ML031400649

NRR Peer Review of Preliminary ASP Analysis of November 2001 Operational Condition at Point Beach, Units 1 & 2

ML031400649
Person / Time
Site:	Point Beach
Issue date:	05/19/2003
From:	Tschiltz M Division of Systems Safety and Analysis
To:	Baranowsky P NRC/RES/DRAA/OERAB
Franovich M, NRR/DSSA/SPSB, 415-3361
References
Download: ML031400649 (12)

Text

May 19, 2003 MEMORANDUM TO: Patrick W. Baranowsky, Chief Operating Experience Risk Analysis Branch Division of Risk Analysis and Applications Office of Nuclear Regulatory Research FROM: Michael Tschiltz, Chief/RA/

Probabilistic Safety Assessment Branch Division of Safety Systems Analysis Office of Nuclear Reactor Regulation

SUBJECT:

NRR PEER REVIEW OF PRELIMINARY ASP ANALYSIS OF NOVEMBER 2001 OPERATIONAL CONDITION AT POINT BEACH 1 & 2 Per your request dated February 27, 2003, NRR SPSB branch has conducted a detailed peer review of the preliminary ASP analysis of the November 2001 operational condition at the Point Beach nuclear plant, Units 1 and 2. SPSB staff reviewed the analysis for accurate and realistic analysis of the design deficiency in the auxiliary feedwater (AFW) pumps air-operated minimum flow recirculation valves. In brief, SPSB is satisfied that the analysis reasonably bounds the risk associated with the degraded design-condition. Two areas of comments are offered for consideration under the premise that best-estimate assumptions should be used:

(1) Assumptions of AFW pump failure: The current analysis assumes a pump failure probability of 1.0 given a loss of instrument air. In review of industry operating experience, similar issues at other Westinghouse plants have not been as significant when considering actual system performance. In particular, the attached LER (excerpts highlighted) documents an actual loss of AFW pump recirculation event at McGuire, unit 1 and indicates that leakage past closed flow control valves and/or AFW flow recirculation valves may be sufficient to prevent imminent AFW pump failure. Subsequent inspection of the AFW pumps revealed no damage even-though the pumps operated from 20 to 60 minutes in the so called "dead-head" condition. The AFW pumps were multi-stage, horizontal centrifugal pumps (8 stage motor-driven pumps and a 9 stage turbine-driven pump). Note that the current McGuire AFW system uses automatic recirculation control (ARC) valves and are not dependent on the instrument air system (IAS). The ARC valves were installed after the event. Note also for Point Beach, the licensees AFW pump vendor has indicated that 10 to 20 gallons per minute flow is sufficient to prevent imminent pump failure (similar to that of the McGuire experience).

An evaluation of the type of flow control valves and/or flow recirculation valves and their susceptibility to leakage under high-AFW pump discharge pressure could provide higher confidence in the upper bound pump failure probability used in the ASP analysis.

CONTACT: Mike Franovich, NRR/DSSA/SPSB 301-415-3361

P. W. Baranowsky 2 (2) Clarification of the seismic analysis section: The current discussion notes that the design basis earthquake is 0.06g. Our review of the licensees IPEEE indicates that the safe shutdown earthquake is 0.12 g peak ground acceleration (PGA). Also, the relationship of the plants existing IAS piping design to the cited ANSI standard should be explained. The context may be intuitive to those individuals who perform seismic evaluations; however, it is not obvious to the non-informed reader what the relationship to the standard means. It should be noted that the IPEEE indicated that the piping was determined to be seismically weak due to the long pipe runs. Should you choose to state this in the ASP analysis, it may be beneficial to note that no credit for instrument air is a conservative assumption and suffices to meet the IPEEE intent of identification of potential severe accident vulnerabilities. Such an assumption in ASP analysis may be overly conservative if attempting to quantify a best-estimate risk value.

The seismic event tree and assumptions indicates that earthquakes exceeding even the lowest range reported in NUREG-1488 (50 cm/sec2) would result in core damage appears to be quite conservative. Review of the LLNL curve distribution for annual probability of exceedance versus peak ground acceleration reveals that for the Point Beach site, the probability distribution is skewed in favor of smaller magnitude earthquakes. The current assumption that exceeding even very small magnitude earthquakes would render IAS unavailable appears unjustified based on not meeting an ANSI pipe design-specification alone. Review of actual earthquake performance of non-nuclear power stations near the Loma Prieta, California 1989 earthquake epicenter (considered a strong earthquake) only sustained minor damage (see EQE Engineering report, The October 17, 1989 Loma Prieta Earthquake).

