ML031110055

E-mail from Timothy Frye to Various Addressees, Regarding 02/21/02 Point Beach SERP

ML031110055
Person / Time
Site:	Point Beach
Issue date:	02/15/2002
From:	Frye T Office of Nuclear Reactor Regulation
To:	Baranowsky P, Barrett R, Cobey E, Coe D, Frye T, Mary Johnson, Koltay P, Roy Mathew, Nolan M, Reinhart F, Satorius M, Marvin Sykes, Sunil Weerakkody, Wilson P, Wong S Office of Nuclear Regulatory Research
References
FOIA/PA-2003-0094
Download: ML031110055 (53)

Text

Coe
-/

4 '

B c S Page 1

^ "

' Y M..I - - --I.o I ' I I :.I.

,, _,, I ~

........Fwd..........

... 2......21.......

02...........P........ea...............E........PaggCo wd /102P eahS RPPg I

From:

Timothy Frye d2 To:

gt'5Baranowsky, Patrick; Barrett, Richard; Cobey, Eugene; Coe, Doug; Frye, Timothy; Johnson, Michael; Koltay, Peter; Mathew, Roy; Nolan, Chris; Reinhart, F. Mark; Satorius, Mark; Sykes, Marvin; Weerakkody, Sunil; Wilson, Peter; Wong, See-Meng Date:

Fri, Feb 15, 2002 4:04 PM

Subject:

Fwd: 2121/02 Pt Beach SERP attached document supports the 2/21 SERP kW7I

F67F'wda:2/21/02-PtPage 1

From:

Brent Clayton j

i To:

K)12.-t-Frye, Timothy; Nolan, Chris Date:

Thu, Feb 14, 2002 4:35 PM

Subject:

Fwd: 2-/21/02 Pt Beach SERP This package will be formally distributed tomorrow. Tim, please get it to anyone in NRR who needs it that we don't include on our distribution. Thanks/Brent

Doug Coe-2/21/02 Pt Beach SERP Page 1 From:

Kenneth Lambert To:

Hicks, Beverly Date:

Thu, Feb 14, 2002 3:57 PM

Subject:

2/21/02 Pt Beach SERP

Bev, Please distribute the attached panel package for Pt. Beach. The SERP package can also be found on the G drive. Please include the following on distribution:

R. Langstaff Mark Salley Phill Quals Thanks Ken CC:

Clayton, Brent

_1_11-1. 1. 1_.-____-11__ __111_11

---

--- -___ 11 --. -

- I -.. -

%
-

1.1-1 -1 I---
I------ -

.11-11,

-1 I -

I -

poug Coe - 020221 Pt Beach instrument air. drs.wpd

^

^Pdage 1

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves EA-Date of Panel: February 21, 2002 Licensee: Nuclear Management Company Facility/Location: Point Beach Docket Nos: 50-266; 50-301 License Nos: DPR-24; DPR-27 Inspection Report No: 50-266/01-17; 50-301/01-17 Date of Exit Meeting/Report Date: Inspection debrief with licensee: December 13, 2001 (date of final exit meeting pending outcome of panel meeting)

Panel Chairman (SES Sponsor): Grobe Responsible Branch Chief/Lead Inspector/Regional SRA:

J. Jacobson/R. Langstaff/S. Burgess EICS Representative: Brent Clayton

1.

Brief Summary of Issues/Potential Violations:

Nuclear Management Company (the licensee for Pt. Beach) identified that there was a potential for dead-heading auxiliary feedwater (AFW) pumps due to the AFW minimum flow recirculation valves failing closed. In a dead-headed condition, the pumps would fail within minutes due to overheating. The dead-heading could occur either through operator actions in response to a transient or by a fire in the Unit 1 turbine driven AFW pumps. The AFW minimum flow recirculation valves at Pt. Beach, by original design, fail closed upon a loss of instrument air. Certain transients, such as loss of off-site power (LOOP), loss of instrument air (LOIA), loss of service water (LOSW), and seismic event, will result in a loss of instrument air. Additionally, certain fire scenarios could cause the AFW minimum flow recirculation valves to fail closed due to fire induced damage to instrument air lines or the control cables for the valves. A draft of the inspection report body is included at Attachment 3.

Issue 1 - Operator Actions The EOPs, under many transient conditions, direct operators to control AFW flow to mitigate either over-filling of the steam generators or overcooling of the reactor coolant system. The EOPs failed to caution operators that drastically reducing AFW flow could N RU PRS U

TA L

D UBLISURE UTAPPH OE 1

Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page 2 SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves result in failure of AFWs pumps upon a LOIA due to overheating. For example, in the case of a LOOP, the instrument air compressor is initially lost because it's stripped from the vital buses. The turbine-driven AFW pumps would be started on a loss of power to the buses for the main feed pumps. The motor-driven pumps would be started due to the low steam generator level. Depending on the nature of the transient, operators would take action to control AFW flow to mitigate over-filling of steam generators or overcooling of the reactor coolant system. Actions to mitigate over-filling the steam generators could be required as soon as 13 minutes into a transient. When the operator controls AFW flow at that time, the operator may fail to recognize that the recirculation valves have failed shut and the AFW pump(s) would be in a dead-headed condition. In the case of overcooling the reactor coolant system, actions to control AFW flow may be required within a few minutes into the transient. At such time, the AFW minimum flow recirculation valves would likely still be open due to remaining air pressure in the instrument air header. However, the AFW minimum flow recirculation valves would subsequently reposition (without operator action) due to loss of instrument air header pressure.

This issue is also described in a Licensee Event Report included as part of Attachment 4 to this package.

The potential violation issues are as outlined below. Draft NOVs are included as part of.

Potential Violation A: 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," requires, in part, that procedures be appropriate to the circumstances. The emergency operating procedures did not provide operators with guidance to the effect that AFW pumps could be damaged under low-flow conditions due to the AFW minimum flow recirculation valves failing in the closed position. The licensee's EOP writers' guide specifically stated that "A caution is used to present information regarding potential hazards to personnel or equipment associated with the subsequent step(s)." No such caution was provided.

Potential Violation B: 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action,"

requires, in part, that measures shall be established to assure that conditions adverse to quality are promptly identified and corrected. The licensee failed to identify the closure of the recirculation valves and operator action to control AFW pump flow as a condition adverse to quality on seven occasions between 1981 and 1997. In addition, corrective actions taken on November 30, 2001 were inadequate because procedure changes did not provide adequate guidance for the operators to address the potential for AFW minimum flow recirculation valves to close upon low instrument air header pressure, which could result in AFW pump damage if the flow was throttled back to control steam generator levels or to mitigate reactor coolant system overcooling.

Issue #2 - Fire

__-0&-0__oR0o P A00G.D ENFOP ACTIONOh BI SCLOSST PH IE 2

uCoe 020221 Pt Beach instrumentair. dr..wpd Page 3 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves The licensee also identified that the AFW pump relied upon to provide AFW flow to a Unit 1 steam generator could be in dead-headed condition due to a Unit 1 turbine driven AFW pump fire. Specifically, the fire could damage the Unit 1 turbine driven pump, the "A" train motor driven AFW pump power cables, and the Unit 1 discharge valve from the "B" train motor driven AFW pump. Fire damage to either the instrument air lines in the area or the control cables for the "B" train motor driven pump could also result in the minimum flow recirculation valve for the "B" train motor driven pump to fail closed.

Consequently, the "B" train motor driven pump would be in a dead-headed condition when a start signal is received. No other AFW pumps would be available to supply a Unit 1 steam generator.

Potential Violation: 10 CFR Part 50, Appendix R, Section III.G.2 requires that a redundant train of equipment be available for safe shutdown. Cables and equipment, located within fire area A23S, required for operation of motor-driven AFW pumps (pumps P-38A and P-38B) were not separated by a horizontal distance of more than 20 feet with no intervening combustible or fire hazards.

2.

Purpose of Panel:

To reach consensus of the significance of the inspection findings as evaluated through the SDP and to determine the appropriate enforcement action, if any.

3.

Regional Recommended Enforcement Strategy:

Issue 1 - Operator Actions The issue relating to failure of AFW pumps due to operator actions has a preliminary risk significance of RED based on a Phase 2 review of internal events. The potential violations are:

Violation of 10 CFR Part 50, Appendix B, Criterion V, for failure to provide appropriate guidance in EOPs (See attachment 2, draft NOV).

Violation of 10 CFR Part 50, Appendix B, Criterion XVI, for failure to promptly identify the effect the loss of instrument air had on the AFW system and take appropriate corrective actions with respect to procedural guidance in addressing the loss of instrument air (See attachment 2, draft NOV).

Issue 2 - Fire The issue relating to failure of a redundant AFW pump due to fire damage has a preliminary risk significance of WHITE based on a Phase 3 review of the fire scenario.

The potential violation is:

Violation of 10 CFR Part 50, Appendix R, Section III.G.2, for failure to provide a redundant means to shutdown (See attachment 2, draft NOV).

3

[ bo'ug bo-'e -' 0-2-0-2 -1 -Pt -Be akfi insfrum-e- ---

rif a i r.- d r-s.' w p d Page 4 ID u C e, 0222.t Beac intum n av. dr.w Pag 499.

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves

4.

Analysis of Significance/Root Cause:

a.

Actual Consequence: There were no actual consequences associated with this finding. There were no events (LOOP, LOIA, LOSW, fire, or seismic) during the time period that the AFW pumps were unavailable for mitigation.

b.

Potential Consequence(s):

Issue #1 - Operator Actions, Phase 2 Internal Events SDP Risk Evaluation:

During a loss of instrument air (caused by random failure of the IA system, LOOP, or loss of service water) the AFW pump minimum recirculation valves fail close. There are no backup air or nitrogen accumulators associated with the AFW pump recirculation valves. During the mentioned scenarios, the AFW pumps will start injecting into the steam generators. Early in the EOPs (3-15 minutes), the operator is directed to control RCS temperature and steam generator level by controlling flow to one or both steam generators. If flow from any AFW pump is reduced too low without functional recirculation valves, the pump will fail in a very short period of time. This common mode failure could result in simultaneous failure of all AFW pumps.

This issue results in a core damage frequency change for internal events, fire, flooding, and seismic events. For internal events, the benchmarked Pt. Beach SDP Phase 2 worksheets were used. For purposes of this SERP, the SRA has made the appropriate changes to the worksheets based on the benchmarking results. The dominant sequences occur with a special initiating event, loss of instrument air, followed by the loss of all AFW. The original plant design did not provide for feed and bleed capabilities using the pressurizer PORVs following a LOlA. Nitrogen accumulators for the PORVs were strictly for LTOP concerns during shutdown operations and have been procedurally isolated during power operations since 1979. The lack of the feed and bleed mitigating feature has always been accounted for in the licensee's PRA model and is also reflected in the SDP worksheets.

Assumptions: 1.

Recovery of any AFW pump was not credited. This conclusion was based on actual operator simulator training where operators are not trained nor directed to recognize consequences of closed AFW minimum recirculation valves. Additionally, the licensee's PRA staff conducted operator interviews and concluded that human error probabilities to recognize that the minimum recirculation valve is closed and take corrective action were on the ENFO RCOR AO OF D

T

_0 OFw

5,aAPO H

Doug Coe -020221 Pt Beach instrument air. drs.wpd Page 5 SDPJENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves order of 0.5 or higher.

2.

The instrument air compressors are powered from the safeguards busses; however, on a LOOP with a EDG start, the instrument air compressors are automatically stripped from the safeguards bus. Manual operator action to restore the instrument air compressors is proceduralized and is credited for the LOOP accident sequences to restore feed and bleed capabilities.

Worksheet Results:

LOlA LOlA (3) + AFW (0) = 3 LOSW LOSW (5) + TDAFW (0) = 5 LOOP LOOP (2) + AFW (0) + HPR (2) = 4 LOOP (2) + AFW (0) + FB (2) = 4 LOOP (2) +AFW (0) +EIHP (3)= 5 LOOP (2) + EAC (5) +i TDAFW (0) + HPR (2) = 9 LOOP (2) + EAC (5) + TDAFW (0) + MDAFW (0) + EIHP (3) 1 10 LOOP (2) + EAC (5) + TDAFW (0) + MDAFW (0) + FB (2) = 9 LOOP (2) + EAC (5) + TDAFW (0) + RECII (1) = 8 Based on the results of the Phase 2 SDP, this issue would be considered RED (ACDF = 10-1) for internal events based on the LOlA and LOOP worksheets.

The licensee's analysis of the issue for internal events also yields a result ACD F

> 1 E-4. The licensee's analysis for internal and external events is included as.

