ML15224A269

Forwards Preliminary ASP Evaluations for Two Plant Events Which Occurred in 1992 Due to Failed Valve & Fuse, Respectively

ML15224A269
Person / Time
Site:	Oconee
Issue date:	06/02/1993
From:	Wiens L Office of Nuclear Reactor Regulation
To:	Hampton J DUKE POWER CO.
References
NUDOCS 9307130195
Download: ML15224A269 (32)

Text

June 2, 1993 Docket Nos. 50-269, 70 DISTRIBUTION and 50-287 Docket Files L.Berry NRC/Local PDRs L.Wiens Mr. J. W. Hampton PDII-3 Reading OGC Vice President, Oconee Site S.Varga ACRS (10)

Duke Power Company G.Lainas P. 0. Box 1439 D.Matthews Seneca, South Carolina 29679 E.Merschoff, RII

SUBJECT:

PRELIMINARY ACCIDENT SEQUENCE PRECURSOR (ASP) ANALYSIS FOR OCONEE EVENTS Enclosed are preliminary ASP evaluations for two Oconee events which occurred in 1992. One event was a reactor trip with emergency feedwater unavailable to one steam generator due to a failed valve, and the other event was the unavailability of emergency power from the Keowee hydrostation due to a failed fuse.

We previously provided, for your information and comment, the preliminary ASP evaluation for the loss of power event which occurred on Oconee Unit 2. Your comments on this event were provided by your letter of March 10, 1993.

Your review and comment on the analyses of these additional two events would be appreciated. In particular, comments on the characterizations of possible plant response given the event occurrence are sought.

We are also interested in comments concerning whether the individual analyses reasonably represent plant safety equipment configurations and capabilities which existed at the time of the events.

Lastly, comments on the analyst's assumptions regarding equipment recovery probabilities are also sought.

As discussed with Mr. Phil North of your staff, we are requesting that your comments be provided by June 25, 1993.

We will review your comments and revise the final ASP analyses as appropriate. If you have questions regarding this matter, contact me at (301) 504-1495.

This requirement affects fewer than ten respondents, and therefore, is not subject to Office of Management and Budget review under P.L.96-511.

Sincerely, ORIGINAL SIGNED BY:

L. A. Wiens, Project Manager Project Directorate 11-3 Division of Reactor Projects -

I/II Office of Nuclear Reactor Regulation

Enclosures:

1. Preliminary ASP Analysis B.9

2. Preliminary ASP Analysis B.10

.cc w/enclosures:

See next page LA:PDII

>P II-3 D

LBerry i~

iens/rst Datthews OFFICIAL RECORD COPY DOCUMENT NAME: G:\\OCONEE\\ASPLTR 9307130195 930602 PDR ADOCK 05000269

Mr. J. W. Hampton Duke Power Company Oconee Nuclear Station cc:

Mr. A. V. Cart' Esquire Mr. M. E. Patrick Duke Power Company 422 South Church Street Comp Charlotte, North Carolina 28242-0001 Oconee Nuclear Site P. 0. Box 1439 J. Michael McGarry, III, Esquire Seneca, South Carolina 29679 Winston and Strawn 1400 L Street, NW.

Mr. Alan R. Herdt, Chief Washington, DC 20005 Project Branch #3 U. S. Nuclear Regulatory Commission Mr. Robert B. Borsum 101 Marietta Street, NW. Suite 2900 Babcock & Wilcox Atlanta, Georgia 30323 Nuclear Power Division Suite 525 Ms. Karen E. Long 1700 Rockville Pike Assistant Attorney General Rockville, Maryland 20852 North Carolina Department of Justice Manager, LIS P. 0. Box 629 NUS Corporation 2650 McCormick Drive, 3rd Floor Clearwater, Florida 34619-1035 Mr. G. A. Copp Licensing -

ECOSO Senior Resident Inspector Duke Power Company U. S. Nuclear Regulatory Commission P. 0. Box 1006 Route 2, Box 610 Charlotte, North Carolina 28201-1006 Seneca, South Carolina 29678 Regional Administrator, Region II U. S. Nuclear Regulatory Commission 101 Marietta Street, NW. Suite 2900 Atlanta, Georgia 30323 Mr. Heyward G. Shealy, Chief Bureau of Radiological Health South Carolinai Department of Health and Environmental Control 2600 Bull Street..

Columbia, South Carolina 29201 Office of Intergovernmental Relations 116 West Jones Street Raleigh, North Carolina 27603 County Supervisor of Oconee County Walhalla, South Carolina 29621

PRELIMINARY B.9 LER Number 269/92-004, 269/92-005 Event

Description:

Reactor Trip with One Emergency Feedwater Pump Inoperable Date of Event:

May 8, 1992 Plant:

Oconee I B.9.1 Summary On May 8, 1992, Oconee tripped from 14% power as a result of a pressure transient in the main feedwater system. On May 27, 1992, it was discovered that one train of emergency feedwater was inoperable and had been inoperable at the time of the trip on May 8. The conditional core damage probability estimated for this event is 9.3 x 10". The relative significance of this event compared to other postulated events at Oconee I is shown in Fig. B. 15.

LER 269/92-004 and -005 1E-7 1E-6 1B-5 1E-4 1E-3 1E-2 L360h EP precursor cutoff --

• L 360 hAFW LOFW + 1 LOOP MTR AFW Fig. B.15.

Relative event significance of LERs 269/92-004 and -005 compared with other Clavert Cliffs 1 potential events.

B.9.2 Event Description With Oconee at 14% power, draining of the condenser hotwell was in progress during a plant startup on May 8, 1992. Because of the low power level, only one main feedwater (MFW) pump-the IB MFW pump-was required; the 1A MFW pump was idle. When the operator opened the condensate dump line (from the condensate system to the condensate storage tank) to drain the condenser, the decreased flow to the feedwater pumps caused a plant trip on low MFW pump discharge pressure. Following the trip, LER NO: 269/92-004, -005 B-68 PRELIMINARY

PRELIMINARY the emergency feedwater (EFW) system actuated, and the lB MFW pump continued to run.

After verifying that the IB MFW pump was running, the operator manually shut down both the 1A and IB EFW pumps. The two motor-driven EFW pumps had run for 43 s. The turbine-driven EFW pump did not start because the start signal was not present for greater than 15 s. The remainder of the post-trip recovery was uneventful.

Between May 12 and May 24, 1992, the plarit operated at 100% power. On May 24 the plant was shut down to repair a reactor coolant pump seal.

On May 27, 1992, with the plant in hot standby, the quarterly stroke test procedure was conducted on the "A" steam generator (SG) EFW control valve. The test revealed that the solenoid valve for enabling automatic control of the "A" SG EFW control valve had failed. A review of the post-trip data for the May 8, 1992, event revealed that the "A" EFW train had exhibited no flow during the event. The valve had last been successfully tested on September 22, 1991.

B.9.3 Additional Event-Related Information The condensate pumps, condensate booster pumps, and MFW pumps are arranged in series to provide the SGs with water from the condenser hotwell and secondary side drains. The condensate dump line to the condensate storage tank branches off between the condensate booster pumps and the MFW pumps.

The EFW system consists of three pumps: two motor-driven and one turbine-driven. The pumps start on loss of the MFW pumps as indicated 'by Tow discharge pressure or loss of hydraulic pressure oil pressure on both MFW pumps. If the start signal clears within 15 s, the turbine-driven EFW pump will reset. The three pumps discharge into two lines, each of which is connected to a SG. The "A" SG EFW flow control valve automatically vari-s itspositiorto brifng the "A" SG level to a predetermined setpoint following a reactor trip. Failure of the automatic control portion of the system does not prevent manual control of the valve.

B.9.4 Modeling Assumptions This event was modeled as a reactor trip with one of two EFW trains inoperable. The model normally utilizes pump status for input, and as a result, the existing EFW model is a 1 of 3 system.. This was modified to a 1 of 2 system, since the component that failed is one of two EFW lines to the SGs. The nonrecovery estimate for the EFW system was set to 0.26 because the failed valve could be controlled manually and recovery of the failure from the control room was possible.

B.9.5 Analysis Results The conditional probability of core damage estimated for this event is 9.3 x 10-6. The dominant core damage sequence, highlighted on the event tree in Fig. B. 16, involves a failure of EFW, MFW and primary system feed and bleed.

LER NO: 269/92-004, -005 B-69 PRELIMINARY

PRELIMINARY RT AFW MFW PORV/

PORV SEQ END TRANS AW UW SRV SRV HPI HPR_

OE CHAL RESEAT-OPEN NO STATE OK OK 11 CD 12 CD OK OK OK 13 CD 14 CD OK OK 15 CD 16 CD 17 CD 18 ATWS Fig. B.16.

Dominant core damage sequence for LERs 269/92-004 and -005.

LER NO: 269/92-004, -005 B-70 PRELIMINARY

PRELIMINARY CONDITIONAL CORE DAMAGE PROBABILITY CALCULATIONS Event Identifier: 269/92-004,005 Event

Description:

Trip with one train of EFW inoperable Event Date:

05/08/92 Plant:

Oconee 1 INITIATING EVENT NON-RECOVERABLE INITIATING EVENT PROBABILITIES TRANS 1.0E+00 SEQUENCE CONDITIONAL PROBABILITY SUMS End State/Initiator Probability CD TRANS 9.3E-06 Total 9.3E-06 ATUS TRANS 3.4E-05 Total 3.4E-05 SEQUENCE CONDITIONAL PROBABILITIES (PROBABILITY ORDER)

Sequence End State Prob N Reck*

17 trans -rt AFW mfw, hpi(f/b)

CD 8.4E-06 3.4E-02 16 trans -rt AFU mfw -hpi(f/b) hpr/-hpi CD 9.3E-07 4.1E-02 18 trans rt ATWS 3.4E-05 1.2E-01 non-recovery credit for edited case SEQUENCE CONDITIONAL PROBABILITIES (SEQUENCE ORDER)

Sequence End State Prob N Rec**

16 trans -rt AFU mfw *hpi(f/b) hpr/-hpi CD 9.3E-07 4.1E-02 17 trans *rt AFU mfw hpi(f/b)

CD 8.4E-06 3.4E-02 18 trans rt ATS 3.4E-05 1.2E-01

• non-recovery credit for edited case SEQUCE MODEL:

c:1asppra\\models\\pwrdseatcap.

