ML101470607
| ML101470607 | |
| Person / Time | |
|---|---|
| Site: | Prairie Island  |
| Issue date: | 05/27/2010 |
| From: | Khadijah West Division Reactor Projects III |
| To: | Schimmel M Northern States Power Co |
| References | |
| EA-10-070 IR-10-010 | |
| Download: ML101470607 (23) | |
See also: IR 05000282/2010010
Text
UNITED STATES
NUCLEAR REGULATORY COMMISSION
REGION III
2443 WARRENVILLE ROAD, SUITE 210
LISLE, IL 60532-4352
May 27, 2010
Mr. Mark A. Schimmel
Prairie Island Nuclear Generating Plant
Northern States Power Company, Minnesota
1717 Wakonade Drive East
Welch, MN 55089
SUBJECT: PRAIRIE ISLAND NUCLEAR GENERATING PLANT, UNITS 1 AND 2
NRC INSPECTION REPORT 05000282/2010010; 05000306/2010010
PRELIMINARY GREATER THAN GREEN FINDING
Dear Mr. Schimmel:
On May 3, 2010, the U.S. Nuclear Regulatory Commission (NRC) completed an inspection at
your Prairie Island Nuclear Generating Plant, Units 1 and 2. The enclosed report documents
the inspection findings, which were discussed on May 3, 2010, with you and other members of
your staff.
The inspection examined activities conducted under your license as they relate to safety and
compliance with the Commissions rules and regulations and with the conditions of your license.
The inspectors reviewed selected procedures and records, observed activities, and interviewed
personnel.
This report discusses a finding that has preliminarily been determined to be Greater than Green
- a finding of greater than very low safety significance resulting in the need for further evaluation
to determine significance and therefore the need for additional NRC action. As documented in
Section 4OA5 of this report, the emergency diesel generators, the auxiliary feedwater system,
and the safety-related batteries were not protected from a loss of safety function following an
internal flooding event, a licensing basis event, in the Unit 1 or Unit 2 turbine building. This
finding was assessed based on the best available information, including influential assumptions,
using the applicable Significance Determination Process (SDP). The results of the SDP were
determined to be sensitive to several analysis assumptions which could be improved with
additional information. Specifically, the NRC is interested in further refining (1) the population of
high energy line break piping that can realistically interact with cooling water or fire protection
piping, and (2) the likelihood of a consequential pipe failure given that a defined interaction
occurs. For this second item, the NRC is seeking an engineering justification from you
regarding the low or high likelihood of consequential pipe failure.
M. Schimmel -2-
Upon identification of this issue, your staff performed an operability evaluation and determined
that the operability of the safety-related equipment mentioned above could not be assured with
the turbine building roll up doors in the closed position. As a result, a compensatory measure
was established to ensure that the doors were maintained at least 16 inches open such that the
flood waters could flow out the doors. Several other compensatory measures were also
implemented. These compensatory measures would prevent a loss of safety function from
occurring during a turbine building internal flooding event.
This finding is also an apparent violation of NRC requirements and is being considered
for escalated enforcement action in accordance with the NRC Enforcement Policy.
The current Enforcement Policy can be found at the NRCs Web site at
http://www.nrc.gov/reading-rm/doc-collections/enforcement.
In accordance with Inspection Manual Chapter (IMC) 0609, we intend to complete our
evaluation using the best available information and issue our final determination of safety
significance within 90 days of the date of this letter. The SDP encourages an open dialogue
between the staff and the licensee; however, the dialogue should not impact the timeliness of
the staffs final determination.
Before the NRC makes its enforcement decision, we are providing you an opportunity to either:
(1) present to the NRC your perspectives on the facts and assumptions used by the NRC to
arrive at the finding and its significance at a Regulatory Conference, or (2) submit your position
on the finding to the NRC in writing. If you request a Regulatory Conference, it should be held
within 30 days of the receipt of this letter and we encourage you to submit supporting
documentation at least 1 week prior to the conference in an effort to make the conference more
efficient and effective. If a conference is held, it will be open for public observation. The NRC
will also issue a press release to announce the conference. If you decide to submit only a
written response, such submittal should be sent to the NRC within 30 days of the receipt of this
letter. If you decline to request a Regulatory Conference or to submit a written response, you
relinquish your right to appeal the final SDP determination; in that, by not doing either you fail to
meet the appeal requirements stated in the Prerequisite and Limitation Sections of Attachment 2
of IMC 0609.
Please contact John Giessner at (630) 829-9619 in writing within 10 days of the date of this
letter to notify the NRC of your intended response. If we have not heard from you within
10 days, we will continue with our significance determination and enforcement decision. The
final resolution of this matter will be conveyed in separate correspondence.
Since the NRC has not made a final determination in this matter, no Notice of Violation is
being issued for this inspection finding at this time. Please be advised that the number and
characterization of the apparent violation described in the enclosed inspection report may
change as a result of further NRC review.
M. Schimmel -3-
In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its
enclosure will be available electronically for public inspection in the NRC Public Document
Room or from the Publicly Available Records (PARS) component of NRC's document system
(ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the
Public Electronic Reading Room).