Issue #2 - Fire. Phase 3 Fire Risk Determination During the inspection, the licensee identified one scenario where an AFW minimum flow recirculation valves failing closed could invalidate existing Appendix R safe shutdown analyses. The licensee initiated CRs 01-3633 and 01 -3648 to document the issues. Specifically, the licensee identified that the following scenario could happen should Unit 1 turbine driven AFW pump (pump 1 P-29) fire occur:

In addition to affecting the Unit 1 turbine drive AFW pump, fire damage would also cause the southern motor-driven pump (pump P-38A) to fail because the power cable for the pump is in the plume area.

000 L

DICLOSUP~

WITHOU R

L OF DIC O E 5

I I --- 1 - '. -1

.1- -1

- I

..

I I I 11-Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page 6 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves Consequently, neither pump is able to supply a Unit 1 steam generator.

"B" train steam generator water level instrumentation for the steam generators is affected due to fire damage. Consequently, "A' train steam generators must be fed.

The Unit 1 reactor is shutdown due to the fire. The Unit 2 reactor and associated plant is kept operating because its not directly affected by the fire.

The cables for the northern motor-driven pump (pump P-38B) Unit 1 discharge valve (valve AF-4021) would also be affected by the fire. The valve is a normally closed valve. Consequently, the pump P-38B Unit 1 discharge valve could fail to open when an open signal is received due to low steam generator water level.

The northern motor-driven pump (pump P-38B) Unit 2 discharge valve (valve AF-4020) would remain shut because no low steam generator water level signal has been received for Unit 2 (because the unit is kept operating).

The northern motor-driven pump (pump P-38B) would receive a start signal due to low Unit 1 steam generator water level.

The minimum flow recirculation valve (valve AF-4014) for the northern motor-driven pump (pump P-38B) fails to open due to either fire damage to the valve control cables or due to loss of instrument air. The instrument air lines used soldered connections which would melt at a relatively low temperature. Instrument air lines ran through the AFW pump room and could be affected by fire damage.

The northern motor-driven pump (pump P-38B) fails within minutes due to lack of available flow pump for pump cooling.

Main feedwater also becomes unavailable due loss of instrument air.

(The feedwater regulating valves fail closed upon a loss of instrument air.) Additionally, cables for the main feedwater system ran through the room and could be affected by the fire.

The pressurizer PORVs would be unavailable due to fire induced loss of instrument air. Consequently, feed and bleed capability would not exist for removal of decay heat.

D00 NI OSW PPROOE DIRECE 0

Poug Coe - 020221 Pt Beach instrument air. drs.wpd Page 7 SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves Unit 2 could receive feedwater from the Unit 2 turbine-driven AFW pump.

However, Unit 1 would have no source of feedwater.

For a fire in this area, the licensee's Appendix R analyses took credit for northern motor driven AFW pump (pump P-38B) to supply the Unit 1 "A" steam generator (through a cross-connect of "A" and "B" trains) while the Unit 2 turbine-driven AFW pump would be available to supply the Unit 2 steam generators, if needed. However, due to the scenario described above, the pump would have already been damaged before operators could locally provide a flow path through the cross-connecting the "A" and "B" trains.

The licensee also identified that similar damage could occur due to a fire from transient combustibles above the tunnel in the AFW pump room. However, the scenario for a transient combustible fire above located above the tunnel is somewhat questionable. In addition, the contribution from a transient combustible fire (as conservatively calculated by the licensee) would not impact the end result. Consequently, for simplicity, the inspectors chose to not include the transient combustibles fire scenario in the calculations.

From a fire scenario credibility standpoint, the following assumptions were made with respect to the above scenarios:

Automatic suppression (i.e., Halon) is effective for lubricating oil fire because it is a surface fire. Consequently, full credit is provided for automatic suppression.

Manual suppression receives full credit (for outside control room).

The licensee estimated the fire frequency for one pump to be 1.42E-4/yr.

Fire damage to identified cables and equipment occurs due to being in or near the plume from the fire (vs. hot gas layer damage).

Main feedwater is assumed to be lost due to fire damage (of either cables or loss of instrument air).

Feed and bleed capability is lost due to fire damage to instrument air lines.

The condition has existed for longer than 30 days.

Based on review of the transient worksheets, the inspectors determined that there was no internal events mitigation credit on the most limiting cutset.

Q PRO 0 ENFORC TACTIO 00 OtDG,..1QTFOf PBULICLOSUR IT UTA VA O THED ROE 7

F-1501.1

r. di
-wpo

9 oe - 020221 Pt Beach instrument ai D0ed Page 8 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves The assumptions for the transient worksheets were as follows:

PCS = 0 due to unavailability of main feedwater (due to loss of IA)

AFW = 0 for affected unit HPR = 2 (full credit)

FB = 0 due to loss of IA impact on pzr PORVs EIHP = 3 (full credit)

The sequences were as follows:

1 TRANS - PCS(O) - AFW(O) - HPR (2) = 2 2

TRANS - PCS(O) - AFW(O) - FB(O) = 0 - most limiting sequence 3

TRANS - PCS(O) - AFW(O) - EIHP(3) = 3 For the pump oil fire, the Phase 2 SDP is calculated as follows:

IF = 1.42E-4 FB = 0 because we're only looking at a single room MS = -1.0 full credit for outside control room AS = -1.25 full credit for Halon automatic suppression CC = 0 because there are no common cause dependancies FMF

=loglO(IF)+FB+MS+AS+CC

= logl0(1.42E-4) + 0 + -1.0 + - 1.25 + 0

= -6.10 FMF = -6.10 which translates to CDF = 7.99E-7, due to no mitigation credit 0

TF BC C000 LOF HE 8

[ 666g- -Co e'- 6,20,2-2,11-PtBe"a-6hinsfitum e-n't-a"ii., drs-".,wp, d,_

Page 9

,. Dug Co -002 Pt Beach...

instrum........

n... air. dr.wp

.P.......................v.

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves The licensee Phase 3 analysis of this scenario suggest that the above Phase 2 risk determination is non-conservative. The licensee identified a ACDF of 1.35E-6/year for a pump fire. The differences between the NRC Phase 2 SDP analysis and the licensee's analysis are as follows:

MC 609 Phase 2 SDP Failure LoglO Probability Value Licensee PRA Analysis Failure LoglO Probability Value Ignition Frequency per 1.43E-4

-3.85 1.43E-4

-3.85 Year Fire Severity factor not used 2.00E-1

-0.70 Automatic Suppression 5.62E-2

-1.25 5.OOE-2

-1.30 Manual Suppression 1.OQE-1

-1.00 no credit taken ACCDP not used 9.50E-1

-0.02 Resulting Estimate (total)

Resulting Color 7.94E-7 Green

-6.10 1.35E-6 White

-5.87 The regional recommendation is to use the licensee's Phase 3 analysis for determining risk significance due to fire.

Conclusion The risk significance due to operator error (internal events) is RED.

The risk significance due to fire is WHITE.

c.

Potential for Impacting Regulatory Process:

None.

d.

Willful Aspects:

None.

e.

Root Cause(s):

Not known at this time.

30 PROPOS VF,,ORCEMEN~

\\

SURE TAR V Lb<1 E

T 9

Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page 10 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves

5.

Apparent Severity Level(s)/Color and Basis:

Issue #1 - Operation Actions RED based on Phase 2 SDP results for internal events.

The color RED has been confirmed by informal analyses performed by the licensee (Attachment 1). The licensee had calculated a ACDF/year of approximately 6E-4 for internal events and 2E-4 for seismic events. The licensee had attempted to identify excessive conservatisms associated with their models which, if eliminated, would yield a ACDF/year of less than 1 E-4. However, the licensee concluded that while eliminating excessive conservatisms would yield a ACDF/year less than 8E-4, the result would still be above the 1 E-4 threshold for a RED finding.

Issue #2 - Fire WHITE based on Phase 3 analysis for the fire scenario.

The color WHITE is based on a Phase 3 analysis performed by the licensee. The inspectors reviewed the licensee assumptions and considered the assumptions reasonable.

6.

Application of Enforcement Policy

a.

Enforcement/Performance History:

Not applicable to SDP cases.

b.

Is Credit Warranted for Identification? Explain:

Yes. The both issues were licensee identified and reported to the NRC.

c.

Is Credit Warranted for Corrective Actions? Explain:

Not applicable to SDP cases.

d.

Should Discretion Be Exercised to Mitigate or Escalate Sanction?

Not applicable to SDP cases.

7.

Is action being considered against individuals?

No.

8.

Non-Routine Issues/Additional Information/Relevant Precedent/Lessons Learned:

I Doug Coe - 020221 Pt Beach instrument air. drsmwpd Paqe 11 SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves None.

.n'i

ai FD-OL
6-66i
-' 6
62
ii-W bea-c'

0 u Page 12 SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves Point Beach, Units 1&2 Rev. 0, Nov. 29, 2000 Table 1 Categories of Initiating Events for Point Beach Nuclear Power Plant Row Approximate Example Event Type Initiating Event Likelihood Rating Frequency (IELR)

I

> 1 per 1-10 yr Reactor Trip (TRANS), Loss of Power Conversion 1

2 3

System (TPCS) il 1 per 1O_102 yr Loss of offsite power (LOOP) 2 3

4 III 1 per 10 2 -103 yr SGTR, Stuck open PORVISRV (SORV), Small LOCA 3

4 5

Including RCP seal failures (SLOCA), MSLBIFLB (outside containment), Loss of Instrument Air (LOIA),

Loss of CCW (LCCW), Medium LOCA (MLOCA), Loss of 125V DC Bus (LDC1 and LDC2)

IV 1 per 10 3 -10'yr ATWS-PWR1 (electrical only), Large LOCA (LLOCA) 4 5

6 V

1 perto' -D 5 yr LOOP with loss of Gas Turbine with one division of 5

6 7

emergency AC unavailable (LEAC), Loss of Service Water (LOSW)

VI less than 1 per 1 05 ATWS-PWR (mechanical only), ISLOCA 6

7 8

> 30 days 3-30 days

<3days Exposure Time for Degraded Condition Note

2. The SDP worksheets for ATWS core damage sequences assume that the ATWS is not recoverable by manual actuation of the reactor trip function or by ARI for BWRs Thus, the ATWS frequency to be used by these worksheets must represent the ATWS condition that 0

PROPOSDEID 2EMENOALO 0 0 P

LIC DIOSU E WITHO APPOVAL OFT I

rm

CTOR, 0

"I

- --

11- -.
-.111-11"

, --- -
- -

[Doug Coe - 020221 Pt Beach instrument air. drs.wpld.

,Page 13 SDPENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves can only be mitigated by the systems shown In the worksheet (e g, boration). Therefore, ATWS-PWR (electrical only) is provided in Table 1 for information only and ATWS-PWR (mechanical only) should be used as applicable when performing an SDP Phase 2 analysis Any inspection finding that represents aloss of manual reactor tnp capability for apostulated ATWS scenarioshould be evaluated by a nisk analyst for consideration of the probability of a successful manual trip Table 3.6 SDP Worksheet for Point Beach Nuclear Plant, Units 1 and 2 -

Loss of Instrument Air (LOIA)(1)

Estimated Frequency (Tablel1Row) ill Exposure Time

>30 days Table 1 Result = 3 Safety Functions Needed:

Full Creditable Mitigation Capability for Each Safety Function:

Secondary Heat Removal (AFW) 1/2 MDAFW trains (I multi-train system) or I TDAFW train (1 ASD train) P1) to 1/2 SGs with 1/4 SSVs Backup supply to CST (CSTFL)

Operator uses firewater or service water to provide backup supply CST (operator

______________________________________action = 3)

Circle Affected Functions IELR Remaining Mitigation Capability Rating for Each Sequence Affected Sequence Color 1 LOlA - CSTFL (2) 2LI-F()0 3 +0=--3 identity any operator recovery actions tmat are credited to directly restore the degraded equipment or initiating event ii operator actions are required to credit placing mitigation equipment In service or for recovery actions, suchr credit should be given ordy It tihe toiiowrng cniteria are met 1) sufficient time Is available to Implement these actions, 2) environmental conditions allow access where needed. 3) procedures exist. 4) training Is conducted on tihe existing procedures under conditions similar is the scenario assumed end 5) any equipment needed to complete these actions is available and ready for use Notes:

1. Loss of instrument air at PBNP fails closed MSIV and the bypass feedwater regulating valves resulibngin unrecoverable loss of the power 0

O P L C I 0 L E O L A P O V O T H I E C O,

E 0 0

E Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page 14 SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves conversion system (and main feedwater) within the time frame Bleed and feed recovery is not possible since pressurizer PORVs fail closed and nitrogen backup is not available for at power' conditions. Also, flow control valves of the motor-dnven auxiliary feedwater pumps fail open requiring operator action to limit the flow A manual gag ovemde would be necessary to operate the SG ADV, and it is not credited SRVs will open automatically If the SG pressure reaches the setpoint The frequency of LOIA event is -5.6E-03/yr.