Footnote 7 on Table 4 (ASP model basic event probabilities that were modified) states that the base case value for the seismic initiating event (IE) frequency was 1.5E-05/year and was taken from the Point Beach Units 1 and 2 Individual Plant Examination (IPE) update of 1997. This reported number appears to represent the base, nominal annualized seismic risk and not the seismic initiating event frequency.

Should you have any questions, please feel free to contact Mike Franovich or Wayne Schmidt.

Attachment:

As stated

P. W. Baranowsky 2 (2) Clarification of the seismic analysis section: The current discussion notes that the design basis earthquake is 0.06g. Our review of the licensees IPEEE indicates that the safe shutdown earthquake is 0.12 g peak ground acceleration (PGA). Also, the relationship of the plants existing IAS piping design to the cited ANSI standard should be explained. The context may be intuitive to those individuals who perform seismic evaluations; however, it is not obvious to the non-informed reader what the relationship to the standard means. It should be noted that the IPEEE indicated that the piping was determined to be seismically weak due to the long pipe runs. Should you choose to state this in the ASP analysis, it may be beneficial to note that no credit for instrument air is a conservative assumption and suffices to meet the IPEEE intent of identification of potential severe accident vulnerabilities. Such an assumption in ASP analysis may be overly conservative if attempting to quantify a best-estimate risk value.

The seismic event tree and assumptions indicates that earthquakes exceeding even the lowest range reported in NUREG-1488 (50 cm/sec2) would result in core damage appears to be quite conservative. Review of the LLNL curve distribution for annual probability of exceedance versus peak ground acceleration reveals that for the Point Beach site, the probability distribution is skewed in favor of smaller magnitude earthquakes. The current assumption that exceeding even very small magnitude earthquakes would render IAS unavailable appears unjustified based on not meeting an ANSI pipe design-specification alone. Review of actual earthquake performance of non-nuclear power stations near the Loma Prieta, California 1989 earthquake epicenter (considered a strong earthquake) only sustained minor damage (see EQE Engineering report, The October 17, 1989 Loma Prieta Earthquake).

Footnote 7 on Table 4 (ASP model basic event probabilities that were modified) states that the base case value for the seismic initiating event (IE) frequency was 1.5E-05/year and was taken from the Point Beach Units 1 and 2 Individual Plant Examination (IPE) update of 1997. This reported number appears to represent the base, nominal annualized seismic risk and not the seismic initiating event frequency.

Should you have any questions, please feel free to contact Mike Franovich or Wayne Schmidt.

Attachment:

As stated CONTACT: Mike Franovich Distribution: spsb: r/f

• See previous concurrence Accession#ML031400649 G:\SPSB/Franovich\ASP-PBcomments.wpd NRR-096 OFFICE *SPSB *SC:SPSB BC:SPSB NAME MFranovich:nxh2 MReinhart/RA/MCaruso for MTschiltz DATE 05/09/03 05/13/03 05/19/03 OFFICIAL RECORD COPY

LER Full Text for LER Number: 36997009 ACCESSION #: 9710080173 LICENSEE EVENT REPORT (LER)

PAGE: 1 OF 15 DOCKET NUMBER: 05000369 TITLE: Reactor Trip On Both Units Due To An Equipment Failure And Operation Prohibited by Technical Specifications Due To Failure To Comply With Required Action Statements EVENT DATE: 09/06/97 LER #: 97-09-0 REPORT DATE:

10/06/97 OTHER FACILITIES INVOLVED: Unit 2 DOCKET NO: 05000370 OPERATING MODE: 1 POWER LEVEL: 100%

THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR SECTION:

50.73(a)(2)(i) 50.73(a)(2)(iv)

LICENSEE CONTACT FOR THIS LER:

NAME: J. W. Pitesa TELEPHONE: (704) 875-4788 COMPONENT FAILURE DESCRIPTION:

CAUSE: X2 SYSTEM: EPF COMPONENT: CKTBRK MANUFACTURER:

W120 REPORTABLE NPRDS: YES*

SUPPLEMENTAL REPORT EXPECTED: NO ABSTRACT:

Unit Status: Units 1 and 2 were in Mode 1 (Power Operation) at 100 percent power. Event