BRANCH MODEL:

c:\\asppra\\models\\oconeel.st1 PROBABILITY FILE:

c:\\esppra\\models\\pwrbsl1.pro No Recovery Limit BRANCH FREQUENCIES/PROBABILITIES Branch System Non-Recov Opr Fail trans 6.4E-05 1,0E400 Event Identifier: 269/92-004, -005 LER NO: 269/92-004, -005 B-71 PRELIMINARY

PRELIMINARY L

oop 1.6E -05 2.48-01 loca 2.4E-06 4.3E-01 rt 2.8E-04 1.2E-01 rtltoop 0.08.00 1.08.00 emerg.power 2.9E-03 8.08-01 ANU 3.8E8-04 1>1 1.08-01 2.6E-01 >1.2E-01 Branch Modet: 1.OF.3+ser Train 1 Cond Prob:

2.OE-02 > Failed Train 2 Cord Prob:

1.08-01 >Failed Train 3 Cond Prob:

5.08-02 > 1.08-01 Seril Coffponent Prob:

2.&E-04 afw/emrg.p4.ee 5.08-02 3.4E-01 infw 2.08-01 3.4E-01 porv.or.srv.chatt 8.08-02 1.08*00 porv.oz-.srv.reseat I.OE-02 1.18-02 porv.or.srv.reseatemrg.power 1.08-02 1.08400 seat:Aoca 0.OE.00 1.08400 ep.rec(st) 0.06+00 1.08+00 ep. rec 4.5E-01 1.OE+00 hpi 3.08-04 8.4E-01 hpi (f/b) 3.OE-04 8.4E-01 1.08-02 hpr/-hpi 1.5E-04 1.08.00 1.08-03

• branch model file.

Sforced Event Identif tar: :26992.004,05 LER NO: 269/92-004, -005 B-72 PRELIMIENARY

PRELIMINARY LICENSEE EVENT REPORT (LER)

FACILITY NAME: Oconee Nuclear Station, Unit 1 DOCKET NO: 269 TITLE:

Reactor Trip Results From Low Main Feedwater Pump. Discharge Pressure Due to Management Deficiency EVENT DATE: 05/08/92 LER #: 92-004-00 REPORT DATE: 06/08/92 OTHER FACILITIES INVOLVED:

DOCKET NO: 05000 OPERATING MODE: N POWER LEVEL: 14 THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR SECTION:

50.73(a)(2)(iv)

LICENSEE CONTACT FOR THIS LER:

S. G. Benesole, Safety Review Manager TELEPHONE: (803) 885-3518 COMPONENT FAILURE DESCRIPTION:

CAUSE: F SYSTEM: SJ COMPONENT: PSP MANUFACTURER:

XOOO REPORTABLE NPRDS: Yes SUPPLEMENTAL REPORT EXPECTED: No ABSTRACT:

On May 8, 1992 at 0342:16 hours, unit I reactor tripped from 14 percent full power on a Reactor Protective System anticipatory trip signal due to low discharge pressure on the Main Feedwater Pump (MFDWP). The low discharge pressure occurred when operators were attempting to decrease a high hotwell level, which diverted flow from the suction of the MFDWP. After the trip, the Emergency Feedwater (EFDW) System actuated due to the low MFDWP discharge pressure. Once the MFDWP was verified to be operating, the EFDW Pumps were secured-.The two root-causes identified for this event were management deficiency, less than adequate training given and lack of a task specific procedure.

Corrective actions include Operator training to inform Operators of the hotwell level oscillations, correct methods of reducing hotwell level, and development of a task specific procedure.

BACKGROUND The main condenser is designed to condense turbine exhaust steam for reuse in the steam cycle. The main condenser also serves as a collecting point for various steam cycle vents and drains to conserve condensate which is stored in the hotwell. The hotwell has an emergency high level alarm (72 inches),

High level alarm (69 inches), Low level alarm (57 inches), and Emergency low level alarm (10 inches).

The condenser also serves as a heat sink for the Turbine Bypass Valves (TBVs) [EIIS:SO] which are capable of passing 25 percent of rated main steam flow.

LER NO: 269/92-004, -005 B-73 PRELIMINARY

PRELIMINARY The TBVs are designed to dump Main Steam [EIIS:SB] load directly to the main condenser during startup and shutdown operation, thereby creating an artificial load on the reactor.

The Condensate Steam Air Ejectors (CSAEs) remove air and noncondensable gasses from the main condenser to maintain proper Condenser vacuum. The Condensate System [EIIS:SDJ originates at the condenser hotweil. --The Hotwell Pumps and-Condensate Booster Pumps-increase -system pressure to that required for the Main Feedwater Pump (MFDWP) net positive suction head. The Upper Surge Tank provides a surge volume for the Condensate System. (See Attachment 1)

The MFDWP increases the Feedwater System [EIIS:SJ] pressure to provide adequate feeding of the Steam Generators.

The Reactor Protective System (RPS) [EIIS:JC] consists of four identical protective channels, each terminating in a trip relay within a reactor trip module. The coincidence logic in all reactor trip modules actuate when any two of the four protective channels trip. The RPS monitors Reactor Coolant System (RCS) [EIIS:AB] parameters related to safe operation and trips the reactor to protect against fuel rod cladding damage. It also assists in protecting against exceeding RCS pressure limits by providing an anticipatory trip on low MFDWP discharge pressure.

The Emergency Feedwater [EIIS:BA] will actuate on loss of both Main Feedwater Pumps (MFDWPs).

The actual initiating conditions are low discharge pressure (<800 psig) on both MFDWPs or low of hydraulic oil-pressure on both MFDWPs.-- MFDWPs -will -trip on-high-discharge pressure. The Auxiliary steam System [EIIS:SA] consists -of a -header-which is supplied-by Main Steam and each-unit's header is normally cross-connected to the other units. When a unit is starting up the Auxiliary Steam header is normally supplied by another units-main-.steam-to-supply-various steam loads.

EVENT DESCRIPTION On May 7, 1992 at 2330 hours0.027 days <br />0.647 hours <br />0.00385 weeks <br />8.86565e-4 months <br />, Unit I was at Hot Shutdown following a unit trip due to a Generator Lockout. The Hotwell Level -was observed-at-67 inches by the Control-Room operator (CRO). The CRO identified this to the Control Room Senior Reactor Operator(CR SRO).

At 0145 hours0.00168 days <br />0.0403 hours <br />2.397487e-4 weeks <br />5.51725e-5 months <br /> on May 8, 1992, Unit I was returned to criticality.

Reactor Power was increasing and the Condensate and Feedwater Systems were aligned utilizing IB Main Feedwater Pump (MFDWP) to maintain minimum Steam Generator level. All steam being produced was bypassing the Main Turbine [EIIS:TA] via the Turbine Bypass Valves to the condenser.

Unit l's Auxiliary Steam header, being supplied -by another unit, was supplying steam to the Condensate Steam Air Ejectors (CSAEs), 'E' Heaters, MFDWP and various-steam seals and exhausting into Unit I's condenser.

LER NO: 269/92-004, -005 B-74 PRELIMINARY

PRELIMINARY At 0325 hours0.00376 days <br />0.0903 hours <br />5.373677e-4 weeks <br />1.236625e-4 months <br />, the hotwell high level alarm (setpoint 72 inches) was received. The hotwell level was fluctuating between 73 and 78 inches, and trending upward. The CRO reviewed the Alarm Response Manual to determine the appropriate actions to be taken.

The CR SRO and Shift Manager were concerned with the possibility of flooding the CSAEs suction lines due to high hotwell level.

At approximately 0330 hours0.00382 days <br />0.0917 hours <br />5.456349e-4 weeks <br />1.25565e-4 months <br />, the Shift Supervisor was notified of the high hotwell level by the CR SRO.

The CR SRO, Shift Manager, and Shift supervisor discussed the need and the method to reduce the hotwell level.

At 0340 hours0.00394 days <br />0.0944 hours <br />5.621693e-4 weeks <br />1.2937e-4 months <br />, the CR SRO, Shift Manager, and Shift Supervisor decided on a method to reduce hotwell level, which only involved opening two valves in the Condensate System. This included opening IC-124 (Condensate Recirc to Upper Surge Tank) and then opening IC-128 (Condensate Recirc Control) to divert condensate to the Upper Surge Tank and then to the Condensate Storage Tank. After completing this lineup it would be transferred to another unit. The CR SRO stated that he had reduced hotwell level using this method on other occasions. The CR SRO stated that actions in the Alarm Response Manual would not solve the high level, because the Alarm Response procedure (ISA6/C-12) did not address the unit's specific operating condition.

At approximately 0342 hours0.00396 days <br />0.095 hours <br />5.654762e-4 weeks <br />1.30131e-4 months <br />, the CR SRO told CRO to verify that IC-128 (Condensate Recirc Control) was in the closed position. After verifying IC-128 closed, the CR SRO instructed the RO to open 10-124.. Upon opening IC-124, IB MFWDP discharge pressure decreased to approximately 800 psig, causing Reactor Protective System Chaninels A, B, C, and D Feed water Pump Anticipatory Trip to initiate a Reactor and Main Turbine Trip at 0342' 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />. The CRO immediately closed IC-124.

At 0342:23 hours, lA and lB MotorDrien Einergency Feed water Pumps (MDEFDWPs) started on low Feedwater Pump discharge pressure. IB MFDWP did not trip and the CRO secured the MDEFDWPs at 0343:06 hours, after verifying proper operation of the IB MFDWP. All full length control rods

[EIIS:ROD] fully inserted into the core and the reactor was shutdown.

