Text

Sdp/Enforcement Panel Worksheet - Point Beach AFW Recirculation Valves
	ML031110059
Person / Time
Site:	Point Beach
Issue date:	02/21/2002
From:	; - No Known Affiliation
To:	; Office of Nuclear Reactor Regulation
References
	EA-02-031, EA-02-032, FOIA/PA-2003-0094
	Download: ML031110059 (34)
	v • d • e

MLo26'909 6o J EL)E SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves EA-02-031, Red Finding EA-02-032, White Finding Date of Panel: February 21, 2002 Licensee: Nuclear Management Company Facility/Location: Point Beach Docket Nos: 50-266; 50-301 License Nos: DPR-24; DPR-27 Inspection Report No: 50-266/01-17; 50-301/01-17 Date of Exit Meeting/Report Date: Inspection debrief with licensee: December 13, 2001 (date of final exit meeting pending outcome of panel meeting)

Panel Chairman (SES Sponsor): Grobe Responsible Branch Chief/Lead Inspector/Regional SRA:

J. Jacobson/R. Langstaff/S. Burgess EICS Representative: Brent Clayton

1. Brief Summary of Issues/Potential Violations:

Nuclear Management Company (the licensee for Pt. Beach) identified that there was a potential for dead-heading auxiliary feedwater (AFW) pumps due to the AFW minimum flow recirculation valves failing closed. In a dead-headed condition, the pumps would fail within minutes due to overheating. The dead-heading could occur either through operator actions in response to a transient or by a fire in the Unit 1 turbine driven AFW pumps. The AFW minimum flow recirculation valves at Pt. Beach, by original design, fail closed upon a loss of instrument air. Certain transients, such as loss of off-site power (LOOP), loss of instrument air (LOIA), loss of service water (LOSW), and seismic event, will result in a loss of instrument air. Additionally, certain fire scenarios could cause the AFW minimum flow recirculation valves to fail closed due to fire induced damage to instrument air lines or the control cables for the valves. A draft of the inspection report body is included at Attachment 3.

Issue 1 - Operator Actions The EOPs, under many transient conditions, direct operators to control AFW flow to mitigate either over-filling of the steam generators or overcooling of the reactor coolant system. The EOPs failed to caution operators that drastically reducing AFW flow could result in failure of AFWs pumps upon a LOIA due to overheating. For example, in the case of a LOOP, the instrument air compressor is initially lost because it's stripped from the vital buses. The turbine-driven AFW pumps would be started on a loss of power to the buses for the main feed pumps. The motor-driven pumps would be started due to the low steam generator level. Depending on the nature of the transient, operators WHlO PR PP ED ENfQRCEMENTACTION 0 FICD LSU OWFAI0 PIR IREC O R,'OE 00T

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves would take action to control AFW flow to mitigate over-filling of steam generators or overcooling of the reactor coolant system. Actions to mitigate over-filling the steam generators could be required as soon as 13 minutes into a transient. When the operator controls AFW flow at that time, the operator may fail to recognize that the recirculation valves have failed shut and the AFW pump(s) would be in a dead-headed condition. In the case of overcooling the reactor coolant system, actions to control AFW flow may be required within a few minutes into the transient. At such time, the AFW minimum flow recirculation valves would likely still be open due to remaining air pressure in the instrument air header. However, the AFW minimum flow recirculation valves would subsequently reposition (without operator action) due to loss of instrument air header pressure.

This issue is also described in a Licensee Event Report included as part of Attachment 4 to this package.

The potential violation issues are as outlined below. Draft NOVs are included as part of .

Potential Violation A: 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings," requires, in part, that procedures be appropriate to the circumstances. The emergency operating procedures did not provide operators with guidance to the effect that AFW pumps could be damaged under low-flow conditions due to the AFW minimum flow recirculation valves failing in the closed position. The licensee's EOP writers' guide specifically stated that "A caution is used to present information regarding potential hazards to personnel or equipment associated with the subsequent step(s)." No such caution was provided.

Potential Violation B: 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action,"

requires, in part, that measures shall be established to assure that conditions adverse to quality are promptly identified and corrected. The licensee failed to identify the closure of the recirculation valves and operator action to control AFW pump flow as a condition adverse to quality on seven occasions between 1981 and 1997. In addition, corrective actions taken on November 30, 2001 were inadequate because procedure changes did not provide adequate guidance for the operators to address the potential for AFW minimum flow recirculation valves to close upon low instrument air header pressure, which could result in AFW pump damage if the flow was throttled back to control steam generator levels or to mitigate reactor coolant system overcooling.

Issue #2 - Fire The licensee also identified that the AFW pump relied upon to provide AFW flow to a Unit 1 steam generator could be in dead-headed condition due to a Unit I turbine driven AFW pump fire. Specifically, the fire could damage the Unit 1 turbine driven pump, the "A" train motor driven AFW pump power cables, and the Unit 1 discharge valve from the "B"train motor driven AFW pump. Fire damage to either the instrument air lines in the area or the control cables for the "B"train motor driven pump could also result in the minimum flow recirculation valve for the "B"train motor driven pump to fail closed.

Consequently, the "B"train motor driven pump would be in a dead-headed condition when a start signal is received. No other AFW pumps would be available to supply a Unit 1 steam generator.

ROPOSED ENF ENTA CTIWD1fO _

ICDISC REWI HOUTA OVAL FTHEDI TORO 000 2

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves Potential Violation: 10 CFR Part 50, Appendix R, Section III.G.2 requires that a redundant train of equipment be available for safe shutdown. Cables and equipment, located within fire area A23S, required for operation of motor-driven AFW pumps (pumps P-38A and P-38B) were not separated by a horizontal distance of more than 20 feet with no intervening combustible or fire hazards.

2. Purpose of Panel:

To reach consensus of the significance of the inspection findings as evaluated through the SDP and to determine the appropriate enforcement action, if any.

3. Regional Recommended Enforcement Strategy:

Issue 1 - Operator Actions The issue relating to failure of AFW pumps due to operator actions has a preliminary risk significance of RED based on a Phase 2 review of internal events. The potential violations are:

Violation of 10 CFR Part 50, Appendix B, Criterion V, for failure to provide appropriate guidance in EOPs (See attachment 2, draft NOV).

Violation of 10 CFR Part 50, Appendix B, Criterion XVI, for failure to promptly identify the effect the loss of instrument air had on the AFW system and take appropriate corrective actions with respect to procedural guidance in addressing the loss of instrument air (See attachment 2, draft NOV).

Issue 2 - Fire The issue relating to failure of a redundant AFW pump due to fire damage has a preliminary risk significance of WHITE based on a Phase 3 review of the fire scenario.

The potential violation is:

Violation of 10 CFR Part 50, Appendix R, Section III.G.2, for failure to provide a redundant means to shutdown (See attachment 2, draft NOV).

4. Analysis of Significance/Root Cause:

a. Actual Consequence: There were no actual consequences associated with this finding. There were no events (LOOP, LOIA, LOSW, fire, or seismic) during the time period that the AFW pumps were unavailable for mitigation.

b. Potential Consequence(s):

Issue #1 - Operator Actions, Phase 2 Internal Events SOP Risk Evaluation:

During a loss of instrument air (caused by random failure of the IA system, LOOP, or loss of service water) the AFW pump minimum recirculation valves fail close. There are no backup air or nitrogen accumulators associated with the AFW pump recirculation valves. During the mentioned scenarios, the AFW O00 P aOOSENF0$OJ4ACT1fi-QQ OUBLI OSURE B-UTAPP&OAOFT;~T H YOR,~

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves pumps will start injecting into the steam generators. Early in the EOPs (3-15 minutes), the operator is directed to control RCS temperature and steam generator level by controlling flow to one or both steam generators. If flow from any AFW pump is reduced too low without functional recirculation valves, the pump will fail in a very short period of time. This common mode failure could result in simultaneous failure of all AFW pumps.

This issue results in a core damage frequency change for internal events, fire, flooding, and seismic events. For internal events, the benchmarked Pt. Beach SDP Phase 2 worksheets were used. For purposes of this SERP, the SRA has made the appropriate changes to the worksheets based on the benchmarking results. The dominant sequences occur with a special initiating event, loss of instrument air, followed by the loss of all AFW. The original plant design did not provide for feed and bleed capabilities using the pressurizer PORVs following a LOlA. Nitrogen accumulators for the PORVs were strictly for LTOP concerns during shutdown operations and have been procedurally isolated during power operations since 1979. The lack of the feed and bleed mitigating feature has always been accounted for in the licensee's PRA model and is also reflected in the SDP worksheets.

Assumptions: 1. Recovery of any AFW pump was not credited. This conclusion was based on actual operator simulator training where operators are not trained nor directed to recognize consequences of closed AFW minimum recirculation valves. Additionally, the licensee's PRA staff conducted operator interviews and concluded that human error probabilities to recognize that the minimum recirculation valve is closed and take corrective action were on the order of 0.5 or higher.

2. The instrument air compressors are powered from the safeguards busses; however, on a LOOP with a EDG start, the instrument air compressors are automatically stripped from the safeguards bus. Manual operator action to restore the instrument air compressors is proceduralized and is credited for the LOOP accident sequences to restore feed and bleed capabilities.

