ML18059B004

Rev 1 to EDG Fuel Supply Sys Storage Tank Tornado Protection Overview of EDG Fuel Supply Sys, Incorporating CARB Comments of 940318 & 24

ML18059B004
Person / Time
Site:	Palisades
Issue date:	04/05/1994
From:	CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
To:
Shared Package
ML18059B003	List: ML18059B002 ML18059B004
References
E-PAL-94-010, E-PAL-94-010-R01, E-PAL-94-10, E-PAL-94-10-R1, NUDOCS 9405310208
Download: ML18059B004 (25)

Text

EVENT REPORT.E-PAL-94-010 EDG FUEL SUPPLY SYSTEM STORAGE TANK TORNADO PROTECTION OVERVIEW OF THE EDG FUEL SUPPLY SYSTEM

• REVISION 1 *~ APRIL 5, 1994 MODIFIED TO INCORPORATE GARB COMMENTS OF MARCH 18 & 24, 19.94

. . I

TABLE OF CONTENTS

1. 0 EXECUTIVE

SUMMARY

. . . . . . . . . . . . . l i

1

2. 0 I

ORGAJ.~IZATION OF EVALUATION AND STATEMENT OF ISSUE 2 i2. l NRC ACCEPTANCE OF ORIGINAL DESIGN 3 2.2 GDC Ill - QUALITY STANDARDS . . . . . . . . 5 2.3 GDC 1/2* - PERFORMANCE STAJ.~DARDS . . . . . . 5 2.3.1 Storage Tank T-10 (Original Design Criteria) 5 2.3.2 Buried Piping (Original Design Criteria) 6 2.3.3 Piping in* SWS Intake Structure and EDG Rooms 6 2.3.4 Pumps P-18A.B (Original Design Criteria) 7 2.3.5 Fuel Oil Day Tanks T-25A.B (Original Design Criteria) 7 2.3.6 Isolation of Non-Essential Demands 7 2.4 GDC #3 - FIRE PROTECTION 8 2.5 GDC #39 - EMERGENCY POWER 8 TABLE 2 .1 . 11 3.0 ROOT CAUSE 12 4.0 SUBSEQUENT SYSTEM DESIGN ACTIVITIES/PROGRAMS/JUSTIFICATIONS 12 4.1 NRC ACCEPTANCE OF CURRENT DESIGN . . . . . . . . . . . . . 13 4.2 GDC #1 - QUALITY STANDARDS AND RECORDS . . . . . . . . . . 13 4.3 GDC #2 - DESIGN BASIS FOR PROTECTION AGAINST NATURAL PHENOMENA 13 4.3.1 Storage Tank T-10 . . . . . . . . . . . . 13 4.3.2 Buried Piping . . . . . . . . . . . . . . 14

~.3.3 Piping in Intake Structure and EOG Rooms 14 4.3.4 Pumps P-18A.B . . . . . . . . . . . 15 4.3.5 Fuel Oil Day Tanks T-25A.B . . . . .15 4.3.6 Isolation of Non-Essential Demands 15 4.4 GDC #3 - FIRE PROTECTION . . . . . 16 4.5 GDC #4 - ENVIRONMENTAL AND MISSILE DESIGN 16 4.6. GDC #17 - ELECTRICAL POWER SYSTEMS' GDC #18 - INSPECTION AND TESTING OF ELECTRICAL* POWER SYSTEMS 16 TABLE 4.1 17 TABLE 4.2 19 5.0 PROPOSED CORRECTIVE ACTIONS 19 6.0 HUMAN PPffiR.MANCE EVALUATION 20

7.0 CONCLUSION

21 8.o REFERENCES 21 ATTACHMENTS

i. REVIEW OF OPEN WORK ORDERS

2.