Following the reactor trip, the Reactor Coolant Sygem (RCS average temperature decreased from 580 degrees F to approximately 555 degrees F. RCS pressure decreased from approximately 2145 psig to 1985 psig. Pressure then slowly increased to 2130 psig. Pressurizer [EIIS:VSL] level reached a minimum of 136 inches and stabilized at approximately 150 inches. Steam Generator (SGs) pressures increased to a maximum of 1009 psig and then decreased to a minimum of 892 psig on both A and B SGs before leveling off at approximately 1000 psig.

SGs levels decreased to a minimum of 18 inches for approximately 14 seconds on both SGs before the 25 inch post trip setpoint was maintained.

During a routine inspection of equipment on May 8, 1992 at 0730 hours0.00845 days <br />0.203 hours <br />0.00121 weeks <br />2.77765e-4 months <br />, a leak was discovered on the impulse line connected to the IA MFDWP suction line.

LER NO: -269/92-04, -005 B-75 PRELIMINARY

PRELIMINARY CONCLUSIONS The root cause of this event is Management Deficiency, lack of 'task specific' procedure and less than adequate training given. When the Emergency High Hotwell (HW) level alarm was received the Alarm Response Manual was referenced. It was determined by Operations personnel that the Alarm Response Manual did not provide the proper guidance to reduce HW level during this condition. Operators were concerned with the HW level trending upward and extending past the level instrumentation range (0 to 7 feet) and flooding the suction line of the Condensate Steam Air Ejectors. The Operators felt a need to reduce HW level, realizing they would be at this power level for two hours, because they were waiting for the completion of shell warming of the Main Turbine [EIIS:TA]. A decision was made to divert a portion of Condensate flow to the Upper Surge Tank (UST) and then to the Condensate Storage Tank, where it could be pumped to another unit. The volume between IC-124 and IC-128 is large. The Operators were not aware that there was significant voiding in the piping. Upon opening IC-124 the void in the piping was filled, reducing the suction pressure of the Main Feedwater Pump, thus decreasing the pump discharge pressure. The flow path utilized by the Operators to lower HW level was performed because of a lack of understanding on the proper method to reduce HW level. Additionally a procedure did not exist to reduce HW level under this operating condition.

Response of the primary system to the trip was normal. Reactor Coolant System inventory, pressure, and temperatures were all maintained within the normal post-trip range. The immediate response of the secondary system was also normal. Both steam generators' pressure and level were maintained at or near their proper -setpoints. A review-of events-over the last-two years, indicates that this is not a recurring problem.

The leak discovered on the impulseline-(l/2-inch,-carbon-steel, ASTM A106, grade B, seamless, schedule 40) for the IA Main Feedwater Pump was corrected under work request 37321C by replacing the damaged section with a new section of piping. The probable cause of the failure was due to the pressure surge during the Feedwater transient. Engineering is currently evaluating the cause of the piping material failure. A search for the piping material manufacturer was performed and the manufacturer could not be determined. This piping-is-Duke Class G (Non-Safety)-and was installed during the initial construction of the plant.

The equipment failure of lA Main Feedwater Pump suction line instrumentation piping is NPRDS reportable. The manufacturer and Model number for this material is unknown. There was no release of radioactive material or exposure to radiation involved.

This event did not involve any personnel injuries.

CORRECTIVE ACTIONS Immediate

1. The CRO Closed IC-124 LER NO: 269/92-004, -005 B-76 PRELIMINARY

PRELIMINARY

2.

Operations personnel took appropriate actions per the Emergency Operating Procedure to bring the unit to stable conditions.

Subsequent

1. Enclosure 3.22 (Control of High Hotwell Level) was added to OP/O/A/ 1106/02 (Condensate and Feedwater System) to reduce high Hotwell level.

2.

The Alarm Response Manual for Hotwell Level Emergency High Statalarm ( ISA6 / C-12) was revised to reference OP/0/A/1 106/02 (Condensate and Feedwater System) enclosure 3.22 (Control of High Hotwell Level).

Planned

1. Operator training will be conducted to inform Operators of the Hotwell level oscillations and the correct method of reducing Hotwell level.

SAFETY ANALYSIS Low Main Feedwater Pump (MFDWP) discharge pressure is an anticipated transient and is described in section 10.4 of the Final Safety Analysis Report. Low MFDWP discharge initiates a reactor trip and starts the Emergency Feedwater (EFDW) System to provide deciy beat removal. In this event all the systems and equipment operated as designed to mitigate the consequences of low MFDWP discharge pressure. Instrumentation detected the low MFDWP discharge pressure, initiated the Main Turbine and Reactor trips, and provided the statsignatil fEFDW Systeif. Both Motor Driven Emergency Feedwater Pumps (MDEFDWPs) started as required. The MFDWP did not trip, after verifying proper operation of MFDWP the Operators secured the MDEFDWPs.

The health and safety of the public was not compromised by this event.

Figure "Duke Power Company, Attachment 1, Condensate System Arrangement" omitted.

LER NO: 269/92-004, -005 B-77 PRELIMINARY

PRELIMINARY LICENSEE EVENT REPORT (LER)

FACILITY NAME: Oconee Nuclear Station, Unit 1 DOCKET NO: 269 TITLE:

Equipment Failure and Defective Procedure Result In Operation In Violation of Technical Specification EVENT DATE: 05/10/92 LER #: 92-005-00 REPORT DATE: 07/09/92 OTHER FACILITIES INVOLVED:

DOCKET NO: 05000 OPERATING MODE: N POWER LEVEL: -0 THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR SECTION:

50.73(a)(2)(i)(B)

LICENSEE CONTACT FOR THIS LER:

S. G. Benesole, Safety Review Manager TELEPHONE: (803) 885-3518 COMPONENT FAILURE DESCRIPTION:

CAUSE: F SYSTEM: BA COMPONENT: XCV MANUFACIURER* V030 REPORTABLE NPRDS: Yes SUPPLEMENTAL REPORT EXPECTED: No ABSTRACT:

On May 8, 1992, at 0342 hours0.00396 days <br />0.095 hours <br />5.654762e-4 weeks <br />1.30131e-4 months <br />, Unit I tripped from 14% full power and Emergency Feedwater (EFDW) actuated. The Main Feedwater pump did not trip and the operators secured the Motor Driven EFDW pumps.

The Post-Trip Review, Reactor Transient Analysis, and the subsequent Licensee Event Report did not identify the fact that flow did not exist in the EFDW-train--A that contains control valve (lFDW-315).

Technical Specifications require two flow paths to be operable when the unit is above 250 F. Seventeen days after the reactor was heated above 250 F the control valve (1FDW-315) was discovered to be inoperable, in the automatic mode, when a periodic stroke test was performed. Therefore, Unit I had operated outside of Technical Specification requirements.

There were two root causes for this event: Equipment Failure and Defective Procedure, Technical Deficiency.. Corrective Actions. include replacing the solenoid valve and revising the Post Trip Review Directive.

BACKGROUND The purpose of the Emergency Feedwater (EFDW) [EIIS:BA] system is to remove decay heat and Reactor Coolant Pump heat following a loss of Main Feedwater (MFDW) [EIIS:SJ]. Three EFDW LER NO: 269/92-004, -005 B-78 PRELIMINARY

PRELIMINARY pumps are provided for each unit. Two motor driven pumps are powered by emergency AC power while the turbine driven pump is aligned to Main Steam [EIIS:SB] or Auxiliary Steam [EIIS:SAI. Each unit's EFDW system is designed to supply feedwater to the Steam Generators (SG) in the event MFDW is lost.

There are three systems at Oconee which are designed to automatically actuate when the setpoints of low MFDW pump-hydraulic oil pressure and/or MFDW pump discharge header-pressure are reached on both MFDW pumps. The systems are the EFDW system, the Reactor Protective System (RPS) [EIIS:JC] and the Anticipated Transient Without Scram (ATWS) Mitigation System Actuation Circuitry (AMSAC).

Each of these systems use diverse means to determine when MFDW has been lost. Each system actuates when signals are received that both MFDW pumps can no longer provide feedwater to the SGs. The EFDW system (all 3 pumps) will start automatically upon loss of both MFDW pumps (indicated by low MFDW pump turbine hydraulic control oil pressure of 75 psig and/or low MFDW pump discharge header pressure of 800 psig decreasing).

This actuation will also enable a circuit which controls SG level

[EIIS:JB] at predetermined setpoints (30 inches on. the start-up range with Reactor Coolant Pumps in operation).

The loss of MFDW provides a signal to the RPS as an anticipatory trip that trips the Reactor prior to Reactor Coolant System [EIIS:AB] parameters reaching their own trip setpoints. The pressure switches and/or AMSAC initiates the start of the EFDW pump turbine. If the start signal clears (i.e. MFDW pump discharge pressure increases above 800 psig) within 15 seconds +/- 1 second, the EFDW pump turbine will reset. The AMSAC signal will initiate the two Motor Driven EFDW pumps and trip the main turbine if it is on line.

EFDW control valve 1FDW-315 is a pneumatically-operated valve that regulates the flow of EFDW to SG A, for control of thewaterleveL. The125VDC,J.three-way solenoid valve IFDW SVO200 selects whether control of IFDW-315 will be manual or automatic.

Technical Specification 3.4 requires two EFDW flow paths to be operable when the reactor is heated above 250 F. The flow path is defined in the Technical Specification Bases as: The flow path to either steam generator including associated valves and piping capable of being supplied by either the turbine driven or the associated motor driven-pump:. Additionally, the-EFDW system is designed to start automatically upon receiving an initiating signal.