Sincerely,
/RA by Gary L. Shear for/
Steven West, Director
Division of Reactor Projects
Docket Nos. 50-282; 50-306
Enclosure: Inspection Report 05000282/2010010; 05000306/2010010
w/Attachment: Supplemental Information
cc w/encl: Distribution via ListServ
U.S. NUCLEAR REGULATORY COMMISSION
REGION III
Docket Nos: 50-282; 50-306
Report No: 05000282/2010010; 05000306/2010010
Licensee: Northern States Power Company, Minnesota
Facility: Prairie Island Nuclear Generating Plant, Units 1 and 2
Location: Welch, MN
Dates: April 29 through May 3, 2010
Inspectors: K. Stoedter, Senior Resident Inspector
P. Zurawski, Resident Inspector
L. Kozak, Senior Reactor Analyst
Approved by: John B. Giessner, Chief
Branch 4
Division of Reactor Projects
Enclosure
TABLE OF CONTENTS
SUMMARY OF FINDINGS .................................................................................................... 1
REPORT DETAILS ................................................................................................................ 2
4. OTHER ACTIVITIES .......................................................................................................... 2
4OA5 Other Activities ............................................................................................ 2
4OA6 Management Meetings .............................................................................. 10
SUPPLEMENTAL INFORMATION ............................................................................................... 1
Key Points of Contact ................................................................................................................... 1
List of Items Opened, Closed and Discussed ............................................................................... 1
List of Documents Reviewed ........................................................................................................ 2
List of Acronyms Used .................................................................................................................. 4
Enclosure
SUMMARY OF FINDINGS
IR 05000282/2010010, 05000306/2010010; 04/29/10 - 05/03/10; Prairie Island Nuclear
Generating Plant, Units 1 and 2; Inspection of turbine building internal flooding vulnerability.
This report covers the review of a design deficiency associated with the failure to protect several
safety-related systems from a loss of safety function following a turbine building internal flooding
event. The inspectors identified one apparent violation (AV) with a preliminary significance of
Greater than Green. The significance of most findings is indicated by their color (Green, White,
Yellow, Red) using Inspection Manual Chapter (IMC) 0609, Significance Determination
Process (SDP). Findings for which the SDP does not apply may be Green or be assigned a
severity level after NRC management review. The NRCs program for overseeing the safe
operation of commercial nuclear power reactors is described in NUREG-1649, Reactor
Oversight Process, Revision 4, dated December 2006.
A. NRC-Identified and Self-Revealed Findings
Cornerstone: Mitigating Systems
- Preliminary Greater than Green. An apparent violation of 10 CFR Part 50, Appendix B,
Criterion III, Design Control, was identified by the inspectors due to the licensees
failure to establish measures to ensure that engineered safety features such as the
emergency diesel generators, the auxiliary feedwater system, and the safety-related
batteries were not adversely affected by events that cause turbine building flooding. As
a result, flooding from these events would cause a loss of safety function for these
systems. This issue was entered into the licensees corrective action program (CAP) as
CAP 1178236. Upon identifying this issue, the licensee implemented compensatory
measures to ensure that the systems listed above were not adversely impacted following
a turbine building internal flood.
This finding was determined to be more than minor because it impacted the design
control and external events attributes of the Mitigating Systems cornerstone. The finding
also impacted the Mitigating Systems cornerstone objective of ensuring the availability,
reliability, and capability of systems that respond to initiating events to prevent
undesirable consequences. The inspectors performed a Phase 1 SDP evaluation and
determined that a Phase 3 evaluation was required because the finding represented a
loss of safety function of multiple mitigating systems. A Phase 2 SDP evaluation was
not performed because the Phase 2 SDP worksheets do not apply to internal flooding
events. The results of the Phase 3 SDP assessment showed that this finding was
potentially Greater than Green. No cross-cutting aspect was assigned to this finding
because licensee decisions made in regard to evaluating the susceptibility of mitigating
systems equipment to turbine building internal flooding events were made more than
3 years ago and therefore, not reflective of current plant performance. (Section 4OA5.1)
B. Licensee-Identified Violations
No violations of significance were identified.
1 Enclosure
REPORT DETAILS
4. OTHER ACTIVITIES
4OA5 Other Activities
.1 (Closed) Unresolved Item 05000282/2009003-01; 05000306/2009003-01: Potential
Turbine Building Flooding Issues
a. Inspection Scope
The inspectors reviewed the circumstances surrounding the licensees failure to protect
the emergency diesel generators, the auxiliary feedwater system and the safety-related
batteries from a loss of safety function following an internal flooding event in the Unit 1 or
Unit 2 turbine building.
b. Findings
Introduction: An apparent violation (AV) of 10 CFR Part 50, Appendix B, Criterion III,
Design Control, was identified by the inspectors due to the licensees failure to
establish measures to ensure that engineered safety features such as the emergency
diesel generators (EDGs), the auxiliary feedwater system and the safety-related
batteries were not adversely affected following a turbine building internal flooding event.
Description: In late 2009, the NRC issued a Green finding for Unit 1 and a White finding
for Unit 2 due to the discovery that a high energy line break (HELB) in the turbine
building could result in a loss of safety function for the component cooling water system.
As part of the extent of condition review for this issue, the licensee identified that a
turbine building HELB could result in the subsequent failure of cooling water piping and
the actuation of fire protection sprinklers such that a large supply of water could be
introduced into the turbine building. This large supply of water could have resulted in an
internal flooding condition that impacted the safety function of the EDGs, the auxiliary
feedwater pumps and the safety-related batteries. The licensee also identified that a
turbine building internal flooding analysis had not been performed. These issues were
documented in corrective action program document (CAP) 1178236 dated April 15,
2009. These issues were also documented as an unresolved item in NRC Inspection
Report 05000282/2009003; 05000306/2009003.