==

Description:==

On September 6, 1997, at 2146, the trip of an auxiliary supply breaker, while the Units were in an abnormal alignment, caused the loss of non-vital power to plant components on both Units. For Unit 1, this resulted in a trip of both Main Feedwater Pumps followed by a main Turbine and subsequent Reactor trip. For Unit 2, it resulted in the closure of the Main Steam Isolation Valves followed by a Reactor trip on Pressurizer high pressure. Additionally, the power loss resulted in loss of the automatic operating function for the Pressurizer Power Operated Relief Valves (PORVs) on both Units, and loss of indication from the Process Radiation Monitor associated with one set of the Control Room Ventilation Outside Air Intakes.

This equipment was inoperable for a period of 62.5 minutes, exceeding Technical Specification (TS) limits of 60 minutes without implementation of required actions.

Attachment

2 Event Cause: The cause of the breaker trip has been determined to be heat build-up created by a loose cable connection on the load side of the breaker, actuating breaker thermal trip units.

The cause of the loose connection is a construction/installation deficiency. A contributing factor is management deficiency due to lack of establishing adequate preventive maintenance.

Failure to implement required TS actions with regard to the Pressurizer PORVs and Process Radiation Monitor is attributed to failure of Control Room personnel to recognize the need to do so. With the loss of KXA, multiple Control Room indications were lost. Due to the absence of these indications and lack of procedural direction to alert them, actions were not taken within the one hour requirement. Corrective Action: Corrective actions include evaluation of preventative maintenance on shared vital and auxiliary control and instrumentation buses, development of procedures for plant operation during loss of instrumentation and control buses, enhancement of existing procedural guidance, and training for all licensed operations personnel.

To be reported through EPIX END OF ABSTRACT NOTE: This text document was processed from a scanned version or an electronic submittal and has been processed as received. Some tables, figures, strikeouts, redlines, and enclosures may not have been included with this submittal, or have been omitted due to ASCII text conversion limitations. In order to view this document in its entirety, you may wish to use the NUDOCS microfiche in addition to the electronic text.

TEXT PAGE 2 OF 15 EVALUATION:

BACKGROUND The 125 VDC Auxiliary Control Power System (EPK) [EIIS:EI] (See Normal Alignment, page 14 of 15) provides non-safety DC control power to Unit 1 and Unit 2 equipment in the Auxiliary and Turbine Buildings and also supplies power to the Operator Aid Computer (OAC) and Auxiliary Control Power Inverters [EIIS:INVT]. The system serves as an uninterruptible power supply for non-safety related loads requiring DC power through the Battery chargers [EIIS:BYC] and batteries [EIIS:BT] or AC power through the Auxiliary Control Inverters. The 125 VDC Auxiliary Control Power System consists of batteries CXA and CXB, battery chargers CXA, CXB, and CXS, distribution centers DCA and DCB, and molded-case circuit breakers [EIIS:72]. The design of the system provides for the manual cross connection of two distribution centers during periods of battery maintenance. Under normal plant operating conditions each battery receives a float charge from its respective charger. Standby battery charger CXS can be placed in service for either of the two primary units, should one be out of service. Distribution Centers DCA and DCB are provided with tie breakers which are procedurally closed during battery maintenance. When Distribution Centers DCA and DCB are cross-tied, procedure P/0/A/6350/01B, 125 VDC- 240/120 VAC Auxiliary Control Power, specifies that the Inverters which are normally powered from the distribution center that is without battery support be manually transferred to an alternate regulated AC source. This reduces the load on the remaining battery and chargers since only two inverters remain on the bus. Initial design calculations, performed per IEEE Standard 485-1983, necessitated this lineup based on single battery capacity during a Loss Of Offsite Power (LOOP) event. These calculations used name

3 plate data for Bus loads, leading to over conservatism in the initial basis for alignment.

Technical Specification (TS) 3.4.4, Action d, specifies that with three Pressurizer [EIIS:PZR]

Power Operated Relief Valves (PORVS) [EIIS:RV] inoperable for causes other than leakage, within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> either restore at least one PORV to operable status or close and remove power from the associated block valves, be in Mode 3 (Hot Standby) within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in Mode 4 (Hot Shutdown) in the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

TEXT PAGE 3 OF 15 TS 3.3.3.1 specifies that radiation monitoring instrumentation channels for plant operations shown in Table 3.3-6, shall be operable with their alarm setpoints within the specified limits.