• INDUSTRY SURVEY OF FUEL OIL SYS EMS

3. RA VINCENT OPERABILITY LETTER DATED MARCH 11, 1994

4. RA VINCENT OPERABILITY LETTER DATED MARCH 21, 1994

5. J L KUEMIN OPERABILITY LETTER DATED APRIL 7, 1994

6. FUEL CONSUMPTION DET~INATION

I:*

1. 0 EXECCEVE SC~'-1:..\.RY This Event Report is the second event report issued on the Emergency Diesel Generator (EOG) Fuel Oil Storage and Transfer system within the last twelve months. The* first, E-PAL-93-026, addressed the issue of inadeq~ate T-10 capacity. The second, E-PAL-94-010, focuses on tornado prot~tion of T-10. This report summarizes a comprehensive evaluation of all of the equipment in the fuel oil transfer system from storage tank T-10 to the EOG day tanks with respect to the applicable General Design Criteria (GDC) in an effort to address not only the tornado issue, but also to identify all other potential general design criteria related issues with the system. The portion of the fuel oil transfer system from the EOG day tank to the diesel engine has not been included in this evaluation because it has always been considered safety-related by the plant.

The evaluation first establishes whether the fuel oil transfer system was designed as a safety-related system, such as the LPSI and CCW systems, or whether it was considered merely a support system for a critical function such as the diesel generator HVAC system. The conclusion drawn in the evaluation is that the EOG fuel oil storage and transfer system was originally designed as a safety-related system. It was designed to be a single header system with redundant active components. The evaluation also. concluded that diesel oil storage tank T-10 and buried piping did not get installed as described to the NRG during the licensing process. This is based on a comprehensive evalua-tion of the following:

• AIF rewrite of the proposed General Design Criteria in 1970,

• Specifications for the equipment,

.*Mechanical and electrical drawings including their revision blocks,

• Correspondence between Consumers Power and the Vendor,

• Correspondence between Consumers Power and the NRG (AEC) during the licensing process.

The following specific conclusions have been reached:

• Storage Tank T-10 should be protected from potential tornado missiles and flooding damage as committed to the NRG and as evidenced in the original design documents.

• Because the buried piping is not encased in concrete. as. originally stated to the NRC, determine whether to encase it or evaluate the risk

.from tornadoes, missiles, excavation, seismic, etc, and notify the NRG of a position change.

• Provisions should be made to isolate non-essential demands from the EDG day tank supply header when potential exists for failure of these lines.

• Because the storage tank T-10 and transfer system up to the day tanks was considered nonsafety-related after installation, it was considered "out of scope" by some analyses/evaluations such as seiche reanalysis and the 79-14 program. Such analyses may need to .b~ performed.

• The Palisades licensing position, with respect to the 1974 GDCs*,

should be clarified in the FSAR since the original GDC wording is different from the 1974 GDC wording.

e r.*

• Pl*ant documen. should be revised co assure that compor.encs are classified as Q.

• The impact of mainta1n1ng this system as a non-Q system for over 20 years needs to be assessed once criteria for this evaluation is

• completed.

In addition. chis event report was discussed with HPES with no problems i.de):"lt ified.

The system was determined to be operable per Generic letter 91-18, "Information to Licerisees Regarding Two NRG Inspe~tions Manual Sections on Resolution of Degraded and Nonconforming Conditions and on Operability," as documented in RA Vincent's letters RAV 94-022 dated March 11, 1994, RAV 94-024 dated March 21, 1994, and J L Kuemin's letter JLK 94-009 dated April 7, 1994.

2.. 0 ORGANIZATION OF EVALUATION AND STATEMENT OF ISSUE Organl.zation This evaluation is organized in two parts. The objective of the first part (Section 2) is to establish whether the EDG fuel oil transfer system from T-10 to the day tanks was designed as a safety-related or nonsafety-related system and compare the original design to the original GDCs (original FSAR, Appendix I). The second part (Section 4) has a number of objectives. They*are as follows:

• Compare the current design to the original (ie, 1970 proposed) GDCs.