2. If the TDAFW pump is not available, the success of the MDP is required The discharge AOV fails open on loss of IA, and manual action may be needed to control flow. The IPE calculation shows that the pump would not run out with LOIA which results in fully open valve Manual action is needed to avoid such possibility Table 3.7 SDP Worksheet for Point Beach Nuclear Plant, Units 1 and 2 -

Loss of Service Water (LOSW) t ° 2)

Estimated Frequency (Table 1 Row)

V Exposure Time >30 days Table 1 Result = 5 Safety Functions Needed:

Full Creditable Mitiqation Capabilitv for Each SafetV Function:

Turbine-Driven AFW (TDAFW) 1 TDAFW train (1 ASD train) (31 Diesel-Driven Fire Pump (DFP) 1/1 Diesel Fire pump or 1/1 MD fire pump (operator action = 2) (4)

Chanrging pumps (CHG)

Venfy 1/2 operating charging pump or start the standby pump (operator action = 3) 5 Circle Affected Functions Recovery of Remaining Mitigation Capabilitv Rating for Each Sequence Failed Train Affected Sequence Color 1 LOSW - DFP (2) 2LOSW-TDAFW(3) 0 5+0=5 3 LOSW - CHG (4) 000 14

Doug Coe - 020221 Pt Beach instrument ai^ drs; wpd Page 15 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves Identify any operator recovery actions that are credited to directly restore the degraded equipment or Initiating event:

If operator actions are required to credit placing mitigation equipment in servce or for recovery actions, such credit should be given only It the ftllowing criteria are met 1) sufficient time Is available to Implement these actions. 2) environmental conditions atow access where needed, 3) procedures east. 4) training is conducted on the ewsting procedures under conditions similar to the scenario assumed and 5) any equipment needed to complete these actions Is available and ready foruse Notes:

1. It is assumed that the operator will manually tnp the reactor on loss of SW, If auto tnp signal Is not generated If manual tnp Is delayed due to actions to locate or repair the malfunction, loss of SW cooling will cause a loss of instrument air which will subsequently cause an automatic tnp because of MSIV closure. The frequency of loss of SW events is -1.7E-3/yr.

2. The loss of SW results in loss beanng cooling to the AFW pumps (TDAFW pump is supplied by the fire water), loss of the PCS, and loss of feed and bleed (PORVs are lost since the loss of SW also causes a loss of the IA) The three positive displacement charging pumps used at PBNP are adequately cooled by ambient air and do not rely on CCW cooling 3

For the toss of SW event, only TDAFW pump Is assumed available. Both MDAFW and TDAFW pumps require SW for beanng cooling, but fire water is automatically supplied to the TDAFW pump 4

Diesel fire pump is required for the TDAFW pump beanngs and for possible refill of the CST.

5 With the loss of SW and consequential loss of CCW to the RCP thermal barner, the operator must venfy or establish charging flow Normally, two charging pumps are running and the third pump is in standby. Failure of both the operating charging pumps will require the operator to align and start the standby pump. The operator action to start a charging pump for seat tnjection is required within 30 minutes following a reactor tnp The positive displacement charging pumps used at PBCH are adequately cooled by the ambient air and do not rely on CCW for cooling The estimated HEP for this action is 4.1 E-3 FOR PU IC OO O

0

., -.. 1 -

I---

I - - I _--- -I-,,-,,--- __. - -- 1-11

- -_11__-1___-11 I, 1-11111---.1'...- 1 111-11--

I
1-1 -. I-.1

.1...-

[ Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page 16 SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves Table 3.12 SDP Worksheet for Point Beach Nuclear Plant, Units 1 and 2 -

Loss of Offsite Power (LOOP)

Estimated Frequency (Table 1 Row) 11 Exposure Time >30 days Table 1 Result = 2 Safety Functions Needed:

Full Creditable Mitigation Capability for Each Safety Function:

Emergency AC Power (EAC) 1M2 dedicated Emergency Diesel Generators(') (1 multi-train system) or crosstie opposite unit EDG (operatoraction = 1) or 1/1 Gas Turbine (operatoraction = 1) " 3 Turbine-driven AFW Pump (TDAFW) 11 TDP trains of AFW (1 ASD train)

Secondary Heat Removal (AFW) 1/2 MDAFW trains (1 multi-train system) or 1/1 TDAFW train (1 ASD train)

Motor-driven AFW Pumps (MDAFW) 112 MDAFW trains (1 multi-train system)

Recovery of AC Power In < 1 hr (REC1)

SBO procedures implemented (operator action = 1) "

Recovery of AC Power In 2-7 hrs (REC7)

SBO procedures implemented (operator action = 1) X Early Inventory, HP Injection (EIHP) 112 HPSI pumps (1 multi-train system)

Primary Heat Removal (FB)

Operator uses RCS pressunzer 1/2 PORVs and block valves (operator action = 2)

High Pressure Recirculation (HPR) 112 HPSI pumps with 112 RHR pumps and with operator action for switchover (operator action = 2)

Circle Affected Functions RecoverV of Remaining Mitigation CapabilitV Rating for Each Affected Sequence Failed Train Seauence Color 1 LOOP - AFW - HPR (3) 0 2+0+2=4 2 LOOP - AFW - FB (4) 0 2 + 0 + 2 =4 3 LOOP - AFW - EIHP (5) 0 2+0+3=5 4LOOP-EAC-TDAFW-HPR (9,11) 0 2+5+0+2=9 (AC recovered) 0 PO P O E F O E N A C IO 00 T

PUBLICDI V

E WITHOUT OAL OF IR CTOR, 000 16

.[ oug Coe - 026221 Pt each instrument air. drs.vvpd Page 17 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves 5 LOOP - EAC -TDAFW - MDAFW - EIHP 0

2+5+0+0+3=10 (13)

(AC recovered) 6 LOOP - EAC - REC7 (7) 7 LOOP - EAC - TDAFW - MDAFW. - FB (12)0 2+5+0+0+2=9 (AC recovered) 8 LOOP - EAC - TDAFW - REC1 (14) 0 2+5+0+1=8 Identify any operator recovery actions that are credited to directty restore the degraded equipment or initiating event.

It operator actions are required to credit placing mitigation equipment in seivice or for recovery actions, such credit should be given only if the loilowing cnitera are met 1) sufficient time ts available to Implement these act ons, 2) environmental conditions atom access where needed, 3) procedures east. 4) training Is conducted on the eesting procedures under condiStions similar to the scenario assumed, and 5) any equiprment needed to complete these actions Is ava iable and ready for use Notes:

I Each PBCH unit has two trains with one diesel normally aligned to each units train (1 diesel to each of 4 trains) In our modeling, dual unit LOOP is assumed On a dual unit LOOP, each diesel would start and load to their respective train (ie, 2 diesels per unit. 1 on each train) However, If a diesel failed, the opposite unirs diesel could be aligned to handle both units on the same train This requires a manual action with an HEP of around 3E-2 Operator action - 1 is assigned based on genenc assignment of credit for such actions Upon a loss of ofsite power and the EDGs operator will attempt to start and align the GTG The HEP for starting and aiigning the GTG Is I 3E-01 and a credit of 1 is assigned 2

For the functions 'Recovery of AC Power In < I hrs (RECl ) and 'Recovery of AC Power in 2-7 hrs (REC7)- the corresponding estimated probabilities in the IPE are 4E-1 and 2 SE-1 to 4 OE-2 Both the actions are given a credit of 1 3

Battery depletion In about 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Power must be restored within approaimately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> if the RCS cooldown was not successful and the TDAFW pump runs for only 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, I e. until battery depletion Power must be restored within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> if the FCS cooldown was successful resulting in a 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or more benefit in core uncovery at low RCP seal leakage rate Recovery wthin 7 hour8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> appiies assuming TDAFW pump operation unti 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Implying local tbind' operation of the pump without the benefit of instrumentation following battery depletion 4

Gas turbine is treated like EDG so solve all the sequences 00QN PROOs FORCEENA N OOONQ 000 NOTFORPOLISCL URE WI.

TPROVAL H

RE E

Doug Coe - 020221 Pt Beach instrument air. Orswpd Page 8 SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves - Licensee's PRA analysis of issue

> Fire Risk:

> Aux Feed Pump Room

> For a fire in this room, a risk change was assumed to occur if the cable associated with the Motor Driven Aux Feed Water (MDAFW) pump discharge valve or power supply to this valve was affected by the fire. The risk was evaluated looking at the condition from both the Unit 1 and Unit 2 perspective. This may be slightly conservative since the other failures (such as the loss of the recirculation valve was assumed to occur without further evaluation).

> Two types of damage scenarios could affect this valve. These are either the direct impact due to the cables located in the plume, ceiling jet, or radiative effects of a fire; or the cables indirectly damaged due to the formation of a hot gas layer.

> All scenarios dealing with the formation of a hot gas layer were subsequently removed from consideration because there would not be a change in plant Core Damage Frequency (CDF) as a result of these fires. This is because the same final result (i.e. Conditional Core Damage Probability - CCDP) would occur if these cables were damaged or not. The CCDP in both cases was assumed to be 1.0 since this fire would be beyond the scope of what was considered for Appendix R and Safe Shutdown Methodologies would not have been available.

Therefore, only those fire initiators that could result in direct fire damage through plume, ceiling jet, or radiative effects were considered.

> Electrical Cabinets - There is one vented electrical cabinet located in the northern most section of the compartment. This cabinet fire could not cause a hot gas layer and its fire plume would not directly affect the cables of concern. Therefore, the cabinet was screened out.

> Ventilation Subsystems - There are two small motors with minimal combustible material associated with ventilation subsystems located in the east side of this compartment. These motor fires could not cause a hot gas layer and their fire plumes would not directly affect the cables of concern. Therefore, the motors were screened out.

> Cable Fires - This is the most significant contributor to the fire frequency for this room. Two separate cases were considered with the cable fires. Those that would directly affect the cables of concern and those that could create a hot gas layer. For reasons stated above, the scenarios that cause a hot gas layer are not included in the overall change of core damage probability. Those cable tray fires that could cause a loss of the discharge valve cables or power supply were evaluated in more detail. The trays associated with these cables are FR &

FM for Unit 1 and FU & FT for Unit 2. If a cable tray fire was not controlled allowing the fire to spread or a hot gas layer to be formed, there would be no change in CDF as discussed above.

If a fire was limited to these trays - due to adequate automatic or manual suppression, closure of the recirculation valve would not occur since the cables or air supplies for these valves are not located directly in or above these trays. In summary there would be not change in CDF for 000 N R

IC DIS E WI PPR OF T E

000 1 8

f Voug (Joe - U20221 Pt Beach instrument air. drs.wpd Page 19 r Doug Coe - 020221 Pt 8each instrument air. drs.wpd Page 19 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves a cable tray fire.>

> Transient Fires - Transient fires were assumed to occur randomly throughout the room.

Conservatively, SNL Nowlen Test #9 (Fire PRA Application Guide) was used to evaluate the Total Heat Content (192,000 BTUs) of the transient fire and SNL Nowlen Test #3 was used for the heat release rate (138 Btu/s). This transient fire alone is not large enough to cause a hot gas layer in this compartment. However, if the transient were placed next to a cable riser (there are exposed risers on the east side of the room) or if the transient was placed upon the tunnel that traverses the room, fire spread could occur and cause a hot gas layer. If this were to occur there would be no change in CDF. The plume for this fire was evaluated and with one exception, the cables of concern were too high to be damaged by the plume. The one exception is a transient fire placed on top of the tunnel in front of the A Motor Driven Pump cubicle. This fire could damage the power supply to the discharge MOV and control cables for the recirculation valve. It is unlikely that a transient would be placed on top of the tunnel because it is not as accessible as floor level and it is not a normal work space. It was conservatively assumed that the probability of the transient fire on top of the tunnel was just as likely as the floor level. If a transient fire were to occur on top of the tunnel, a change in CDF could result, so a detailed analysis was performed with the following results:

> Fire Frequency (FF): 4.08E-4/yr (includes both transient and welding/transient)

> Floor Ratio (FR): 4E-2 (This is the ratio of the tunnel roof area - where damage could occur -

compared to the total floor area)

> Automatic Suppression (AS): 5E-2 (Automatic Initiated Halon System)

> Manual Suppression (MS):

1.0 (Manual suppression is not credited since damage is expected to occur prior to response)

> Conditional Core Damage Probability Prior to issue (CCDP1): 5E-2 (Alternate shutdown with control room available)

> Conditional Core Damage Probability with issue (CCDP2): 1.0 (Shutdown assumed to fail with damage)

> Change in CDFTrans = FF

• FR

• AS

• MS * (CCDP2 - CCDP1)

> Change in CDFTrans = 4.08E-4

• 4E-2

• 5E-2

• 1.0 * (1.0 - 5E-2) = 7.75E-7

> Pump Fires - There are 4 AFW pumps located in this compartment. The two motor driven pumps are estimated to have 0.5 gallons of oil each and the two turbine driven pumps are estimated to have 1.875 gallons of oil each. For evaluation purposes 2 gallons of oil was conservatively assumed per pump and all of the oil from a single pump was assumed to be spilled prior to ignition - resulting in the highest heat release rate. In all cases, this amount of oil was not enough to cause a hot gas layer and no other combustibles were close enough to result in a secondary ignition. Only one of the four pumps (Unit 1 Turbine Driven AFW pump) has discharge valve cables and power supply cables located in the plume. Further fire modeling was done for this pump. The cable trays containing these cables are located in the plume at an elevation which could result in cable damage, but, would not result in cable ignition.

