS overcooling), the recirculation
valves could remain open at the time that operators throttle or close flow control and
discharge valves due to remaining air header pressure. However, the recirculation
valves would subsequently close due to decreasing air pressure. Consequently, the
valves could reposition at a time when an operator's attention would not be directly
focused on the AFW pumps.
Operating experience demonstrated that operators would drastically reduce AFW flow
within several minutes of pump start due to RCS overcooling under some transient
conditions. For example, on June 27, 2001, the Unit 2 reactor was manually tripped due
to low and decreasing water level in the Unit 2 circulating water pump bay (reported in
LER 05000301/2001-002-00). Due to subsequent low steam generator water levels, the
Unit 2 turbine driven AFW pump and both motor driven AFW pumps initiated and began
feeding the Unit 2 steam generators. One steam generator in a unit nominally requires
200 gpm feedwater flow for decay heat removal. However, with three AFW pumps
running, approximately 800 gpm of feedwater flow - approximately four times the
required flow, was provided to the Unit 2 steam generators. Consequently, the reactor
coolant system was cooled down at an excessive rate. Approximately three minutes
after the reactor was tripped, operators closed either the flow control valves or the
discharge valves to stop flow from the motor driven AFW pumps. Approximately four
minutes after the reactor was tripped, operators closed the discharge valves from the
Unit 2 turbine driven AFW pump stopping all AFW flow to the steam generators. The
AFW pumps were not secured until approximately eight minutes after the reactor was
tripped when feed flow using main feedwater was partially restored. In this particular
event, the AFW recirculation valves were functional because instrument air had not been
lost. However, had instrument air not been available, as would happen in transients
such as loss of instrument air, loss of off-site power, and loss of service water events, all
AFW pumps could have been damaged.
Procedure AOP-5B, "Loss of Instrument Air," provided operators guidance for loss of
instrument air. However, the team noted that, during these transients, operators would
typically be using emergency operating procedures, such as EOP-0.1, in their initial
response to a transient. After plant conditions stabilized, abnormal operating
7
procedures, such as AOP-5B, would be used to restore equipment. The team reviewed
procedure AOP-5B and determined that procedural steps were provided to secure open
the AFW pump recirculation valves. However, guidance to secure open the valves did
not appear until step 1 of Attachment R, "Auxiliary Feed," located on page 36 of the
procedure. Operators were directed to Attachment R by step 26 (located on page 14) of
the procedure. Step 26 simply directed operators to check plant systems status per
attachments A through Z. Consequently, although procedure AOP-5B had steps which
addressed the recirculation valves, the team determined that operators would likely
damage all AFW pumps by following the emergency operating procedures given the
transient timelines described above.
(4)
Regulatory Issue Associated With Procedure Guidance
10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings,"
requires, in part, that activities affecting quality be prescribed by documented
instructions, procedures, or drawings, of a type appropriate to the circumstances. As of
November 29, 2001, procedures EOP-0.1 Unit 1, "Reactor Trip Response," Revision 24,
and EOP-0.1 Unit 2, "Reactor Trip Response," Revision 23, addressing activities
affecting quality, were not of a type appropriate to the circumstances. Specifically, the
procedures did not provide adequate guidance to operators regarding the potential to
damage AFW pumps while controlling AFW flow upon low instrument air header
pressure, which would cause the recirculation valves to fail closed. Because the
procedures did not include instructions to ensure the recirculation valves were open, the
AFW pumps could be damaged under low flow conditions such as when the flow is
throttled back to control steam generator level or to mitigate RCS overcooling. This
issue is considered an apparent violation (AV 50-266/01-17-01; 50-301/01-17-01).
(5)
Operator Training
The team reviewed licensed operator training lesson plans and simulator scenarios for
training conducted prior to November 29, 2001, and interviewed licensed reactor
operators and senior reactor operators to evaluate the emphasis placed on the effect of
loss of instrument air on AFW operability prior to November 29, 2001. The team
determined:
Operators were trained on and knowledgeable of the "fail-safe" position of air
operated valves including the AFW recirculation valves. No emphasis, however,
was placed on the consequence of the fail-closed AFW recirculation valves.