Worksheet Results:

LOIA LOIA (3) + AFW (0) = 3 LOSW LOSW (5) + TDAFW (0) = 5 LOOP LOOP (2) + AFW (0) + HPR (2) = 4 LOOP (2) + AFW (0) + FB (2) = 4 LOOP (2) + AFW (0)+ EIHP (3)= 5

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves LOOP (2) + EAC (5) + TDAFW (0) + HPR (2) = 9 LOOP (2) + EAC (5) + TDAFW (0) + MDAFW (0) + EIHP (3) = 10 LOOP (2) + EAC (5) + TDAFW (0) + MDAFW (0) + FB (2) = 9 LOOP (2)+ EAC (5) + TDAFW (0)+ REC1 (1)= 8 Based on the results of the Phase 2 SDP, this issue would be considered RED

(&CDF = 104) for internal events based on the LOIA and LOOP worksheets.

The licensee's analysis of the issue for internal events also yields a result ACDF

> I E-4. The licensee's analysis for internal and external events is included as Attachment 1.

Issue #2 - Fire. Phase 3 Fire Risk Determination During the inspection, the licensee identified one scenario where an AFW minimum flow recirculation valves failing closed could invalidate existing Appendix R safe shutdown analyses. The licensee initiated CRs 01-3633 and 01-3648 to document the issues. Specifically, the licensee identified that the following scenario could happen should Unit 1 turbine driven AFW pump (pump 1P-29) fire occur:

In addition to affecting the Unit I turbine drive AFW pump, fire damage would also cause the southern motor-driven pump (pump P-38A) to fail because the power cable for the pump is in the plume area.

Consequently, neither pump is able to supply a Unit 1 steam generator.

UB" train steam generator water level instrumentation for the steam generators is affected due to fire damage. Consequently, 'A"train steam generators must be fed.

The Unit 1 reactor is shutdown due to the fire. The Unit 2 reactor and associated plant is kept operating because its not directly affected by the fire.

The cables for the northern motor-driven pump (pump P-38B) Unit I discharge valve (valve AF-4021) would also be affected by the fire. The valve is a normally closed valve. Consequently, the pump P-38B Unit 1 discharge valve could fail to open when an open signal is received due to low steam generator water level.

The northern motor-driven pump (pump P-38B) Unit 2 discharge valve (valve AF-4020) would remain shut because no low steam generator water level signal has been received for Unit 2 (because the unit is kept operating).

The northern motor-driven pump (pump P-38B) would receive a start signal due to low Unit 1 steam generator water level.

The minimum flow recirculation valve (valve AF-4014) for the northern motor-driven pump (pump P-38B) fails to open due to either fire damage to the valve control cables or due to loss of instrument air. The oOPOSEEN MENT o N P 1lSCL U WI THOUT RVALO EDRC 000

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves instrument air lines used soldered connections which would melt at a relatively low temperature. Instrument air lines ran through the AFW pump room and could be affected by fire damage.

The northern motor-driven pump (pump P-38B) fails within minutes due to lack of available flow pump for pump cooling.

Main feedwater also becomes unavailable due loss of instrument air.

(The feedwater regulating valves fail closed upon a loss of instrument air.) Additionally, cables for the main feedwater system ran through the room and could be affected by the fire.

The pressurizer PORVs would be unavailable due to fire induced loss of instrument air. Consequently, feed and bleed capability would not exist for removal of decay heat.

Unit 2 could receive feedwater from the Unit 2 turbine-driven AFW pump.

However, Unit 1 would have no source of feedwater.

For a fire in this area, the licensee's Appendix R analyses took credit for northern motor driven AFW pump (pump P-38B) to supply the Unit 1 "A" steam generator (through a cross-connect of 'A" and 'B" trains) while the Unit 2 turbine-driven AFW pump would be available to supply the Unit 2 steam generators, if needed. However, due to the scenario described above, the pump would have already been damaged before operators could locally provide a flow path through the cross-connecting the "A"and "BW trains.

The licensee also identified that similar damage could occur due to a fire from transient combustibles above the tunnel in the AFW pump room. However, the scenario for a transient combustible fire above located above the tunnel is somewhat questionable. In addition, the contribution from a transient combustible fire (as conservatively calculated by the licensee) would not impact the end result. Consequently, for simplicity, the inspectors chose to not include the transient combustibles fire scenario in the calculations.

From a fire scenario credibility standpoint, the following assumptions were made with respect to the above scenarios:

Automatic suppression (i.e., Halon) is effective for lubricating oil fire because it is a surface fire. Consequently, full credit is provided for automatic suppression.

Manual suppression receives full credit (for outside control room).

The licensee estimated the fire frequency for one pump to be 1.42E-4/yr.

Fire damage to identified cables and equipment occurs due to being in or near the plume from the fire (vs. hot gas layer damage).

(30(0 Z SED ENFtjENTACTiN Q TF R PUB D CLOSO WIT UTAP OV F THE Coo k~~6 11

1

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves

Main feedwater is assumed to be lost due to fire damage (of either cables or loss of instrument air).

Feed and bleed capability is lost due to fire damage to instrument air lines.

The condition has existed for longer than 30 days.

Based on review of the transient worksheets, the inspectors determined that there was no internal events mitigation credit on the most limiting cutset.

The assumptions for the transient worksheets were as follows:

PCS = 0 due to unavailability of main feedwater (due to loss of IA)

AFW = 0 for affected unit HPR = 2 (full credit)

FB = 0 due to loss of IA impact on pzr PORVs EIHP = 3 (full credit)

The sequences were as follows:

1 TRANS - PCS(O) - AFW(O) - HPR (2) = 2 2 TRANS - PCS(O) - AFW(O) - FB(O) = 0 - most limiting sequence 3 TRANS - PCS(O) - AFW(O) - EIHP(3) = 3 For the pump oil fire, the Phase 2 SDP is calculated as follows:

IF = 1.42E-4 FB = 0 because we're only looking at a single room MS = -1.0 full credit for outside control room AS = -1.25 full credit for Halon automatic suppression CC = 0 because there are no common cause dependencies FMF = loglO(IF) + FB + MS + AS + CC

= loglO(1.42E-4) + 0 + -1.0 + -1.25 + 0

= -6.10 FMF = -6.10 which translates to CDF = 7.99E-7, due to no mitigation credit 0 M E- E ME0kJAOO'\\

FdRlBLISL WI THOUT PP OVAL OF E pJIRECTO^O; 000 7

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves The licensee Phase 3 analysis of this scenario suggest that the above Phase 2 risk determination is non-conservative. The licensee identified a ACDF of 1.35E-6lyear for a pump fire. The differences between the NRC Phase 2 SDP analysis and the licensee's analysis are as follows:

MC 609 Phase 2 SDP Licensee PRA Analysis Failure Log1O Failure LoglO Probability Value Probability Value Ignition Frequency per 1.43E-4 -3.85 1.43E-4 -3.85 Year Fire Severity factor not used 2.OOE-1 -0.70 Automatic Suppression 5.62E-2 -1.25 5.OOE-2 -1.30 Manual Suppression 1.OOE-1 -1.00 no credit taken ACCDP not used 9.50E-1 -0.02 Resulting Estimate (total) 7.94E-7 -6.10 1.35E-6 -5.87 Resulting Color Green White The regional recommendation is to use the licensee's Phase 3 analysis for determining risk significance due to fire.

Conclusion The risk significance due to operator error (internal events) is RED.

The risk significance due to fire is WHITE.

c. Potential for Impacting Regulatory Process:

None.

d. Willful Aspects:

None.

e. Root Cause(s):

Not known at this time.

FOPRPOSRED RMN 00 0 PBLIC OSURE WI U APPROVA OF TE DIREC R, T 00

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves

5. Apparent Severity Level(s)IColor and Basis:

Issue #1 - ODeration Actions RED based on Phase 2 SDP results for internal events.

The color RED has been confirmed by informal analyses performed by the licensee (Attachment 1). The licensee had calculated a ACDF/year of approximately 6E-4 for internal events and 2E-4 for seismic events. The licensee had attempted to identify excessive conservatisms associated with their models which, if eliminated, would yield a ACDF/year of less than 1E-4. However, the licensee concluded that while eliminating excessive conservatisms would yield a ACDF/year less than 8E-4, the result would still be above the 1E-4 threshold for a RED finding.

Issue #2 - Fire WHITE based on Phase 3 analysis for the fire scenario.

The color WHITE is based on a Phase 3 analysis performed by the licensee. The inspectors reviewed the licensee assumptions and considered the assumptions reasonable.

6. Application of Enforcement Policy

a. Enforcement/Performance History:

Not applicable to SDP cases.

b. Is Credit Warranted for Identification? Explain:

Yes. The both issues were licensee identified and reported to the NRC.

c. Is Credit Warranted for Corrective Actions? Explain:

Not applicable to SDP cases.

d. Should Discretion Be Exercised to Mitigate or Escalate Sanction?

Not applicable to SDP cases.

7. Is action being considered against Individuals?

No.

8. Non-Routine Issues/Additional InformationlRelevant Precedent/Lessons Learned:

None.