• Compare the current design to the 1974 GDCs in the UFSAR (It is possible to meet the original GDCs and not meet the new GDCs.) and identify where Palisades response to the GDCs requires revision in FSAR Section 5.1.

• Identify required actions to bring plant in conformance with original GDCs and licensing commitments.

• Identify required actions to complete and make accurate the plant record.

This report provides an overview description of the Emergency Diesel Generator Fuel Oil System from T-10 to the day tanks. From DBD-5.03, the functional requirement of the fuel oil system, is to maintain a seven day on-site supply of available fuel oil for diesel generator operation.

Statement of Issue The original licensing commitments and corresponding design basis regarded the Fuel Oil Transfer System as a safety-related system. The remainder of Sections 2.0 and 3.0 provide the bases for this statement.

The following 1970 proposed General Design Criteria (GDC) apply to the EOG Fuel Oil System.

• 1_.

GDC No GDC Title 1 Quality Standards 2 Performance Standards 3 Fire Protection 39 Emergency Power II Table 2.1 shows how each original General Design Criteria has been addressed in the original design for each significant component of the Fuel Oil Transfer System from T-10 to the day tanks. The column headings indicate the following:

N/A GOG does not apply.

MEETS Original design is described as meets the GOG requirement if the implementation of the GDC is explicit.

NOT SURE No explicit implementation of GDC requirement can be found but, *

• PROBABLE Indirect indications are that the designers intent was to meet the GOG,

• NOT ?ROBABLE Designer may have intended to meet GOG but no indications to that affect are found.

DOES NOT MEET GDC requirement is not met.

2.1 NRG ACCEPTANCE OF ORIGINAL DESIGN The following summary of original licensing, design, and construction aspects of the fuel oil system indicate that the system was regarded as safety-related and was accepted by the NRG as designed.

1966 - 1967

• Original PSAR Section X:V response to AEC Proposed GDC Criterion 1 -

• The facility is designed so that the plant can be safely shut down and maintained in a safe shutdown condition during a tornado.

• Original PSAR Appendix A -

• The Emergency Diesel Generator System is CPCo Design Class 1.

• PSAR Amendment 1, in response to. AEC Question 1.3 -

• The emergency diesel and its associated equipment will be designed to function under the same earthquake loading as the engineered safeguards and will be designed to function under tornado conditions.

• Bechtel T-10 Sizing Calculation, February 27, 1967 (Reference 1) -

• One EOG operating seven days (note only one EDG proposed at this time).

• T-10 Specification ~-71 Revision 1. ~1ay 10, 1967, Issued for Purchase.

specified -

• . suitable for underground service

• buoyant force holddown straps

• design for seismic a~celerations

• SK~M-71-1 depicts buried T-10 with concrete slab tovering.

1968 - 1969

• P&ID M-214 Revision 0, October 16, 1968, Issued for Construction -

• Two EOG, one storage tank, one non-essential line with two branch lines, two normally closed, normally de-energized solenoid valves (SV-1413, 1414).

• Original FSAR Revision 0 Appendix I (November 1, *1968) Response to draft GDC 2 -

• These systems and components are designed, fabricated, and erected to withstand the forces imposed by extraordinary natural phenomena.,

• Original FSAR Appendix A -

• The emergency generator including fuel supply is CPCo design Class 1.

• Q&A between Division of Reactor Licensing (DRL) and CPCo on March 18-19_, 1969 (Reference .13) -

DRL - What provision has been made for separate fuel oil supplies for each diesel?

CPCo - Buried lines and storage tank, two transfer pumps, and separate day tanks in each diesel room are sufficient redundancy.

DRL - But a single line supplies both diesels?

CPCo - Yes, but its buried in concrete.

DRL - OK.

• FSAR Section.8.4.1.3 (April 10, 1969) -

• Day tank runs approximately 28 hours3.240741e-4 days <br />0.00778 hours <br />4.62963e-5 weeks <br />1.0654e-5 months <br /> before transfer from underground storage tank is mandatory.