Turbine Building Design
The Unit 1 and Unit 2 turbine buildings at Prairie Island consist of multiple elevations.
The condenser pits (one per unit) were located below grade and had the ability to hold
approximately 750,000 gallons of water. The first floor of the turbine building (commonly
referred to as the 695-foot elevation) was located at grade level. The 695-foot elevation
of the Unit 1 and Unit 2 turbine buildings also provided access to rooms/buildings
containing the EDGs, the auxiliary feedwater system (for both units) and the
safety-related batteries.
2 Enclosure
Design and Licensing Basis Information
The inspectors reviewed the licensees licensing and design bases and found the
following:
On August 3, 1972, the Atomic Energy Commission (AEC) (the former name of the
Nuclear Regulatory Commission) issued a letter to Northern States Power Company
(the licensee) requesting that the Prairie Island plant design be reviewed to determine
whether the failure of any non-seismic-Class I equipment, particularly the circulating
water system, could cause flooding sufficient to adversely affect the performance of
engineered safety systems. The licensee was also required to determine whether the
failure of any equipment could cause flooding such that common mode failure of
redundant safety-related equipment would result.
To address this request, the licensee asked the plants architect engineer, Pioneer
Service and Engineering Company, to review the Prairie Island design. The results of
this review were transmitted from the architect engineer to the licensee on
September 21, 1972. The inspectors reviewed this letter and found that Pioneers
review was focused on the adequacy of the plant design to cope with a failure of the
circulating water system, flooding of the condenser pit, and flooding the turbine building.
The results of this review showed that a failure of the circulating water system would
result in filling the condenser pit in 2.5 minutes. After filling the condenser pit, the
cooling air ducts used to ventilate the D1 and D2 EDG rooms during engine operation
would fill with water causing a loss of safety function. The rate of water level rise on the
695-foot elevation of the turbine building was estimated to be 1 inch every 15 seconds.
Pioneer concluded that the 2.5 minutes available from the time the circulating water
system failed until the water reached the EDG cooling air ducts was sufficient for the
control room to dispatch a non-licensed operator to perform a visual inspection of the
condenser pit, report back to the control room, and manually shut down the circulating
water system.
On September 26, 1972, the licensee received an additional letter from the AEC.
This letter requested that the licensee review the plant design to determine whether
the failure of any non-seismic equipment, particularly in the circulating water and fire
protection systems, could result in a condition, such as flooding or the release of
chemicals, that might potentially adversely affect the performance of safety-related
equipment required for safe shutdown of the facility or to limit the consequences of an
accident. This letter became known as the DeYoung letter.
Northern States Power responded to the DeYoung letter on October 23, 1972. In this
letter, the licensee concluded that where the potential of flooding engineered safety
features exist, the operator is provided with sufficient information and means to take
corrective action in a timely manner. There was no discussion regarding the term
sufficient information or how timely the actions needed to be. However, the inspectors
believed that the time referred to in this letter was the 2.5 minutes discussed in the
September 26, 1972, letter. The licensee further described that level switches located in
the condenser pit would provide a control room alarm to alert operations personnel that
water was accumulating inside the condenser pit. The licensee stated that since all
safety-related mechanical/electrical components are on or above floor elevation 695
when the condenser pit high-high-high water level annunciates, there will still be ample
time for visual operator inspection of the situation and initiation of corrective actions.
3 Enclosure
There is no further danger of loss of safeguards by flooding after shut down of the
circulating water pumps. The licensee concluded their response by stating that any
potential failure of non-Class I equipment does not pose a threat to the overall plant
safety, either by impeding safeguard performance or by causing common mode failure of
redundant safeguard related equipment. No safety evaluation report could be located
to determine whether the AEC viewed the licensees response as adequate.
Conversely, no records could be located to indicate the response was inadequate.
On December 12, 1972, the licensee received a letter from the AEC regarding
postulated steam pipe breaks outside of containment. This letter required that the
Prairie Island Nuclear Generating Plant be designed such that the following statements
were true:
- Failure of any structure, including seismic Class II or Class III structures, caused
by the accident should not cause failure of any other structure, system or
component in a manner to adversely affect the mitigation of the consequences of
the accident and the capability to bring the units to a cold shutdown condition;
- Rupture of a pipe carrying high energy fluid, including a steam line rupture,
should not directly or indirectly result in the loss of required redundancy in any
portion of the protection system, Class 1E electric system, engineered safety
feature equipment, cable penetration, or their interconnecting cables required to
mitigate the consequences of that event and place the reactors in cold shutdown
condition; and
- A discussion should be provided of the potential for flooding safety-related
equipment in the event of failure of a feedwater line or any other high energy
fluid line.
This letter became known as the Giambusso letter. The licensees responses to this
letter appeared to be focused on events occurring in the auxiliary building. There is
currently no information contained in the Updated Safety Analysis Report (USAR)
regarding HELBs in the turbine building.