Table 3.3-6, Action 27, directs that with either of the Control Room air intake radioactivity high monitors (EMFs) 43A or 43B inoperable, isolate the Control Room Ventilation System outside air intake which contains the inoperable EMF within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

DESCRIPTION OF EVENT On September 6, 1997, prior to the event, Units 1 and 2 were in Mode 1 (Power Operation) at 100 percent power. EPK System Battery CXA had been isolated from the DCA Bus [EIIS:BU]

for equalize charge following annual service testing and maintenance. Bus DCA had been cross tied to Bus DCB and, as a result, inverters 1KU and KXA were shut down with the associated Power Panel Boards (1KU and KXA) being supplied power from the regulated alternate AC source through Regulated Power Distribution Center MKA (See Pre-Trip Alignment, page 15 of 15). At 2146:31.33, Breaker MKA-1B, Inverter KXA Manual Bypass Switch Alternate Supply, tripped. This de-energized Power Panel Board KXA. Loss of alternate power to Power Panel Board KXA caused loss of non-vital power to a number of plant components on both Units, which, in turn, caused loss of non-safety related control and indication functions associated with those components. Also lost were the Events Recorder and data inputs to portions of the OAC. UNIT ONE SEQUENCE OF EVENTS Time Event 2146:31 Main Steam System [EIIS:SB] Turbine Governor Valves GV01, GV02, GV03, and GV04 closed. Valve movement to the closed position is an expected response due to the loss of KXA. 2146:36 Main Feedwater System [EIIS:SJ] Pumps [EIIS:P] A and B tripped. As a result, the Main Turbine tripped and the Auxiliary Feedwater System (EIIS:BA] Motor Driven Pumps A and B started as expected on loss of both CF Pumps. Also, loss of power to the manual controls for valves 1SA-48ABC and 1SA-49AB, Main Steam from Steam Generators C and B to the Turbine Driven.

Text PAGE 4 OF 15 Auxiliary Feedwater Pump, respectively, caused the valves to fail open and start the Unit 1 Turbine Driven Auxiliary Feedwater Pump. Indication for valves 1SA-48ABC and 1SA-49AB was lost as a result of loss of KXA. Turbine speed indication was also lost. These two primary indications provide Operations personnel with indication that the Turbine Driven Auxiliary Feedwater Pump is running. The loss of these indications contributed to the failure of Operations personnel to recognize the Turbine Driven Auxiliary Feedwater Pump start. The Main Reactor [EIIS:RCT] Trip Breakers opened as expected on a Turbine trip at 100 percent power. 2146:37 Containment Ventilation Isolation occurred due to loss of power causing EMFs 38, 39, and 40, Containment Radiation Monitors, control relaying to fail to the fail safe state.

This resulted in the isolation of the Containment Air Release And Addition System [EIIS:BF],

4 which is used for operational Containment pressure control. Containment Narrow Range pressure indicated an increase to a peak pressure of 0.22 psig due to loss of ventilation. Train B pressure indication continued to function properly during this time to provide computer indication. No containment systems were challenged as a result. 2146:37 to The Main Steam System Code Safety Valves each cycled 2146:44 once. Maximum steam pressure reached 1199 psig. 2146:41 A Main Feedwater System Isolation occurred due to low T-AVE coincident with Reactor trip. 2146:39 to The Main Steam System PORVs each cycled multiple 2257:09 times in automatic and manual. 2146:38 Reactor Coolant System [EIIS:AB] pressure reached 2366 psig. The pressure setpoints for the Pressurizer Code Safety Valves were never reached; therefore, the valves were never challenged. The no-load value for Reactor Coolant System temperature and the no-load Steam Generator pressure recovered to 557 degrees F and 1092

psig, Text PAGE 5 OF 15 Respectively, within approximately 30 minutes following the trip. Steam Generator Narrow Range level and Pressurizer level recovered to 45 percent (both) within 30 minutes following the trip. The normal no-load levels of 39 percent and 25 percent, respectively, were not recovered until several hours following the trip. UNIT TWO SEQUENCE OF EVENTS Time Event 2146:39 All four Main Steam System Isolation Valves (MSIVs) closed. Reactor Coolant System pressure began rising due to loss of heat removal with the Pressurizer PORVs not available in automatic due to the loss of KXA. 2146:43 The Reactor Trip Breakers opened due to exceeding the high Pressurizer pressure setpoint of 2385 psig (Peak pressure reached was 2407 psig). The pressure setpoints for the Pressurizer Code Safety Valves was never reached; therefore, the valves were never challenged. 2146:44 The main Turbine tripped as expected on a Reactor Trip. 2146:45 The Steam Generator Code Safety Valves and PORVs lifted to relieve steam pressure. 2147:02 The Steam Generator Code Safety Valves reseated. The Steam Generator PORVs continued to cycle to control steam pressure until approximately 2300.