000 coo

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves

-U Table I Categories of Initiating Events for Point Beach Nuclear Power Plant CD)

Row Approximate Example Event Type Initiating Event Likelihood Rating (IELR)

Frequency Ca)

I > 1 per 1-10 yr Reactor Trip (TRANS), Loss of Power Conversion System 1 2 3 (TPCS)

_I 1 per 10-102 yr Loss of offsite power (LOOP) 2 3 4 0

III 1 per 102 -103 yr SGTR, Stuck open PORV/SRV (SORV), Small LOCA including 3 4 5 RCP seal failures (SLOCA), MSLB/FLB (outside containment),

Loss of Instrument Air (LOIA), Loss of CCW (LCCW), Medium LOCA (MLOCA), Loss of 125V DC Bus (LDC1 and LDC2)

IV 1 per 103 -104 yr ATWS-PWR1 (electrical only), Large LOCA (LLOCA) 4 5 6 V 1 per 104- 105yr LOOP with loss of Gas Turbine with one division of emergency 5 6 7 AC unavailable (LEAC), Loss of Service Water (LOSW)

VI less than 1 per 105 yr ATWS-PWR (mechanical only), ISLOCA 6 7 8

> 30 days 3-30 days <3 days Exposure Time for Degraded Condition Cm Note:

0

2. The SDP worksheets for ATWS core damage sequences assume that the ATWS is not recoverable by manual actuation of the reactor trip z function or by ARI for BWRs. Thus, the ATWS frequency to be used by these worksheets must represent the ATWS condition that can only 0

be mitigated by the systems shown in the worksheet (e.g., boration). Therefore, ATWS-PWR (electrical only) is provided in Table 1 for information only and ATWS-PWR (mechanical only) should be used as applicable when performing an SDP Phase 2 analysis. Any Co inspection finding that represents a loss of manual reactor trip capability for a postulated ATWS scenario should be evaluated by a risk 00o analyst for consideration of the probability of a successful manual trip.

>f3oooRZOP XD ENF, MENTAC N000 00 NO BL DC UR HOUT PR AL 000 10 _JA 0

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves Table 3.6 SDP Worksheet for Point Beach Nuclear Plant, Units I and 2 - Loss of Instrument Air (LOIA) ()

Estimated Frequency (Table I Row) lIl Exposure Time >30 days Table I Result = 3 Safety Functions Needed: Full Creditable Mitigation Capability for Each Safety Function:

Secondary Heat Removal (AFW) 1/2 MDAFW trains (1 multi-train system) or 1 TDAFW train (1 ASD train) (2) to 1/2 SGs with 1/4 SSVs Backup supply to CST (CSTFL) Operator uses firewater or service water to provide backup supply CST (operator

_____ _________ _____ _____ _____ ____ action = 3) __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _

Circle Affected Functions IELR Remaining Mitigation Capability Rating for Each Affected Sequence Sequence Color 1 LOIA - CSTFL (2) 2 LOIA - AFW (3) 0 3+0=3 Identify any operator recovery actions that are credited to directly restore the degraded equipment or initiating event:

If operator actions are required to credit placing mitigation equipment In service or for recovery actions, such credit should be given only if the following cntena are met:

1) sufficient time Is available to implement these actions, 2) environmental conditions allow access where needed, 3) procedures exist, 4) training is conducted on the existing procedures under conditions similar to the scenario assumed, and 5) any equipment needed to complete these actions is available and ready for use.

Notes:

1. Loss of instrument air at PBNP fails closed MSIV and the bypass feedwater regulating valves resulting in unrecoverable loss of the power conversion system (and main feedwater) within the time frame. Bleed and feed recovery is not possible since pressurizer PORVs fail closed and nitrogen backup is not available for 'at power" conditions. Also, flow control valves of the motor-driven auxiliary feedwater pumps fail open requiring operator action to limit the flow. A manual gag override would be necessary to operate the SG ADV, and it is not credited. SRVs will open automatically if the SG pressure reaches the setpoint.

The frequency of LOIA event is -5.6E-03/yr.

2. If the TDAFW pump Is not available, the success of the MDP Is required. The discharge AOV fails open on loss of IA, and manual action may be needed to control flow. The IPE calculation shows that the pump would not run out with LOIA which results In fully open valve. Manual action is needed to avoid such possibility.

00OP ISCL ROVAL DECT E 000

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves Table 3.7 SDP Worksheet for Point Beach Nuclear Plant, Units I and 2 - Loss of Service Water (LOSW) (1,2)

Estimated Frequency (Table I Row) V Exposure Time >30 days Table I Result = 5 Safety Functions Needed: Full Creditable Mitigation Capability for Each Safety Function:

Turbine-Driven AFW (TDAFW) 1 TDAFW train (1 ASD train) (3)

Diesel-Driven Fire Pump (DFP) 1/1 Diesel Fire pump or 1/1 MD fire pump (operator action = 2) (4)

Chanrging pumps (CHG) Verify 1/2 operating charging pump or start the standby pump (operator action = 3) (5)

Circle Affected Functions Recovery of Remaining Mitigation Capability Rating for Each Affected Sequence Failed Train Sequence Color 1 LOSW - DFP (2) 2 LOSW - TDAFW (3) 0 5 +0 5 3 LOSW - CHG (4)

Identify any operator recovery actions that are credited to directly restore the degraded equipment or initiating event:

If operator actions are required to credit placing mitigation equipment In service or for recovery actions, such credit should be given only If the following criteria are met. 1) sufficient time is available to Implement these actions, 2) environmental conditions allow access where needed, 3) procedures exist, 4) training Is conducted on the existing procedures under conditions similar to the scenario assumed, and 5) any equipment needed to complete these actions is available and ready for use.

Notes:

1. It is assumed that the operator will manually trip the reactor on loss of SW, if auto trip signal is not generated. If manual trip is delayed due to actions to locate or repair the malfunction, loss of SW cooling will cause a loss of instrument air which will subsequently cause an automatic trip because of MSIV closure. The frequency of loss of SW events'-1 .7E-3/yr.

00 CROPO ENFOR EMENTA TIO 000 000 NOT FOR P LCIs 0 R 3THU A L OF E IRECT , WE000 II

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves

2. The loss of SW results in loss bearing cooling to the AFW pumps (TDAFW pump is supplied by the fire water), loss of the PCS, and loss of feed and bleed (PORVs are lost since the loss of SW also causes a loss of the IA). The three positive displacement charging pumps used at PBNP are adequately cooled by ambient air and do not rely on CCW cooling.

3. For the loss of SW event, only TDAFW pump is assumed available. Both MDAFW and TDAFW pumps require SW for bearing cooling, but fire water Is automatically supplied to the TDAFW pump. .

4. Diesel fire pump is required for the TDAFW pump bearings and for possible refill of the CST.

5. With the loss of SW and consequential loss of CCW to the RCP thermal barrier, the operator must verify or establish charging flow. Normally, two charging pumps are running and the third pump Is In standby. Failure of both the operating charging pumps will require the operator to align and start the standby pump. The operator action to start a charging pump for seal injection is required within 30 minutes following a reactor trip. The positive displacement charging pumps used at PBCH are adequately cooled by the ambient air and do not rely on CCW for cooling. The estimated HEP for this action Is 4.1 E-3.

00 LIC DISCLOSURE 0TAPPRO OF TH IC 000

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves Table 3.12 SDP Worksheet for Point Beach Nuclear Plant, Units I and 2 - Loss of Offsite Power (LOOP)

Estimated Frequency (Table I Row) II Exposure Time >30 days Table I Result = 2 Safety Functions Needed: Full Creditable Mitigation Capability for Each Safety Function:

Emergency AC Power (EAC) 1/2 dedicated Emergency Diesel Generators (1)(1 multi-train system) or crosstie opposite unit EDG (operator action = 1)or 1/1 Gas Turbine (operator action =1) (14)

Turbine-driven AFW Pump (TDAFW) 1/1 TDP trains of AFW (1ASD train)

Secondary Heat Removal (AFW) 1/2 MDAFW trains (1 multi-train system) or 1/1 TDAFW train (1 ASD train)

Motor-driven AFW Pumps (MDAFW) 1/2 MDAFW trains (1 multi-train system)

Recovery of AC Power in < 1 hr (REC1) SBO procedures implemented (operator action = 1) 0" Recovery of AC Power In 2- 7 hrs (REC7) SBO procedures implemented (operator action = 1) (2)

Early Inventory, HP Injection (EIHP) 1/2 HPSI pumps (1 multi-train system)

Primary Heat Removal (FB) Operator uses RCS pressurizer 1/2 PORVs and block valves (operator action = 2)

High Pressure Recirculation (HPR) 1/2 HPSI pumps with 1/2 RHR pumps and with operator action for switchover (operator action = 2)

Circle Affected Functions Recovery of Remaining Mitigation Capabilitv Rating for Each Affected Sequence Failed Train Sequence Color 1 LOOP - AFW - HPR (3) 0 2 + 0 + 2 =4 2LOOP-AFW-FB (4) 0 2+0+2=4 3LOOP-AFW-EIHP (5) 0 2+0+3=5 4 LOOP- EAC-TDAFW - HPR (9, 11) 0 -2 5 0 2 9 (AC recovered) 000

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves Circle Affected Functions Recoverv of Remaininq Mitigation Capability Rating for Each Affected Sequence Failed Train Sequence Color 5 LOOP- EAC -TDAFW - MDAFW - EIHP 0 2+5+0+0+3=10 (13) 6 LOOP - EAC - REC7 (7) 7LOOP-EAC-TDAFW-MDAFW-FB (12) 0 2+5+0+0+2=9 (AC recovered) 8LOOP- EAC - TDAFW - RECI (14) 0 2+5+0+1=8 Identify any operator recovery actions that are credited to directly restore the degraded equipment or initiating event: -

If operator actions are required to credit placing mitigation equipment in service or for recovery actions, such credit should be given only if the following critena are met. 1) sufficient time is available to implement these actions, 2) environmental conditions allow access where needed, 3) procedures exist, 4)training is conducted on the existing procedures under conditions similar to the scenano assumed, and 5) any equipment needed to complete these actions is available and ready for use.