On January 3, 1986, the licensee sent a letter to the NRC regarding the resolution of
Generic Issue No. 77, Flooding of Safety Equipment Compartments by Backflow
Through Floor Drains. The letter contained the following statement about water flow
in the turbine buildings:
Once the water goes above Elevation 695 - 0 the water storage capacity
increases greatly such that, with the exception of the EDG room cooling air
ducts, it would take about 3 more minutes to reach Elevation 695 - 10 whereby
the flooding would affect safety-related equipment.
To address this statement, the licensee implemented a permanent modification to
ensure that the circulating water pumps tripped due to high water level in the condenser
pit. The inspectors determined that although the EDG room cooling air duct flooding
vulnerability was identified in 1972, the modifications implemented to address this
vulnerability were not installed until 1988 and 1989. The inspectors also found that the
licensee had failed to consider other flooding scenarios (such as HELB induced flooding
4 Enclosure
or flooding due to random pipe breaks) as part of addressing any of the previous letters
sent by the AEC or the NRC.
As discussed above, on April 15, 2009, the licensee initiated a CAP to document that a
turbine building HELB could result in an internal flooding condition that impacted the
safety function of the EDGs, the auxiliary feedwater pumps and the safety-related
batteries. The licensee performed an operability review and determined that operability
of these safety-related systems could not be assured. To remedy this immediate
concern, the licensee opened both turbine building roll up doors to prevent water from
accumulating on the 695-foot elevation of the turbine building if an internal flooding event
occurred.
The same day, the inspectors reviewed the licensees corrective action system to
determine how the licensee had evaluated and addressed industry internal flooding
operating experience (OE) from 2005. The inspectors found that the licensee had
conducted an OE review, determined that the OE was applicable to Prairie Island, and
assigned several actions to evaluate specific portions of the turbine building (including
the battery rooms, the auxiliary feedwater pump room and the EDG rooms). However,
no work had been performed on these reviews as of April 2009. In summary, the
inspectors concluded that the failure to adequately protect the safety related
components from the affects of license basis events was within their ability to foresee
and correct, and is, therefore, a performance deficiency.
Since April 2009, the licensee has initiated additional CAPs and operability evaluations
associated with internal flooding of the Unit 1 or Unit 2 turbine building. The licensee
found that based upon the best available information, the pre-April 2009 plant
configuration was not adequate to ensure that operations personnel could take
appropriate actions following a turbine building internal flood to protect safety-related
equipment prior to the equipment (both trains) being impacted by the flood water. The
licensee took the following actions to ensure that safety-related equipment was
protected:
- The turbine building roll up doors were opened (as the seasons permit) to allow
the flood waters to exit the turbine building;
- The bottom of the roll up doors were modified to allow the doors to stay partially
open during the fall and winter;
- Approximately 18-inch flood walls were constructed to protect the Unit 1 and
Unit 2 EDGs;
- Valve access covers and metal plates on the floor of the auxiliary feedwater
pump room were secured with fasteners to prevent additional water intrusion;
and
- All doors leading from the turbine building into rooms housing safety-related
equipment were inspected. Repairs were made to the door from the Unit 2
turbine building into the safety-related battery room to lessen the rate of water
intrusion into the room.
Analysis: The inspectors determined that the licensees failure to establish measures to
ensure that the EDGs, the auxiliary feedwater system and the safety-related batteries
were protected from a loss of safety function following an internal flood was a
performance deficiency that required an evaluation using the Significance Determination
Process (SDP) described in NRC Inspection Manual Chapter (IMC) 0609. The
5 Enclosure
inspectors also determined that this finding should be assigned to the Mitigating
Systems cornerstone because it impacted systems used in short term and long term
heat removal.
The inspectors performed a Phase 1 SDP analysis and concluded that the finding
represented a loss of safety function of several mitigating systems including the EDGs,
the auxiliary feedwater system and the safety-related batteries (direct current power).
A Phase 2 SDP analysis was not performed because the Phase 2 process was not
applicable for internal flooding scenarios. As a result, the inspectors requested that a
regional senior reactor analyst (SRA) perform a preliminary SDP phase 3 analysis.
The SRA used spreadsheet calculations to estimate the risk from the internal flooding
scenarios affected by this finding. The Standardized Plant Analysis Risk (SPAR) model
for Prairie Island (Revision 3.45) and the Prairie Island Phase 2 SDP worksheets were
used to determine the success criteria for loss of main feedwater events and to
determine system functional requirements for auxiliary feedwater, feed and bleed, and
high pressure recirculation.
The baseline core damage frequency (CDF) for the internal flooding scenarios related to
the performance deficiency was assumed to be much lower than the CDF estimated for
the plant in the pre-April 2009 configuration. Therefore, the CDF calculated in this SDP
Phase 3 analysis was assumed to represent the delta CDF due to the performance
deficiency.
As part of this SDP Phase 3 evaluation, the following three flooding scenarios were
evaluated:
- High Energy Line Break-induced flooding and consequential failure of other
piping;
- Random failure of a cooling water (CL) pipe; and
- Seismically-induced pipe failures.
HELB-induced Flooding and Consequential Failure of Cooling Water Pipe and/or Fire
Protection Piping
The SRA conducted a plant tour to observe piping arrangements and the overall layout
of the Unit 1 and Unit 2 turbine buildings. Plant general arrangement drawings and
piping and instrumentation drawings were also reviewed. Based upon this information,
the SRA assumed that the turbine building HELB could result in the consequential failure
of CL or fire protection system piping such that an unlimited supply of water from the
Mississippi River could be introduced into the turbine building causing an internal flood.