000O LPRO SURM IAENFORP VALTCTRONE T

E 00 O

S9~( iOURNVTJTAPR)

E 19

2Doug;1 PtBeach instru met air. dr.wage SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves

> Fire Frequency (FF): 1.42E-4/yr (fire frequency for single pump)

> Fire Severity (FS): 2E-1 (

Reference:

Fire PRA Implementation guide)

> Automatic Suppression (AS): 5E-2 (Automatic Initiated Halon System - credit for suppression prior to cable damage.)

> Manual Suppression (MS): 1.0 (Manual suppression is not credited since damage is expected to occur prior to response)

> Conditional Core Damage Probability Prior to issue (CCDP1): 5E-2 (Alternate shutdown with control room available)

> Conditional Core Damage Probability with issue (CCDP2): 1.0 (Shutdown assumed to fail with damage)

> Change in CDFTrans = FF

• FS

• AS

• MS * (CCDP2 - CCDP1)

> Change in CDFTrans = 1.42E-4

• 2E-1

• 5E-2

• 1.0 * (1.0 - 5E-2) 1.35E-6>

> Summary of change to fire risk:

Transient Fire:

7.75E-7 Pump Fire:

1.35E-6 2.13E-6 (WHITE)

> Aux Building Rooms

> Three fire zones in the Aux building also relied upon the Motor Driven AFW pumps and the discharge valves could be damaged. In all fire zones analyzed, it was determined that adequate AFW capacity would have been available through the use of AFW pumps not credited but available. And, procedures were available to use those pumps. A brief description for credited systems is identified below and more detail will be available in the LER.

> Si Pump Room: Even though the motor driven pumps were credited for a pump in this fire zone, through manual actions the turbine driven pumps would have been available. The manual actions credited were proceduralized. Therefore, even though these pumps were not credited, their success probability would be similar to the motor driven pumps such that the overall change in risk would be insignificant.

> 26' PAB Elevation: Again, motor driven pumps were credited for a fire in this zone. However, as with the Si Pump room the TDAFW pumps would have been available with through manual actions. Therefore, even though these pumps were not credited, their success probability would be similar to the motor driven pumps such that the overall change in risk would be insignificant. Justification for the ability to perform these manual actions will be discussed in the LER.

> 46' PAB Elevation: This fire zone required a more detailed analysis. The Turbine Driven AFW pump steam supply valves are located in this fire zone. The Unit 1 valves are located in 0

0DSRTHOT0ALERECR

r Doug Coe - 020221 Pt Beach instrument aair. drs.wpd

Page 21 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves the South East corner and the Unit 2 valves are located in the North East corner. The cables associated with these valve are all located near floor level (within 5 feet of the floor). Because of the large horizontal doorway opening (12 feet high) between this fire zone and the central portion of the 46' PAB, a hot gas layer of sufficient depth to damage these cables can not occur. A further review of the fire scenarios showed that none of them could spread or damage both units steam supply valves. Since the use of one motor driven pump (P38B) was already proceduralized and the use of the one of the turbine driven pumps from the control room would be available and proceduralized, there would have been adequate AFW flow to both units --

one using the Motor Driven pump and the other with the unitized Steam Driven pump.

Therefore the change in risk for this zone is insignificant.

> Internal Events/Seismic:

> There were 4 initiators that are directly impacted with this issue. These include Loss of off-site power, Loss of Instrument Air, Loss of Service Water, and Seismic. In all these cases, instrument air is lost either long term or short term due to direct impact of the initiator. In addition to these initiators, most other initiators were also indirectly affected through the potential subsequent random loss of Instrument Air. Both cases were evaluated. The direct loss of Instrument Air through the initiator accounts for more than 90% of the Core Damage Frequency (CDF) increase. Therefore, the focus of a detailed PRA review was on these 4 initiating events.

> In all cases, the initiator results in a dual unit event. The change in CDF was a direct result of the assumed loss of all AFW for one of the two units given this issue. Because of the conditions that need to occur for operators to take the action of securing flow, we were able to demonstrate that complete loss of AFW could only occur on one of the two units. In all sequences analyzed, the other unit would protect (through forward flow) either an electric or turbine driven auxiliary feed pump.

> Reasons for AFW loss will be further discussed in the LER associated event, but a brief description follows. There were a number of sequences evaluated with this issue due to the number of initiators involved. In addition, there are two circumstances (overcooling of RCS, and overfilling of > Steam Generator) that could occur early in an event that could cause the operators to secure flow. Therefore, there are a number of combinations of initiating events, sequences, and operator actions that needed to be considered.

> Each of the circumstances where an operator could secure flow has potential to damage the AFW pumps for a subset of the sequences. The first scenario involves over-cooling of the RCS. In this condition (expected for some event sequences), an operator may secure AFW flow within the first few minutes of a reactor trip. At this point in time, it is likely that air pressure would still be adequate to indicate the recirculation by-pass valves open. As air pressure decays away, the recirculation valves would close. A short time later, pump damage would occur. The second scenario involves over-filling of the SG. In this condition (again, expected 0O UBCLOSU OUTAPLOF

IRETOR, 21

[ Doug Coe - 020221 Pt Beach instrument air. drs.wpd I

. X

>Page 22 Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page 22 SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves for some event sequences), an operator is directed to secure flow. This step is expected to be reached around 13 minutes after plant trip. Air pressure may, or more likely, may not be available and the recirculation valve would be failed closed. If the operator does not notice the valve closed, pump damage would occur a short time later.

> All of these scenarios have been evaluated by the PRA model. A CDF of approximately 8E-4 was calculated using the internal and seismic PRA models (Approximately 6E-4 internal and 2E-4 seismic). We have performed an extensive review of the model to determine if additional credit could be taken for recovery through the use of non modeled methodologies.

Methodologies evaluated included the use of main feed water, charging, and the recovery of equipment originally lost. In addition, a close look at the initiators was performed to determine primary and secondary response to validate if over-cooling or over-filling was possible. For some initiating event sequences, we were able to determine that overcooling would not be likely. In addition, we found that for some sequences charging flow may be adequate to protect from core damage. To determine if these benefits would be enough to reduce the resulting change in CDF to less than 1E-4, some best case scenarios were studied. From these studies, we concluded that these benefits were not enough to demonstrate that the resulting change in CDF would be less than 1 E-4. In summary, from these benefits we believe that the actual change in CDF would be less than the base 8E-4 calculated by the PRA models, but, would still be above the 1 E-4 threshold for a Red finding., Notices of Violation Issue #1 - Operator Actions A.

10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings,"

requires, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances.

Contrary to the above, as of November 29, 2001, procedures EOP-0.1 Unit 1, "Reactor Trip Response," revision 24, and EOP-0.1 Unit 2, "Reactor Trip Response," revision 23, activities affecting quality, were not of a type appropriate to the circumstances.

Specifically, the procedures did not provide adequate guidance to operators regarding the potential to damage AFW pumps while controlling AFW flow upon low instrument air header pressurre, which would cause the recirculation valves to fail closed. Because the procedures did not include instructions to ensure the recirculation valves were open, the AFW pumps could be damaged under low flow conditions such as when the flow is throttled back to control steam generator level or to mitigate reactor coolant system overcooling.

B.

10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," requires, in part, that measures shall be established to assure that conditions adverse to quality are promptly identified and corrected. In the case of significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective actions taken to preclude repetition.

Contrary to the above, as of November 2001, the licensee failed to identify that the auxiliary feedwater system was not capable of performing its safety function under certain T

LIOPCSE INFORCtHTA CT10AOF E

S:<C t~

Ce URE-WIHUT APAR OF D~t 22

DoEu~g Coe' -02022 Pt Be~a~ch 'intr'umen~t 'air". drwdPae2 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves conditions and failed to correct the deficiency until December 2001. Specifically, all auxiliary feedwater pumps would be subject to a common mode failure involving dead-heading of auxiliary feedwater pumps following a loss of offsite power or seismic event due to the closure of the minimum flow recirculation valves upon loss of the non-safety grade, non-seismically qualified instrument air system and prescribed operation actions to control feedwater flow in response to transient conditions.

1.

On seven occasions between 1981 and 1997, the licensee was made aware, through the following means, of the susceptibility of the auxiliary feedwater system to this type of vulnerability, but the licensee failed to identify this significant condition adverse to quality and to identify its cause:

In October 1997, the safety function of the minimum flow recirculation valves was considered in response to Condition Report 97-3363.

In March 1997, the licensee identified a failure mode of the auxiliary feedwater system due to the loss of instrument air.

In 1994, the original design basis document for the auxiliary feedwater system identified that the minimum flow recirculation valves had a safety function to open and remain open.

In 1991, the original probabilistic risk, assessment performed in response to Generic Letter 88-20, did not adequately consider the function of the recirculation valves.

In 1989, the licensee determined that no air-operated valves were required to cope with a station blackout.

In 1988, Generic Letter 88-14 requested that the licensee perform a design verification of the instrument air system, including an analysis of component failure positions. The licensee conducted a design verification, however, it was not adeauate to identify the system deficiency.

In 1981, Generic Letter 81-14 requested the licensee to review the seismic qualification of the auxiliary feedwater system. The generic letter specifically identified the instrument air interface as an issue identified during NRC walkdowns. The licensee specifically addressed the auxiliary feedwater pump recirculation valves in its response to the NRC,dated May 4, 1982.

2.

Once the deficiency was identified on November 29, 2001, the licensee failed to adequately correct the significant condition adverse to quality on November 30, 2001, when developing temporary change numbers 2001-0873 and 2001-0874 for procedures EOP-0.1 Unit 1, "Reactor Trip Response," revision 24, and EOP-0.1 Unit 2, "Reactor Trip Response," revision 23, respectively. Specifically, the temporary changes did not identify the instrument air header pressure low 000 F

PU C

OSURUT RVALOF 23

Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page 24

'Doug Coe - 020221 Pt Beach instrument air. drs.wpo Page 24 SDPJENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves annunciator as a condition for monitoring AFW minimum flow recirculation valve position. Thus these procedure changes did not provide adequate guidance for the operators to address the potential for AFW minimum flow recirculation valves to close upon low instrument air header pressure, which could result in AFW pump damage if the flow was throttled back to control steam generator levels or to mitigate reactor coolant system overcooling.

Issue #2 - Fire C.

10 CFR 50.48, Section (b)(2) requires, in part, that all nuclear power plants licensed to operate before January 1, 1979, must satisfy the applicable requirements of Appendix R to this part, including specifically the requirements of Sections III.G, lll.J, and 111.0. The Point Beach Plant was licensed to operate prior to January 1, 1979.

10 CFR Part 50, Appendix R, Section III.G.2 requires, in part, where cables or equipment, including associated non-safety circuits that could prevent operation or cause maloperation of redundant trains of systems necessary to achieve and maintain hot shutdown conditions, are located within the same fire area outside of containment, the cables and equipment and associated non-safety circuits be separated by a fire barrier having a three-hour rating, or be separated by a horizontal distance of more than 20 feet with no intervening combustibles or fire hazards, or one redundant train be enclosed in a fire barrier having a one-hour rating.

Contrary to the above, as of November 29, 2001, cables and equipment, located within fire area A23S, required for operation of redundant trains of systems necessary to achieve and maintain hot shutdown conditions were not separated by the required distance.

Specifically, cables required for operation of motor-driven AFW pumps (pumps P-38A and P-38B) were located within a set of cable trays that were separated by a horizontal distance less than five feet. In addition, the cables were not separated or enclosed by an appropriate fire barrier. Consequently, a fire within fire area A23S could damage cables and equipment required for operation of the northern motor-driven AFW pump (pump P-38B), the AFW pump relied upon for safe shutdown in the event of a fire in fire area A23S.