EVENT DESCRIFTION On May 8, 1992, at 0145 hours0.00168 days <br />0.0403 hours <br />2.397487e-4 weeks <br />5.51725e-5 months <br />, the Unit 1 Reactor was critical and preparations were being made to increase Reactor power and place the Electrical Generator [EIIS:EL} on line,- following a previous Reactor trip (which was reported, in LER 269/92-03).

At 0325 hours0.00376 days <br />0.0903 hours <br />5.373677e-4 weeks <br />1.236625e-4 months <br />, with the Reactor at 14% full power and the B Main Feedwater (MFDW) pump in service, problems were encountered with high Hotwell [EIIS:KA] level. While trying to lower the level in the Hotwell, the Reactor and Main Turbine [EIIS:TA) tripped at 0342:23 hours due to a feedwater transient.

This event was reported in LER 269/92-04.

LER NO: 269/92-04, -005 B-79 PRELIMINARY

PRELIMINARY At 0342:23 hours, the A and B Motor Driven Emergency Feedwater Pumps (MDEFDWPs) started on a low Main Feedwater Pump (MFDWP) discharge pressure. The B MFDWP did not trip and Control Room Operator A (CRO-A) secured the MDEFDWPs at 0343:06 hours, after verifying proper operation of the B MFDWP. CRO-A stated that he also verified the Steam Generator levels were being controlled by the B MFDWP.

CRO-A did not observe or verify flow through the two trains of Emergency Feedwater (EFDW). The Emergency Operating Procedure does not require the CRO to verify EFDW flow unless there is a loss of MFDW.

A Post-Trip Review Report was completed on May 8, 1992 by Shift Manager (SM) A, with assistance from SM-B, the Engineering Supervisor and the duty Reactor Engineer.

SM-A noted in the Plant Response section of the report that the MFDWP trip signal had not occurred but the MDEFDWP A and B had started. The MDEFDWP start signal was from low MFDWP discharge pressure. The start and stop times for each pump were recorded. The Turbine Driven Emergency Feedwater Pump (TDEFWP) initiated, but the MFDWP discharge pressure went above the setpoint-before the 15 second seal-in timed out. This satisfied the logic for the TDEFDWP. SM-A stated that, during his review, the failure of the TDEFDWP to start was questioned and verified to be the correct response.

On May 10, 1992, at 1509 hours0.0175 days <br />0.419 hours <br />0.0025 weeks <br />5.741745e-4 months <br />, the Reactor Coolant System (RCS) temperature was increased to 325 F.

The Reactor was critical at 1517 hours0.0176 days <br />0.421 hours <br />0.00251 weeks <br />5.772185e-4 months <br /> on May 11, 1992. On May 12, 1992 at 1827 hours0.0211 days <br />0.508 hours <br />0.00302 weeks <br />6.951735e-4 months <br /> the Unit reached 100% Full Power. The Unit continued to operate at 100% Full Power until May 24, 1992, at 2010 hours0.0233 days <br />0.558 hours <br />0.00332 weeks <br />7.64805e-4 months <br />, when a Reactor power reduction was begun to repair the 1A2 Reactor Coolant Pump Seals.

The-Reactor was shutdown at 0438 hours0.00507 days <br />0.122 hours <br />7.242063e-4 weeks <br />1.66659e-4 months <br />, on May 25, 1992. The RCS was cooled to < 250 F by 2040 hours0.0236 days <br />0.567 hours <br />0.00337 weeks <br />7.7622e-4 months <br />.

On May 27, 1992, Performance Technicians performed the IFDW-315 and IFDW-316 Stroke Test procedure (PT/1/A/0150/22M). The test is performed on a "Quarterly at Cold Shutdown" frequency to determine operability of the automatic function of 1FDW-315 (Steam Generator A EFDW Control Valve) and IFDW-316 (Steam Generator B EFDW Control Valve).

The IFDW-316 valve stroke times were in the acceptable range but the IFDW-315 valve failed to operate. A work request was issued to investigate and repair IFDW-315 valve. Investigations by the Instrument and Electrical (IAE) Technicians revealed that the solenoid valve used for enabling the automatic functioning of IFDW-315 had failed.

The failures are due to the valve being energized continually, resulting in overheating and binding. This causes the control valve (FDW-315) to be inoperable in the automatic mode. This was also identified in LER 287/91-07.

On May 30, 1992, Station Management discussed the need and intent to review the Post Trip data with respect to IFDW-315. On June 1, 1992 the solenoid valve (ISV-200) was replaced with a newer model valve as directed by the previous commitment (LER 287/91-07) due to failure of the original solenoid valve.

LER NO: 269/92-004, -005 B-80 PRELIMINARY

PRELIMINARY On June 2, 1992, the stroke test (PT/1/A/0150/22M) was performed on IFDW-315 valve after the solenoid valve (ISV-200) had been replaced. The valve operated and stroke times were in the acceptable range. The IAE Section issued a Problem Report on June 4, 1992 for identification of IFDW-315 not working in automatic. This was to document the fact that this was a repetitive failure.

The Reactor Trip (LER 269/92-04), reporting the May 8, 1992 Reactor-trip, was approved and sent to.

the Nuclear Regulatory Commission on June 8, 1992.

On June 11, 1992, the Safety Review Section held discussions and reviewed data with the Reactor Engineering Group concerning the EFDW actuation, following the Unit trip of May 8, 1992. It was noted that the A EFDW train had exhibited no flow. From a more detailed review of existing Transient Monitor information, it was determined that IFDW-315 valve had not opened.

The last time the 1FDW-315 valve stroke test-was -performed satisfactorily was September 22,1991, during a refueling shutdown.

CONCLUSIONS There were two root causes associated with this event: Equipment Failure and Defective Procedure, Incomplete Information. Technical Specification 3.4.1.b requires two flow paths to be operable when the reactor is heated above 250 F. The reactor operated at power for 15 days with one flow path inoperable-in-the automatic mode.----

The root cause of Equipment Failure was due to the failure of ISV-200. This is similar to the event documented in LER 287/91-07..The-valves-in-Unit-2-have-been-replaced.

The-valves in Units 1 and 3 are scheduled to be replaced during the next refueling outages. The solenoid valve failure is NPRDS reportable. The valve is a Valcor V-70900-21-3, Serial Number 1495. This root cause is considered recurring.

The root cause of the failure to--identify that one-Emergency -Feedwater (EFDW) flow path was inoperable, is Defective Procedure, Technical Deficiency. If the Post Trip Review had explicitly required the verification of EFDW flow in each train this event could have been prevented. The fact that no flow was present in the SG A EFDW train could have been verified by a more detailed review of the transient monitor charts. Since this was not observed in the Post Trip Review, the approval to restart was made and the Unit was heated above the temperature that EFDW is required to be operable.

The safety systems which respond to a loss of Main Feedwater (MFDW) receive automatic actuation from the presence of a low MFDW pump discharge header pressure (800 psig) or low MFDW pump hydraulic oil pressure (75 psig) signal-. The-A MFDW-pump-was-off -and the B MFDW'pu mp -was supplying the feedwater to the Steam Generators (SG) at the time of the event.

LER NO: 269/92404, -005 B-81 PRELIMINARY

PRELIMINARY The transient monitor plot (See Attachment A) for Emergency Feedwater (EFDW) flow that was submitted as part of the Reactor Transient Analysis was plotted on a 15 minute time line.

The MDEFDWPs were on for approximately 43 seconds. The amount of time the EFDW controls called for IFDW-315 and IFDW-316 to be open was only 15-30 seconds. Unless the flow parameter had been observed by the Control Room Operator during this time frame, it would not have been detected. The personnel performing Post Trip Review and-Transient-Analysis stated that they did not place sufficient emphasis on the EFDW flow aspect since the B MFDW pump remained on during the event and both Motor Driven EFDW pumps started. They also observed that steam generator levels tracked together to approximately 18 inches immediately following the reactor trip and progressed to the level where EFDW maintains (30 inches).

The Post Trip Review Checklist did not explicitly require documentation that flow had been established in both SG trains. The transient monitor plot showing EFDW train A and B flow was not clear in showing that both EFDW trains had exhibited-flow.

The Defective Procedure is considered recurring based on a review of Problem Investigation Report Database.

There were no personnel injuries, radiation exposures, or releases of radioactive materials associated with this event.

CORRECTIVE ACTIONS Immediate

1. The solenoid valve (ISV-200) was replaced and tested.

Subsequent

1. The Performance Testing frequencywas changed to-require valves. FDW-315 and-316 to be stroked tested quarterly without an exception-as to the Unit itatus. Planned~

1.

Enhance the Post Trip Review process as necessary, specifically addressing the verification of Emergency Feedwater Flow.

SAFETY ANALYSIS The purpose of the Emergency Feedwater (EFDW) System is to remove decay heat and cool down the Reactor Coolant System (RCS), in the event that Main-Feedwater (MFDW) is unavailable. This system is composed of three EFDW pumps supplying two independent trains, with a control valve present in each train to throttle flow. Each unit has the ability of cross-connecting to either of the other two units if necessary. Two of the EFDW pumps are motor-driven while the third is turbine driven. The accident analyses in the Final Safety Analysis Report (FSAR) only credit EFDW flow from one pump to one LER NO: 269/92-004, -005 B-82 PRELIMINARY

PRELIMINARY steam generator (SG). Thus, any one of these pumps is capable of providing adequate flow to remove RCS heat from any initial power condition.

All three pumps receive a start signal on low Main Feedwater (MFDW) header pressure, low turbine oil pressure, or low steam generator level. In the event of a single failure, adequate redundancy is present to assure that the EFDW system will function as designed.

In the event that one of the control valves is inoperable while in the automatic control mode, as was the case with 1FDW-315, a single failure in the other train (lFDW-316) could isolate all EFDW flow to the SGs. This would prevent the EFDW System from performing its intended safety function as assumed in the FSAR accident analyses. However, the operators have the ability to switch control of these valves into manual. Testing of these valves prior to unit start-up was performed in the manual mode. The results of these tests showed that the valves opened as required. The Emergency Operating Procedure (EOP) instructs the operator to take manual control of these valves in the event that no flow is indicated in the EFDW header(s). Thus, during the time period that IFDW-315 was inoperable in the automatic mode, operator action could have restored feedwater to the steam generator, even in the event of a single failure in the other train.