The SRA assumed that the postulated HELB resulted in a loss of main feedwater event.
If the CL and/or fire protection (FP) piping also failed as a consequence of the HELB,
and the CL and/or FP piping was not isolated by the operator, the auxiliary feedwater,
instrument air, high pressure recirculation, and direct current power functions could be
impacted. This would lead to core damage. Information provided by the licensee
showed that if the HELB resulted in the consequential failure of the largest nonsafety-
related CL pipe, the functions listed above could fail in approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> due to the
amount of water flowing into the turbine building. The amount of time available prior to
6 Enclosure
the function failing increased as the amount of water flowing into the turbine building
dropped.
The inspectors and the SRA discussed the postulated HELB and turbine building
flooding sequence of events with operations, engineering and licensee risk personnel.
The inspectors also reviewed operating procedures and simulator training associated
with HELBs and turbine building flooding. The SRA determined that isolating the flood
sources required the operators to diagnose which system(s) were causing the flooding
after the postulated HELB event. If the cause was diagnosed as a CL pipe failure,
actions could be taken in the control room to stop the flow of water from the CL system
using established procedures. If the diagnosis determined that the FP system was also
introducing water into the turbine building due to a pipe break, sprinkler actuation or
deluge system actuation, the operators would need to perform manual actions in the
turbine building or plant screenhouse to stop the flow of water.
To simplify this portion of the SDP Phase 3 analysis, two categories of HELB-induced
flooding events were analyzed. Category 1 was defined as HELB-induced flooding
events that resulted in flow rates greater than 18,000 gallons per minute (gpm) (including
any fire sprinkler flow). Category 2 was defined as HELB-induced flooding events
resulting in flow rates between 10,000 gpm and 18,000 gpm for Unit 1 and between
7800 gpm and 18,000 gpm for Unit 2. These categories were selected after considering
the results of Engineering Change EC 15656, Evaluation of flooding times and flow
rates associated with Unit 1 and Unit 2 TB [turbine building] for significance
determination, and Calculation ENG-ME-759, Gothic Internal Flooding Calculation for
the Turbine Building. These documents showed that a loss of safety function would not
occur if operator action was successful within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for 18,000 gpm floods and within
2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for Unit 1 10,000 gpm floods or Unit 2 7800 gpm floods. The length of HELB
piping that could interact with the CL and FP piping was estimated by the licensee and
resulting CL and/or FP flow rates were calculated. These assumptions were used in this
preliminary SDP evaluation.
The SRA estimated the frequency of HELB events that interact with CL and/or FP piping
by determining the pipe failure frequency for pressurized water reactor feedwater and
condensate piping for Major Flooding using Electric Power Research Institute (EPRI)
Document 1013141, Revision 1, Pipe Rupture Frequencies for Internal Flooding PRAs,
Table A-51, and the pipe lengths provided by the licensee. The HELB pipe was
assumed to interact with a target pipe (the non-safety-related CL and/or FP piping) and
result in the failure of that target pipe.
Due to the complexity of responding to the postulated event, it was assumed that
operator actions required at least 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to detect and isolate the flood source. As a
result, for the largest flood rates, the event could not be mitigated and core damage was
assumed to occur. If the flooding flow rate resulted in the operators having between
1 and 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to respond, a human error probability (HEP) for operator action was
estimated using NUREG/CR-6883, The SPAR-H Human Reliability Analysis Method.
The SRA calculated a HEP associated with failing to isolate flood sources of 0.33
assuming that the actions were performed under high stress, were of moderate
complexity, and consisted of poor ergonomics for both diagnosis and action.
7 Enclosure
Random Failure of Non-safety-Related Cooling Water Piping
A failure of non-safety-related CL piping in the turbine building would initially result in
filling up the condenser pit. When the water in the condenser pit was 5 feet deep, the
circulating water pumps would trip resulting in a subsequent reactor trip. As water from
the broken CL pipe continued to enter the turbine building, it would reach a level where it
would impact the normal feedwater and condensate systems. Depending on the
location and size of the pipe failure, operators may receive low cooling water pressure or
high cooling water flow alarms in the control room. Similar to the HELB scenario,
operators would need to diagnose the source of the flood and identify the failed pipe.
After identification, the flood could be stopped by operator action within the control room.
Similar to the HELB-induced flooding information discussed previously, two categories of
flooding were defined for this event. Category 1 was defined as random CL pipe breaks
that resulted in flooding flow rates greater than 18,000 gpm. The second category was
defined as CL pipe breaks that resulted in flow rates between 12,500 gpm and
18,000 gpm. Flood rates of less than 12,500 gpm would take greater than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to fill
the condenser pit. Operator action to isolate the flood source after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> was assumed
to be reliable. For category 1 events, it was assumed that operators would not be able
to take action to stop the water flow before both trains of mitigating equipment would be
impacted. This was assumed to result in core damage. For the second category it was
assumed that at least 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> was available for operator action.
The pipe failure frequency for Pressurized Water Reactor Service Water - River Water
piping for Major Flooding from EPRI 1013141, Revision 1, Pipe Rupture Frequencies
for Internal Flooding PRAs, Table A-20, was used with the turbine building pipe lengths
of non-safety-related CL piping provided by the licensee to estimate the frequency of
random CL pipe failures that could result in flooding impacts to mitigating systems.