2148:21 A Main Feedwater System Isolation occurred due to low T-AVE coincident with a Reactor Trip. 2200:21 Operations personnel manually started the Turbine Driven Auxiliary Feedwater Pump to maintain Steam Generator levels. Steam Generator pressure was not stabilized on Unit 2 until the MSIVs were re-opened at approximately 0100, on September 7, 1997. The Steam Generator levels were comparable and relatively stable (+ or - 5 percent) within approximately 90 minutes following the trip. Pressurizer level was trending toward no-load value within 30 minutes Text PAGE 6 OF 15 Following the trip, but was not totally stable until the MSIVs were re- opened. T-AVE was stable within 30 minutes following the trip. ADDITIONAL EFFECTS OF THE LOSS OF KXA 1.

Normal and Excess Letdown flow capabilities were lost for Unit 1. o With the loss of ability to establish Normal or Excess Letdown there was concern about Reactor Coolant System inventory increasing and eventually filling the Pressurizer. The Pressurizer PORVs were manually operable if needed. 2. Reactor Coolant System makeup control was taken from the automatic to the manual condition due to loss of automatic makeup control. o Without makeup to the Volume Control Tank and without Letdown, level would decrease, requiring automatic or manual swap-over of the supply to the Centrifugal Charging Pumps from the Volume Control Tank to the Refueling Water Storage Tank. These functions were available. 3. Power was lost to the non-safety solenoid valves associated with the recirculation valves for all three Unit 1

5 Auxiliary Feedwater System Pumps. o

4. At 2146:37, a Unit 2 Containment Ventilation Isolation occurred due to loss of indication from Containment Radiation Monitors, EMFs 38, 39, and 40. o Containment isolation defeats the Containment Air Release and Addition System, which is used to maintain internal Containment pressures within limits.

Containment pressure increased as a result, and Containment Narrow Range pressure indicated a peak pressure of 0.21 psig. Operational pressure limits assure safety analysis initial conditions for design basis accidents are met. The accidents assume full power initial conditions. This is not a concern with the Unit in Mode 3 (Hot Standby). 5. Power was lost to the circuitry providing the automatic function for the Pressurizer PORVs on both Units. o The manual function for these valves was available from the Main Control Board if it had been needed. 6. Power was lost to 2 of the 4 bays of Process Radiation Monitors on both units. The Radiation Monitors having control functions went to the fail safe position as designed, which initiated control actions to terminate any associated releases. o Both units remained in compliance with required Technical Specification Action requirements for inoperable radiation monitors, except for response to loss of EMF 43A, Control Room Air Intake Radioactivity High Monitor, which is shared by both units. The expected radiation monitor control actions did occur with the loss of control power, including the Containment Ventilation Isolation. o A number of Selected Licensee Commitments (SLC) related liquid and gaseous effluent radiation monitors were inoperable during this event, and the proper control signals to close discharge valves were generated as a result. Plant response to loss of radiation monitors is to terminate any releases associated with the affected monitor until sampling or other previously defined measures are put in place, or to initiate sampling at a specified intervals until monitoring is restored. Accident Text PAGE 8 OF 15 Monitors are used in emergency procedures to aid in determining appropriate recommendations for accident response. Emergency procedures have built in alternative measurements and calculations to conservatively measure accident releases should accident monitors be lost. No radiological gas or liquid releases were being performed during the loss of KXA, thus no automatic control actions actually occurred. 7. Some Fire Detection System

6

[EIIS:IC] indications were lost on both Units. o Several fire detection zones became inoperable on loss of power. SLC 16.9-6.b requires a fire watch patrol be established within one hour for SLC Fire Detection Zones which become inoperable. Because of the loss of indication, the need to establish the required fire watch patrols was not recognized. Although monitoring capability for these zones was lost during this time, inoperability of the detectors in question did not affect the operability of any equipment required to mitigate the consequences of this event.