In the event that 1FDW-315 was inoperable in both the automatic and manual modes and a single failure in the other train occurred, other means of RCS heat removal are available. The EOP directs the operators to initiate High Pressure Injection (HPI) [EIIS:BGJ feed and bleed cooling upon a loss of all primary-to-secondary heat transfer. Adequate time is available between the initiation of a total loss of feedwater event and the time at which feed and bleed begins such that no core damage would occur. This manner of RCS heat removal can be used until MFDW or EFDW flow is restored.

If the EOP is followed properly, feed and bleed cooling is capable of removing decay heat and preventing core damage.

In the absence of MFDW and EFDW, an alternative method of heat removal to HPI feed and bleed is the use of the Standby Shutdown Facility (SSF) Auxiliary Service Water (ASW) [EIIS:BA] pump. The design purpose of this pump is to supply secondary inventory at flow rates as high as 500 gpm to each unit during SSF event. An SSF scenario can result in a loss of MFDW and EFDW, as well as other safety systems. Flow from the ASW pump enters the EFDW System downstream of control valves FDW-315 and FDW-316. Analyses have been performed to verify that sufficient time is available for an operator to line this system up before any core damage would occur.

Although the potential existed for the automatic control of the EFDW system to be inoperable, assuming a single failure, adequate means of RCS heat removal were available through the use of operator action to restore EFDW flow, HPI feed and bleed cooling, or use of the SSF ASW pump. Each of these alternate methods of decay heat removal would have been successful in preventing core damage.

Therefore, this event did not result in a significant risk to the health and safety of the public.

Figure "Attachment A" omitted.

LER NO: 269/92-004, -005 B-83 PRELIMINARY

PRELIMINARY B.10 LER Number 269/92-008 Event

Description:

Emergency Power Unavailable Date of Event:

July 16, 1992 Plant:

Oconee 1, 2, and 3 B.10.1 Summary With all three Oconee units at 100% power and emergency power source Keowee 1 unavailable because of maintenance, a failed fuse was discovered in the control power circuit for an auxiliary power breaker on Keowee 2.

This rendered Keowee 2 also unavailable.

Both emergency power sources were unavailable for 34 h.

The conditional core damage probability estimated for this event is 2.6 x 10-6. The relative significance of this event compared to other postulated events at Oconee is shown in Fig. B. 17.

[ER 269192-Mo8 1M7 1

M15 1M4 1M3 1M2 1

360hEP WOP (nomwn*

ProcUuor cutoff L360hAFW MflXAFW

• nwqv y pwa film pr6bab5 from Kew* da.

Fig. B.17.

Relative event significance of LER 269/92-008 compared with other Oconee potential events.

B.10.2 Event Description On July 16, 1992, with all three Oconee units at 100% power, Keowee I was removed from service for maintenance.

Consistent with the Oconee Technical Specifications, Keowee 2 was aligned to the underground path.

LER NO: 269/92-008 B-84 PRELIMINARY

PRELIMINARY At 1200 hours0.0139 days <br />0.333 hours <br />0.00198 weeks <br />4.566e-4 months <br />, the hydro operations specialist (HOS) at Keowee found the green (trip) control power indicator light for breaker ACB-8 (the alternate power source for Keowee 2 auxiliary loads) glowing less brightly than expected. At 1430 hours0.0166 days <br />0.397 hours <br />0.00236 weeks <br />5.44115e-4 months <br />, the red (close) control power indicator light for ACB-8 was also found to be glowing, but not as brightly as the "trip" light. The HOS concluded that the problem with the lights was caused by dirty contacts and was not an operability concern, and therefore decided to wait to investigate the problem until Keowee 2 was taken out of service for maintenance (scheduled for the next day).

Due to modification delays, Keowee I remained out of service. On July 17, 1992, at 1200 hours0.0139 days <br />0.333 hours <br />0.00198 weeks <br />4.566e-4 months <br />, the HOS and other personnel began to investigate the cause of the lighted control power indicator lights. At about 1330 hours0.0154 days <br />0.369 hours <br />0.0022 weeks <br />5.06065e-4 months <br />, it was determined that the fuse feeding the positive circuit in ACB-8 had blown. With the positive fuse blown, a bypass series circuit path illuminated both indicator lights. In addition, the negative fuse was found to be rated at 15 A, instead of the required 10 A. The HOS realized that an operability/limiting condition for operation concern existed and began to search for replacement fuses.

Unsuccessful attempts were made to contact the Oconee Operations support manager and switchyard coordinator for assistance in resolving the operability issues related to the Keowee units.

At 1415 h, the HOS notified the Oconee 2 Unit supervisor that a blown fuse had been found in the positive circuit for ACB-8. The unit supervisor realized that this rendered Keowee 2 inoperable (with Keowee 2 aligned to the underground path, closure of ACB-8 is required to power Keowee 2 auxiliary loads). Since Keowee I was also out of service, the Oconee Technical Specifications required the standby buses to be energized from the Lee combustion turbines. At 1436 hours0.0166 days <br />0.399 hours <br />0.00237 weeks <br />5.46398e-4 months <br />, Lee was notified that backup power was-required.

The replacement fuses needed for ACB-8 were determined to be safety-related. When none could be located on-site, fuses from. a.spare.breaker-cabinetwere-used.

These fuses appeared to be original equipment and were determined to be in good condition. After the fuses for ACB-8 were replaced, the breaker was tested and determined to be operable at 1509 hours0.0175 days <br />0.419 hours <br />0.0025 weeks <br />5.741745e-4 months <br />.

At 1513 hours0.0175 days <br />0.42 hours <br />0.0025 weeks <br />5.756965e-4 months <br />, Oconee Operations personnel were notified that Keowee 2 was operable. At 1528 hours0.0177 days <br />0.424 hours <br />0.00253 weeks <br />5.81404e-4 months <br />, Lee notified Oconee that a gas turbine was in operation and that transformer CT-5 was energized. This was almost 2 h after Keowee 2 had been declared inoperable. The Lee operators had experienced trouble with the first gas turbine they had started, and a second turbine had to be started. The standby buses were never energized from the Lee gas turbine because Keowee 2 had been returned to service before Oconee received power from Lee.

B.10.3 Event-Related Information The Keowee Hydro Station, located approximately three-fourths of a mile east-northeast of the Oconee Nuclear Station, consists of two hydroelectric generators rated at 87,500 kVA each, which generate at 13.8 kV. The two Keowee hydro units serve the dual functions of generating commercial power to the Duke Power system grid through the Oconee 230-kV switchyard and providing emergency power to the Oconee Station. When a Keowee unit is generating to the grid and an emergency start at Oconee occurs, it is separated from the 230-kV switchyard and continues to run in standby until needed.

LER NO: 269/92-008 B-85 PRELIMINARY

PRELIMINARY Upon loss of power from an Oconee generating unit and 230-kV switchyard, power is supplied from both Keowee units through two separate and independent paths. One path is a 4000-ft underground 13.8-kV cable feeder to transformer CT-4, which supplies power to the 4160-V standby buses. The underground power path is connected at all times to one hydro unit on a predetermined basis through locked-closed breakers. The underground power path and the associated transformer are sized to carry full engineered safeguards auxiliaries of one Oconee unit plus auxiliaries for safe shutdown of the other two units. If a Keowee unit is to provide power to an Oconee unit through the underground power path (required by Technical Specifications if one of the Keowee units is out of service), then due to the limited capacity of CT-4, loadshed of non-essential loads occurs. The second path from Keowee is a 230-kV transmission line through breakers ACB-1 or ACB-2, via the yellow bus, to the startup transformer of each Oconee unit.

Keowee auxiliary power is required for the ac hydraulic oil pumps, along with other loads. These pumps are used to pressurize the air pre-loaded accumulators that provide hydraulic oil pressure to the governor which controls the position (depending on load)-of the wicket gates on the Keowee water turbine. The length of time that the Keowee units can run without ac auxiliaries is limited by the changing load to which the governor must respond. The utility has indicated in several LERs that one hour is the expected maximum time period of Keowee operation without ac auxiliaries.

A standby shutdown facility (SSF) is located in a separate building on the Oconee site. This facility, which is not normally manned, is capable of providing limited high-pressure injection for reactor coolant system (RCS) makeup and reactor coolant pump (RCP) seal cooling [provided an RCP seal loss-of-coolant accident (LOCA) does not occur]. It also supplies.limited steam generator makeup. The facility includes a separate diesel generator which can power SSF loads in the event of a station blackout. SSF systems consist of single trains and are therefore not single-failure-proof.

A more detailed description of the Oconee emergency power system is included in the precursor analysis for LER 270/92-004, "Loss of Offsite Power with Failed Emergency Power."

B.10.4 Modeling Assumptions The. event has been modeled as a postulated loss of offsite power (LOOP) during the 34 h that both Keowee units were unavailable. Consistent with the analysis for LER 270/92-004, the Keowee hydro units were assumed to fail after one-half hour of operation. The probability of failing to recover the faulted emergency power system within - 30 min via the Keowee hydro units was assumed to be 0.5.

During the event reported in LER 270/92-004, which also involved unavailability of auxiliary power to Keowee but during an actual LOOP, a lack of understanding of the Keowee electrical system by the Keowee operator delayed restoration of auxiliary power for 30 min, at which time the hydraulic oil accumulator tanks were almost empty. In addition, a probability of 0.12 (ASP Recovery Class R3) was assumed for failing to recover emergency -power in the short-term from-the Central Switchyard via transformer CT-5. While the use of CT-5 is described in Oconee procedures, the need for manual load shedding is not addressed.