0KNOTF FR LIC DISC UR WITH m

APPOVAL 0 EEC E

[Doug Coe - 020221 Pt Beach instrument air. drs.wpd Paqe 25 l, Doug qoe 7 020221 Pt Beach instrument ai!r. drs.wpd Page 25 SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves - Draft Body of Inspection Report

4.

OTHER ACTIVITIES (OA) 40A3 Event Follow-Up (93812)

.1 Auxiliary Feedwater Failure Due To Operator Actions

.a Inspection Scope The team performed inspection activities as specified by the charter for the special inspection. The charter was outlined in NRC memorandum from John M. Jacobson to Ronald A. Langstaff, dated November 30, 2001. The charter directed review of the following areas:

Timeline development relating to contributors and discovery of the potential common mode failure of the auxiliary feedwater system due to the loss of instrument air on auxiliary feedwater (AFW).

Adequacy of licensee's operability evaluation and immediate corrective actions for addressing impact of loss of instrument air on AFW.

Preliminary determination of risk significance.

Apparent cause of condition resulting in potential loss of AFW upon loss of instrument air.

Evaluation of pressurizer power operated relief valve (PORV) modifications impact on operational capability in response to loss of feedwater.

Extent of condition of the adequacy of engineering review of instrument air system, other air operated valves, and failure modes.

Failure of the original individual plant examination (IPE) to consider AFW recirculation valve function.

.b Findinqs A violation of 10 CFR Part 50, Appendix B, Criterion V was identified for failure to have adequate guidance in emergency operating procedures to prevent damage to auxiliary feedwater pumps. Additionally, two violations of 10 CFR Part 50, Appendix B, Criterion XVI were identified for failure to identify conditions adverse to quality relating to the inadequate procedural guidance. Collectively, the findings associated with the violations were preliminarily determined to be of high safety significance (i.e., red).

000 25

[ Doug Poe - 020221 Pt Beach instrument air. drs.wpd Paae 2E Doug Coe ~- 0221Pt c insrmn air drsw Paaei SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves (1) Event Description The licensee probabilistic risk analysis (PRA) staff identified a vulnerability associated with AFW recirculation valves. The recirculation valves were air operated valves which failed closed upon a loss of instrument air. Consequently, in certain transients, such as a loss of off-site power, loss of service water, and loss of instrument air, the flow path via the recirculation lines would be lost due to the recirculation valves failing closed upon a loss of instrument air. Closure of the recirculation valves could result in pump failure under low flow conditions such as when AFW flow was throttled back to control steam generator level or mitigate overcooling of the reactor coolant system.

The PRA staff identified the vulnerability while updating the Point Beach PRA model for internal events. The PRA staff originally considered the vulnerability to be a procedural weakness associated with procedure AOP 56, "Loss of Instrument Air." The original concern was steps to restore AFW pump recirculation flow did not occur sufficiently early in the procedure. Condition Report (CR) 01-2278 was initiated on July 6, 2001 to document the concern. The PRA staff continued discussions with operations personnel over the next several months with regards to the vulnerability. During November, 2001, the PRA staff completed their internal events modeling and determined that the vulnerability resulted in a substantial increase in risk. On November 28, 2001, the PRA staff, engineering personnel, and operations personnel met to discuss the significance of the vulnerability and potential courses of action. On November 29, 2001, operations concluded that temporary information tags and operator briefings was appropriate to address the vulnerability. CR 01-3595 was initiated to documented the increased risk and to address the vulnerability. The NRC was also formally notified (Event Notification 38525) on November 29, 2001. The issue was subsequently reported by Licensee Event Report 266/2001-005-00 on January 28, 2002.

(2) System Description Point Beach Nuclear Plant is a two unit site. Each unit has a turbine driven AFW pump (pumps 1 P29 and 2P29) which can supply water to both steam generators. Additionally, the plant has two motor driven AFW pumps (pumps P39A and P398) each of which can be aligned to a steam generator in each unit. The recirculation minimum flow valves for both the turbine driven and motor driven pumps would open for the initial 45 seconds after pump start and open on low flow conditions. However, the recirculation minimum flow valves were air operated valves which failed closed upon a loss of instrument air. The control room had valve position indication for the recirculation valves and flow indication to individual steam generators.

The AFW recirculation lines were installed, as part of original construction, to ensure the pump would have a flow path to prevent dead-heading the pump, which would damage the pump. Discussions with licensee engineering staff indicated that a pump could be PRO~w EN FOREM ACTION 000LISS URITUTAPPVLFTHED C0 OE 26

\\

Doug Coe I-II -- 1~I1-02022 -I 1 1- -I --- -- I

---

-tBe ch in tr m e t-ir dr

.w Page 27_

II I - -~III-I 111.-.

II~-IIII_

- _I.Ii-I-I

-1 ~I-1 1I.

I Doug Coe - 020221 Pt Beach instrument air. drs.wpq Page 27 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves damaged within minutes under insufficient flow conditions due to lack of cooling. The initial lines installed included an orifice that allowed a 30 gpm flow rate. This flow rate was determined by the pump vendor, Byron Jackson, to be sufficient to prevent pump damage based on pump heat-up when on mini-flow. The recirculation lines were subsequently modified in 1988, in response to Bulletin 88-04, "Potential Safety-Related Pump Loss," to accommodate a greater flow rate and protect the pump from low flow instabilities.

(3) Operator Actions Procedure EOP-0.1, "Reactor Trip Response," directed operators to control feedwater flow early on in the procedure. Procedure EOP-0.1 was the procedure which operators would be using for most transients. Response not obtained (RNO) column step 1.c of the procedure directed operators to reduce feed flow if reactor coolant system (RCS) temperatures were less than 5470 Fahrenheit (F) and trending lower. Step 4.b directed operators to control feed flow to maintain steam generator levels between 29% and 69%.

RNO step 4.b directed operators to stop feed flow to intact steam generators if level continued to rise. However, if instrument air had been lost, damage could occur to the AFW pumps by operator actions to control feedflow due to low flow conditions created.

The inspectors noted that procedure OM 4.3.1, "AOP and EOP Writers' Guide," step 5.4.2 stated "A caution is used to present information regarding potential hazards to personnel or equipment associated with the subsequent step(s)." The emergency operating procedures steps did not provide any such cautions prior to November 30, 2001.

Portions of the EOP-0.1 steps are illustrated below:

STEP ACTION/EXPECTED RESPONSE 1

Verify RCS Temperature Control:

a. Check RCS wide range cold leg temperatures:

LESS THAN OR EQUAL TO 5470 F AND STABLE STEP ACTION/EXPECTED RESPONSE RESPONSE NOT OBTAINED Perform the following:

1. IF RCS cold leg temperature less than 5470 F AND RCS temperatures are trending lower, THEN stabilize RCS temperature as follows:

a) Stop dumping steam.

b) Ensure S/G blowdown isolations - SHUT c) IF cooldown continues, THEN control feed flow:

1) Reduce total feed flow.

2) Maintain total feed flow greater than or equal to 200 gpm until level greater than 29% in at least one S/G.

RESPONSE NOT OBTAINED 00OFCOSEWOCEMENAPRIO OF E

000 N

C JRE IOTPRO E

DRCOE 27

f Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page 28 f Doug qoe - 020221; Pt Beach instrujmept air. drs,.wpdt X

Page 28 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves 4

Stabilize S/G Levels:

a. Check S/G/ levels - GREATER

a. Maintain total feedflow greater THAN 29%

than 200 gpm until level greater than 29% in at least one S/G

b. Control feed flow to maintain

b. IF level in intact S/G continues to SIG levels between 29% and rise, THEN stop feed flow to that 65%

S/G.

Operating experience demonstrated that operators could drastically cut back auxiliary feedwater flow within several minutes due to overcooling under some transient conditions. For example, on June 27, 2001, the Unit 2 reactor was manually tripped due to low and decreasing water level in the Unit 2 circulating water pump bay (reported on Licensee Event Report 05000301/2001-002-00). Due to low steam generator water levels, the Unit 2 turbine driven AFW pump and both motor driven AFW pumps initiated and began feeding the Unit 2 steam generators. Only one steam generator in a unit nominally required 200 gallons per minute (gpm) feedwater flow for decay heat removal.

However, with three AFW pumps running, approximately 800 gpm of feedwater flow, i.e.,

approximately four times the required flow, was provided to the Unit 2 steam generators.

Consequently, the reactor coolant system was cooled down at an excessive rate.

Approximately three minutes after the reactor was tripped, operators closed either the flow control valves or the discharge valves to stop flow from the motor driven AFW pumps. Approximately four minutes after the reactor was tripped, operators closed the discharge valve from the Unit 2 turbine driven AFW pump to stop all AFW flow. The AFW pumps were not secured until approximately eight minutes after the reactor was tripped when feedflow using main feedwater was partially restored. In this particular event, the AFW minimum flow recirculation valves were functional because instrument air had not been lost. However, instrument air would not be initially available in some other transients such as loss of instrument air, loss of off-site power, and loss of service water events.

Based on discussions with licensee engineering staff, the inspectors determined that the time that the AFW minimum flow recirculation valves would fail closed due to loss of instrument air could vary. The engineer staff had determined that the minimum flow recirculation valves would begin to drift shut at 40 psig and would be fully closed at 25 psig. The instrument air header pressure was normally maintained at roughly 100 psig with some variation due to cycling of air compressors. Based on observations of instrument air header pressure drop between cycling of air compressors, the engineering staff determined that the instrument air head pressure would drop approximately 13.5 psi in one minute under normal loads. The engineering staff estimated that the AFW minimum flow recirculation valves would begin to drift shut approximately six to eight minutes after loss of all air compressors with complete valve closure one to two minutes thereafter. A loss of instrument air due to a break in an airline versus a loss of air compressors would result in different bleed down rates, depending on the size of the break. Additionally, the instrument air bleed down rate could be faster due to greater demands on the instrument air system in response to the O~~eOSED E~s~MN A oo NOD S

CLDIS WITO AL 0 EDEC R, OE 28

[Doug Coe- 020221 Pt Beach instrument air. drs.wpd^

Page 29 SOP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves transient.

Based on discussions with licensee personnel, the preferred method for controlling auxiliary feedwater flow was by throttling or closing the AFW flow control valves (for the motor driven AFW pumps) or discharge valves (for the turbine driven AFW pumps) rather than securing pumps. The inspectors noted that Section 14.1.12, "Loss of All AC Power to the Station Auxiliaries," of the original Final Facility Description and Safety Analysis Report (FFDSAR)," stated the "The reactor operator in the control room can monitor the steam generator water level and control the feedwater flow with remote operated auxiliary feedwater control valves." The FFDSAR did not discuss securing AFW pumps as a means to control steam generator levels. Licensee operations personnel contested that operators would recognize that the AFW pumps would not have sufficient flow if the recirculation valve failed closed. The inspectors recognized that operations personnel may recognize that low flow conditions existed and secure a pump accordingly. However, the inspectors were not confident that such actions would be taken with a high degree of certainty prior to the procedure changes and training provided November 29, 2001 and after. The inspectors noted that although operators had flow indication for flow to individual steam generators, the operators did not have direct flow indication for the AFW pumps in the control room. The control room did provide valve position indication for the AFW minimum flow recirculation valves.

Additionally, the inspectors noted that in some scenarios, the recirculation valves could remain open at the time that operators throttle or close flow control and discharge valves. However, the recirculation valves could close due to decreasing air pressure.

Consequently, the valves could reposition at a time when an operator's attention would not be directly focused on the AFW pumps.

Procedure AOP-5B, "Loss of Instrument Air," provided operators guidance for loss of instrument air. However, the inspectors noted that operators would typically be using emergency operating procedures, such as EOP-0.1, in their initial response to a transient. After plant conditions stabilized, abnormal operating procedures, such as AOP-5B, would be used to restore equipment. The inspectors reviewed procedure AOP-5B and determined that the first procedure step which directed operators to gag the AFW pump recirculation valves open was step 1 of Attachment R, 'Auxiliary Feed,"

located on page 36 of the procedure. Operators were directed to Attachment R by step 26 (located on page 14) of the procedure. Step 26 simply directed operators to check plant systems status per attachments A through Z. The inspectors also noted that although procedure AOP-5B had a procedure step, step 24, relating to auxiliary feedwater which appeared earlier in the procedure, the procedure step did not address the recirculation valves. Consequently, although procedure AOP-5B had steps which addressed the recirculation valves, the inspectors considered it unlikely that operations personnel would have performed the steps in time to prevent pump damage had auxiliary feedwater flow already been cut back.

