05000269/LER-2003-001, For Oconee Nuclear Station, Regarding Design Oversight Resulting in Appendix R Control Cable Separation Issue
| ML032250125 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 08/04/2003 |
| From: | Rosalyn Jones Duke Power Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| O-03-3708 LER 03-001-00 | |
| Download: ML032250125 (14) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(3)(ii)(B) |
| 2692003001R00 - NRC Website | |
text
Duke PoPowere A Duke Energy Company R. A. JONES Vice President Duke Power 29672 / Oconee Nuclear Site 7800 Rochester Highway Seneca, SC 29672 864 885 3158 864 885 3564 fax August 4, 2003 U.S. Nuclear Regulatory Commission Document Control Desk Washington, D.C.
20555 Subjects Oconee Nuclear Station Docket Nos. 50-269,-270, -287 Licensee Event Report 269/2003-01, Problem Investigation Process No.:
Revision 0 0-03-3708 Gentlement Pursuant to 10 CFR 50.73 Sections (a) (1) and (d), attached is Licensee Event Report 269/2003-01, Revision 0, concerning discovery of a scenario for fire damage that could potentially result in inoperability of a component credited for Appendix R fire mitigation.
This report is being submitted in accordance with 10 CFR 50.73 (a) (3)(ii)(B), Unanalyzed Condition because this scenario involves a lack of required separation between Appendix R mitigation components due to a design oversight.
This event is considered to be of no significance with respect to the health and safety of the public.
Very truly yours, R. A. Jones Attachment
,-T 0 www. duke-energy. com
4
Document Control Desk Date: August 4, 2003 Page 2 cc: Mr. Luis A. Reyes Administrator, Region II U.S. Nuclear Regulatory Commission 61 Forsyth Street, S. W., Suite 23T85 Atlanta, GA 30303 Mr. L. N. Olshan Project Manager U.S. Nuclear Regulatory Commission Office of Nuclear Reactor Regulation Washington, D.C.
20555 Mr. M. C. Shannon NRC Senior Resident Inspector Oconee Nuclear Station INPO (via E-mail)
Abstract
On June 4, 2003, with Oconee Units 1 and 2 operating in Mode 1 at 100% Rated Power and Unit 3 in Mode 5 (start-up after refueling), an engineering evaluation identified a cable routed contrary to 10CFR 50, Appendix R separation criteria. Consequently, a low probability hot short due to a hypothetical fire could spuriously operate any one of six (6) valves in each Unit. Depending on the location of the design basis fire, one, two, or all three Oconee Units could be affected. This was considered a previously unanalyzed condition.
A fire watch patrol has been established on a once per 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> frequency and will remain in place until appropriate permanent corrective actions are in place to mitigate this condition.
The apparent cause of this event is an unanalyzed condition resulting from a historic design deficiency.
Engineering risk assessment concludes that the likelihood of the actual spurious actuation of these valves is low.
This event is considered to have minimal safety significance with respect to the health and safety of the public.
NRC FORM 366 (7-2001)
Oif more space Is reqred, use additional copies of (if more space Is required, use additonal copies of (if more space Is required, use adUdotil copies of NRC Faor 366A) (1
- 1, 2, and 3 HP-3 and 4 (RCS letdown cooler outlet isolation valves), and
- 1, 2, and 3 HP-20 (Reactor Coolant Pump seal return line isolation valve).
Due to the design of the control circuits, two conductors in different valve circuits making contact will not result in spurious operation unless additional shorts are postulated.
However, if the right two conductors on the same valve short together, it is possible to result in a spurious operation.
This raised the possibility that a fire induced "hot short" could occur in a portion of the normal shutdown control circuit that would bypass the torque and limit switches in the open direction, resulting in either a stall condition for the valve actuating motor (typically resulting in a burnt out motor) or an over thrust of the valve/actuator combination.
Either condition could render the valve incapable of operating when necessary after the SSF is placed in service.
The SSF related function of these valves is to close in order to limit flow from the RCS so that RCS losses are within the capacity of the SSF RCMU Pump.
The failure of one or more of these valves to close could potentially cause RCS leakage to exceed the capability of the RCMU Pump.
This could possibly result in the RCMU Pump being unable to maintain RCS inventory and could eventually result in loss of decay heat removal.