Notes:

1. Each PBCH unit has two trains with one diesel normally aligned to each units train (1 diesel to each of 4 trains). In our modeling, dual unit LOOP is assumed.

On a dual unit LOOP, each diesel would start and load to their respective train (ie, 2 diesels per unit; 1 on each train). However, if a diesel failed, the opposite unit's diesel could be aligned to handle both units on the same train. This requires a manual action with an HEP of around 3E-2. Operator action = 1 Is assigned based on generic assignment of credit for such actions. Upon a loss of offsite power and the EDGs, operator will attempt to start and align the GTG. The HEP for starting and aligning the GTG is 1.3E-01 and a credit of 1 is assigned.

2. For the functions 'Recovery of AC Power in < 1 hrs (RECI)" and 'Recovery of AC Power in2-7 hrs (REC7)p the corresponding estimated probabilities inthe IPE are 4E-1 and 2.8E-1 to 4.OE-2. Both the actions are given a credit of 1.

- 0 i ,-I

3. Battery depletion in about 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Power must be restored within approximately 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if the RCS cooldown was not successful and the TDAFW pump runs for only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , i.e., until battery depletion. Power must be restored within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months if the RCS cooldown was successful resulting in a 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or more benefit In core uncovery at low RCP seal leakage rate. Recovery within 7 hour8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months applies assuming TDAFW pump operation until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , Implying local 'blind' operation of the pump without the benefit of Instrumentation following battery depletion.

4. Gas turbine is treated like EDG so solve all the sequences.

00 PROPOSED ENFORC ENTACTON 0 0O WITHOA OF THICTOR, 000

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves - Licensee's PRA analysis of issue

> Fire Risk:

> Aux Feed Pump Room

> For a fire in this room, a risk change was assumed to occur if the cable associated with the Motor Driven Aux Feed Water (MDAFW) pump discharge valve or power supply to this valve was affected by the fire. The risk was evaluated looking at the condition from both the Unit 1 and Unit 2 perspective. This may be slightly conservative since the other failures (such as the loss of the recirculation valve was assumed to occur without further evaluation).

> Two types of damage scenarios could affect this valve. These are either the direct impact due to the cables located in the plume, ceiling jet, or radiative effects of a fire; or the cables indirectly damaged due to the formation of a hot gas layer.

> All scenarios dealing with the formation of a hot gas layer were subsequently removed from consideration because there would not be a change in plant Core Damage Frequency (CDF) as a result of these fires. This is because the same final result (i.e. Conditional Core Damage Probability - CCDP) would occur if these cables were damaged or not. The CCDP in both cases was assumed to be 1.0 since this fire would be beyond the scope of what was considered for Appendix R and Safe Shutdown Methodologies would not have been available.

Therefore, only those fire initiators that could result in direct fire damage through plume, ceiling jet, or radiative effects were considered.

> Electrical Cabinets - There is one vented electrical cabinet located in the northern most section of the compartment. This cabinet fire could not cause a hot gas layer and its fire plume would not directly affect the cables of concern.* Therefore, the cabinet was screened out.

> Ventilation Subsystems - There are two small motors with minimal combustible material associated with ventilation subsystems located in the east side of this compartment. These motor fires could not cause a hot gas layer and their fire plumes would not directly affect the cables of concern. Therefore, the motors were screened out.

> Cable Fires - This is the most significant contributor to the fire frequency for this room. Two separate cases were considered with the cable fires. Those that would directly affect the cables of concern and those that could create a hot gas layer. For reasons stated above, the scenarios that cause a hot gas layer are not included in the overall change of core damage probability. Those cable tray fires that could cause a loss of the discharge valve cables or power supply were evaluated in more detail. The trays associated with these cables are FR &

FM for Unit I and FU & FT for Unit 2. If a cable tray fire was not controlled allowing the fire to spread or a hot gas layer to be formed, there would be no change in CDF as discussed above.

If a fire was limited to these trays - due to adequate automatic or manual suppression, closure of the recirculation valve would not occur since the cables or air supplies for these valves are not located directly in or above these trays. In summary there would be not change in CDF for a cable tray fire.>

> Transient Fires - Transient fires were assumed to occur randomly throughout the room.

Conservatively, SNL Nowlen Test #9 (Fire PRA Application Guide) was used to evaluate the Total Heat Content (192,000 BTUs) of the transient fire and SNL Nowlen Test #3 was used for C PROPHET ENFOR ENTAC NOOO 0OO-tUIC URE OTAPL TDI 000

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves the heat release rate (138 Btu/s). This transient fire alone is not large enough to cause a hot gas layer in this compartment. However, if the transient were placed next to a cable riser (there are exposed risers on the east side of the room) or if the transient was placed upon the tunnel that traverses the room, fire spread could occur and cause a hot gas layer. If this were to occur there would be no change in CDF. The plume for this fire was evaluated and with one exception, the cables of concern were too high to be damaged by the plume. The one exception is a transient fire placed on top of the tunnel in front of the A Motor Driven Pump cubicle. This fire could damage the power supply to the discharge MOV and control cables for the recirculation valve. It is unlikely that a transient would be placed on top of the tunnel because it is not as accessible as floor level and it is not a normal work space. It was conservatively assumed that the probability of the transient fire on top of the tunnel was just as likely as the floor level. If a transient fire were to occur on top of the tunnel, a change in CDF could result, so a detailed analysis was performed with the following results:

> Fire Frequency (FF): 4.08E-4/yr (includes both transient and welding/transient)

> Floor Ratio (FR): 4E-2 (This is the ratio of the tunnel roof area - where damage could occur -

compared to the total floor area)

> Automatic Suppression (AS): 5E-2 (Automatic Initiated Halon System)

> Manual Suppression (MS): 1.0 (Manual suppression is not credited since damage is expected to occur prior to response)

> Conditional Core Damage Probability Prior to issue (CCDPI): 5E-2 (Alternate shutdown with control room available)

> Conditional Core Damage Probability with issue (CCDP2): 1.0 (Shutdown assumed to fail with damage)

> Change in CDFTrans = FF

FR 'AS-* MS * (CCDP2 - CCDPI)

> Change in CDFTrans = 4.08E-4

4E-2 *.5E-2

1.0 * (1.0 - 5E-2) = 7.75E-7

> Pump Fires - There are 4 AFW pumps located in this compartment. The two motor driven pumps are estimated to have 0.5 gallons of oil each and the two turbine driven pumps are estimated to have 1.875 gallons of oil each. For evaluation purposes 2 gallons of oil was conservatively assumed per pump and all of the oil from a single pump was assumed to be spilled prior to ignition - resulting in the highest heat release rate. In all cases, this amount of oil was not enough to cause a hot gas layer and no other combustibles were close enough to result in a secondary ignition. Only one of the four pumps (Unit 1 Turbine Driven AFW pump) has discharge valve cables and power supply cables located in the plume. Further fire modeling was done for this pump. The cable trays containing these cables are located in the plume at an elevation which could result in cable damage, but, would not result in cable ignition.

> Fire Frequency (FF): 1.42E-4/yr (fire frequency for single pump)

> Fire Severity (FS): 2E-1 (

Reference:

Fire PRA Implementation guide)

> Automatic Suppression (AS): 5E-2 (Automatic Initiated Halon System - credit for suppression prior to cable damage.)

> Manual Suppression (MS): 1.0 (Manual suppression is not credited since damage is expected to occur prior to response)

> Conditional Core Damage Probability Prior to issue (CCDP1): 5E-2 (Alternate shutdown with control room available)

> Conditional Core Damage Probability with issue (CCDP2): 1.0 (Shutdown assumed to fail with damage) o PO SED NOEM CTlOO 0 TOR LlC SLOS I THOLF ROLF E 000

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves

> Change in CDFTrans = FF

FS

AS

MS * (CCDP2 - CCDP1)

> Change in CDFTrans = 1.42E-4

2E-1

5E-2

1.0* (1.0 - 5E-2) = 1.35E-6>

> Summary of change to fire risk:

> Transient Fire: 7.75E-7

> Pump Fire: 1.35E-6 2.13E-6 (WHITE)

> Aux Building Rooms

> Three fire zones in the Aux building also relied upon the Motor Driven AFW pumps and the discharge valves could be damaged. In all fire zones analyzed, it was determined that adequate AFW capacity would have been available through the use of AFW pumps not credited but available. And, procedures were available to use those pumps. A brief description for credited systems is identified below and more detail will be available in the LER.

> SI Pump Room: Even though the motor driven pumps were credited for a pump in this fire zone, through manual actions the turbine driven pumps would have been available. The manual actions credited were proceduralized. Therefore,- even though these pumps were not credited, their success probability would be similar to the motor driven pumps such that the overall change in risk would be insignificant.

> 26' PAB Elevation: Again, motor driven pumps were credited for a fire in this zone. However, as with the SI Pump room the TDAFW pumps would have been available with through manual actions. Therefore, even though these pumps were not credited, their success probability would be similar to the motor driven pumps such that the overall change in risk would be insignificant. Justification for the ability to perform these manual actions will be discussed in the LER.