Operator response to this postulated event was assumed to be less complicated than
the response to a HELB-induced consequential failure of CL. For category 2 events, a
HEP for operator action to isolate flooding before mitigating system damage was
estimated to be 0.2. This estimate assumed high stress and poor ergonomics for
diagnosis and high stress for action execution.
Seismically-Induced Failure of Non-safety- Related Turbine Building Piping
A seismic event can result in the failure of one or more non-safety-related pipes resulting
in turbine building flooding. A loss of offsite power event may occur as a result of the
seismic event. Since loss of offsite power was a consequence of the seismic event, the
SRA concluded that the EDG function was required in the SDP evaluation. If flood
sources were not isolated before the EDG function was lost (for Unit 1) or before other
mitigating functions were lost, core damage was assumed.
Using guidance from the Risk Assessment of Operation Events (RASP) handbook,
Volume 2 - External Events, only the Bin 2 seismic events were assumed to represent
a delta CDF. Bin 2 was defined in the RASP handbook as seismic events with
intensities greater then 0.3g but less than 0.5g. Earthquakes of lesser severity were
unlikely to result in large pipe failures and earthquakes of a larger magnitude could result
in major structural damage throughout the plant. The frequency of an earthquake in
Bin 2 was estimated to be 1.4E-5 per year. A high confidence low probability of failure
8 Enclosure
of 0.3g was assigned to the most susceptible component in the non-safety-related
portion of the CL system based on preliminary information obtained by the licensee on
the seismic fragility of CL system components. This value was used to estimate a pipe
failure probability using an average bin acceleration of 0.38g. A 0.5 probability was then
assigned using engineering judgment for the likelihood that the flood was large enough
that operator action was not possible before damage to EDG, auxiliary feedwater, or
direct current power systems occurred. This judgment was based on the conditional
probability of large pipe rupture in large diameter piping in Table 3A-2-2 of the RASP
Handbook, Volume 2.
Preliminary Significance Determination Process Phase 3 Conclusions
The total delta CDF calculated for Unit 1 and Unit 2 was greater than 1E-6 per year,
which was determined to be greater than very low safety significance (Green). The
dominant scenario was a HELB which interacted with non-safety-related CL and/or
FP piping, causing the failure of that pipe and subsequent flooding. In this scenario, the
operator fails to isolate the flooding prior to the flood damaging the auxiliary feedwater,
instrument air and high pressure recirculation functions or prior to the flood damaging
both trains of direct current power. If either of these flood impacts occurred, no
mitigation was available and core damage was assumed.
The results of the SDP were determined to be sensitive to several analysis assumptions
which could be improved with additional information. Specifically, the NRC is interested
in further refining (1) the population of HELB piping that can realistically interact with CL
and FP piping, and (2) the likelihood of a consequential pipe failure given that a defined
interaction occurs. For this second item, the NRC is seeking engineering justification
from the licensee for a low or high likelihood of consequential pipe failure in the identified
pipe interactions rather than a probabilistic estimate of consequential pipe failure.
No cross-cutting aspect was assigned to this finding as the decision regarding the
completion of reviews assigned as part of the OE evaluation were made greater than
3 years ago.
Old Design Issue Review
NRC IMC 0305, Operating Reactor Assessment Program, Section 04.11 defines an
old design issue as an inspection finding involving a past design-related problem in the
engineering calculations or analyses, the associated operating procedure, or installation
of plant equipment that does not reflect a performance deficiency associated with
existing licensee programs, policy, or procedures. Section 12.01(a) of IMC 0305 states
that the NRC may refrain from considering safety significant inspection findings in the
assessment program for a design-related finding in the engineering calculations or
analysis, associated operating procedure, or installation of plant equipment if the
following statements were true:
- The issue was licensee-identified as a result of a voluntary initiative such as a
design basis reconstitution;
- The performance issue was or will be corrected within a reasonable period of
time following identification;
- The issue was not likely to have been previously identified by routine efforts such
as normal surveillance or quality assurance activities; and
9 Enclosure
- The issue does not reflect a current performance deficiency associated with
existing licensee programs, policy or procedures.
The inspectors determined that this issue did not qualify as an old design issue.
Specifically, the issue was not licensee-identified as part of a voluntary initiative. It was
identified as part of an extent of condition review for a previous NRC-identified issue.
Had the licensee taken appropriate actions following their review of the 2005 OE, the
issue would have likely been identified. Lastly, no actions had been taken after
identifying that the plant was susceptible to turbine building flooding in 2005. As a result,
the issue was not corrected within a reasonable period of time.
Enforcement: Title 10 CFR Part 50, Appendix B, Criterion III, Design Control, requires,
in part, that measures be established to assure that applicable regulatory requirements
and the design basis, as defined in Section 50.2, and as specified in the license
application, for those structures, systems and components to which this appendix
applies are correctly translated into specifications, drawings, procedures, and
instructions. Further, Criterion III requires that the design control measures shall provide
for verifying or checking the adequacy of designs.
Title 10 CFR 50.2 defines design basis as that information which identifies the specific
functions to be performed by a structure, system, or component of a facility.
USAR Section 6.1.2.8 states, in part, that internal flooding which could be postulated to
adversely affect the performance of engineered safety features was a part of the original
plant design criteria. As such, the turbine building was designed to have the capacity to
accommodate large internal floods since it takes time to increase the water levels to an
elevation where nuclear safety-related equipment is located.