Station procedures govern the performance of any specific work involving ignition sources, and a separate fire watch is required to be in place during performance of those activities. At 2249, 62.5 minutes after the loss, Operations personnel re-closed Breaker MKA-1B, restoring power to KXA. After power was restored, all plant parameters quickly returned to nominal no-load values. Notifications were made to the NRC with regard to the trip of both units (September 6, 1997, at 2311) and loss of the automatic function for the Pressurizer PORVs (September 9, 1997, at 1559) as directed by procedure RP/0/A/5700/010, NRC Immediate Notification Requirements. No notification was required due to loss of indication from EMF 43A.

CONCLUSION This event did not result in any uncontrolled releases of radioactive material, personnel injuries, or radiation overexposures. This event would have been Nuclear Plant Reliability Data System (NPRDS) reportable due to equipment failure associated with Breaker MKA,-1B; however, NPRDS no longer exists. The failure will be reported through the Equipment Performance Information Exchange (EPIX).

Text PAGE 9 OF 15 The cause of the dual Reactor trips is attributed to loss of the regulated non-vital power supply from Power Panel Board KXA due to an equipment failure which caused Breaker MKA-1B to trip. The breaker trip has been determined to be an equipment failure due to heat build-up created by a loose cable connection on the load side of the breaker. This heat build-up actuated the breaker thermal trip units. The cause of the loose connection has been determined to be a construction/installation deficiency. This is based on expectation that the connection should have been torqued per manufacturers recommended values during initial installation. Although no preventive maintenance checks to verify torque had been performed, the corresponding connection on the same breaker, which would have been subjected to the same environment and stresses, was found to be tight. Also, all remaining connections on Non-vital Buses MKA and MKB were checked for correct torque and found to be tight.

Therefore, it has been determined that the correct torque was not applied to this connection during initial installation. A contributing cause is management deficiency due to lack of preventive maintenance for this equipment. No preventive maintenance had been established for the 125 VDC Auxiliary Control Power System Bus or associated breakers due to management concerns with regard to the inability to shut-down the equipment because of its effect on both Units, as well as performing maintenance on the equipment on-line for personnel safety reasons. Failure to implement required TS and SLC actions for the Pressurizer PORVs, Process Radiation Monitor, and Fire Zones is attributed to the lack of procedures, training, or indications leading to failure of Control Room personnel to recognize the need to do so. With the loss of KXA, multiple Control Room indications were lost. Due to the absence of indications and lack of procedural direction to alert the operators, required actions were not taken within the one hour requirement as specified by TS and SLC for loss of the automatic function for the Pressurizer PORVs, loss of EMF 43A alarm functions, and loss of alarm indication for several SLC Fire Zones. Although these required actions were not performed, the overall operator response to mitigate the transient created by the dual unit trip was appropriate. Review of the Operating Experience Program (OEP) and Problem Investigation Process (PIP) data bases for

7 the past 24 months revealed no reportable events involving loss of non-vital systems or equipment failures involving similar equipment. However, OEP data recorded a similar event which occurred on September 6, 1987. That event was Text PAGE 10 OF 15 Rreported under LER 370/87-16, Revision 1, and involved a trip of Unit 2 due to loss of power to Power Panel Board KXB, resulting from an overcurrent fault in an instrument air compressor motor. Unit 1 was already shut down at the time of that event. Corrective actions from that event concentrated on prevention of recurrence of similar motor faults and did not address the need or risk of being in the alternate alignment. Therefore, no corrective actions from that event were taken which would have prevented the occurrence of this event. It has been determined as a result of the analysis of this event that it is preferable to be aligned to the Inverter rather than the alternate source during equalize charge of either battery CXA or CXB.

However, to achieve this a modification is necessary to alter interlocks on the Battery Inverters.

This event is considered to be recurring. CORRECTIVE ACTIONS IMMEDIATE: 1. Breaker MKA-1B was re-closed and KXA was restored to service. 2. Breaker MKA-1B was replaced and the cable connection repaired. 3. Enclosures 4.9, 4.10, and 4.11, which provide guidance in Operations procedure OP/0/A/6350/01B for placing Batteries CXA and CXB on or removing from equalization charge, were deleted to prevent placing the 125 VDC Auxiliary Control Power System in a similar alignment until evaluation of the event could be completed. 4. Associated cable connections on Non-vital Buses MKA and MKB were checked for correct torque.