> 46' PAB Elevation: This fire zone required a more detailed analysis. The Turbine Driven AFW pump steam supply valves are located in this fire zone. The Unit 1valves are located in the South East corner and the Unit 2 valves are located in the North East corner. The cables associated with these valve are all located near floor level (within 5 feet of the floor). Because of the large horizontal doorway opening (12 feet high) between this fire zone and the central portion of the 46' PAB, a hot gas layer of sufficient depth to damage these cables can not occur. A further review of the fire scenarios showed that none of them could spread or damage both units steam supply valves. Since the use of one motor driven pump (P38B) was already proceduralized and the use of the one of the turbine driven pumps from the control room would be available and proceduralized, there would have been adequate AFW flow to both units --

one using the Motor Driven pump and the other with the unitized Steam Driven pump.

Therefore the change in risk for this zone is insignificant.

0 0~ op ED ORCE CT NO 00 Pu IDIS RE UT PPRO LOFTH CTOR, 000 18

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves

> Internal Events/Seismic:

> There were 4 initiators that are directly impacted with this issue. These include Loss of off-site power, Loss of Instrument Air, Loss of Service Water, and Seismic. In all these cases, instrument air is lost either long term or short term due to direct impact of the initiator. In addition to these initiators, most other initiators were also indirectly affected through the potential subsequent random loss of Instrument Air. Both cases were evaluated. The direct loss of Instrument Air through the initiator accounts for more than 90% of the Core Damage Frequency (CDF) increase. Therefore, the focus of a detailed PRA review was on these 4 initiating events.

> In all cases, the initiator results in a dual unit event. The change in CDF was a direct result of the assumed loss of all AFW for one of the two units given this issue. Because of the conditions that need to occur for operators to take the action of securing flow, we were able to demonstrate that complete loss of AFW could only occur on one of the two units. In all sequences analyzed, the other unit would protect (through forward flow) either an electric or turbine driven auxiliary feed pump.

> Reasons for AFW loss will be further discussed in the LER associated event, but a brief description follows. There were a number of sequences evaluated with this issue due to the number of initiators involved. In addition, there are two circumstances (overcooling of RCS, and overfilling of > Steam Generator) that could occur early in an event that could cause the operators to secure flow. Therefore, there are a number of combinations of initiating events, sequences, and operator actions that needed to be considered.

> Each of the circumstances where an operator could secure flow has potential to damage the AFW pumps for a subset of the sequences. The first scenario involves over-cooling of the RCS. In this condition (expected for some event sequences), an operator may secure AFW flow within the first few minutes of a reactor trip. At this point in time, it is likely that air pressure would still be adequate to indicate the recirculation by-pass valves open. As air pressure decays away, the recirculation valves would close. A short time later, pump damage would occur. The second scenario involves over-filling of the SG. In this condition (again, expected for some'event sequences), an operator is directed to secure flow. This step is expected to be reached around 13 minutes after plant trip. Air pressure may, or more likely, may not be available and the recirculation valve would be failed closed. If the operator does not notice the valve closed, pump damage would occur a short time later.

> All of these scenarios have been evaluated by the PRA model. A CDF of approximately 8E-4 was calculated using the internal and seismic PRA models (Approximately 6E-4 internal and 2E-4 seismic). We have performed an extensive review of the model to determine if additional credit could be taken for recovery through the use of non modeled methodologies.

Methodologies evaluated included the use of main feed water, charging, and the recovery of equipment originally lost. In addition, a close look at the initiators was performed to determine primary and secondary response to validate if over-cooling or over-filling was possible. For some initiating event sequences, we were able to determine that overcooling would not be likely. In addition, we found that for some sequences charging flow may be adequate to protect from core damage. To determine if these benefits would be enough to reduce the resulting change in CDF to less than 1E-4, some best case scenarios were studied. From these studies, we concluded that these benefits were not enough to demonstrate that the resulting change in CDF would be less than I E-4. In summary, from these benefits we believe that the actual change in CDF would be less than the base 8E-4 calculated by the PRA models, but, would still be above the 1E-4 threshold for a Red finding.

P rOP PED ENF, EME CTIOh 0 OTFOPuLIC SLOSU IHOUP 0LFTHEIRE o ,E 000

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves , Notices of Violation Issue #1 - Onerator Actions A. 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings,"

requires, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances.

Contrary to the above, as of November 29, 2001, procedures EOP-0.1 Unit 1, "Reactor Trip Response," revision 24, and EOP-0.1 Unit 2, "Reactor Trip Response," revision 23, activities affecting quality, were not of a type appropriate to the circumstances.

Specifically, the procedures did not provide adequate guidance to operators regarding the potential to damage AFW pumps while controlling AFW flow upon low instrument air header pressurre, which would cause the recirculation valves to fail closed. Because the procedures did not include instructions to ensure the recirculation valves were open, the AFW pumps could be damaged under low flow conditions such as when the flow is throttled back to control steam generator level or to mitigate reactor coolant system overcooling.

B. 10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," requires, in part, that measures shall be established to assure that conditions adverse to quality are promptly identified and corrected. In the case of significant conditions adverse to quality, the measures shall assure that the cause of the condition is determined and corrective actions taken to preclude repetition.

Contrary to the above, as of November 2001, the licensee failed to identify that the auxiliary feedwater system was not capable of performing its safety function under certain conditions and failed to correct the deficiency until December 2001. Specifically, all auxiliary feedwater pumps would be subject to a common mode failure involving dead-heading of auxiliary feedwater pumps following a loss of offsite power or seismic event due to the closure of the minimum flow recirculation valves upon loss of the non-safety grade, non-seismically qualified instrument air system and prescribed operation actions to control feedwater flow in response to transient conditions.

1. On seven occasions between 1981 and 1997, the licensee was made aware, through the following means, of the susceptibility of the auxiliary feedwater system to this type of vulnerability, but the licensee failed to identify this significant condition adverse to quality and to identify its cause:

In October 1997, the safety function of the minimum flow recirculation valves was considered in response to Condition Report 97-3363.

In March 1997, the licensee identified a failure mode of the auxiliary feedwater system due to the loss of instrument air.

In 1994, the original design basis document for the auxiliary feedwater system identified that the minimum flow recirculation valves had a safety function to open and remain open.

000

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves

In 1991, the original probabilistic risk, assessment performed in response to Generic Letter 88-20, did not adequately consider the function of the recirculation valves.

In 1989, the licensee determined that no air-operated valves were required to cope with a station blackout.

In 1988, Generic Letter 88-14 requested that the licensee perform a design verification of the instrument air system, including an analysis of component failure positions. The licensee conducted a design verification, however, it was not adeauate to identify the system deficiency.

In 1981, Generic Letter 81-14 requested the licensee to review the seismic qualification of the auxiliary feedwater system. The generic letter specifically identified the instrument air interface as an issue identified during NRC walkdowns. The licensee specifically addressed the auxiliary feedwater pump recirculation valves in its response to the NRC,dated May 4, 1982.

2. Once the deficiency was identified on November 29, 2001, the licensee failed to adequately correct the significant condition adverse to quality on November 30, 2001, when developing temporary change numbers 2001-0873 and 2001-0874 for procedures EOP-0.1 Unit 1, "Reactor Trip Response," revision 24, and EOP-0.1 Unit 2, "Reactor Trip Response," revision 23, respectively. Specifically, the temporary changes did not identify the instrument air header pressure low annunciator as a condition for monitoring AFW minimum flow recirculation valve position. Thus these procedure changes did not provide adequate guidance for the operators to address the potential for AFW minimum flow recirculation valves to close upon low instrument air header pressure, which could result in AFW pump damage if the flow was throttled back to control steam generator levels or to mitigate reactor coolant system overcooling.

Issue #2 - Fire C. 10 CFR 50.48, Section (b)(2) requires, in part, that all nuclear power plants licensed to operate before January 1, 1979, must satisfy the applicable requirements of Appendix R to this part, including specifically the requirements of Sections III.G, Ill.J, and 111.0. The Point Beach Plant was licensed to operate prior to January 1, 1979.

10 CFR Part 50, Appendix R, Section III.G.2 requires, in part, where cables or equipment, including associated non-safety circuits that could prevent operation or cause maloperation of redundant trains of systems necessary to achieve and maintain hot shutdown conditions, are located within the same fire area outside of containment, the cables and equipment and associated non-safety circuits be separated by a fire barrier having a three-hour rating, or be separated by a horizontal distance of more than 20 feet with no intervening combustibles or fire hazards, or one redundant train be enclosed in a fire barrier having a one-hour rating.

Contrary to the above, as of November 29, 2001, cables and equipment, located within fire area A23S, required for operation of redundant trains of systems necessary to achieve and maintain hot shutdown conditions were not separated by the required distance.

00 PSEDNO 0 EATA TI0 0 UBLICLOSU THOUT A PRVA T DpECT C000 21

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves Specifically, cables required for operation of motor-driven AFW pumps (pumps P-38A and P-38B) were located within a set of cable trays that were separated by a horizontal distance less than five feet. In addition, the cables were not separated or enclosed by an appropriate fire barrier. Consequently, a fire within fire area A23S could damage cables and equipment required for operation of the northern motor-driven AFW pump (pump P-38B), the AFW pump relied upon for safe shutdown in the event of a fire in fire area A23S.