Lesson Plan 2672, "Instrument Air and Service Water Review," outlined training
on the loss of instrument air PRA initiating event. The outline addressed the loss
of instrument air effect on secondary cooling. The lesson plan stated that the
turbine-driven AFW pump would be available for feeding the steam generator
"loss of instrument air had no effect" and that the pressure control valves for the
motor-driven AFW pumps fail open upon a loss of pneumatic supply providing a
flow path from the motor-driven AFW pumps to the steam generators. The team
noted that the training only addressed the forward flow aspect of AFW to feed
the steam generators. The training did not address the consequences of the
"fail-closed" recirculation valves causing pump damage.
8
No simulator training scenario, including loss of offsite power and loss of
instrument air, had included the failure of an AFW pump due to loss of
recirculation flow. The licensee's training staff informed the team that the
simulator, as modeled, would not fail an AFW pump due to low flow conditions
as would likely occur in the plant.
(6)
Operability Evaluation
The team reviewed the licensee's initial operability determination screen completed by a
senior reactor operator on November 29, 2001. The documented basis for system
operability was satisfactory completion of required surveillance testing. The team noted
' that the operability determination screen did not address the potential simultaneous
failure of all AFW pumps due to loss of instrument air and procedurally directed operator
actions (the specific issue identified by the CR). The site resident inspectors engaged
licensee management (duty shift supervisor and operations manager) on the adequacy
of the operability determination screen. Licensee management assured the resident
inspectors that extensive discussions of system operability were conducted involving
both operations and engineering and the operability determination was adequate. After
questions by the resident inspectors, the licensee initiated a formal engineering
operability determination on November 30, 2001. The team reviewed Revision 1 of the
formal engineering operability determination. The operability determination concluded
that the AFW system was operable but nonconforming and specified necessary
procedural revisions.
(7) Licensee Corrective Actions
The licensee revised procedures EOP 0, "Reactor Trip or Safety Injection," and
EOP 0.1, "Reactor Trip Response," on November 30, 2001, to provide additional
guidance to operators. The foldout pages for both procedures were revised to state:
IF any AFW pump mini-recirc valve fails shut, THEN maintain minimum
flow or stop the affected AFW pump as necessary to control S/G levels.
"o P-38A minimum flow - GREATER THAN 50 GPM
"o P-38B minimum flow - GREATER THAN 50 GPM
"o P-29 minimum flow - GREATER THAN 75 GPM
The above guidance addressed overfilling of steam generators which would, generally,
take longer than 10 minutes after the transient initiated. Consequently, under such
circumstances, had instrument air failed, it would have likely bled down to the point of
failing the recirculation valves shut before operators would have taken actions to
drastically control AFW flow. As such, the operators would have had the opportunity,
when controlling AFW flow, to observe that the recirculation valves had failed shut.
The licensee PRA staff subsequently identified that operator action to control AFW flow
could be required much earlier in a transient due to RCS overcooling before the
9
recirculation valves would shut due to a loss of instrument air. In response to this issue,
the licensee revised the foldout page for procedures ECA-0.0, "Loss of all AC Power,"
EOP 0, and EOP 0.1, on December 20, 2001, to state:
IF any AFW pump mini-recirc valve fails shut OR annunciator C01 A 1-9,
INSTRUMENT AIR HEADER PRESSURE LOW in alarm, THEN monitor
and maintain minimum AFW flow or stop the affected AFW pump as
necessary to control S/G levels.
"o P-38A minimum flow - GREATER THAN 50 GPM
"o P-38B minimum flow - GREATER THAN 50 GPM
"o P-29 minimum flow - GREATER THAN 75 GPM
The team reviewed an operations notebook entry, dated December 27, 2001, and
determined that operations staff had also changed the annunciator for low instrument air
header pressure to a green color. The change was made to make the annunciator tile
stand out if a large number of alarms are received at one time. The majority of
annunciator tiles were the color white.