Section 6.1.1 of the USAR stated that the EDGs, the auxiliary feedwater system, and the
safety-related batteries were engineered safety features of the Prairie Island Nuclear
Generating Plant.
Contrary to the above, prior to January 29, 2010, the licensee failed to establish
measures to assure that the applicable regulatory requirements and the design basis for
the EDGs, the auxiliary feedwater system, and the safety-related batteries were correctly
translated into specifications, drawings, procedures, and instructions. Specifically, the
licensee failed to assure that a turbine building internal flooding event would not
adversely affect the performance of multiple engineered safety features. This is an
apparent violation of 10 CFR Part 50, Appendix B, Criterion III pending the completion of
the final significance determination (AV 05000282/2010010-01; 05000306/2010010-01,
Failure to Ensure Design Measures Were Appropriately Established for the
Emergency Diesel Generator, Auxiliary Feedwater, and Safety-Related Battery
Systems).
4OA6 Management Meetings
.1 Exit Meeting Summary
On May 3, 2010, the inspectors presented the inspection results to M. Schimmel and
other members of the licensee staff. The licensee acknowledged the issues presented.
10 Enclosure
The inspectors confirmed that none of the potential report input discussed was
considered proprietary.
ATTACHMENT: SUPPLEMENTAL INFORMATION
11 Enclosure
SUPPLEMENTAL INFORMATION
KEY POINTS OF CONTACT
Licensee
M. Schimmel, Site Vice President
B. Sawatzke, Director Site Operations
K. Ryan, Plant Manager
J. Anderson, Regulatory Affairs Manager
C. England, Radiation Protection General Supervisor
D. Kettering, Site Engineering Director
J. Lash, Operations Manager
R. Madjerich, Production Planning Manager
M. Milly, Maintenance Manager
J. Muth, Nuclear Oversight Manager
S. Northard, Performance Improvement Manager
K. Peterson, Business Support Manager
J. Sternisha, Training Manager
Nuclear Regulatory Commission
J. Giessner, Chief, Reactor Projects Branch 4
T. Wengert, Project Manager, Office of Nuclear Reactor Regulation
LIST OF ITEMS OPENED, CLOSED AND DISCUSSED
Opened
05000282/2010010-01; AV Failure to Ensure Design Measures Were Appropriately
05000306/2010010-01 Established for the Emergency Diesel Generator, Auxiliary
Feedwater, and Safety-Related Battery Systems
(Section 4OA5.1)
Closed
05000282/2009003-01; URI Potential Turbine Building Flooding Issues05000306/2009003-01
1 Attachment
LIST OF DOCUMENTS REVIEWED
The following is a list of documents reviewed during the inspection. Inclusion on this list does
not imply that the NRC inspectors reviewed the documents in their entirety, but rather, that
selected sections of portions of the documents were evaluated as part of the overall inspection
effort. Inclusion of a document on this list does not imply NRC acceptance of the document or
any part of it, unless this is stated in the body of the inspection report.
Section 4OA5
- 10 CFR 50.59 Screening 3188; OPR 1178239 Compensatory Measures; Revision 0
- 5AWI 8.9.0; Internal Flooding Drainage Control; Revision 4
- 5AWI 8.9.0; Internal Flooding Drainage Control; Revision 4
- Abnormal Operating Procedure 2C3 AOP2; Loss of RCP Seal Cooling; Revision 6
- Abnormal Operating Procedure 2C35 AOP2; Loss of Pumping Capacity or Supply Header
Without SI; Revision 11
- C31 AOP1; Fire Protection Line Break; Revision 0
- C35 AOP2; Loss of Pumping Capacity or Supply Header Without SI; Revision 11
- C47022-0104; Turbine Building Steam Exclusion Actuated; Revision 45
- C47022-0307; Fire Header Lo Pressure; Revision 44
- C47520-0103; Loop A Cooling Water Hi Flow; Revision 32
- C47520-0201; 21 Cooling Water Pump Overload; Revision 32
- C47520-0202; 22 Cooling Water Pump Running; Revision 34
- C47520-0203; Loop A Cooling Water Lo Pressure; Revision 32
- CAP 1178236; No HELB Flooding Calculation for Turbine Building; April 15, 2009
- CAP 1179019; Actions from OEER 888906 Have Not Been Completed; April 21, 2009
- CAP 1179979; Unit 2 Turbine Roll Up Door Found at 14 Inches Open; April 28, 2009
- CAP 1192814; Turbine Building HELB Analysis Not Completed by INPO Date; August 7, 2009
- CAP 1199492; OPR 1174113 Conclusions Not Appropriate for CAP 1199165;
September 24, 2009
- CAP 1202820; Potential Concern Raised for a HELB in the Turbine Building; October 16, 2009
- CAP 1203173; Potential Concern Raised Related to a HELB in the Turbine Building;
October 19, 2009
- CAP 1203370; OPR 1178236-04 Did Not Consider Time to Enter AOP in Evaluation;
October 20, 2009
- CAP 1206060; Potential CL System Unanalyzed Condition During HELB; November 6, 2009