000

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves - Draft Body of Inspection Report

4. OTHER ACTIVITIES (OA) 40A3 Event Follow-Up (93812)

.1 Auxiliary Feedwater Failure Due To Operator Actions

.a Inspection Scone The team performed inspection activities as specified by the charter for the special inspection. The charter was outlined in NRC memorandum from John M. Jacobson to Ronald A. Langstaff, dated November 30, 2001. The charter directed review of the following areas:

Timeline development relating to contributors and discovery of the potential common mode failure of the auxiliary feedwater system due to the loss of instrument air on auxiliary feedwater (AFW).

Adequacy of licensee's operability evaluation and immediate corrective actions for addressing impact of loss of instrument air on AFW.

Preliminary determination of risk significance.

Apparent cause of condition resulting in potential loss of AFW upon loss of instrument air.

Evaluation of pressurizer power operated relief valve (PORV) modifications impact on operational capability in response to loss of feedwater.

Extent of condition of the adequacy of engineering review of instrument air system, other air operated valves, and failure modes.

Failure of the original individual plant examination (IPE) to consider AFW recirculation valve function.

.b Findings A violation of 10 CFR Part 50, Appendix B, Criterion V was identified for failure to have adequate guidance in emergency operating procedures to prevent damage to auxiliary feedwater pumps. Additionally, two violations of 10 CFR Part 50, Appendix B, Criterion XVI were identified for failure to identify conditions adverse to quality relating to the inadequate procedural guidance. Collectively, the findings associated with the violations were preliminarily determined to be of high safety significance (i.e., red).

(1) Event Description The licensee probabilistic risk analysis (PRA) staff identified a vulnerability associated with AFW recirculation valves. The recirculation valves were air operated valves which failed closed upon a loss of instrument air. Consequently, in certain transients, such as a loss 000

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves of off-site power, loss of service water, and loss of instrument air, the flow path via the recirculation lines would be lost due to the recirculation valves failing closed upon a loss of instrument air. Closure of the recirculation valves could result in pump failure under low flow conditions such as when AFW flow was throttled back to control steam generator level or mitigate overcooling of the reactor coolant system.

The PRA staff identified the vulnerability while updating the Point Beach PRA model for internal events. The PRA staff originally considered the vulnerability to be a procedural weakness associated with procedure AOP 5B, 'Loss of Instrument Air." The original concern was steps to restore AFW pump recirculation flow did not occur sufficiently early in the procedure. Condition Report (CR) 01-2278 was initiated on July 6, 2001 to document the concern. The PRA staff continued discussions with operations personnel over the next several months with regards to the vulnerability. During November, 2001, the PRA staff completed their internal events modeling and determined that the vulnerability resulted in a substantial increase in risk. On November 28, 2001, the PRA staff, engineering personnel, and operations personnel met to discuss the significance of the vulnerability and potential courses of action. On November 29, 2001, operations concluded that temporary information tags and operator briefings was appropriate to address the vulnerability. CR 01-3595 was initiated to documented the increased risk and to address the vulnerability. The NRC was also formally notified (Event Notification 38525) on November 29, 2001. The issue was subsequently reported by Licensee Event Report 266/2001-005-00 on January 28, 2002.

(2) System Description Point Beach Nuclear Plant is a two unit site. Each unit has a turbine driven AFW pump (pumps 1P29 and 2P29) which can supply water to both steam generators. Additionally, the plant has two motor driven AFW pumps (pumps P39A and P39B) each of which can be aligned to a steam generator in each unit. The recirculation minimum flow valves for both the turbine driven and motor driven pumps would open for the initial 45 seconds after pump start and open on low flow conditions. However, the recirculation minimum flow valves were air operated valves which failed closed upon a loss of instrument air. The control room had valve position indication for the recirculation valves and flow indication to individual steam generators.

The AFW recirculation lines were installed, as part of original construction, to ensure the pump would have a flow path to prevent dead-heading the pump, which would damage the pump. Discussions with licensee engineering staff indicated that a pump could be damaged within minutes under insufficient flow conditions due to lack of cooling. The initial lines installed included an orifice that allowed a 30 gpm flow rate. This flow rate was determined by the pump vendor, Byron Jackson, to be sufficient to prevent pump damage based on pump heat-up when on mini-flow. The recirculation lines were subsequently modified in 1988, in response to Bulletin 88-04, 'Potential Safety-Related Pump Loss," to accommodate a greater flow rate and protect the pump from low flow instabilities.

(3) Operator Actions Procedure EOP-0.1, "Reactor Trip Response," directed operators to control feedwater flow early on in the procedure. Procedure EOP-0.1 was the procedure which operators would be using for most transients. Response not obtained (RNO) column step 1.c of the QoP ROOSNFORCM ACTO 0 00 NT O IC C l/SURE OU APR AL F THE E T ,E000

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves procedure directed operators to reduce feed flow if reactor coolant system (RCS) temperatures were less than 5470 Fahrenheit (F) and trending lower. Step 4.b directed operators to control feed flow to maintain steam generator levels between 29% and 69%.

RNO step 4.b directed operators to stop feed flow to intact steam generators if level continued to rise. However, if instrument air had been lost, damage could occur to the AFW pumps by operator actions to control feedflow due to low flow conditions created.

The inspectors noted that procedure OM 4.3.1, "AOP and EOP Writers' Guide," step 5.4.2 stated 'A caution is used to present information regarding potential hazards to personnel or equipment associated with the subsequent step(s)." The emergency operating procedures steps did not provide any such cautions prior to November 30, 2001.

Portions of the EOP-0.1 steps are illustrated below:

STEP ACTION/EXPECTED RESPONSE RESPONSE NOT OBTAINED I Verify RCS Temperature Control: Perform the following:

a. Check RCS wide range cold leg 1. IF RCS cold leg temperature less temperatures: than 5470 F AND RCS

LESS THAN OR EQUAL TO temperatures are trending lower, 5470 F THEN stabilize RCS temperature AND as follows:

STABLE a) Stop dumping steam.

b) Ensure SIG blowdown isolations - SHUT c) IFcooldown continues, THEN control feed flow:

1) Reduce total feed flow.

2) Maintain total feed flow greater than or equal to 200 gpm until level greater X . than 29% in at least one SIG.

STEP ACTION/EXPECTED RESPONSE RESPONSE NOT OBTAINED 4 Stabilize SIG Levels:

a. Check SIGI levels - GREATER a. Maintain total feedflow greater THAN 29% than 200 gpm until level greater than 29% in at least one SIG

b. Control feed flow to maintain b. IFlevel in intact SIG continues to S/G levels between 29% and rise, THEN stop feed flow to that 65% SIG.

Operating experience demonstrated that operators could drastically cut back auxiliary feedwater flow within several minutes due to overcooling under some transient conditions. For example, on June 27, 2001, the Unit 2 reactor was manually tripped due to low and decreasing water level in the Unit 2 circulating water pump bay (reported on 0

iO BLIC LOSU OU PPOVATHE vTO 0000

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves Licensee Event Report 05000301/2001-002-00). Due to low steam generator water levels, the Unit 2 turbine driven AFW pump and both motor driven AFW pumps initiated and began feeding the Unit 2 steam generators. Only one steam generator in a unit nominally required 200 gallons per minute (gpm) feedwater flow for decay heat removal.

However, with three AFW pumps running, approximately 800 gpm of feedwater flow, i.e.,

approximately four times the required flow, was provided to the Unit 2 steam generators.

Consequently, the reactor coolant system was cooled down at an excessive rate.

Approximately three minutes after the reactor was tripped, operators closed either the flow control valves or the discharge valves to stop flow from the motor driven AFW pumps. Approximately four minutes after the reactor was tripped, operators closed the discharge valve from the Unit 2 turbine driven AFW pump to stop all AFW flow. The AFW pumps were not secured until approximately eight minutes after the reactor was tripped when feedflow using main feedwater was partially restored. In this particular event, the AFW minimum flow recirculation valves were functional because instrument air had not been lost. However, instrument air would not be initially available in some other transients such as loss of instrument air, loss of off-site power, and loss of service water events.

Based on discussions with licensee engineering staff, the inspectors determined that the time that the AFW minimum flow recirculation valves would fail closed due to loss of instrument air could vary. The engineer staff had determined that the minimum flow recirculation valves would begin to drift shut at 40 psig and would be fully closed at 25 psig. The instrument air header pressure was normally maintained at roughly 100 psig with some variation due to cycling of air compressors. Based on observations of instrument air header pressure drop between cycling of air compressors, the engineering staff determined that the instrument air head pressure would drop approximately 13.5 psi in one minute under normal loads. The engineering staff estimated that the AFW minimum flow recirculation valves would begin to drift shut approximately six to eight minutes after loss of all air compressors with complete valve closure one to two minutes thereafter. A loss of instrument air due to a break in an airline versus a loss of air compressors would result in different bleed down rates, depending on the size of the break. Additionally, the instrument air bleed down rate could be faster due to greater demands on the instrument air system in response to the transient.