• FSAR Section 8.4.l.2 (October 15, 1969) - The EDGs and their auxiliaries are designed-to withstand.Seismic Class 1 acceleration forces without malfunction. The EDG systems and components are installed in tornado prote~ted areas.

2. 2 CDC 1!1 - QUALITY STANDARDS GDC *11 requires that systems and components which are essential to the prevention, or the mitig~~ion of the consequen~es, of nuclear accidents

~hich could ca~se undue risk to the health and safety of the public shall be identified.

Since Appendix A of the original Palisades FSAR (Refe.rence 3) identifies the* "Emergency generators, including fuel supply" as CPCo de~ign Class l it is concluded this CDC might be applicable. Proof lies with meeting the other CDCs.

Other items of GDC #1 focus on additional attention to be paid to these systems or components. FSAR Appendix I (Reference 4) indicates the general response to.these items.

GDC ffl is a motherhood type GDC and a specific system would have to meet other applicable criteria in order to be able to state that it meets GDC

!fl. As shown in later sections of this document, the other applicable GDCs are regarded as being satisfied and hence GDC #1 is considered to be satisfied.

2.3 GDC #2 - PERFORMANCE STANDARDS 2.3.1 Storage Tank T-10 (Original Design Criteria)

Tank T-10 was originally designed and fabricated as being a buried tank with a concrete pa~ ovei the tank pe~ Reference 10. Drawing SK-M-71-1 of Reference 10 included a concrete slab above the tank. Reference 10 also required the tank vendor to consider design seismic loading conditions in his design with buoyant force hold-down straps.

The installation details of the tank are shown on Reference 11. The tank is shown supported on a concrete slab located at Elevation 580 -9 11 ,

1 which means the tank will be partially above grade. Reference 11 shows that the grade elevation in this area would have to be raised from 590'-

011 to a plateau at 594'-0" to provide approximately 6 of soil covering 11 for the highest point of th~ tank. Only Revisions 3 and 4 of Reference 11 were located, but a review of the descriptions for Revisions 1 and 2 strongly indicate that the original construction issue of the drawing (Revision 0) also included the requirement for the plateau at 594'-0".

Thus between the time the tank specification was awarded to Buffalo Tank DivisioD:,in May of 1967 and the time that Reference 11 was initi'ally issued for construction in August of 1967, the concrete pad above the tank was deleted. An exhaustive search for justification for the current tank installation failed to locate supporting documentation for the change in burial.

The above disc\.ission indicates that the original Bechtel design for T-10 took earthquake loading conditions into consideration. In addition, tornado loadings were considered by Bechtel due to locating the tank . . '

completely underground with.a concrete protective cover '(slab), however the tank installation was changed to delete the concrete slab and only partially bury the tank. These design factors strongly suggest protec-tio.n for T-10 as if it were a safety related tank.

Installation of T-10 above ground is cheaper than undergound. The tank could have been buried to contain oil spillage, however it appears that

.pro'.'isions were not made. (or containment of oil spillage in the* original design of T-10. Therefore, T-10 was not buried to alleviate oil spil-lage concerns, but rather .this more expensive installation technique ~as to be used to address earthquake and tornado missile events.

Hold-down straps were designed for an upward buoyant force on an empty tank assuming water level to be four feet above the -b~ttom elevation ~f the tank. The maximum water level for design basis flood or seiche at the time of the original- design of the tank was 590' -0 per the FSAR.

11 Buoyancy force as described above may be equivalent to the largest buoy-ancy force on a full tank. Hence, in Table 2.1, for external flooding, the "PROBABLE" column is marked. However, further engineering analyses will be required to ensure that* the external flooding phenomena ( seiche) can be s~tisfied.

Thus, the tank T-10, as originally designed, is considered to satisfy GDC #2 requirements as describe<l in Table 2.1.