(8)
Failures to Identify Significant Condition Adverse to Quality
The team identified a number of opportunities which the licensee had prior to 2001 to
identify that the failure mode of the AFW recirculation valves conflicted with operating
practice. The specific instances were as follows:
1981
In Generic Letter (GL) 81-14, "Seismic Qualifications for Auxiliary Feedwater
Systems," the NRC requested that the licensee perform a walk-down of the non
seismically qualified portions of their AFW systems to identify apparent and
practically correctable deficiencies that may exist. The GL specifically identified
instrument air for AFW control valves as a potential issue. In Attachment 1,
Section IV, of their response, dated May 4, 1982, the licensee documented that
"the AFW recirculation valves are now normally open and fail close." The
licensee did not address the impact that the valves failing closed could have on
the system.
1988
GL 88-14, "Instrument Air Supply System Problems Affecting Safety-Related
Equipment," requested that licensees perform a design verification of the entire
instrument air system including an analysis of current air operated component
failure positions to verify that they were correct for assuring required safety
functions. The licensee's response, dated February 20, 1989, stated under
action item 2 that Abnormal Operating Procedure AOP-5B, "Loss of Instrument
Air," provided operators with a listing of component failure positions due to loss
of instrument air and the actions that might be necessary for various systems
and/or components. The licensee failed to recognize that the emergency
operating procedures did not include appropriate guidance.
1989
In their April 17, 1989, submittal to the NRC in response to 10 CFR 50.63, "Loss
of All Alternating Current," (i.e., the station blackout rule), the licensee stated that
no air-operated valves are required to operate to cope with a station blackout for
one hour.
10
1991
The original PRA performed in response to GL 88-20, "Individual Plant
Examination for Severe Accident Vulnerabilities," did not model the recirculation
valves failing closed upon loss of instrument air. Consequently, the interaction
between the instrument air system and the AFW system was not fully evaluated.
1994
The design basis document (DBD) for the AFW system, DBD-01 dated April
1994, stated that recirculation valves had a safety function to open and remain
open. However, the identified safety function for the valves to open was not
reconciled with the valves failure mode to fail closed upon a loss of instrument
air.
1997
In March 1997, the licensee identified an AFW system failure mode due to
instrument air (reported by LER 97-014-00). Specifically, the flow control valves
for the motor driven AFW pumps were air operated valves which failed open. In
certain scenarios, such as a main steam line break coincident with a loss of
instrument air, the motor driven AFW pumps could be in a run-out condition and
trip the circuit breakers for the pumps. As a result of identifying this vulnerability,
the licensee installed nitrogen back-up for the motor driven pump flow control
valves. However, the licensee did not adequately review the function of other air
operated valves in the AFW system such as the recirculation valves.
1997
In October 1997, a contractor working on the revision of the licensee's inservice
testing (IST) program identified the discrepancy between the IST background
document and the AFW system DBD for the safety function of the valves in the
recirculation line. The IST background document stated the check valves did not
have a safety function to open since there was always adequate flow to the
steam generator such that the recirculation flow path was not needed to protect
the pump. The AFW system DBD stated that the recirculation valves, and,
hence, the recirculation lines, did have a safety function to open to protect the
pumps. The issue was documented on CR 97-3363 and investigated. In their
investigation, the licensee focused on ensuring that the AFW system would
provide adequate flow to the steam generators. For the turbine-driven pumps,
the valve lineup was such that there was normally a flow path to the generator.
The only power-operated valves in the line were motor-operated valves (MOVs)
to each steam generator that were normally in the throttled position. For the
motor-driven pumps, although there were normally closed valves (one control
valve and an MOV to each steam generator) in the discharge path, these valves
received an open signal on pump start to provide an adequate flow path. The
dead-heading of the motor-driven pump could occur if the control valve or MOV
failed to open. Based on single failure criteria, this type of failure would only
affect one of the two motor-driven pumps. Based on this evaluation, the licensee
deleted the open safety-function of the recirculation valves from DBD-1.