Based on discussions with licensee personnel, the preferred method for controlling auxiliary feedwater flow was by throttling or closing the AFW flow control valves (for the motor driven AFW pumps) or discharge valves (for the turbine driven AFW pumps) rather than securing pumps. The inspectors noted that Section 14.1.12, 'Loss of All AC Power to the Station Auxiliaries," of the original Final Facility Description and Safety Analysis Report (FFDSAR)," stated the "The reactor operator in the control room can monitor the steam generator water level and control the feedwater flow with remote operated auxiliary feedwater control valves." The FFDSAR did not discuss securing AFW pumps as a means to control steam generator levels. Licensee operations personnel contested that operators would recognize that the AFW pumps would not have sufficient flow if the recirculation valve failed closed. The inspectors recognized that operations personnel may recognize that low flow conditions existed and secure a pump accordingly. However, the inspectors were not confident that such actions would be taken with a high degree of certainty prior to the procedure changes and training provided November 29, 2001 and after. The inspectors noted that although operators 0 0OPOw EN RCEMENT sTION 0O 00 LIDISC SRE opo$26IOU6 PP VAOFTH ICTOO 000

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves had flow indication for flow to individual steam generators, the operators did not have direct flow indication for the AFW pumps in the control room. The control room did provide valve position indication for the AFW minimum flow recirculation valves.

Additionally, the inspectors noted that in some scenarios, the recirculation valves could remain open at the time that operators throttle or close flow control and discharge valves. However, the recirculation valves could close due to decreasing air pressure.

Consequently, the valves could reposition at a time when an operator's attention would not be directly focused on the AFW pumps.

Procedure AOP-5B, "Loss of Instrument Air," provided operators guidance for loss of instrument air. However, the inspectors noted that operators would typically be using emergency operating procedures, such as EOP-0.1, in their initial response to a transient. After plant conditions stabilized, abnormal operating procedures, such as AOP-5B, would be used to restore equipment. The inspectors reviewed procedure AOP-5B and determined that the first procedure step which directed operators to gag the AFW pump recirculation valves open was step 1 of Attachment R, 'Auxiliary Feed,"

located on page 36 of the procedure. Operators were directed to Attachment R by step 26 (located on page 14) of the procedure. Step 26 simply directed operators to check plant systems status per attachments A through Z. The inspectors also noted that although procedure AOP-5B had a procedure step, step 24, relating to auxiliary feedwater which appeared earlier in the procedure, the procedure step did not address the recirculation valves. Consequently, although procedure AOP-5B had steps which addressed the recirculation valves, the inspectors considered it unlikely that operations personnel would have performed the steps in time to prevent pump damage had auxiliary feedwater flow already been cut back. ;

The inspectors reviewed licensed operator training lesson plans and simulator, scenarios -

for training conducted prior to November 29, 2001, and interviewed licensed reactor operators and senior reactor operators to evaluate the emphasis placed on the effect of loss of instrument air on AFW operability prior to November 29, 2001. The inspectors determined:

Operators were trained on and knowledgeable of the 'fail-safe" position of air operated valves including the AFW minimum recirculation valves. No emphasis, however, was placed on the consequence of the fail-closed AFW minimum recirculation valves.

Lesson Plan 2672, "Instrument Air and Service Water Review," outlined training on the loss of instrument air PRA initiating event. The outline addressed the loss of instrument air effect on secondary cooling. The lesson plan stated that the turbine-driven AFW pump would be available for feeding the steam generator -

"loss of instrument air had no effect" and that the pressure control valves for the mrtrrrzoxAMA/ -- mo f,;1 rear Ac I-r en -_+,{,..I_ .1.

-~

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves discussed, and (3)the need to gag open the atmospheric steam dumps was discussed. The inspectors concluded that the effect loss of instrument air on the AFW minimum recirculation valves was not specifically addressed because it was not recognized by PRA as being significant at the time of the training.

No simulator scenario, including loss of offsite power and loss of instrument air, had included the failure of an AFW pump due to loss of recirculation flow. The licensee's training staff informed the inspectors that the simulator, as modeled, would not fail an AFW pump due to low flow conditions.

10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings,"

requires, in part, that activities affecting quality shall be prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances. As of November 29, 2001, procedures EOP-0.1 Unit 1, 'Reactor Trip Response," revision 24, and EOP-0.1 Unit 2, "Reactor Trip Response," revision 23, were not of a type appropriate to the circumstances in that the procedures did not provide adequate guidance to operators regarding the potential to damage AFW pumps while controlling AFW flow upon a loss of instrument air. As a result of the inadequate guidance, operators could have inadvertently damaged multiple AFW pumps in response to a transient involving a loss of instrument air, a non-safety related system. This issue is considered an apparent violation (AV 50-266/01-17-xx; 50-301/01-17-xx)

(4) Operability Evaluation The inspectors reviewed the licensee's initial operability determination screen conducted by a Senior Reactor Operator (SRO) on November 29, 2001. The documented basis for system operability was satisfactory completion of required surveillance testing. The inspectors noted that the operability determination screen did not address the potential simultaneous failure of all AFW pumps due to loss of instrument air and procedurally directed operator actions (the specific issue identified by the CR). The inspectors engaged licensee management (duty shift supervisor and operations manager) on the adequacy of the operability determination screen. Licensee management acknowledged that the documented operability basis was lacking in detail, but assured the inspectors that extensive discussions of system operability were conducted involving both operations and engineering. After repeated questioning by the inspectors, the licensee initiated a formal engineering operability determination on November 30, 2001. The inspectors noted that despite the "extensive discussions" conducted prior to inspector intervention on November 30, over twenty-four hours, and one revision, were required to complete the formal engineering operability determination. The inspectors reviewed revision 1 of the formal engineering operability determination to verify that the licensee's conclusion that the AFW system was operable but nonconforming was appropriate.

(5) Licensee Corrective Actions The licensee revised procedures EOP 0, "Reactor Trip or Safety Injection," and EOP 0.1, "Reactor Trip Response," on November 30, 2001, to provide additional guidance to operators. The foldout pages for both procedures were revised to state:

IF any AFW pump mini-recirc valve fails shut, THEN maintain minimum flow or stop the affected AFW pump as necessary to control S/G levels.

O>X00

-\ PROSED CEMNTION 0 000 NOTFO0 LIiSLOSEITHO PROVA OFTHEDETOR, 000 28

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves o P-38A minimum flow - GREATER THAN 50 GPM o P-38B minimum flow - GREATER THAN 50 GPM o P-29 minimum flow - GREATER THAN 75 GPM The above guidance addressed overfilling of steam generators which would, generally, take longer than 10 minutes after the transient initiated. Consequently, under such circumstances, instrument air would have likely bled down to the point of failing the recirculation valves shut before operators would have taken actions to drastically control AFW flow.

However, the licensee PRA staff subsequently identified that operator action to control AFW flow could be required much earlier in a transient due to overcooling. Morever, during an event which had occurred during the summer of 2001, operators had taken actions to drastically control AFW flow due mitigate overcooling of the reactor coolant system within approximately three minutes of the start of the event. Consequently, at the time operators take action to control AFW flow, the recirculation valves may still be functional due to sufficient instrument air header pressure remaining. However, as instrument air header pressure decreases, the recirculation valves would reposition at time when operators are not in the process of manipulating AFW controls. Hence the greater likelihood that the operators would not recognize that the recirculation valves had failed shut.

In response to this issue, the licensee revised the foldout page for procedures ECA-0.0,

'Loss of all AC Power," EOP 0, and EOP 0.1, on December 20, 2001, to state:

IFany AFW pump mini-recirc valve fails shut OR annunciator C01 A 1-9, INSTRUMENT AIR HEADER PRESSURE LOW in alarm, THEN monitor and maintain minimum AFW flow or stop the affected AFW pump as necessary to control S/G levels.

o P-38A minimum flow - GREATER THAN 50 GPM o P-38B minimum flow - GREATER THAN 50 GPM o P-29 minimum flow GREATER THAN 75 GPM The inspectors questioned the effectiveness of the procedure revisions. Based on discussions with licensee personnel, the inspectors determined that the instrument air pressure annunciator would alarm at 89 psig. However, the recirculation valves would begin to fail closed at 40 psig and would be completely shut at approximately 25 psig.

Based on timing the cycling of the air compressors, the licensee estimated that instrument air header pressure dropped about 10 psi per minute with normal loads. The licensee estimated that the annunciator would provide five to nine minutes of warning to the operators. Additionally, the inspectors noted that for most transients, numerous annunciators would be lit and would tend to mask the instrument air header pressure annunciator.

10 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," requires, in part, that measures shall be established to assure that conditions adverse to quality are promptly identified and corrected. On November 29, 2001, the licensee had identified the potential for common mode failure of AFW pumps due to the AFW minimum flow recirculation valves failing closed upon loss of instrument air. However, the procedure changes performed on November 30, 2001, to address this issue were inadequate in OOOP OSED CE NCTN 000 NOTL 000

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves that insufficient time would exist for operators to recognize that AFW pump low flow conditions existed and take appropriate actions to secure affected AFW pumps.

Specifically, although operators were provided with indication of AFW minimum flow valve position indication, the operators did not have direct indication of low AFW pump flow conditions which would necessitate securing AFW pumps. Additionally, although operators had annunciation of low instrument air header pressure indication, the annunciation only provided operators with about a half minute of warning prior to the AFW minimum flow control valves failing shut. Given the demands placed on operators during the early phases of a transient, the procedure changes did not provide sufficient time for operators to recognize AFW pump low flow conditions and take appropriate actions. This issue is considered an apparent violation (AV 50-266101-17-xx; 50-301/01-17-xx)

(6) Missed Opportunities The inspectors identified a number of opportunities which the licensee had prior to 2001 to identify that the failure mode of the AFW minimum flow recirculation valves conflicted with operating practice.