2.3.2 Buried Piping (Original Design Criteria)

Piping between T-10 and the SWS Intak~ Structure and from the Intake Structure to the Auxiliary Building is HB-5 (welded) class piping per Reference 12. A single line is routed from T-10 to the. P-18A,B pumps and a single line is routed from the discharge of the pumps to the auxiliary building where it splits into two lines, one for each of the EOG day tanks. During the plant licensing phase, the NRG questioned why a single line was provided between T-10 and T-25A,B (Reference 13).

They were informed that the line was encased in concrete, however this is not entirely correct. Only a portion of the line, as it passes under*

the turbine and auxiliary building, is encased in concrete. The NRG accepted the response and did not subsequently discuss this issue in the Safety Evaluation Report.

Because of the small pipe size,* welded construction and burial in the ground, it is probable that a detailed evaluation will verify seismic adequacy. The single buried line cannot be demonstrated to ,be single failure proof. Encasing the buried piping in concrete would most likely had provided adequate tornado missile and earthquake protection.

External flooding, wind and ice loadings are not applicable for this piping because it is buried. A very small segment of the piping as it leave~. ._.top of_the tank and enters into the valve pit next to the tank is potentially susceptible to a tornado missile hit. The flame arrestor for T-10 is located above ground and is susceptible to tornado missiles and earthquake events also, but this component does not perform any safety-related function.

Thus, the buried piping, as originally designed, is considered to satisfy GDC a requirements as described in Table 2.1.

f.3.3 Piping in SWS Intake Structure and EOG Rooms (ie. above ground) 1 (Original Design Criteria)

Fuel Oil piping in the Intake Structure and EOG rooms is HB-5 (welded) class small bore piping (Reference 12). No specific requirement to

design this p1p1ng for seismic loadings has been found. The p1p1ng is 3 inch and under and located at low elevations where the seismic design values ar~ low compared to those at higher elevations in the buildings.

Because of the welded construction and small pipe size, the "PROBABLE" cohunn is marked for the earthquake event in Table 2 .1.

Note that only the fuel oil supply piping to the T-25A.B day tanks has been included in this evaluation as fuel oil piping from T-25A,B to the EDG belly tanks has always been c?nsidered safety-related.

The piping is considered to meet all the other GDC conditions mentioned in Table 2.1 because it is inside the safety-related Class 1 buildings.

2.3.4 Pumps P-18A.B (Original Design Criteria)

Pumps P-18A and P-18B are located in the SWS Intake Structure, which is des igne.d to withstand earthquake, tornado; wind and ice loadings.

The pumps were purchased from Goulds Pumps via Reference 14. The specification required the pumps to be designed to meet seismic loading conditions. Because they are located inside the building, the pumps are considered to meet all of the other loading conditions mentioned in Table 2. 1.

2.3.5 Fuel Oil Day Tanks T-25A.B (Original Design Criteria)

Tanks T-25A and T-25B were field fabricated per designs specified by Bechtel. The original design or fabrication drawings were not located but the as-built configuration is shown on References 15 and 16. The tanks are located within separate concrete enclosures in their associ-ated diesel generator room. A document that specified these tanks to be seismic has not been located. The tanks are field fabricated and the details shown on the drawing seem to indicate that the person preparing the drawings was cognizant of seismic forces. Thus the "PROBABLE" column has been checked for earthquake in Table 2.1.

The day tanks are considered to meet other loading conditions in Table 2.1 because they are located in the Auxiliary Building.

2.3.6 Isolation of Non-Essential Demands

• P&ID K-214 Revision 0 (October 16, 1968), Issued for Construction, Depicu.--che fuel oil transfer system as:

A. One* storage tank (T-10).

B. Single T-10 discharge line.

C. Two transfer pumps (P-18A,B) taking suction off a common header and discharging to a common header.

D. Single supply line serving two EOG and one "non-essential" line.

E. Single non-e~~ential line originates in EOG room with branch lines to diesel fire pump day tank and heating boiler day tank. The two

1*

\

branch lines are isolated by normallv closed, normally deenergized solenoid valves sV-1413, SV-1414. -

Thus, as originally designed, the system was essentially dedicated to its main function of serving as the fu_el supply line to the EDCs and provided for isola~ion of non-essential fuel oil demands on T-10.