00M I DF ENF(TACT 0

29

Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page 30 Doug Coe - 020221 Pt Beach instrument air..drs.wrpd Page 30 SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves The inspectors reviewed licensed operator training lesson plans and simulator scenarios for training conducted prior to November 29, 2001, and interviewed licensed reactor operators and senior reactor operators to evaluate the emphasis placed on the effect of loss of instrument air on AFW operability prior to November 29, 2001. The inspectors determined:

Operators were trained on and knowledgeable of the "fail-safe' position of air operated valves including the AFW minimum recirculation valves. No emphasis, however, was placed on the consequence of the fail-closed AFW minimum recirculation valves.

Lesson Plan 2672, "Instrument Air and Service Water Review," outlined training on the loss of instrument air PRA initiating event. The outline addressed the loss of instrument air effect on secondary cooling. The lesson plan stated that the turbine-driven AFW pump would be available for feeding the steam generator -

"loss of instrument air had no effect" and that the pressure control valves for the motor-driven AFW pumps fail open on loss of instrument air (providing a flow path from the motor-driven AFW pumps to the steam generators. Licensee management informed the inspectors that the lesson plan was not a stand alone document and that the scenario described was the "forward flow" scenario for AFW to the steam generators upon initiation of AFW. The inspectors noted that (1) there was no mention of limiting the lesson to the immediate response of AFW system in the lesson plan, (2) the 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> of operation limitation on the nitrogen supply to the pressure control valves for the electric AFW pumps was discussed, and (3) the need to gag open the atmospheric steam dumps was discussed. The inspectors concluded that the effect loss of instrument air on the AFW minimum recirculation valves was not specifically addressed because it was not recognized by PRA as being significant at the time of the training.

No simulator scenario, including loss of offsite power and loss of instrument air, had included the failure of an AFW pump due to loss of recirculation flow. The licensee's training staff informed the inspectors that the simulator, as modeled, would not fail an AFW pump due to low flow conditions.

10 CFR Part 50, Appendix B, Criterion V, 'Instructions, Procedures, and Drawings,"

requires, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances. As of November 29, 2001, procedures EOP-0.1 Unit 1, "Reactor Trip Response," revision 24, and EOP-0.1 Unit 2, "Reactor Trip Response," revision 23, were not of a type appropriate to the circumstances in that the procedures did not provide adequate guidance to operators regarding the potential to damage AFW pumps while controlling AFW flow upon a loss of instrument air. As a result of the inadequate guidance, operators could have inadvertently damaged multiple AFW pumps in response to a transient involving a loss of instrument air, a non-safety related system. This issue is considered an apparent violation (AV 50-266/01-17-xx; 50-301/01-17-xx)

T FO UBLI LOSURE OU APPROVAL 0REC

,E 30

r Doug Coe - 020221 Pt Beach instrumentair. drs wpd

^Page 31 SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves (4)

Operability Evaluation The inspectors reviewed the licensee's initial operability determination screen conducted by a Senior Reactor Operator (SRO) on November 29, 2001. The documented basis for system operability was satisfactory completion of required surveillance testing. The inspectors noted that the operability determination screen did not address the potential simultaneous failure of all AFW pumps due to loss of instrument air and procedurally directed operator actions (the specific issue identified by the CR). The inspectors engaged licensee management (duty shift supervisor and operations manager) on the adequacy of the operability determination screen. Licensee management acknowledged that the documented operability basis was lacking in detail, but assured the inspectors that extensive discussions of system operability were conducted involving both operations and engineering. After repeated questioning by the inspectors, the licensee initiated a formal engineering operability determination on November 30, 2001. The inspectors noted that despite the "extensive discussions" conducted prior to inspector intervention on November 30, over twenty-four hours, and one revision, were required to complete the formal engineering operability determination. The inspectors reviewed revision 1 of the formal engineering operability determination to verify that the licensee's conclusion that the AFW system was operable but nonconforming was appropriate.

(5)

Licensee Corrective Actions The licensee revised procedures EOP 0, OReactor Trip or Safety Injection,' and EOP 0.1, "Reactor Trip Response," on November 30, 2001, to provide additional guidance to operators. The foldout pages for both procedures were revised to state:

IF any AFW pump mini-recirc valve fails shut, THEN maintain minimum flow or stop the affected AFW pump as necessary to control S/G levels.

• P-38A minimum flow - GREATER THAN 50 GPM

• P-38B minimum flow - GREATER THAN 50 GPM

• P-29 minimum flow - GREATER THAN 75 GPM The above guidance addressed overfilling of steam generators which would, generally, take longer than 10 minutes after the transient initiated. Consequently, under such circumstances, instrument air would have likely bled down to the point of failing the recirculation valves shut before operators would have taken actions to drastically control AFW flow.

However, the licensee PRA staff subsequently identified that operator action to control AFW flow could be required much earlier in a transient due to overcooling. Morever, during an event which had occurred during the summer of 2001, operators had taken actions to drastically control AFW flow due mitigate overcooling of the reactor coolant system within approximately three minutes of the start of the event. Consequently, at 31

Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page 32 fDug Coe - 020221 Pt Beach instrument air. drs.wpd Page 32 SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves the time operators take action to control AFW flow, the recirculation valves may still be functional due to sufficient instrument air header pressure remaining. However, as instrument air header pressure decreases, the recirculation valves would reposition at time when operators are not in the process of manipulating AFW controls. Hence the greater likelihood that the operators would not recognize that the recirculation valves had failed shut.

In response to this issue, the licensee revised the foldout page for procedures ECA-0.0, "Loss of all AC Power," EOP 0, and EOP 0.1, on December 20, 2001, to state:

IF any AFW pump mini-recirc valve fails shut OR annunciator C01 A 1-9, INSTRUMENT AIR HEADER PRESSURE LOW in alarm, THEN monitor and maintain minimum AFW flow or stop the affected AFW pump as necessary to control S/G levels.

• P-38A minimum flow - GREATER THAN 50 GPM

• P-38B minimum flow - GREATER THAN 50 GPM

• P-29 minimum flow - GREATER THAN 75 GPM The inspectors questioned the effectiveness of the procedure revisions. Based on discussions with licensee personnel, the inspectors determined that the instrument air pressure annunciator would alarm at 89 psig. However, the recirculation valves would begin to fail closed at 40 psig and would be completely shut at approximately 25 psig.

Based on timing the cycling of the air compressors, the licensee estimated that instrument air header pressure dropped about 10 psi per minute with normal loads. The licensee estimated that the annunciator would provide five to nine minutes of warning to the operators. Additionally, the inspectors noted that for most transients, numerous annunciators would be lit and would tend to mask the instrument air header pressure annunciator.

10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," requires, in part, that measures shall be established to assure that conditions adverse to quality are promptly identified and corrected. On November 29, 2001, the licensee had identified the potential for common mode failure of AFW pumps due to the AFW minimum flow recirculation valves failing closed upon loss of instrument air. However, the procedure changes performed on November 30, 2001, to address this issue were inadequate in that insufficient time would exist for operators to recognize that AFW pump low flow conditions existed and take appropriate actions to secure affected AFW pumps.

Specifically, although operators were provided with indication of AFW minimum flow valve position indication, the operators did not have direct indication of low AFW pump flow conditions which would necessitate securing AFW pumps. Additionally, although operators had annunciation of low instrument air header pressure indication, the annunciation only provided operators with about a half minute of warning prior to the AFW minimum flow control valves failing shut. Given the demands placed on operators during the early phases of a transient, the procedure changes did not provide sufficient time for operators to recognize AFW pump low flow conditions and take appropriate 32

Doug Uoe - 020221 Pt Beach instrument air. drs.wpd Page 33 SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves actions. This issue is considered an apparent violation (AV 50-266/01-17-xx; 50-301/01-17-xx)

(6) Missed Opportunities The inspectors identified a number of opportunities which the licensee had prior to 2001 to identify that the failure mode of the AFW minimum flow recirculation valves conflicted with operating practice.

1981 In Generic Letter (GL) 81-14, the NRC requested that the licensee perform a walk-down of the non-sesmically qualified portions of their Auxiliary Feedwater systems to identify apparent and practically correctable deficiencies that may exist. In attachment 1, section IV, of their response, dated May 4, 1982, the licensee stated "the auxiliary feedwater recirculation valves are now normally open and fail close." The licensee did not address the impact of the valves failing closed could have on the system.

1988 GL 88-14, 'Instrument Air Supply System Problems Affecting Safety-Related Equipment," requested that licensees perform a design verification of the entire instrument air system including an analysis of current air operated component failure positions to verify that they were correct for assuring required safety functions. The licensee's response, dated February 20,1989, stated under action item 2 that Abnormal Operating Procedure AOP-5B, "Loss of Instrument Air" provides operators with a listing of component failure positions due to loss of instrument air and the actions that might be necessary for various systems and/or components.

1989 In their April 17, 1989 submittal to the NRC in response to 10 CFR 50.63 (i.e.,

the station blackout rule), Wisconsin Electric stated that no air-operated valves are required to operate to cope with a station blackout for one hour.

1991 The original PRA performed in response to GL 88-20 did not model the minimum flow recirculation valves failing closed upon loss of instrument air. Consequently, the interaction between the instrument air system and the auxiliary feedwater system was not fully evaluated.

1994 The design basis document (DBD) for the auxiliary feedwater system, DBD-01 dated April 1994, stated that minimum flow recirculation valves had a safety function to open and remain open. However, the identified safety function for the valves to open was not reconciled with the valves failure mode to fail closed upon a loss of instrument air.

1997 In March 1997, the licensee identified an AFW system failure mode due to instrument air (reported by Licensee Event Report 97-014-00). Specifically, the flow control valves for the motor driven AFW pumps were air operated valves 000 33

r Doug Coe - 020221 Pt Beach instrument air. drs.wpd; Page ^34 Doug Coe - 020221 Pt Beach instrument air. drs.wpd Paie 34 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves which failed open. In certain scenarios, such as a main steam line break coincident with a loss of instrument air, the motor driven AFW pumps could be in a run-out condition and trip the circuit breakers for the pumps. As a result of identifying this vulnerability, the licensee installed nitrogen back-up for the motor driven pump flow control valves. However, the licensee did not adequately review the function of other air operated valves in the AFW system such as the minimum flow recirculation valves.

1997 In April 1997, a contractor working on the revision of the licensee's inservice testing (IST) program identified the discrepancy between the IST background document and the AFW system DBD for the safety function of the valves in the recirculation line. The IST background document stated the check valves did not have a safety function to open. since there was always adequate flow to the steam generator such that the recirculation flow path was not needed to protect the pump. The AFW system DBD stated that the minimum flow recirculation valves, and, hence, the recirculation line, did have a safety function to open. The issue was documented on CR 97-3363 and investigated. In their investigation, the licensee focused ensuring that the AFW system would provide water to the flow steam generators. For the turbine-driven pumps, the valve lineup was such that there was normally a flow path to the generator. The only power-operated valves in the line were motor-operated valves (MOVs) to each steam generator that were normally in the throttled position. For the motor-driven pumps, although there were normally closed valves (one control valve and an MOV to each steam generator) in the discharge path, these valves received an open signal on pump start to provide an adequate flow path. The dead-heading of the motor-driven pump could occur if the control valve or MOV failed to open. Based on single failure criteria, this would however only affect one of the two motor-driven pumps. Based on this evaluation, the licensee deleted the open safety-function of the minimum flow recirculation valves from DBD-1. However, the licensee failed to address operator actions which could be taken to control auxiliary feedwater flow to prevent overcooling of the RCS or overfilling the steam generators. As such, the licensee failed to identify that multiple AFW pumps (both turbine driven and motor driven) could be affected by the failure mode of the AFW minimum flow recirculation valves.

(7)

Pressurizer PORV Impact on Operational Capabilitv The pressurizer PORVs were air operated valves which were provided with a backup nitrogen supply. However, since 1979, the back-up nitrogen supply has been isolated, by procedure, for power operation. A containment entry was required to restore the back-up nitrogen supply. Consequently, upon a loss of the instrument air, the ability to 000 PR000 ORC E

000 0-NO FOR CLOSURAPPROVAL THIECRE 34

Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page PE SOPENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves use the PORVs would not be available. The safety injection pumps did not provide sufficient discharge pressure to lift the reactor coolant system safety relief valves.

Although the positive displacement charging pumps provided sufficient discharge pressure to lift and pass coolant through the code safety relief valves, the charging pumps did not provide sufficient flow for adequate decay heat removal. Consequently, a loss of instrument air would also result in the loss of feed and bleed capability. A loss of f eedwater combined with a loss of instrument air would result in a loss of decay heat removal capability.

.x Risk Significance to be provided later pending SRP panel

.2 Auxiliary Feedwater Failure due to Fire Damage

.a ~Scope The team performed inspection activities as specified by the charter for the special inspection. The charter was outlined in NRC memorandum from John M. Jacobson to Ronald A. Langstaff, dated November 30, 2001. The charter directed review in the area of preliminary risk significance determination of fire scenarios.