These assumptions result in a combined short-term emergency power nonrecovery probability of 0.06.

LER NO: 269/92-008 B-86 PRELIMINARY

PRELIMINARY The probability of not recovering offsite power prior to battery depletion was estimated to be 0.33 (as described in ORNL/NRC/LTR-89/ 11, Revised LOOP Recovery and PWR Seal LOCA Models, August 1989, with loss of emergency power at - 30 min).

B.10.5 Analysis Results The conditional core damage probability estimated for the event is 2.6 x 10-6.

This conditional probability is applicable to each of the Oconee units. The dominant core damage sequence, highlighted on the event tree in Fig. B. 18, involves a postulated LOOP with failed emergency power and failure to recover ac power before battery depletion.

The conditional probability estimate is strongly influenced by assumptions concerning the failure of Keowee upon loss of hydraulic oil and the likelihood of providing power from the Lee combustion turbines or the central switchyard via transformer CT-5.

The use of the SSF as an alternate source of RCS and steam generator makeup for the station blackout scenarios was not considered in the above analysis. This was done for consistency with other precursor analyses. Assuming a combined operator and equipment failure probability of 0.2 for the SSF results in a revised conditional probability estimate of 5.2 x 10'.

L O O PO R" /

S E A L E PAE Cw H P I H P R P O R0 N

LOPHOP P F

SR EAT LOCA (LONG)

OPEN No STATE OK OK 41 CD 42 CD OK OK 44 co 49CD 45 CD OK 46 CD 47 CD 46 CD OK 49 CD 55 CD OK 51 CD 52 CD(

53 Co OK 54 CD 55 CD 40 ATWS Fig. B.18.

Dominant core damage sequence for LER 269/92-008.

LER NO: 269/92-008 B-87 PRELIMINARY

PRELIMINARY CONDITIONAL ::CORE :DAMAGE PROBABILITY CALCULATIONS Event Identifier: 269/92-008 Event D~escription: Emergency power unavailable Event Date:

07/17/92 Plant:

Oconee 1 UNAVAILABILITY, DURATION= 34 hours3.935185e-4 days <br />0.00944 hours <br />5.621693e-5 weeks <br />1.2937e-5 months <br /> WN-RECOVERABLE INITIATING EVENT PROBABILITIES LOOP 1...i.3E-0.4 SEQUENCE CONDITIONAL PROBABILSU M

End State/Initiator Probability CD LOOP 2.6E-06 Total 2.6E-06 ATUS LOOP O.OE40O Total 0.OE.00 SEQMECE CONDIrTIONAL PROBABILITIES (PROBABILITY ODR Sequence End State Prob N Rec**

.54 toop -rt/loop ENERGLPOWER -afwfemerg.power -porv.or.srv.chatl -

CD 2.3E-06 1.4E-02 seal.loca EP.REC 49 loop -rtitoop FKA.POWER -afw/emerg.power porv.or~srv.chatt -

M2.OE-07 1.4E-02 pv.rvresatee.poweer -seaI toca EP.REC 55 toop -rt/Loop ENERG.POWER afvlemerg.power.

CD*

1.3E-07 4.9E-03

'* nvr.ecovery credit for edited case SEQUECE COND~IINAL. PROBABILITIES (SEQUENCE ORDER 47 loopm-;.+7 /r~Loop

.ENER(.POWEP

-afw/emerg.power porv.or.srv.chall CD 2.OE-07 1.4E-OZ porvWo.srvy.reseat/tmerg.power -seaL.toca E.EC Woo

-rtlop ENERG.POIEI

-afvweerg. power *porv.or.arv.chall CD 2.3E~O

.EO el oaEP.REC 55 lp t:o ENRG.PO.ER afw/emerg~power CD 1.3E-07 4.9E-03

~-ngn-irocovery credit for edited case Rote:

For taiavaitabitities, conditional probability values are differential values which rflect the added risk due to failures associated with an event.

Parenthetical valuses indicate a reduction in risk coupared to a similar period without the existing failures.

SEQUENCE MODEL:

c: \\asp\\1989.\\pwrdseaL. ca BRANCHt MODEL:

c:\\asp\\1989\\oconee.stl PROBABILITY FILE:

c:\\asp\\1989\\pwr.bst1.pro Evet Identifienr: 26992-008.

LER NO: 269/924008 B-88 PRELIMINARY

PRELIMINARY No Recovery Limit BRANCH FREQUJENCIES/PROBABILITIES Branch System Mon-Recov

.Opr Fail t rams 6.4E-05 1.GE0 Loop 1.6E-05 2.4E-01 Loca 2.4E-06 4.3E-01 Zt

.SE-04 1.2E-01 rttoap 0.0E+0 I.OE+0O EXERIG.P0IR 2.SE-04 > l.OE.O0 M.O-01 > 6.OE-02 Branch Model:

1.0F.2+ser.

Train 1 Cand Prob:

2.3E-03 > Fai led Train 2 Cond Prob:

4.7E-02 >Failed Serial Compoanent Prob:

1.4E-04 afw 3.8E-04 2.6E-01 afw/emerg.powaer 5.OE-02 3.4E-01 mfw

~2.OE-O13.E0 porv.or.srv.chalt M.E-02 1.OE4-00 porv.or!.srv.r.eat t.OE-02 1.1E-02 porv.or~ srv~reseat/emerg.poier.I.OE-02

1. OE+0O sett*

0.OE.OO 1.05+00 ep..rec(al) 0.0E+00.........

1.0500 Branch Model:

101F.1 Train 1 Cond Prob:

4.5E-01 >3.3E-01 hp ME.004

.4-01 hpi(f/b) 3.OE-04 8.4E-01 1.0E-02 hpr/-hpi 1.5E-04 1.05+00 1.05-03 branch mdlfl

• • forced.

EvenW Identffier:. 269/92-008 LER NO:.269/924008 B-89 PRELIMINARY

PRELIMINARY LICENSEE EVENT REPORT (LER)

FACILITY NAME: Oconee Nuclear Station, Unit 1 DOCKET NO: 269 TITLE:

Equipment Failure And Inappropriate Action Result In The Concurrent Inoperability Of Both Onsite Emergency Power Sources And A-Technical Specification Violation EVENT DATE: 07/17/92 LER #: 92-008-00 REPORT DATE: 08/17/92 OTHER FACILITIES INVOLVED: Oconee, Unit 2 DOCKET NO: 05000270 Oconee, Unit 3 05000287 OPERATING MODE: N POWER LEVEL: 100 THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR SECTION:

50.73(a)(2)(v)(D)

LICENSEE CONTACT FOR THIS LER:

S. G. Benesole, Safety Review Group TELEPHONE: (803) 885-3518 COMPONENT FAILURE DESCRIPTION:

CAUSE:

SYSTEM:

COMPONENT:

MANUFACTURER:

REPORTABLE NPRDS:

SUPPLEMENTAL REPORT EXPECTED: No ABSTRACT:

On July 17, 1992, at 1330 hours0.0154 days <br />0.369 hours <br />0.0022 weeks <br />5.06065e-4 months <br />, all three Oconee units were at 100 percent Full Power. With Keowee Unit 1 out of service for planned maintenance, it was discovered that the closing circuit fuse in ACB-8 breaker was blown causing an inoperability of Keowee Unit 2.

With these conditions both onsite emergency power sources were technically inoperable. Procedures were implemented to energize the Standby Buses via the Lee Gas Turbines through the 100 KV dedicated lines. The blown fuse was replaced, returning Keowee Unit 2 to operable status--- Problems:with the start up of the Lee Gas Turbines and a misunderstanding led to exceeding the Technical Specifications time frame by 58 minutes.

The root causes of this event are classified as Equipment Failure and Inappropriate Action (proper response identified but not in time). Corrective actions include diagnosing the specific failure mode of the fuse, implementing administrative procedural controls, and training in the modes of control power indicator failures and the time restraints of Technical Specifications.

BACKGROUND The Keowee Emergency Power System (EIIS:EK) consists of two hydroelectric generators which provide an emergency onsite power source for Oconee Nuclear Station via two separate and independent paths.

One path is the underground feeder through transformer CT-4 (EIIS:XFMR) and the Standby Buses (EIIS:EB) and the other is the overhead through the 230 KV Switchyard (EIIS:FK).

LER NO: 269/92-008 B-90 PRELIMINARY

PRELIMINARY Each Keowee Unit is provided with its own automatic start equipment. Both units undergo a simultaneous automatic start and run in standby on: a loss of the grid, an Engineered Safeguards actuation on any of the three Oconee Units, or an extended loss of voltage on any Oconee unit's main feeder bus. On an emergency automatic startup, the Keowee Unit connected to the underground feeder supplies the Oconee Standby Bus while the other Keowee Unit, remains in standby. If there is a grid disturbance, the unit in standby ties to the overhead path and is automatically connected to the Oconee 230 KV Switchyard Yellow Bus after the yellow bus is automatically isolated from the grid. Therefore, in the event of a Loss of Coolant Accident and the simultaneous loss of degradation of the grid, emergency power is available from either Keowee unit through the underground feeder and/or the overhead transmission line.

Technical Specification ( TS ) 3.7.2 allows one Keowee Unit to be out of service for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> provided the other unit is aligned to the underground and verified operable within one hour and every eight hours thereafter. Operability is verified by starting the available Keowee Unit and energizing the Standby Bus.

The Keowee 600 VAC Switchgears IX-and 2X with their normal and alternate feeder breakers will provide power to the Keowee auxiliary loads. (See Attachment 1) Keowee's Auxiliary Switchgear IX and 2X receive their normal, non-emergency power from the 230 KV switchyard back charging Keowee's Main Step-up Transformer through ACB-5 and ACB-6. An alternate power source is provided to IX and 2X Switchgear from one of Oconee Unit I's 4160 VAC Switchgear ( ITC ) through Keowee's CX Transformer and the Alternate Feeder Breakers ACB-7 and ACB-8, respectively. With only one Keowee Unit available and tied to the underground and a Loss of Offsite Power occurs, the only available Keowee Auxiliary power source is through CX. Therefore, a loss of CX or ACB-7 or 8 makes the associated Keowee Unit tied to the underground -technically inoperable.