SUBSEQUENT: 1. A team was formed to evaluate the circumstances surrounding the KXA failure, to include an analysis of possible effects, response to the event, and recommendations for corrective actions. 2. Procedures AP/1 and 2/A/5500/05, Loss of Auxiliary Feedwater Recirculation Capability, were developed to address concerns as a result of the closure of Auxiliary Feedwater Recirculation valves on loss of KXA or KXB.

Text PAGE 11 OF 15 The procedures provide guidance to Operations personnel, reducing the possibility of operating the Auxiliary Feedwater Pumps with less than the required minimum flow during loss of recirculation valve control. 3. Calculations were performed that would allow all four Inverters powered from Distribution Centers DCA and DCB to remain loaded on the remaining battery and charger with one battery out of service. o The calculation reduces the over conservatism of using nameplate load data as in the initial design, and uses actual load data with a margin.

This allows a preferred alignment to the Inverter rather than the alternate source during equalize charge of either battery CXA or CXB. PLANNED: 1. A modification will be implemented to alter interlocks on the non- vital inverters, and operating procedures will be revised, allowing them to remain powered during periods when one battery is removed from service. 2. A formal re-evaluation will be performed to establish an effective preventative maintenance program on shared vital and auxiliary control and instrumentation buses. 3.

Procedures for plant operation during loss of shared vital and auxiliary control and instrumentation buses will be developed. Direction will be included for required Operator actions associated with EMFs 43A and 43B. o These procedures will provide guidance to operators on the symptoms of the loss of a bus, the effects of the loss of power to each load on the bus, and the actions to mitigate the loss of these loads. 4. The annunciator response procedures will be enhanced to provide Operations personnel with appropriate information concerning operability of the Pressurizer PORVs based on the power loss, and the loss of bus

8 procedures being developed will include guidance with regard to compliance with TS and SLC action statements. 5. This event will be covered as a part of required training for all licensed Operations personnel.

Text PAGE 12 OF 15 SAFETY ANALYSIS: Based on this analysis, this event is not considered to be significant. At no time were the safety or health of the public or plant personnel affected as a result of the event. The Pressurizer and the Steam Generator Code Safety Relief Valves are sized to protect the Reactor Coolant System and the Steam Generators against over pressure for all Main Steam load losses without assuming the operation of the steam dump system, Pressurizer Spray, Pressurizer PORVs, or Automatic Rod Control. During this event, Pressurizer pressure increased due to closure of the Main Turbine Governor Valves (for Unit 1) and closure of the MSIVs (for Unit 2). The Pressurizer PORV automatic function was unavailable due to the loss of Auxiliary Control power. However, further primary system pressure increase was terminated for Unit 1 and 2 as the respective Reactors tripped. No Unit 1 or 2 Pressurizer Code Safety valves were challenged during the event. As previously stated, although the automatic open function of the Pressurizer PORVs was not available, manual control was available and Operator action, in accordance with applicable procedures, could have been taken if necessary to open the valves. The loss of a portion of Auxiliary Control power also caused the unavailability of the Condenser and Atmospheric Steam Dump Valves. The Steam Generator PORVs and Main Steam Code Safety valves for each unit functioned as needed to control steam pressure. The dump valves became available 62.5 minutes after the trip when control power was restored. During the event, feedwater flow to the Steam Generators was maintained by the Auxiliary Feedwater system, ensuring adequate residual and decay heat removal Failure to close a Control Room Ventilation System Outside Air Intake during a Design Basis Accident is bounded by the assumptions of the Control Room Dose Analysis. Therefore, the loss of indication for EMF 43A was not safety significant. In summary, the units experienced conditions that have been analyzed in Final Safety Analysis report (FSAR) Section 15.2.3, Turbine Trip, or in the Control Room Dose Analysis. Emergency core cooling and emergency Text PAGE 13 OF 15 power were not required and were not actuated. The Dual Unit Reactor Trip involved additional Operator actions and attention not required by a conventional Single Unit Reactor Trip.

However, all safety systems required for maintaining Reactor Core and Containment protection remained fully available.

Text PAGE 14 OF 15 Figure "Normal Alignment" omitted.

Text PAGE 15 OF 15 Figure "Pre-Trip Alignment" omitted.

• • • END OF DOCUMENT *** Copyright 1 1996 Oak Ridge National Laboratory (ORNL) Last modified: May 9, 2002