.b Findings One violation of 1 0 CFR Part 50, Section lll.G.2 was identified for failure to provide separation of cables and equipment and associated non-safety circuits of redundant trains by a horizontal distance of more than 20 feet with no intervening combustible or fire hazards. As a result, one AFW pump relied upon for post-fire safe shutdown would not be available. The finding associated with the violation was preliminarily determined to be of low to moderate safety sig nif icance (i.e., white).

(1) Fire Scenario During the inspection, the licensee identified one scenario where an AFW minimum flow recirculation valves failing closed could invalidate existing Appendix R safe shutdown analyses. The licensee initiated CRs 01-3633 and 01-3648 to document the issues.

Specifically, the licensee identified that the following scenario could happen should a fire occur in the Unit 1 turbine driven AFW pump (pump 1 P-29):

• In addition to affecting the Unit 1 turbine drive AFW pump, fire damage would also cause the southern motor-driven pump (pump P-38A) to fail because the power cable for the pump is in the plume area. Consequently, neither pump is able to supply a Unit 1 steam generator.

d.

"B" train steam generator water level instrumentation for the steam generators is 00 UL COURE OUT PPROV OTEDRC R

E

Doug Coe - 020221 Pt Beach instrumentjair. drs.wpd Page 36 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves affected due to fire damage. Consequently, "A" train steam generators must be fed.

The Unit 1 reactor is shutdown due to the fire. The Unit 2 reactor and associated plant is kept operating because its not directly affected by the fire.

5.

The cables for the northern motor-driven pump (pump P-38B) Unit 1 discharge valve (valve AF-4021) would also be affected by the fire. The valve is a normally closed valve. Consequently, the pump P-38B Unit 1 discharge valve could fail to open when an open signal is received due to low steam generator water level.

The northern motor-driven pump (pump P-38B) Unit 2 discharge valve (valve AF-4020) would remain shut because no low steam generator water level signal has been received for Unit 2 (because the unit is kept operating).

The northern motor-driven pump (pump P-38B) would receive a start signal due to low Unit 1 steam generator water level.

The minimum flow recirculation valve (valve AF-4014) for the northern motor-driven pump (pump P-38B) fails to open due to either fire damage to the valve control cables or due to loss of instrument air. The instrument air lines used soldered connections which would melt at a relatively low temperature.

Instrument air lines ran through the AFW pump room and could be affected by fire damage.

The northern motor-driven pump (pump P-38B) fails within minutes due to lack of available flow pump for pump cooling.

Main feedwater also becomes unavailable due loss of instrument air. (The feedwater regulating valves fail closed upon a loss of instrument air.)

Additionally, cables for the main feedwater system ran through the room and could be affected by the fire.

The pressurizer PORVs would be unavailable due to fire induced loss of instrument air. Consequently, feed and bleed capability would not exist for removal of decay heat.

Unit 2 could receive feedwater from the Unit 2 turbine-driven AFW pump.

However, Unit 1 would have no source of feedwater.

For a fire in this area, the licensee's Appendix R analyses took credit for northern motor driven AFW pump (pump P-38B) to supply the Unit 1 "A" steam generator (through a cross-connect of "A" and "B" trains) while the Unit 2 turbine-driven AFW pump would be available to supply the Unit 2 steam generators, if needed.

However, due to the scenario described above, the pump would have already 36

Doug Coe-020221 Pt inst6rum-ent air.- dr.wp Page e7 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves been damaged before operators could locally provide a flow path through the cross-connecting the "A" and "B" trains.

(2) Regulatory Issue 10 CFR Part 50, Appendix R, Section III.G.2, requires, in part, that where cables or equipment, prevent operation or cause maloperation due to hot shorts, open circuits, or shorts to ground, of redundant trains of systems necessary to achieve and maintain hot shutdown conditions are located within the same fire area outside of primary containment, separation of cables and equipment and associated non-safety circuits of redundant trains by a horizontal distance of more than 20 feet with no intervening combustible or fire hazards. As of November 29, 2001, cables and equipment required for operation of the norther motor-driven AFW pump (pump P-38B) were not separated by a horizontal distance of more than 20 feet with no intervening combustible or fire hazards. Consequently, AFW pumps required for safe shutdown could be damaged due to the lack of an available flow path. This issue is considered an apparent violation (AV 50-266/01-17-xx; 50-301/01-17-xx)

(3)

Risk Significance to be provided later pending panel decision 40A6 Meeting(s)

Exit Meeting 37

Doug Coe -020221 Pt Beach instrument air. drsdwpd Page 38 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves NRC 2002-0012 10 CFR 50.73 January 28, 2002 Document Control Desk U.S. NUCLEAR REGULATORY COMMISSION Mail Station P1-137 Washington DC 20555 Ladies/Gentlemen:

Dockets 50-266 And 50-301 Licensee Event Report 266/2001-005-00 PRA Assessment of Auxiliary Feedwater System Reveals Procedural Vulnerability Related To Loss Of Instrument Air Point Beach Nuclear Plant, Units 1 And 2 Enclosed is Licensee Event Report 266/2001-005-00 for the Point Beach Nuclear Plant, Units 1 and 2. The subject condition was determined to be reportable under 1 0 CFR 50.73(a)(2)(v)(D) as; MAny event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to: (D) Mitigate the consequences of an accident." Paragraph 50.73(a)(2)(vi) states that events covered in Paragraph (a)(2)(v) may include discovery of design, analysis, and/or procedural inadequacies. This LER discusses the identification of a misalignment between plant design and plant procedures. This vulnerability had the potential to cause the failure of all four auxiliary feedwater pumps and result in the inability of the auxiliary feed water system to mitigate the consequences of the initiating accident.

Corrective actions, completed and proposed, have been identified in the attached report. New commitments have been identified in italics.

Should you have any questions concerning the information provided in this report, please contact Mr. C.W. Krause at (920) 755-6809.

Sincerely, Tom Taylor Plant Manager Enclosure cc:

NRC Resident Inspector PSCW O

OSE MEN AC O"0

°° NVAL°° 3b

-Dou-g -C-oe -2-0-2-21 -Pt -B-e-a-c-h-i in--s-t-r-u-m-e-n-t a-ir. drsaw dua Page 39 SOP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves NRC Regional Administrator INPO Support Services OE 39

r Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page 4C r Doug Coe - 020?21 Pt Beach instrument air. drs.wpd Page4C SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves bcc:

R. A. Anderson (P460)

R. G. Mende K. E. Peveler D. A. Weaver (P129)

File A. J. Cayia L. Schofield (JOSRC)

R. P. Pulec I

T. J. Webb I

K. M. Duescher (3)

R. R. Grigg M. E. Reddemann E. J. Weinkam III OOPR Os NRCEp CTION 00 0

ODIS U APP TDIREC E

[ Doug Coe - 020221 Pt Beach instrument air. drs.wpd i

.Page 41 y

F R

a X

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves NRC FORM 366U.S. NUCLEAR REGULATORY APPROVED BY OMB NO. 3150-0104 EXPIRES 7-31-2004 (7-2ooi)COMMISSION Estimated burden per response to comply with this mandatory Information collection request 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> Reported lessons learned are Incorporated into the licensing process and fed back to industry Send comments regarding burden LICENSEE EVENT REPORT (LER) estimate to the Records Management Branch (T-6 E6), U S Nuclear Regulatory Commission, Washington, DC 20555-0001. or by Internet e-mail to bIsl Onrc gov, POINT BEACH NUCLEAR PLANT UNIT 1 05000266 1 OF 6

TITLE (4)

PRA Assessment of Auxiliary Feedwater System Reveals Procedural Vulnerability Related to Loss of Instrument Air EVLENT P2ATE (5 LE I

R..EPORT DATE (71 1

OTHER FAC~ILITIES INVOLVyED (81 MO DAY YEAR YEAR SEQUENTIA I RE MO DAY YEAR FACIL ITY NAME nnrKFT NHi iMBER Point Beach Utnit 05000301 11 29 2001 2001 _ 005l- 00 01 28 2002 FACILITY NAME DOCKET NUMBER 1. I n...... Ij 05000 20 2201 (b) 20.2203(a)(3)(ii)

=

50.73(a)(2)(i0)(B) 50.73(a)(2)(x)(A)

POWER 1

20 2201 (d) 20 03(al(4 50 73(ai(2f(ii) 50 73(a) (2iX}

20 2203(a)(1) 50 36(c)(1)(I)(A) 50.73(a)(2)Civ)(A) 73.71 (a) (4) 20 2203(a)(1(l 50 s36(c)(1(,ii(A) 50 73(`I(;)(vi(A) 73.71(a)(5) 20 2203(a)(2)(ii) 50 36(c)(2) 50.73(a)(2)(v)(B)

OTHER 20 2203(a)(2)(i) 50 46(a)(3)(1i) 50.73(a)(2)(v)(C) 20 2203(a)(2)(iv) 50 73(a)(2)(1)(A)

X 50.73(a)(2)(v)(D) 20 2203(a)(2)(v) 50 73(a)(2)(1)(B) 50.73(a)(2)(vii) 20 2203(a)(2)(vi) 50 73(a)(2)(1)(C) 50 73(a)(2)(viii)(A) 20 2203(a)(3)(i) 50 73(a)(2)(ii)(A) 50 73(a)(2)(viii)(B)

LICENSEE CONTACT FOR THIS LER (121 NAME I TELEPHONE NUMBER (Include Area Code)

Charles Wm. Krause, Senior Regulatory Compliance l

(920) 755-6809 COMPLETF N

LINE FORE ECH COMPON T FAILURE DESCRIBED IN:TI REPORT t13)

CAUSE SYSTEM COMPONENT MANU-REPORTABLE CAUSE SYSTEM COMPONENT MANU-REPORTABLE FACTURER TO EPIX FA CTURER TO EPIX SUPPLEMENTAL REPORTEXPECTED(141_

i EX PECD DAY YES (If yes, complete EXPECTED SUBMISSION DATE).

X INO 41

[ boug Coe - 020M Pt Beach__in-s__t-_rurnent air. drs.wpd Page 42 Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page 42 SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves ABSTRACT (Limit to 1400 spaces, i.e approximately 15 single-spaced typewntten lines) (1 6)

While conducting a self-initiated, voluntary review and revision of the Point Beach Nuclear Plant (PBNP) PRA model, including the auxiliary feedwater system (AFWS) portion of that model, NMC identified that the air-operated valves in the minimum flow recirculation piping for the AFWS pumps were not included in the PRA model. These valves fail closed on the loss of instrument air. While examining the significance of this failure, in conjunction with initiating events that require AFWS flow, NMC identified a misalignment between system design and EOPs. If the AFWS pump discharge or flow control valves were throttled closed with the minimum recirculation valve failed closed, it is possible that the AFW pumps could be placed in a condition of insufficient flow. This could result in pump damage in a short interval of time. The operators were trained on the significance of maintaining adequate AFW recirculation flow. However; early in the post reactor trip emergency operating procedures, the operators were directed to control AFWS flow without specific written guidance to maintain minimum AFW flow. It was postulated that the loss of instrument air together with a common operator response to high steam generator level or overcooling of the RCS had some probability to result in failure of one or all of the AFWS pumps. This could cause the loss of a safety function to mitigate the consequences of the accident and was determined to be reportable under 10 CFR 50.72. The PRA evaluation of this event sequence indicated that the potential consequences of this hypothesized failure were significant. Corrective actions included procedure changes to alert the operator to this potential failure sequence and additional operator training.

Event

Description:

While conducting a self-initiated, voluntary review and revision of the Point Beach Nuclear Plant (PBNP) PRA model, including the auxiliary feedwater system (AFWS) (BAI portion of that model, Nuclear Management Company (the licensee for PBNP) engineers revealed a previously unidentified vulnerability. NMC observed that the air operated valves (V} in the minimum flow recirculation piping for the AFWS pumps {P) were not modeled

Doug Coe :-020221 Pt Beach instrument air. drs.wpd Page 43 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves within the PRA. The recirculation line provides a flow path back to the condensate storage tanks. This recirculation path is provided to ensure adequate flow through the AFWS pumps to prevent hydraulic instabilities and to dissipate pump heat during low AFWS flow conditions. The isolation valves in the recirculation line are operated with Instrument Air (IA) {LDI and are designed to fail close. Therefore, if the AFW pump discharge valves had been throttled or closed and the recirculation valves had closed (either before or after the discharge valves were closed) due to a hypothesized loss of IA, the AFW pumps could have been placed in a condition of reduced or insufficient pump flow. NMC further identified that a loss of offsite power (LOOP) could also initiate the event since the IA compressors are tripped on under-voltage and not automatically re-powered from a safeguards bus. Certain design basis accidents assume a LOOP. A loss of IA would also cause a loss of normal feedwater and would initiate a dual unit trip. During these transients, the AFWS pumps will start injecting into the steam generators {SGI. Early in the emergency operating procedures (EOPs), which would be entered as a result of the reactor trip transient, the plant operators are directed to control flow to the steam generators to maintain desired level and to prevent overcooling of the RCS {AB). This may include shutting off flow to one or both steam generators by either securing the pump(s) or shutting an AFW pump discharge valve. At the time of discovery, the EOPs did not contain information addressing the requirement to maintain a minimum amount of flow through the pump. If flow from any AFWS pump is reduced too low (as would occur if the AFWS discharge valves are closed) and the recirculation valves had closed (either before or after the discharge valves were closed) due to a hypothesized loss of IA and the operators fail to identify the lack of recirculation flow, then the associated pump could fail in a very short period of time. This failure mode (common loss of IA and similar operator response to high steam generator level or overcooling of the RCS) could potentially result in the failure of more than one or all of the AFW pumps.