However, the licensee failed to address operator actions which could be taken to
control AFW flow to prevent overcooling of the RCS or overfilling the steam
generators. As such, the licensee failed to identify that multiple AFW pumps
(both turbine driven and motor driven) could be damaged by the failure mode of
the AFW recirculation valves.
11
(9)
Regulatory Issue Associated With Failures to Identify Significant Condition Adverse to
Quality
10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," requires, in part, that
measures be established to assure that conditions adverse to quality are promptly
identified and corrected. In the case of significant conditions adverse to quality, the
measures shall assure that the cause of the condition is determined and corrective
actions taken to preclude repetition. As of November 2001, the licensee failed to identify
that the AFW system was not capable of performing its safety function under certain
conditions. Specifically, all AFW pumps would be subject to a common mode failure
involving dead-heading of AFW pumps following a loss of instrument air, loss of offsite
power, loss of service water, or a seismic event due to the closure of the recirculation
valves upon loss of the non-safety grade, non-seismically qualified instrument air system
and prescribed operation actions to control feedwater flow in response to transient
conditions. On seven occasions between 1981 and 1997, the licensee was made aware
of the susceptibility of the AFW system to this type of vulnerability, but the licensee failed
to identify this significant condition adverse to quality. This issue is considered an
apparent violation (AV 50-266/01-17-02; 50-301/01-17-02).
(10) Pressurizer PORV Impact on Operational Capability
The pressurizer PORVs were air operated valves which were provided with a backup
nitrogen supply. However, since 1979, the back-up nitrogen supply has been isolated,
by procedure, during power operation. A containment entry was required to restore the
back-up nitrogen supply. Consequently, upon a loss of instrument air, the PORVs would
not be available. The safety injection pumps do not provide sufficient discharge
pressure to lift the reactor coolant system safety relief valves. Although the positive
displacement charging pumps provide sufficient discharge pressure to lift and pass
coolant through the code safety relief valves, the charging pumps do not provide
sufficient flow for adequate decay heat removal. Consequently, a loss of instrument air
would result in the loss of effective feed and bleed capability. A loss of auxiliary
feedwater combined with a loss of instrument air, which would also involve a loss of
main feedwater, would result in a loss of decay heat removal capability.
(11) Extent of Condition
The team reviewed the configuration of other significant systems, such as safety
injection, to verify that the recirculation lines did not have air-operated valves which
failed closed upon of loss of instrument air. The team did not identify any other systems
in which a similar vulnerability existed.
(12) Safety Significance
The team evaluated the finding using the Phase 2 process described in Inspection
Manual Chapter 609, Appendix A, "Significance Determination of Reactor Inspection
Findings for At-Power Situations." The site specific worksheets for the Point Beach
Nuclear Plant were used. These site specific worksheets had been benchmarked
against the licensee's current PRA model for the plant. Based on this review, the team
determined that the most limiting scenario was loss of instrument air. The following
assumptions were made:
12
0
The exposure time was greater than 30 days.
The initiating event frequency was 1 x 10-3 for loss of instrument air.
No credit for any AFW was applied. The emergency operating procedures used
by operators did not provide adequate guidance to address recirculation valve
closure. Additionally, operators were not trained to specifically recognize the
potential for AFW recirculation valve closure and the consequences. The
licensee's PRA staff performed informal calculations which showed overall
human error probabilities in the range of 0.3 to 0.5 (depending on the
calculational method used) for operator actions in response to steam generator
overfill. For operator response to RCS overcooling, the licensee's PRA staff
assumed that operator actions would result in failure of the AFW pumps.
For loss of instrument air, feed and bleed capability using the pressurizer PORVs
was not credited because of the reliance upon instrument air.
Based on use of the Point Beach Nuclear Plant site specific worksheets for loss of
instrument air, the finding was preliminarily determined to be of high safety significance
(Red). The dominate sequences involved the loss of instrument air and the loss of
The team also evaluated the finding using the loss of off-site power site specific
worksheets. The assumptions used were similar to those above with the following
exceptions:
The initiating event frequency was 1 x 10-2 for loss of off-site power.