Therefore, fire induced damage of these cables could potentially affect the ability of the SSF to achieve and maintain safe shutdown in accordance with 10CFR50 Appendix R. Operations shift personnel were notified and the SSF RCMU Pump for each Oconee Unit was declared inoperable at 1115 am on 6/4/03.
The cables are non-conforming with respect to 10CFR 50, Appendix R requirements for the separation of control circuits for motor operated valves powered from the SSF.
This condition is similar to an example given in NUREG 1022, Section 3.2.4 (fire barrier missing such that the required degree of separation for redundant safe shutdown trains is lacking).
Therefore it was reported under 50.72(b)(3)(ii) (B)
UNANALYZED CONDITION via the Emergency (if more space Is requfre4 use additional copies of NRC Fobn 366A) (17)
Notification System at 1903 hours0.022 days <br />0.529 hours <br />0.00315 weeks <br />7.240915e-4 months <br /> on 6/4/03, and was documented as event # 39903.
Engineering performed an operability evaluation which concluded that a fire watch patrol performed once every 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> in the area that the control cables run was an adequate compensatory measure to reduce the likelihood and severity of a fire. This will ensure that transient combustibles are kept to a minimum and that no unauthorized hot work is performed in the vicinity that could cause a fire.
Following the acceptance of this operability evaluation by Operations and implementation of the fire watch, the SSF RCMU Pump was declared operable but non-conforming at 2047 on 6/5/03 and the TS condition was exited.
CAUSAL FACTORS The apparent cause of this condition is a historic design deficiency existing since the SSF was declared operational in October 1986.
The original SSF design considered it not credible that a hot short could occur inside a multi-conductor armored cable that bypassed the actuator torque and limit switches resulting in permanent damage to either the actuator or the valve as a result of a fire-induced hot short. When the Appendix R Safe Shutdown Analysis team performed the safe shutdown analysis in the mid 1980s, this was also the case. When the industry was informed that this phenomenon could fail safe shutdown valves in inappropriate positions through NRC Information Notice 92-18, the Duke response stated that armored cable would not be susceptible to this problem.
Because the normal shutdown cables would be separated from the control circuits when the SSF transfer process was completed, and because "smart hot shorts" were not considered credible during the SSF design, the SSF designers were of the opinion that fire damage to these cables could not cause damage to the motor operated valves.
The decision process to locate the normal shutdown cables in the Turbine Building did not properly consider the timing of a fire, the ability to detect a fire, or the potential to cause (if more space Is required, use addional copies of (If more space Is rquied, use addiTonal copWes of NRC Formn 66A) (17) are protected by fire detection systems.
Duke had previously received an NRC approved exemption from Appendix R requirements for the installation of an operable suppression system1 in the Oconee Control Rooms.
In addition, the Control Rooms are continuously staffed by experienced and trained operators.
Based upon this information, no compensatory actions are required to protect the normal shutdown cables routed to the Equipment Rooms, Cable Rooms and Control Rooms.
The potential for the initiation of a fire in the areas of the Turbine Building through which these cables are routed was conducted by the Oconee Fire Protection Engineer.
The assessment included consideration of various fire ignition sources; flammable and combustible material loading; and the effectiveness of available fire detection, suppression, and extinguishment equipment in the area.
The assessment concluded that the risk of fire in these areas of the Turbine Building is small due to the limited number of fire ignition sources and low flammable/combustible material loading.
The assessment further notes that the probability for early detection of a fire is greatly increased because these areas are routinely and heavily traveled by station personnel who have been trained to immediately notify the Control Room via the emergency phone number upon the detection of any fire.
These areas of the Turbine Building are readily accessible to fire hose streams from several hose reel stations. Once a fire has been detected, it can be suppressed and extinguished using available manual suppression means.
Planned:
1.Continue completion of the Oconee Appendix R Reconstitution Program.
This project should satisfactorily identify and address any remaining issues with the SSF design for Appendix R events.
- 2. Oconee will implement an appropriate permanent resolution to this issue.
Options to be considered include, but are not limited to, installing fire detection/suppression in the area, and/or rerouting the affected cables.
1 Letter from H. R. Denton (NRC) to W. 0. Parker (Duke), dated 2/2/82, Exemption Granted From Requirements of 10CFR50, Appendix R, Item III.G.3, Fixed Suppression System for Oconee Control Rooms (If more space Is required, use additonal copies of (if more space Is reqired, use additoal copies of NRC Form 36A) (17)
These physical attributes of the cable construction would indicate that a fire exposure at any random location along the length of the cable would cause the most outer conductor, closest to the armor sheathing, to have its insulation heated first such that it would make contact.