- CAP 1208131; Insufficient Time for Operator Response in Certain Turbine Building HELBs;
November 24, 2009
- CAP 1213357; Potential HELB Pipe Whip Impact on Doors 42 and 43; January 12, 2010
- CAP 1213638; Dumpster in Front of the West Turbine Roll Up Door; January 14, 2010
- CAP 1215137; Forklift Parked in Unit 1 Turbine Building Truck Aisle; January 25, 2010
- CAP 1218454; Cooldown to Cold-Shutdown After a HELB; February 16, 2010
- CAP 781440; Evaluate D1/D2 Compartments for Internal Flooding; November 20, 2004
- CAP 830732; Determine the Effects of Potential Flooding in the Turbine Building; April 8, 2005
- Internal Flooding - Accident Sequence Analysis for Turbine Building Floods; March 2010
- LER 2009-006-00; Unanalyzed Condition Due to Potential Safety System Susceptibility to
Turbine Building Flooding Due to a Postulated High Energy Line Break; December 17, 2009
- Licensing and Design Bases for Prairie Island Nuclear Generating Plant Turbine Building
Internal Flooding; January 29, 2010
- NRC Information Notice 2005-30; Safe Shutdown Potentially Challenged by Unanalyzed
Internal Flooding Events and Inadequate Design; November 7, 2005
2 Attachment
- OPR 1178236-04; Operability of Safety-Related Equipment Following Turbine Building
Flooding; Multiple Revisions
- OPR 1203173-01; Impact of Turbine Building HELB on Auxiliary Feedwater Pump Room Heat
Up; Revisions 0 and 1
- OPR 1206060-01; Evaluation of HELB Induced Flood, Loss of Offsite Power and Single
Failure; Revisions 0 and 1
- PINGP Calculation ENG-ME-586; Effects of Flooding in the AFW Pump Room from a
Postulated Pipe Rupture; Revision 0
- Plant Safety Procedure F9; High Energy Line Break/Leak; Revision 8
- Procedure H36; Plant Flooding; Revision 1
- Significance Determination Input Information for PINGP Turbine Building Internal Flooding;
February 19, 2010
- Simulator Exercise Guide P9110SE-CLHELB-2; High Energy Line Break with Loss of Offsite
Power - Cooling Water and Fire Protection Response; Revision 0
- Special Test Procedure TP 1398; Verify Physical Inputs to Internal Flooding Evaluations;
Revision 1
3 Attachment
LIST OF ACRONYMS USED
ADAMS Agencywide Document Access Management System
AEC Atomic Energy Commission
AV Apparent Violation
CAP Correction Action Program
CDF Core Damage Frequency
CFR Code of Federal Regulations
CL Cooling Water
EDG Emergency Diesel Generator
EPRI Electric Power Research Institute
FP Fire Protection
gpm Gallons Per Minute
HEP Human Error Probability
IMC Inspection Manual Chapter
NRC Nuclear Regulatory Commission
OE Operating Experience
PARS Publicly Available Records System
RASP Risk Assessment of Operational Events
SDP Significance Determination Process
SPAR Standardized Plant Analysis Risk
SRA Senior Reactor Analyst
USAR Updated Safety Analysis Report
4 Attachment
M. Schimmel -3-
In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice," a copy of this letter and its
enclosure will be available electronically for public inspection in the NRC Public Document
Room or from the Publicly Available Records (PARS) component of NRC's document system
(ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the
Public Electronic Reading Room).
Sincerely,
/RA by Gary L. Shear for/
Steven West, Director
Division of Reactor Projects
Docket Nos. 50-282; 50-306
Enclosure: Inspection Report 05000282/2010010; 05000306/2010010
w/Attachment: Supplemental Information
cc w/encl: Distribution via ListServ
DOCUMENT NAME: G:\PRAI\Prai 2010 010.doc
Publicly Available Non-Publicly Available Sensitive Non-Sensitive
To receive a copy of this document, indicate in the concurrence box "C" = Copy without attach/encl
"E" = Copy with attach/encl "N" = No copy
OFFICE RIII RIII RIII NRR OE RIII
NAME JGiessner:dtp LKozak SOrth LJames*via GGulla via SWest
RLerch for on *PPelke for Email from email *GLS for
5/20/2010 GGulla
DATE 05/25/2010 05/20/2010 05/25/2010 05/25/2010 05/25/2010 05/26/2010
JAG
OFFICIAL RECORD COPY
Letter to M. Schimmel from S. West dated May 27, 2010.
SUBJECT: PRAIRIE ISLAND NUCLEAR GENERATING PLANT, UNITS 1 AND 2
NRC INSPECTION REPORT 05000282/2010010; 05000306/2010010
PRELIMINARY GREATER THAN GREEN FINDING
DISTRIBUTION:
Susan Bagley
RidsNrrPMPrairieIsland
RidsNrrDorlLpl3-1 Resource
RidsNrrDirsIrib Resource
Cynthia Pederson
DRPIII
DRSIII
Patricia Buckley
ROPreports Resource
RidsSecyMailCenter Resource
OCADistribution
Bill Borchardt
Bruce Mallett
Roy Zimmerman
James Wiggins
Steve West
Gary Shear
Anne Boland
Kenneth OBrien
Rani Franovitch
Paul Bonnett
Jeff Mitman
Suni Weerakkody
Marvin Itzkowitz
Eric Leeds
Bruce Boger
Daniel Holody
Carolyn Evans
MaryAnn Ashley
Holly Harrington
Hubert Bell
Guy Caputo
Mona Williams
James Lynch
OEMAIL Resource
OEWEB Resource