Instrument air would be initially lost upon loss of off-site power because the air
compressors would be automatically stripped from the safeguards power buses.
The initial loss of instrument air would result in damage to the AFW pumps due
to operator actions.
Credit for feed and bleed capability was applied because instrument air could be
restored by manual operators actions. The necessary operator actions were
proceduralized.
Credit for high pressure recirculation was applied because neither safety
injection nor residual heat removal was affected by the finding.
Based on use of the Point Beach Nuclear Plant site specific worksheets for loss of off
site power, the finding was preliminarily determined to be of high safety significance
(Red). The dominate sequences involve the loss of off-site power and AFW with either
feed and bleed capability or high pressure recirculation being available.
In addition, the finding was evaluated using the loss of service water worksheets.
However, the significance due to loss of service water was not as great as the loss of
instrument air and loss of off-site power transients as described above.
13
.2
Licensee Event Reports
LER 50-266/2001-05: 50-301/2001-05 (Open): PRA assessment of AFW system
reveals procedural vulnerability related to loss of instrument air. The subject of this LER
is discussed in Section 4OA3.1 and two apparent violations were identified. This LER
will remain open pending future inspection review.
40A6 Meetinq(s)
Exit Meeting
On December 13, 2001, at the conclusion of the on-site inspection activities, the lead
inspector presented the initial findings to Mr. Reddemann and other members of
licensee management at Point Beach Nuclear Plant. On February 28, 2002, the team
presented the findings to Mr. Warner and other members of licensee management. The
licensee representatives acknowledged the findings presented. The team identified the
proprietary information reviewed during the inspection and noted that the information
would be handled accordingly. The licensee did not identify any other material reviewed
during the inspection as being proprietary.
14
KEY POINTS OF CONTACT
Licensee
J. Anderson, Manager, Production Planning
F. Cayia, Director, Kewaunee - Point Beach Site
R. Mende, Director, Kewaunee - Point Beach Engineering
M. Reddemann, Vice President - Engineering, Nuclear Management Company
J. Strharsky, Assistant Manager, Operations
M. Warner, Vice President, Kewaunee - Point Beach Site
T. Webb, Manager, Kewaunee - Point Beach Regulatory Affairs
NRC
J. Grobe, Director, Division of Reactor Safety, Region III
J. Jacobson, Chief, Mechanical Engineering Branch, Region III
LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED
Opened
50-266/01-05
50-302/01-05
50-266/01-17-01
50-301/01-17-01
50-266/01-17-02
50-301/01-17-02
LER
PRA Assessment of Auxiliary Feedwater System Reveals
Procedural Vulnerability Related to Loss of Instrument Air
Potential Common Mode Failure of Auxiliary Feedwater Pumps
Due to Inadequate Procedural Guidance
Failure to Identify and Correct Problem Associated With
Potential Common Mode Failure of Auxiliary Feedwater Pumps
15
LIST OF ACRONYMS USED
0
Degrees
Abnormal Operating Procedure
Apparent Violation
CFR
Code of Federal Regulations
CR
Condition Report
Design Basis Document
Division of Reactor Projects
Division of Reactor Safety
Enforcement Action
Emergency Operating Procedure
F
Fahrenheit
FFDSAR
Final Facility Description and Safety Analysis Report
GL
Generic Letter
GPM
Gallons Per Minute
Individual Plant Examination
IR
Inspection Report
In Service Testing
LER
Licensee Event Report
Limited Liability Company
Motor Operated Valve
Nuclear Management Company, LLC
NRC
U.S. Nuclear Regulatory Commission
Power Operated Relief Valve
Plant Process Computer System
Probabilistic Risk Analysis
Pounds per Square Inch Gauge
RNO
Response Not Obtained
Significance Determination Process
S/G
16
LIST OF DOCUMENTS REVIEWED
The following is a list of licensee documents reviewed during the inspection, including
documents prepared by others for the licensee. Inclusion on this list does not imply that NRC
team reviewed the documents in their entirety, but, rather that selected sections or portions of
the documents were evaluated as part of the overall inspection effort.