On November 29, 2001, a corrective action report (CR 01-3595) was initiated to document this condition. During the internal screening of this report, the AFWS was determined to be operable and capable of performing its safety function to provide water to the steam generators for decay heat removal. However, since we had determined that the potential loss of IA, in conjunction with inappropriately directed operator action, could have affected multiple trains of a safety related system, we conservatively concluded that this condition should be reported. An ENS notification (EN#38525) was made at 1705 CST pursuant to 10 CFR 50.72(b) (3)(v)(D) for "a condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to:... (D) Mitigate the consequences of an accident. This vulnerability appears to be applicable to this situation in that EOP-0, "Reactor Trip or Safety Injection" and EOP 0.1 "Reactor Trip Response" did not include explicit operator directions regarding the concern for maintaining adequate minimum AFWS pump flow. As a result, there was some probability that operator action could have prevented the AFWS from completing its safety function. At 1746 on November 30, 2001, the ENS event notification was supplemented to further clarify the discussion of the specific failures postulated and to reiterate that the loss of IA affects only the AFWS pump recirculation valves and not the air operated discharge valves. The discharge valves fail open on loss of instrument air and have nitrogen backup.

Cause:

The apparent cause of this condition was the failure to recognize that the lack of guidance within the EOPs, in conjunction with action directed by the EOPs, could exacerbate an event that included a loss of IA. The PBNP abnormal operating procedure, AOP-5B, "Loss Of Instrument Air," addresses the vulnerability of the AFWS DD0 0W0UPOSED UU PQRCUEMT P

ECTION OR DISC S

I lt HI k THEbl<.OR, OE 01 1El43

---

[ Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page 4x SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves system to the fail closed minimum recirculation air operated valves. That procedure includes specific directions to gag open the AFWS recirculation valves using the valve handwheels. However, the timing of that step in this procedure was such that action at that point may occur after the operator has already taken action to throttle back on the AFWS pump 44

rug I20221 Pt Beach instrumentair. Ow Page 45 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves discharge flow. The significance of the timing of these actions was realized by the NMC in its self-initiated, voluntary review and update of the PRA. This condition had not been identified in the baseline PRA.

Operator training included lesson plans which identified the need and basis for maintaining minimum flows through the AFWS pumps and discussed the opening and closing logic for the recirculation valves. Operating crew simulator training included loss of instrument air scenarios. However, the specifics of the simulator program are such that failing closed the recirculation valves and shutting the AFWS discharge valves does not automatically fail the AFW pump. Therefore, the crew simulator training may not have sensitized the operators to this vulnerability.

The PRA's capacity to integrate system performance with potential human actions to obtain a spectrum of plant responses allowed for identification of this vulnerability. The NMC has concluded that this vulnerability would not likely have been identified through normal surveillance or quality assurance activities. The root cause investigation of this condition identified that previous reviews in this area were generally focused on the necessity of providing adequate flow to the steam generators to remove decay heat. Because of the small margin in the capacity of the motor driven AFWS pumps in particular, it is essential in many scenarios that the recirculation valves are shut in order to assure adequate flow to the steam generators.

Corrective Actions:

A Root Cause Evaluation (RCE 01-069) Team was chartered to evaluate the vulnerability and why the risk significance of this condition was not recognized previously. The report of this team is scheduled to be provided for senior management review in late January 2002. The preliminary findings of this team with regard to root cause and contributing factors are included in the "Cause" section of this report.

Beginning at 1520 on November 30, 2001, the operating crews were briefed on the concerns identified with a loss of IA and AFWS pump requirements to maintain adequate minimum pump flow. Temporary information tags were placed adjacent to the Control Room controls for all four AFW pumps to provide a reminder of the minimum flow requirements for each AFW pump.

Temporary procedure changes were completed on November 30 to EOP-0, "Reactor Trip or Safety Injection" and EOP 0.1 "Reactor Trip Response," to reflect the guidance provided earlier to operators via the temporary information tags. On December 14, 2001, these changes were made permanent. The step was added as a foldout page item so that operators would stop the pumps any time the minimum flow requirements were not met.

Each operating crew received just in time training, briefings and simulator training concerning this event scenario to reinforce proper AFWS flow control.

On December 20, 2001, EOP 0 and EOP 0.1 were further revised to link problems with IA as indicated by the IA header pressure low alarm with the continuing need to closely monitor and maintain adequate AFWS pump flows This revision was also included in ECA 0.0, "Loss of All AC Power".

Plant modifications to enhance system reliability, including providing a backup air or nitrogen supply to the minimum recirculation valves, are being evaluated.

Simulator modifications to enhance modeling the potential failure of the AFWS pumps following loss of OE

E Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page 4E SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves instrument air scenarios are being pursue

f, Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page 47 I Doug Coe - 020221 Pt Beach instrument air. drs.wpd PaQe 47 SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves Component and System

Description:

The following component and system description comes from Section 10.2 of the PBNP FSAR. A diagram of the major AFWS flowpaths is provided on the last page of this LER.

The auxiliary feedwater system consists of two electric motor-driven pumps, two steam turbine-driven pumps, pump suction and discharge piping, and the controls and instrumentation necessary for operation of the system.

Redundancy is provided by utilizing two different pumping methods, two different sources of power for the pumps, and two sources of water supply to the pumps. The AFWS is categorized as seismic Class I and is designed to ensure that a single fault will not obstruct the system function.

One AFWS water source uses a steam turbine-driven pump for each unit with the steam capable of being supplied from either or both steam generators. Each turbine driven pump is capable of supplying 400 gpm of feedwater to its dedicated unit, or 200 gpm to each steam generator through normally throttled motor-operated discharge valves. The feedwater flowrate from the turbine-driven auxiliary feedwater pump depends on the throttle position of these motor operated valves (MOVs). Each pump has an AOV controlled recirculation line back to the condensate storage tanks to ensure minimum flow to dissipate pump heat. The pump drive is a single-stage turbine, capable of quick starts from cold standby and is directly connected to the pump. The turbine is started by opening either one or both of the isolation valves between the turbine supply steam header and the main steam lines upstream of the main steam isolation valves. The turbine and pump are normally cooled by service water with an alternate source of cooling water from the firewater system.

The other AFW source is common to both units and uses two similar motor-driven pumps each capable of obtaining its electrical power from the plant emergency diesel generators. Each pump has a capacity of 200 gpm with one pump capable of supplying the "A" steam generator in either or both units through an AOV back-pressure control valve and normally closed MOVs and with the other pump capable of supplying the "B" steam generator in either or both units through an AOV back-pressure control valve and normally closed MOVs.

Both back-pressure control valves fail open when instrument air to the valves is lost. The discharge valves are provided with a backup nitrogen supply to provide pneumatic pressure in the event of a loss of instrument air.

This backup supply assures that the discharge valves do not move to the full open position which, combined with low steam generator pressures, may cause the pump motor to trip on over-current due to high flow conditions.

Each pump has an AOV controlled recirculation line back to the condensate storage tanks to ensure minimum flow to prevent hydraulic instabilities and dissipate pump heat. The discharge headers also provide piping, valves, and tanks for chemical additions to any steam generator. The pump bearings are ring lubricated and bearing oil is cooled by service water.

The water supply source for the auxiliary feedwater system is redundant. The normal source is by gravity feed from two nominal capacity 45,000 gallon condensate storage tanks, while the safety-related supply is taken from the plant service water system whose pumps are powered from the diesel generators if station power is lost.

Safety Assessment:

Any complete loss of IA for a significant time is expected to result in a reactor trip and an AFW start signal due to a loss of normal feedwater (the normal feed water regulating valves fail close on loss of air). Under this postulated condition, all components of the AFWS are now and continue to be fully capable of performing their 000 NOTJ

Doug Coe - 020221 Pt Beach instrument air. drs.wpd Page 48 SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves design functions supporting automatic starting and supplying sufficient flow to the steam generators to mitigate any transient or accident by removal of decay heat. It is the continued function of the AFWS, in response to directed operator actions to control AFWS flow and the lack of specific guidance contained within the original EOPs regarding a loss of IA, that is the issue identified in this event report.

A PRA assessment of the possible failure modes and effects associated with an IA failure identified a previously unrecognized vulnerability. This failure would have been caused by a combination of a design limitation, a specific sequence of postulated operator actions, and a lack of clear guidance within the EOPs. This combination could have resulted in failure of one or more of the AFW pumps due to aggressive AFW flow reduction (as may be expected in response to a steam generator overfill or RCS over-cooling) after automatic system start and flow had been established. The likelihood of success or failure in the postulated scenario is highly dependent upon plant transient response (which may vary with the nature of the initiating event, initial power levels, etc.) and operator response. Operator response is highly dependent upon prior training, procedural usage, system knowledge and awareness, experience, and other human effectiveness (HE) factors.

It should be noted that a control board alarm is provided (Instrument Air Header Pressure Low) to alert the operator to the existence of an initiating condition for this event and that established plant procedures direct the restoration of IA (both Emergency Operating Procedures and Abnormal Operating Procedures), and the manual gagging open of the minimum flow recirculation valves in the event that IA cannot be promptly restored (AOP 5B). PBNP has experienced partial losses of IA, including one event involving the loss of all off-site power and another involving a low IA header pressure alarm following a reactor trip. In each of these cases the operators demonstrated the ability to cope with the loss of IA casualty and recover IA header pressure before it had an adverse affect on plant equipment or response.

Preliminary PRA results show that the vulnerability described in this LER, prior to the procedural changes, was potentially risk significant. Although the initiating event frequencies are low to moderate, the unrecoverable IA scenario was risk significant due to the consequences of a total loss of all AFW pumps requiring feed and bleed without the pressurizer PORVs (AOVs which fail closed). The risk results are highly dependant upon human interactions. PBNP operators are trained on AFW system operations and have experience with degraded IA scenarios. Because of this training and experience, we believe it is reasonable to assume that the operators would have successfully handled this combination of conditions in the unlikely event that it would have occurred.

Although the AFWS met, and continues to meet all of its design and licensing requirements, the initiating event of a loss of IA, in conjunction with a misaligned procedure, had the potential to affect redundant trains of the AFWS, a safety-related system. Since it could be postulated that the same operator action could have impacted all the AFWS pumps, there is some probability that the result could have been the complete loss of the AFWS safety-related function. Accordingly, we have also identified this event as a possible safety system functional failure.

Similar Occurrences:

A review of recent LERs (past two years) identified the following event which was also determined to involve the potential for a loss of safety function:

LER NUMBER Title 266/2001-002-00 Use of the Steam Generator Blowdown Isolation Interlock Defeat Switch Could Result in Loss of Safety Function R P IcIC WITHO A

OA L F TH DREC E

14

Doug ~~~~~

~

~

~

~

Co--0021Pt-aciintumn ar dswp

-g4

, poug Poe - 020221 Pt Beach instrument air.. 5r
.)mpo I.

I !

ge f
9 SOPENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves 49

0

-i t

j~~~>

'i'-"?

'V f R~~

['UNIT ICONTAINMENT 4 k

iswig--

i, -3/4-lo t"V y4$zi j'fEE:?

STFA

• ..} LU

. ^

^

IOENE!I^ AQ iw M rWr

• r>f^,rMO IEe cn 0

,,* Z O

CD D) m 0 0

=r M

> Z

_ MT Dm 'V CD z tn m

m

-0 4 4,,210 A) 1/4~4~'

2

<'<4

1. 1 J,,

i

J i"

. 4 M ZN O ~ ~jR t ;"'s1?

^+FOR i NFOR MATIO N

-Xe t

+-<'lfi,J;1.i.'~dt~ trD~ f\\1 4

4 ' 4 e

4.

, 4 4 - ' <

A a

f^....

Y.

._-'.24 9z

.._f.