The power co the transfer pwnps also facilitates isolation of the non-essential header. Refer to GDC 39 discussion.

2 .. 4 CDC ff3 - FIRE PROTECTION Fire Protection measures would not have been considered applicable for the buried Tank T-10 and the buried piping. In general, at the time of original design (late 1960's), fire protection measures for the EDC fuel oil system were not common practice. Sprinklers were provided in the diesel generator rooms for the EDC system as a whole (Reference 5).

2.5 CDC #39 - EMERGENCY POWER The emergency diesel generator fuel oil system was designed with a variety of features to maintain adequate independence and redundance to.

ensure its functioning assuming a failure of a single active component.

These features include two separate Diesel Engine Auxiliary Day Tanks (T-25A,B) and associated level/inventory control systems and power supplies, and two separate Fuel Oil Transfer Pumps (P-18A,B) and associated control systems and power supplies.

Fuel Oil Storage Tank T-10 has a single set of level instrumentation (Reference 24). Since it is a single set, it is not independent, redundant, or single failure proof although it is testable. However, its purpose is to provide a "low" level alarm (References 24 and 34) which is not required for the operation of the fuel oil system. Thus, it is not necessary that 'the tank's level instrumentation be indepen-dent, redundant, or single failure proof.

• Each diesel generator day tank has its own level/inventory control system (Reference 24). The control system for each one includes two separate* control switches, one for each fuel oil transfer pump, a fuel oil day tank supply solenoid valve, and two fuel oil day tank level switches, one for "low" level and *one for "full" (References 32, 32, 35, 36, and 37). The cables for each control system are routed in separate raceway channels except where they come together to interface with the control system fo.r each fuel oil transfer pump (Reference 29). The power for each control system is supplied from separate Class lE power system channels (References 30 and 31). Therefore, the day tanks' electrical design.is independent, redundant, testable, and single failure proof.

Each fuel oil transfer pump has its own control system (Reference 27).

The control system for Fuel Oil Transfer Pump P-18A is designed to per-mit manual and automatic running and shutoff of the pump (References 35 and 3 7). whereas the.* control system for Fuel Oil Transfer Pump P-188 is designed to permit manual running and shutoff of the pump only (Refer-ences 36 and 37). The power for Pump P-18A and its control system is supplied* from a non-Class lE power system (MCC 8) (Reference 35) which

also supplies power to loads required to conform with Technical Specifi-cation requirements (Reference 38). The power for Pwnp P-18B and its control system is supplied from a Class lE power system (MCC 1)

(Reference 36). This Class lE power system channel 'is separate from that one which supplies Pump P-18A (References 30 and 31).

Alth,ough there are two separate. fuel oil transfer* pumps' and associated control systems and power supplies, . the cables* for each are. run together in many raceways (Reference 29). It should be noted that within the limitations of having only two fuel oil transfer pumps and four day tanks to fill, one for each safety-related diesel generator, one for the nonsafety-related diesel.fire pump, and one for the nonsafety-related boiler, the electrical design developed for the fuel' oil transfer pumps was logical as the optimum at the time the plant was designed in the late 1960's.

The best alternative would have been to have an electrical supply which met all safety-related requirements* for the power to the pumps and pump controls for the EOG day tanks. A nonsafety-related control system would' then be designed for the boiler and diesel fire pump day tanks, since there were only one s'et of transfer pumps and both were required for redundancy requirements for the EDGs, it would have been necessary to interface the nonsafety controls with the safety-related controls and motor power for.the transfer pumps. Failures or malfunctions in the nonsafety system could. then have compromised the safety system which was unacceptable.