Number
Procedures
AOP-10A Unit 1
CSP-H.1 Unit 1
Red
ECA-0.0 Unit 1
ECA-0.0 Unit 2
EOP-0 Unit 1
EOP-0 Unit 2
EOP-0.1 Unit 1
EOP-0.1 Unit 2
IT 10
OM 4.3.1
Temporary Changes
2001-0871
2001-0872
2001-0873
2001-0874
2001-0911
Title
Loss of Instrument Air
Safe Shutdown - Local Control
Response to Loss of Secondary Heat Sink
Loss of All AC Power
Loss of All AC Power
Reactor Trip or Safety Injection
Reactor Trip or Safety Injection
Reactor Trip Response
Reactor Trip Response
Test of Electrically-Driven Auxiliary Feed Pumps
and Valves (Quarterly)
EOP-0 Unit 1, Reactor Trip or Safety Injection
EOP-0 Unit 2, Reactor Trip or Safety Injection
EOP-0.1 Unit 1, Reactor Trip Response
EOP-0.1 Unit 2, Reactor Trip Response
ARP C01 A 1-9, Instrument Air Header Pressure
Low
Revision/Date
Revision 18
Revision 32
Revision 21
Revision 29
Revision 30
Revision 35
Revision 36
Revision 24
Revision 23
July 5, 2001
Revision 3
November 30,
2001
November 30,
2001
November 30,
2001
November 30,
2001
December 20,
2001
17
2001-0912
ECA-0.0 Unit 1, Loss of All AC Power
2001-0913
EOP-0.1 Unit 2, Reactor Trip Response
2001-0914
EOP-0 Unit 2, Reactor Trip or Safety Injection
2001-0915
EOP-0 Unit 1, Reactor Trip or Safety Injection
2001-0916
EOP-0.1 Unit 1, Reactor Trip Response
2001-0917
ECA-0.0 Unit 1, Loss of All AC Power
Design Basis Documents
Auxiliary Feedwater System
Auxiliary Feedwater System
Instrument & Service Air
DBD-T-46
Station Blackout
Updated Final Safety Analysis Report Sections
4.2
RCS System Design and Operation
8.8
Diesel Generator (DG) System
9.7
Instrument Air (IA) / Service Air (SA)
10.2
Auxiliary Feedwater System (AF)
Calculations
N-91-007
Steam Generator Inventories 5 Minutes After an
N-91-031
1 & 2 P29 Mini-Recirc Line System
Characteristics
N-91-032
Comparison of Nominal Flow Rates from 2P-29
to 2HX-1A and 2HX-1B with the Recirc Line
Open
December 20,
2001
December 20,
2001
December 20,
2001
December 20,
2001
December 20,
2001
December 20,
2001
Revision 0
Revision 1
Revision 2
Revision 0
June 2000
June 2000
June 2000
June 2000
November 7, 1991
March 19, 1991
March 19, 1991
18
Correspondence
VPNPD-95-056
NPL 97-0186
NRC Generic Letter No. 81-14, Point Beach
Nuclear Plant, Units 1 and 2
Additional Response to NRC Generic Letter 81-14, Point Beach Nuclear Plant, Units 1 and 2
Seismic Qualification of the Auxiliary Feedwater
System, Point Beach Nuclear Plant, Units 1 and
2
Final Resolution of Generic Letter 81-14,
Seismic Qualification of Auxiliary Feedwater
System, Point Beach Nuclear Plant, Units 1 and
2
Response to NRC Bulletin 88-04
Response to Generic Letter No. 88-14,
Instrument Air System Problems Affecting
Safety-Related Equipment, Point Beach Nuclear
Plant, Units 1 and 2
Response to 10 CFR 50.63, Tac. Nos. 68586
and 68587, Loss of All Alternating Current
Power, Point Beach Nuclear Plant, Units 1 and 2
Response to NRC Bulletin 88-04
Minimum Flow Analysis
Generic Letter 88-20, Supplement 4, Summary
Report on Individual Plant Examination of
External Events for Severe Accident
Vulnerabilities
Licensee Event Report 97-014-00, Auxiliary
Feedwater System Inoperability Due to Loss of
Instrument Air