1981 In Generic Letter (GL) 81-14, the NRC requested that the licensee perform a walk-down of the non-sesmically qualified portions of their Auxiliary Feedwater systems to identify apparent and practically correctable deficiencies that may exist. In attachment 1, section IV,of their response, dated May 4, 1982, the licensee stated "the auxiliary feedwater recirculation valves are now normally open and fail close." The licensee did not address the impact of the valves failing closed could have on the system.

1988 GL 88-14, Instrument Air Supply System Problems Affecting Safety-Related Equipment," requested that licensees perform a design verification of the entire instrument air system including an analysis of current air operated component failure positions to verify that they were correct for assuring required safety functions. The licensee's response, dated February 20, 1989, stated under action item 2 that Abnormal Operating Procedure AOP-5B, "Loss of Instrument Air" provides operators with a listing of component failure positions due to loss of instrument air and the actions that might be necessary for various systems and/or components.

1989 In their April 17, 1989 submittal to the NRC in response to 10 CFR 50.63 (i.e.,

the station blackout rule), Wisconsin Electric stated that no air-operated valves are required to operate to cope with a station blackout for one hour.

1991 The original PRA performed in response to GL 88-20 did not model the minimum flow recirculation valves failing closed upon loss of instrument air. Consequently, the interaction between the instrument air system and the auxiliary feedwater system was not fully evaluated.

1994 The design basis document (DBD) for the auxiliary feedwater system, DBD-01 dated April 1994, stated that minimum flow recirculation valves had a safety function to open and remain open. However, the identified safety function for the PRO OS ENFOCE TAG 10 00 0 T ULIC CLSURE HOJAPP VA OFT DICTO0 000

SDP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves valves to open was not reconciled with the valves failure mode to fail closed upon a loss of instrument air.

1997 In March 1997, the licensee identified an AFW system failure mode due to instrument air (reported by Licensee Event Report 97-014-00). Specifically, the flow control valves for the motor driven AFW pumps were air operated valves which failed open. In certain scenarios, such as a main steam line break coincident with a loss of instrument air, the motor driven AFW pumps could be in a run-out condition and trip the circuit breakers for the pumps. As a result of identifying this vulnerability, the licensee installed nitrogen back-up for the motor driven pump flow control valves. However, the licensee did not adequately review the function of other air operated valves in the AFW system such as the minimum flow recirculation valves.

1997 In April 1997, a contractor working on the revision of the licensee's inservice testing (IST) program identified the discrepancy between the IST background document and the AFW system DBD for the safety function of the valves in the recirculation line. The IST background document stated the check valves did not have a safety function to open. since there was always adequate flow to the steam generator such that the recirculation flow path was not needed to protect the pump. The AFW system DBD stated that the minimum flow recirculation valves, and, hence, the recirculation line, did have a safety function to open. The issue was documented on CR 97-3363 and investigated. In their investigation, the licensee focused ensuring that the AFW system would provide water to the flow steam generators. For the turbine-driven pumps, the valve lineup was such that there was normally a flow path to the generator. The only power-operated valves in the line were motor-operated valves (MOVs) to each steam generator that were normally in the throttled position. For the motor-driven pumps, although there were normally closed valves (one control valve and an MOV to each steam generator) in the discharge path, these valves received an open signal on pump start to provide an adequate flow path. The dead-heading of the motor-driven pump could occur if the control valve or MOV failed to open. Based..

on single failure criteria, this would however only affect one of the two motor-driven pumps. Based on this evaluation, the licensee deleted the open safety-function of the minimum flow recirculation valves from DBD-1. However, the licensee failed to address operator actions which could be taken to control auxiliary feedwater flow to prevent overcooling of the RCS or overfilling the steam generators. As such, the licensee failed to identify that multiple AFW pumps (both turbine driven and motor driven) could be affected by the failure mode of the AFW minimum flow recirculation valves.

(7) Pressurizer PORV Impact on Operational Capability The pressurizer PORVs were air operated valves which were provided with a backup nitrogen supply. However, since 1979, the back-up nitrogen supply has been isolated, by procedure, for power operation. A containment entry was required to restore the back-up nitrogen supply. Consequently, upon a loss of the instrument air, the ability to use the PORVs would not be available. The safety injection pumps did not provide 00 TER PUNI DJSCLO WITHOUPROVA THED ETo 000

SOP/ENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves sufficient discharge pressure to lift the reactor coolant system safety relief valves.

Although the positive displacement charging pumps provided sufficient discharge pressure to lift and pass coolant through the code safety relief valves, the charging pumps did not provide sufficient flow for adequate decay heat removal. Consequently, a loss of instrument air would also result in the loss of feed and bleed capability. A loss of feedwater combined with a loss of instrument air would result in a loss of decay heat removal capability.

.x Risk Significance to be provided later pending SRP panel

.2 Auxiliary Feedwater Failure due to Fire Damage

.a Scope The team performed inspection activities as specified by the charter for the special inspection. The charter was outlined in NRC memorandum from John M. Jacobson to Ronald A. Langstaff, dated November 30, 2001. The charter directed review in the area of preliminary risk significance determination of fire scenarios.

.b Findincs One violation of 10 CFR Part 50, Section III.G.2 was identified for failure to provide separation of cables and equipment and associated non-safety circuits of redundant trains by a horizontal distance of more than 20 feet with no intervening combustible or fire hazards. As a result, one AFW pump relied upon for post-fire safe shutdown Would not be available. The finding associated with the violation was preliminarily determined to be of low to moderate safety significance (i.e., white).

(1) Fire Scenario During the inspection, the licensee identified one scenario where an AFW minimum flow recirculation valves failing closed could invalidate existing Appendix R safe shutdown analyses. The licensee initiated CRs 01-3633 and 01-3648 to document the issues.

Specifically, the licensee identified that the following scenario could happen should a fire occur in the Unit 1 turbine driven AFW pump (pump 1P-29):

In addition to affecting the Unit 1turbine drive AFW pump, fire damage would also cause the southern motor-driven pump (pump P-38A) to fail because the power cable for the pump is in the plume area. Consequently, neither pump is able to supply a Unit 1 steam generator.

b. "B" train steam generator water level instrumentation for the steam generators is affected due to fire damage. Consequently, "A" train steam generators must be fed.

The Unit 1 reactor is shutdown due to the fire. The Unit 2 reactor and associated plant is kept operating because its not directly affected by the fire.

000

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves

3. The cables for the northern motor-driven pump (pump P-38B) Unit 1 discharge valve (valve AF-4021) would also be affected by the fire. The valve is a normally closed valve. Consequently, the pump P-38B Unit 1 discharge valve could fail to open when an open signal is received due to low steam generator water level.

The northern motor-driven pump (pump P-38B) Unit 2 discharge valve (valve AF-4020) would remain shut because no low steam generator water level signal has been received for Unit 2 (because the unit is kept operating).

The northern motor-driven pump (pump P-38B) would receive a start signal due to low Unit 1 steam generator water level.

The minimum flow recirculation valve (valve AF-4014) for the northern motor-driven pump (pump P-38B) fails to open due to either fire damage to the valve control cables or due to loss of instrument air. The instrument air lines used soldered connections which would melt at a relatively low temperature.

Instrument air lines ran through the AFW pump room and could be affected by fire damage.

The northern motor-driven pump (pump P-38B) fails within minutes due to lack of available flow pump for pump cooling.

Main feedwater also becomes unavailable due loss of instrument air. (The feedwater regulating valves fail closed upon a loss of instrument air.)

Additionally, cables for the main feedwater system ran through the room and could be affected by the fire.

The pressurizer PORVs would be unavailable due to fire induced loss of instrument air. Consequently, feed and bleed capability would not exist for removal of decay heat.

Unit 2 could receive feedwater from the Unit 2 turbine-driven AFW pump.

However, Unit 1 would have no source of feedwater.

For a fire in this area, the licensee's Appendix R analyses took credit for northern motor driven AFW pump (pump P-38B) to supply the Unit 1 'A"steam generator (through a cross-connect of "A" and 'B" trains) while the Unit 2 turbine-driven AFW pump would be available to supply the Unit 2 steam generators, if needed.

However, due to the scenario described above, the pump would have already been damaged before operators could locally provide a flow path through the cross-connecting the 'A" and 'B" trains.

(2) Regulatory Issue 10 CFR Part 50, Appendix R, Section III.G.2, requires, in part, that where cables or equipment, prevent operation or cause maloperation due to hot shorts, open circuits, or shorts to ground, of redundant trains of systems necessary to achieve and maintain hot shutdown conditions are located within the same fire area outside of primary containment, separation of cables and equipment and associated non-safety circuits of redundant trains by a horizontal distance of more than 20 feet with no intervening 000

SDPIENFORCEMENT PANEL WORKSHEET Point Beach AFW Recirculation Valves combustible or fire hazards. As of November 29, 2001, cables and equipment required for operation of the norther motor-driven AFW pump (pump P-38B) were not separated by a horizontal distance of more than 20 feet with no intervening combustible or fire hazards. Consequently, AFW pumps required for safe shutdown could be damaged due to the lack of an available flow path. This issue is considered an apparent violation (AV 50-266/01-17-xx; 50-301/01-17-xx)

(3) Risk Significance to be provided later pending panel decision 40A6 Meetino(s)

Exit Meetinq coo

ML031110059

Text

Reference:

Navigation menu

Search