If both Keowee Units are unavailable, the Oconee Standby Buses can be energized from the Lee Steam Station Combustion Turbinesthrough the.dedicated.-i00-KV transmission lines. TS 3.7.7 requires that, in the event that both Keowee Units become unavailable for unplanned reasons, the Oconee Standby Buses shall be energized within one hour by the Lee Gas Turbines through the 100 KV transmission lines and shall be separated from the system grid and all offsite non-safety related loads.

EVENT DESCRIPTION On June 7, 1992, at approximately 1400 hours0.0162 days <br />0.389 hours <br />0.00231 weeks <br />5.327e-4 months <br />, with Oconee Nuclear Station (ONS) Unit 1 at Hot Shutdown (Start-up in progress), and Unit 2 and 3 at 100 percent Full Power, an operability test (

PT/O/A/610/05B "Electro-Mechanical Relay Breaker Trip Test") was performed on Keowee Unit 2's 2X Alternate Feeder Breaker (ACB-8) and the Normal Feeder Breaker (ACB-6). This test opened ACB-6 and closed ACB-8 to 2X, then returned the breakers to a normal status by opening ACB-8 and closing ACB-6. Test results were satisfactory.

On July 16, 1992, at 0436-hours, while all three Oconee-units were at 100 percent Full Power, Keowee Unit 2 was verified operable in accordance with Technical Specifications (TS) 3.7.2 prior to removing Keowee Unit I from service. This test was completed approximately every eight hours, thereafter, per requirements. At 0515 hours0.00596 days <br />0.143 hours <br />8.515212e-4 weeks <br />1.959575e-4 months <br />, Keowee Unit I was removed from service for implementation of Nuclear LER NO: 269/92-008 B-91 PRELIMINARY

PRELIMINARY Station Modification (NSM) 52917 (Replacing Keowee X Relay Electro-Mechanical Scheme With a X-Y Electrical Scheme) and a Limiting Condition for Operation (LCO) was entered.

NSM 52917 was a response/commitment item initiated in response to Licensee Event Report (LER) 269/92-02 (iuipment Failure in Emergency Power System and Inappropriate Action Result in Technical Specification Violation). This LER is related to the failure of Keowee's field and field flashing breakers' X relay.

On July 16,1992, at approximately 1200 hours0.0139 days <br />0.333 hours <br />0.00198 weeks <br />4.566e-4 months <br />, Hydro Operations Specialist (HOS), while performing a inspection of plant equipment, found the Green (Trip) control power indicating light for ACB-8 glowing, but not as bright as expected for normal conditions; however, it is not unusual to have varying degree of brightness of indicating lights.

At approximately 1430 hours0.0166 days <br />0.397 hours <br />0.00236 weeks <br />5.44115e-4 months <br />, the HOS noticed, after cupping his hand over the Red (Close) Control Power indicating light for ACB-8, it was also glowing but not as bright as the Trip light. At this time, ACB-8 was open and ACB-6 was closed as-required for the-plant conditions.

Keowee Unit 2 was scheduled to be taken out of service on July 17th for implementation of NSM 52917. Suspecting dirty contacts in the control power light circuits and not an operability question, the HOS decided to wait and investigate the problem during the outage.

Due to modification delays, Keowee Unit I remained out of service and on July 17,1992, at approximately 1200 hours0.0139 days <br />0.333 hours <br />0.00198 weeks <br />4.566e-4 months <br />, the HOS, the Component Engineer (CE) and the Instrumentation and Electrical Plant Maintenance Supervisor (IEPMS) began investigating several possible causes for the control power lights to be lit in that combination.

At approximately 1330 hours0.0154 days <br />0.369 hours <br />0.0022 weeks <br />5.06065e-4 months <br />, theCEand-the.IEPMS.decided-to. remove-one of the bulbs to troubleshoot the lighting problem. This action caused both control power indicating lights to go out. While tracing the circuitry for series power sources, the investigation revealed that the close circuit "1B" positive 10 amp ( OTIO ) fuse feeding ACB-8 had blown. A check of the close circuit "lB" negative fuse for ACB-8 revealed that a 15 amp (OT15) fuse was installed instead of a OT1O fuse as called for on electrical print KEE-27-2. The OTIS fuse-was not blown. The HOS recognized that he had an operability/Limiting Condition for Operation concern and began to make contacts to the Commodities and Facilities department in search for replacement fuses, and Quality Control Staff to monitor the work. Unsuccessful attempts were made to contact the Oconee Operations Support Manager and the Oconee Operations Switchyard Coordinator for assistance in addressing and resolving the operability of the Keowee Units in accordance with TS.

At 1415 hours0.0164 days <br />0.393 hours <br />0.00234 weeks <br />5.384075e-4 months <br />, the HOS notified ONS Unit 2 Supervisor that a blown fuse had been found in ACB-8.

The ONS Unit 2 Supervisor recognized -that this caused.

the*CX Transformer to be out of service.

Therefore, Keowee Unit 2 was declared technically inoperable. With Keowee Unit I out of service for modifications, a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Limiting Condition for Operations (LCO) in accordance with TS 3.7.7 was entered. This required the energizing of the Standby Buses via the Lee Gas Turbines through the 100 KV dedicated lines. Lee Steam Station (Lee) personnel were notified of the condition of the Keowee Units as a "heads-up" that their services would be required.

LER NO: 269/92-008 B-92 PRELIMINARY

PRELIMINARY At 1423 hours0.0165 days <br />0.395 hours <br />0.00235 weeks <br />5.414515e-4 months <br />, Operations began performing OP/O/A/1 107/03 (100 KV Power Supply) Enclosure 3.3 (Charging Standby Bus No. I and 2 from Lee Steam Station for Backup Power) due to both Keowee Units being inoperable.

At 1436 hours0.0166 days <br />0.399 hours <br />0.00237 weeks <br />5.46398e-4 months <br />, Lee was notified per OP/O/A/1 107/03, enclosure 3.3 that backup power was required.

Replacement OTIO fuses requested from Commodities and Facilities were determined to be Quality Assurance (QA) qualified fuses and none were in stock at ONS.

Attempts were made by the CE to find qualified QA OTIO fuses and a dialogue was opened with the Electrical Engineer Supervisor (EES) from Oconee Engineering Division. The EES suggested to the CE to use the OTIO fuses from a spare compartment, since these fuses came with the original equipment and should be of the same grade as those installed in ACB-8. The fuses in the spare compartment were examined and were OTIO fuses. They were tested and found to be in good condition and appeared to be the original equipment.

The OT10 fuses were replaced at 1445 hours0.0167 days <br />0.401 hours <br />0.00239 weeks <br />5.498225e-4 months <br /> using Work Request number 59726C.

At 1509 hours0.0175 days <br />0.419 hours <br />0.0025 weeks <br />5.741745e-4 months <br />, Keowee Operators tested ACB-8 by swapping supplies to 2X from ACB-6 to ACB-8.

This tested the closing circuit and fuses on ACB-8 which showed satisfactory results. 2X was then swapped back to it's normal source, ACB-6.

At 1510 hours0.0175 days <br />0.419 hours <br />0.0025 weeks <br />5.74555e-4 months <br />, Lee was called and questioned by ONS Operation personnel as to the status of the Lee Combustion Gas Turbines. Lee Operators indicated that trouble was being experienced in the sequencing circuit and the startup of another Gas Turbine was in progress.

At 1513 hours0.0175 days <br />0.42 hours <br />0.0025 weeks <br />5.756965e-4 months <br />, ONS Operations personnel were notified that Keowee Unit 2 was operable and the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> LCO was exited.

At 1528 hours0.0177 days <br />0.424 hours <br />0.00253 weeks <br />5.81404e-4 months <br />, ONS was notified by Lee that the Lee Gas Turbines were in operation and the 100 KV line was energized to CT-5. This was -i hour and 58 minutes after the time that Keowee Unit 2 was declared technically inoperable. The Standby Buses were never energized from Lee because Keowee Unit 2 was returned to service prior to receiving power from Lee.

The blown fuse and similar good fuses were sent to Nuclear Services, Instrumentation and Electrical department for diagnostic testing and evaluation to determine the failure mechanism.

CONCLUSIONS The root cause of Keowee Unit 2's inoperability is Equipment failure. With the failure of the "IB" positive 10 amp ( OT 10) fuse feeding ACB-8, one source of power available to the 2X Switchgear was lost, thus, rendering the CX Transformer and Keowee Unit 2 technically inoperable. It is not known exactly when the fuse blew, but it is assumed that on June 7, 1992, at approximately 1400 hours0.0162 days <br />0.389 hours <br />0.00231 weeks <br />5.327e-4 months <br />, the "lB" positive close fuse failed during the closure test performed on ACB-8 and the failure went unabserved until approximately 1200 hours0.0139 days <br />0.333 hours <br />0.00198 weeks <br />4.566e-4 months <br /> on July 16, 1992.

LER NO: 269/92-008 B-93 PRELIMINARY

PRELIMINARY Normally, only one of the indicating lights is illuminated to show the appropriate breaker position.

However, when the "IB" positive fuse was blown, both the Trip and Close indicating lights were illuminated. This occurs because a bypass, series, circuit path exists. This path was from the positive power bus through contacts in the closed circuit of ACB-6, the Trip and Close indicating bulbs of ACB-8, and completing the circuit to the negative power bus; thus allowing both bulbs to be illuminated. When one bulb is removed or both the positive and negative are blown, the series circuit will be broken extinguishing both lights.

A Configuration and Control Inspection/Program will be initiated during the Unit 3's, EOC-13, outage to check the condition of fuses, terminal links, and housekeeping within Oconee and Keowee's electrical cabinets.