Licensee Event Report 301/2001-002-00,
Manual Reactor Trip Due to Decreasing Water
Level in Circulating Water System
NRC Memorandum From John M. Jacobson to
Ronald A. Langstaff, Special Inspection Charter
for Point Beach Potential Common Mode Failure
July 16,1981
May 4, 1982
December 15,
1982
April 26,1985
June 28, 1988
February 20, 1989
April 17, 1989
May 26, 1989
August 7, 1989
June 30, 1995
April 18, 1997
August 17, 2001
November 30,
2001
19
VPNPD-88-335
VPNPD-88-090
VPNPD-89-216
Condition Reports
97-0930
97-3363
98-2575
QCR 99-0115
99-3091
01-2278
01-3595
01-3641
01-3654
Evaluations
RCE 98-148
Licensee Event Report 266/2001-005-00,
PRA Assessment of Auxiliary Feedwater System
Reveals Procedural Vulnerability Related to Loss
of Instrument Air
Questions and Concerns About the use of
Operator Action to Control AFW Flow
IST Program Design Basis for AFW Minimum
Flow Recirculation Valves
P-38A AFW Pump Recirc Valve Found Failed
Shut
Code Testing Conflict with the Aux Feedwater
Mini-Flow Recirc Check Valves
Aux Pump Recirc Line Leakage Acceptance
Criteria Questioned
Auxiliary Feedwater Probabilistic Risk
Assessment (PRA) Model for Loss of Instrument
Air
Potential common mode failure for all auxiliary
feed pumps under certain initiating events.
Modifications that had potential to identify
concern
The development and revision of DBD-01
appears to have been a missed opportunity to
identify a design weakness in the AFW system.
P-38A AFW Pump Recirc Valve Found Failed
Shut
January 28, 2002
March 20, 1997
October 15, 1997
June 29, 1998
May 24, 1999
December 3, 1999
July 6, 2001
November 29,
2001
December 4, 2001
December 6, 2001
January 29, 1999
Drawings
M-201, sheet 1
M-209, sheetl
M-209, sheet2
M-209, sheet3
Main & Reheat Steam System
Service Air
Service Air
Instrument Air
January 20, 2001
May 12, 2001
November 18,
2000
November 18,
2000
20
M-209, sheet 4
Instrument Air
M-209, sheet 11
Instrument Air
M-217, sheet 1
Auxiliary Feedwater System
M-217, sheet 2
Auxiliary Feedwater System
M-2201, sheet 1
Main & Reheat Steam System
Modifications
97-038*A
AFW Motor Driven Pump Discharge Control
Valve Modification
97-038*B
AFW Discharge Valve AF-04012 & AF-04019
Modification 88-099, Common
AFW Recirc Line Modification
88-099-A,
AFW Recirc Line Modification
Common
88-099-C,
AFW Recirc Line Modification
Common
88-099-D,
AFW Recirc Line Modification
Common
Miscellaneous Documents
LP3178
Auxiliary Feedwater System
Mod Request IC-
Making AFW Recirc Valves Normally Open
274
Procedure Change
Cold Shutdown to Low Power Operation
OP-1A,Major
Procedure Change
Cold Shutdown to Low Power Operation
OP-1A,Major
IST Background
Valve Data Sheet 97-201
Setpoint Change to the Auxiliary Feedwater By
pass Control Valves Time Delay Relay Setpoints
(1/2-NCO05, 62-P38A and 62-P38B)
Action Items Associated with GL 88-14
Final Facility Description and Safety Analysis
Report
October 25, 2001
January 19, 1998
September 29,
2001
February 3, 2001
January 20, 2001
March 24, 1998
June 26, 1998
March 27, 1991
February 14, 1992
February 14, 1992
July 1, 1992
June 15, 2001
December 26,
1978
July 26, 1979
May 17, 2000
December 4, 1997
September 17,
1991
Original
21