Once the conductor voltage can overcome the decreased resistance of the decomposing insulating material an electrical short to ground will occur and cause the control power circuitry fuse to fail.
A fuse failure prior to an intra-conductor short would prevent any spurious actuation of the valve's motor contactor.
The predominant cable type for motor operated valve controls at Oconee is PVC insulated, galvanized metallic armor surrounding individual conductors.
PVC insulation has an ignition temperature of 735 degrees Fahrenheit3.
EPR Hyperlon insulated control circuit cables are used for valves 1, 2, 3 HP-3, HP-4, HP-20, RC-4, RC-5 and RC-6.
Insulating material made of EPR Hyperlon has a higher ignition temperature than PVC.
A series of experimental fire tests4 were conducted involving energized electrical circuits using Oconee motor operated valve control circuit cable and circuit design (which include control power transformers that limit available fault current and voltage).
Based upon the test results, demonstrating the robust fire resistance characteristics of the cable, fire induced spurious valve actuations are not expected to occur. One of these experimental tests demonstrated that under conditions of extreme physical abuse (e.g., a right angle bend of the cable in the tray, without limiting current circuit design, conducted under severe exposure to fire) fire induced spurious valve actuation could occur.
Thus, while the probability of fire induced spurious actuation cannot be ruled out, it is not expected to occur under
plant conditions
Based upon the conservatisms in test methodologies, it has been estimated that a period in excess of 30 minutes is required to cause a fault in the Unit 1, 2, 3 HP-3, HP-4, HP-20, RC-4, RC-5 and RC-6 valve control circuit cables.
3 R. J. Budnitz, "Spurious Actuation of Electrical Circuits Due to Cable Fires:
Technical Investigator's Reportsf Future Resources Associates, study managed by EPRI in coordination with NEI 4 Budnitz (if mor space Is reurd use additional copies of NRC Fnn 366A) (17)
Fire brigade drills have been practiced in the areas of the Turbine Building in which these normal shutdown cables are subject to fire damage with response times of less than 20 minutes.
The brief response time allows the fire brigade to get positioned and initiate mitigating actions prior to fires becoming fully developed; therefore it is not expected that these cables will be exposed to the temperature at which cable degradation occurs (threshold temperatures greater than 700 degrees Fahrenheit) for any significant duration.
The Oconee SSF license basis is based upon the fact that Oconee is designed to be able to mitigate the effects of one single spurious actuation following the 10 minutes allowed for SSF activation.
Analysis5 of the risk significance of various sequences involving the routing of normal shutdown cables in the Turbine Building was conducted.
Although a fire without detection could fail a normal shutdown cable in the Turbine Building, analysis determined that each of the scenarios analyzed had the following multiple defense-in-depth features:
- the fire would have to be large enough to damage multiple
- cables,
- spurious operation of the motor operated valves controlled by these cables would have to occur prior to fire detection and manning of the SSF, and
- each of the sequences analyzed had multiple recovery paths to prevent core damage.
For the excess letdown scenario, recovery of Emergency Feed Water [EIIS:BA], or the automatic or manual closure of valve HP-5 will prevent core damage.
For the pressurizer power operated relief valve (PORV) isolation valve scenario, the PORV could reclose or HPI can be recovered to prevent core damage.
These defense-in-depth features result in a low overall risk for this condition.
Considering the low probability of a fire located in the applicable area of the turbine building, the potential for discovery and extinguishment of the fire before cable damage occurs, the relative low probability of a "smart short" damaging a valve rather than causing the control power fuse to fail, and the potential for 5 Calculation: SAAG 774, "Fire PRA for SSF Cable Issue in ONS Turbine Building" (if mor space Ls reqIred, useaddonalcopes of NRCForm 3HA) (17) either automatic or manual isolation using a redundant valve, the risk assessment found the overall impact on core damage frequency to be 1.9E-07/year and large early release frequency to be 3.6E-09/year6.
Therefore, this event is considered to have minimal safety significance with respect to the public health and safety.
ADDITIONAL INFORMATION
There were no releases of radioactive materials, radiation exposures or personnel injuries associated with this event.
This event is not considered reportable under the Equipment Performance and Information Exchange (EPIX) program.
Energy Industry Identification System (EIIS) codes are identified in the text within brackets [].
6 SAAG 774