The blown fuse and similar good fuses were sent to Nuclear Services, Instrumentation and Electrical department for diagnostic testing and evaluation to determine the failure mechanism: A review of Work Requests written between February 19, 1981 and the event revealed no indication as to when the OTIO fuse was replaced with a OT15 fuse. This fuse failure is not considered NPRDS reportable. A review of past Problem Investigation Reports indicate no similar failures, thus this part of the event is not considered recurring.

The root cause of failing to provide power to ONS's Standby Buses within I hour is Inappropriate Action (proper response identified but not in time). --The one hour time limit-begins at the time of the discovery of the equipment being out of service.

The initial observation of the problem-with..thelights-on ACB was on July 16, 1992 at 1200 hours0.0139 days <br />0.333 hours <br />0.00198 weeks <br />4.566e-4 months <br />.

The time Keowee Unit 2 was confirmed to be technically inoperable was approximately 1330 hours0.0154 days <br />0.369 hours <br />0.0022 weeks <br />5.06065e-4 months <br />, July 17,1992, and, as a minimum, the time for compensatory actions should have started then.

However, Operations personnel were not notified until 1415 hours0.0164 days <br />0.393 hours <br />0.00234 weeks <br />5.384075e-4 months <br />, at which point compensatory actions were initiated. Therefore, the Technical Specifications time requirements for action was violated when power was not available to the Oconee Standby Bus from Lee Gas Turbines-at 1430 hours0.0166 days <br />0.397 hours <br />0.00236 weeks <br />5.44115e-4 months <br />.

The HOS recognized that Keowee Unit 2 was into a Technical Specification issue. Once the blown fuse was identified, the HOS should have notified the Operations shift personnel (i.e. the Control Room),

immediately, versus attempting to contact the Operations staff personnel or expediting the replacement of the fuses. This resulted in a 45 minute delay in the initiation of compensatory actions. Licensee Event Report 269/92-02 (Equipment Failure in Emergency Power System and Inappropriate Action Result in Technical Specification Violation) addresses the need for immediate notification of operability status of the Keowee Units to the ONS Control Room. Keowee operators -have been directed to notify Oconee Control Room, immediately, during an operability concern of the Keowee Units. Corrective actions from that report did not prevent the recurrence of this communications issue. Therefore, this portion of the event is recurring.

LER NO: 269/92-008 B-94 PRELIMINARY

PRELIMINARY At 1415 hours0.0164 days <br />0.393 hours <br />0.00234 weeks <br />5.384075e-4 months <br />, ONS Unit 2 Supervisor was notified that a blown fuse was found in ACB-8 at 1330 hours0.0154 days <br />0.369 hours <br />0.0022 weeks <br />5.06065e-4 months <br />. The Unit 2 Supervisor recognized that this made Keowee Unit 2 technically inoperable. This required the energizing of the Standby Buses via the Lee Gas Turbines through the 100 KV dedicated lines. Lee Steam Station (Lee) was notified that their services would be required. After experiencing problems with the sequencing circuit on the SC Turbine, 4C Gas Turbine was started. Interviews revealed that Lee understood that they had one hour to start and close into the 100 KV line to CT-5 after they were officially notified through the ONS procedures, rather than the actual time of inoperability. At 1528 hours0.0177 days <br />0.424 hours <br />0.00253 weeks <br />5.81404e-4 months <br />, ONS was notified by Lee that the Lee Gas Turbines were in operation and the 100 KV lines were energized to CT-5. This was I hour and 58 minutes after the time that Keowee Unit 2 was determined to be technically inoperable, which exceeded the time limit. To prevent a misunderstanding, ONS will revise OP/O/A/I1 107/03, Enclosure 3.3 to include notifying Lee Steam Station of the time the Combustion Gas Turbines are required to be in service. Lee will change their operating practices to initiate a start of a second Combustion Gas Turbine if the primary turbine does not start, or trips after initial starting.

Offsite personnel who operate equipment which provides safety related support functions to ONS need to adequately understand the appropriate communication paths for reporting equipment problems and to report these problems immediately. The fact that the Control Room was not notified more promptly indicates a lack of understknding of associated requirements.

There were no releases of radioactive material, radiation overexposures, or personnel injuries associated with these events.

CORRECTIVE ACTIONS Immediate

1)

Fuses OT1O and OTIS from ACB-8 Control Power were removed and replaced by OTIO fuses.

ACB-8 was tested satisfactorily. Keowee Unit 2 declared operable.

Subsequent

1)

Keowee's Breaker Status checklist has been revised to include additional breaker and indicator status for each breaker; also, the checklist gives direction on what to look for and who to call for guidance on other than normal conditions.

2)

Quality Assurance qualified OTIO fuses and a maximum and a minimum to be maintained in stock has been established.

Planned

1)

A formal rounds and turnover procedure will be initiated to enhance the monitoring of Keowee Hydro equipment.

LER NO: 269/92-008 B-95 PRELIMINARY

PRELIMINARY

2)

Training will given to Keowee personnel on the new Keowee procedures, checklists, and the time restrains of Technical Specifications.

3)

Nuclear Services, Instrumentation and Electrical department will investigate the cause of the fuse failure and test similar fuses for possible failure mode(s).

4)

Training will be given to Lee Steam Station personnel concerning the operating practice of initiating a start of the second Combustion Gas Turbine if the primary turbine does not start or trips after initial start.

5)

Oconee Nuclear Station's OP/O/AlI 107/03, Enclosure 3.3 will be revised to include notifying Lee Steam Station of the time the Combustion Gas Turbines are required to be in service and establish a notification step early in the procedure as possible.

6)

Problem Investigation Process 0-092-0293 was initiated on July 27, 1992 to resolve the problem with the bypass, series, circuit. A proposed resolution will be developed by October 26, 1992.

SAFETY ANALYSIS Keowee Hydro Station provides an emergency power source to Oconee Nuclear Station for scenarios which involve-a Loss of Offsite Power (LOOP). Asmentioned earlier in this report, Keowee can feed Oconee through either an overhead or an underground path. Additionally, in the event both Keowee Units are unavailable, the busses connected to the underground path can be supplied from the Central Switchyard or from Lee Steam-Station (Lee)-Gas-Turbines via dedicated lines. The supply from Lee should be available within one hour of identifying the need, but, in this event, it was not available until approximately one hour and fifty-eight minutes after the initial inoperability of the Keowee unit was recognized.

Each Keowee Unit shall be capable of starting and " accelerating without AC power to either of its auxiliaries. They can black start. A review of the Final Safety Analysis Report (FSAR) indicates that the worst case accident for this event is a LOOP affecting all three Oconee units and a concurrent Loss of Coolant Accident (LOCA) on one unit.

FSAR 15.8.3 addresses a simultaneous LOOP event on all three units. This analysis shows that natural circulation of the Reactor Coolant System (RCS) [EIIS:AB], Turbine Driven Emergency Feedwater System (EIIS:BA], Condenser Circulating.Water gravity induced flow, and gravity insertion ofl the control rods [EIIS:ROD] are among the design features provided to ensure the removal of decay heat for the RCS without offsite power being available. Additionally, FSAR Section 15.8.3 states that "Each reactor can sustain a complete electrical power loss without emergency cooling for about 23 minutes before the steam volume in the pressurizer is filled with reactor coolant" and that "beyond this time reactor coolant will boil off, and an additional 83 minutes will elapse before the boil off will start to uncover the core."

LER NO: 269/92-008 B-96 PRELIIdNARY

PRELIMINARY Therefore, even without cooling from the Turbine Driven Emergency Feedwater Pump or the Standby Shutdown Facility, the FSAR states that core uncovery will not occur for 106 minutes after the initial loss of power. Even though it was delayed in this event, power was available from Lee within 73 minutes.

In a scenario involving a LOOP affecting all three Oconee units and a concurrent LOCA on one unit, Emergency Feedwater and/or the SSF would not be able to assist in mitigating the LOCA.

FSAR 15.14.3.3.6 states that "The failure of transformer CT-4 has been identified as a more limiting single failure for the large break LOCA. With the assumed LOOP, this single failure results in a 48 second delay until Emergency Core Cooling System fluid is delivered to the RCS." If an event had occurred that would have rendered the normal power source to IX and 2X inoperable, the alternate power source could have been aligned by the manual operation of ACB-8 or ACB-7 breaker. Several factors allow time for this manual operation to occur: 1) ACB-8 and ACB-7 are manually operable, 2) Keowee Station is manned 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> per day, 3) Keowee Batteries can carry the DC loads for approximately one hour, 4)

Keowee Alarm Response Manual directs the operator on a loss of voltage to the 600 VAC Switchgear (IX and 2X) to verify feeder breaker tripped and close the alternate breaker, 5) the Keowee governor controls can be operated four and one half full cycles of the wicket gates before depleting the accumulator pressure (1 1/2 to 2 cycles are required for start-up, then minor changes afterwards). During a normal start the accumulator low trip of 250 psi will trip the Unit, but during a emergency start this trip is bypassed. Therefore, power can be regained manually to IX or 2X within a short time once the event is recognized.

However, even though technically inoperable, Keowee would still have been able to respond in a significant manner. Even in the condition described in this event, if a LOOP or LOCA/LOOP had occurred, Keowee Unit 2 would have responded to an emergency start signal by starting up with all necessary support systems powered by the Keowee DC Battery System and compressed air stored in an accumulator. Keowee would have been able to operate for an indeterminate time, during which the Keowee operator on duty should have time to diagnose the loss of AC power with the use of existing Abnormal Procedures and manually close ACB-8 to connect to the alternate power source.

As described above, emergency power would have been available, and even if a LOCA/LOOP had occurred during this time, the health and safety of the public would not have been endangered.

Figure "Attachment 1" omitted.

LER NO: 269/92-008 B-97 PRELIMINARY