It is believed the solution was to make the entire system nonsafety but reliably powered, since controls had to be in the boiler room, for exampl~. Since the fuel o:il. system design is now known to have been reviewed at the time of licensing by the NRC, this arrangement must have been acceptable.

The power source and control system arrangements are also believed to have been carefully thought out. Pump P-18A has the automatic controls and is supplied from MCC 8. Pump P-188 .has manual controls and is fed from MCC 1. In the event of a loss of offsite power, MCC 8 is shed but readily available. The. pump which i's supplied from automatically restored MCC l is manual-only control. Thus, operator action is requirELcLto start. e.~,ther pump following a loss of offsite power, significantly reducing the chance of pumping oil to failed piping in the non-essaotial header.

The fuel oil transfer.pumps' electrical and control system design is redundant and testable but not independent or single failure proof. It appears that the emergency diesel generator fuel oil transfer system was designed to meet the requirements of GDC 39 insofar as how it was inter-preted as an industry issue in the late 1960's. Portions of the design may not meet today's requirements, however, that is to be expected since many documents were*issued by the NRG. after .~he plant was designed which specify acceptable designs and methods for compliance with the current GDC on issues such as separation requirements for control systems inter-facing with safety-related and nonsafety-related portions of the plant.

It should be noted that the day tanks were originally designed with a fu~l oil capacity in excess of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (Reference 28). Thus, it may

have been thought that ~his would provide adequate time to perform repairs to ensure operation of one pump due to a failure ~f a single active component.

~ .

I l

-e TABLE 2. l ORIGIHAL DESIGR CORFOllHA!ICE TO ORIGIHAL GERERAI.. DESIGR CRITERIA

" DOES ORIGINAL DESIGN ME! SOC?

NOT SUR! JCES

~O!

GDCI> ITEM N/A MEETS PROBABLE NOT ?RO BABLE 1-!E:::T l Quality Standards x Earthquake x 2

Storage Tanlc Tornado x T-10 External Flooding x Tornado Missile x Wind, Ice x Earthquake x Tornado & Missile x Buried Piping (Welded} External Flooding x Wind, Ice x Earthquake x Piping in Intake Tornado & Missile x Structure and EDG Rooms External Flooding x r Wind, Ice x Earthquake x Tornado*& _Missile .x Pumps P-18A&B I External Flooding x Wind, Ice x I I

Earthquake x '

Dq Tmka Tornado & Missile External Flooding x

x I

~

Wind, Ice x T-10 x Buried Piping x 3 Fir* Protection Pumpa P-l8A&B x Indepandmt x Redundant x I

39 T-10 Electrical I Tea table x I Single Failure x Proof "

12 JCES OR!G:NAL ::>ESIGN ~ET GDC?

NOT SURE DOES NOT

• cc1; ITEM N/A ~ETS PROBABLE NOT PROBr.BLE ~

  ::!

Independent x 39  ?*.!lllpS ?-c3A&B

• Redundant* x Elect.=ical Testable ' x Single Failure x Proof Independent x Day Tanks Redundant x Electrical Testable x Sing la Failure x Proof Isolation of Piping From the Nonessential x Demands 3.0 ROOT CAUSE Based upon the above evaluation, the intent of the original system designers is clear. The fuel oil system was designed as a safety-related system. The documentation on the system design from the original design organization was somewhat poor and consequently, the station was unaware of the safety classification of the fuel oil supply system. Due to the disconnect, the. station believed the system to be nonsafety-related. In addition, the brevity in the FSAR description of the Fuel Oil Transfer System permitted leeway in interpretation and consequently, the wrong interpretation.

4.. 0 SUBSEQUENT SYSTEM DESIGN ACTIVITIES/PROGRAMS/JUSTIFICATIONS This section describes the design basis enhancements and physical modifications performed to the system over the last 20 years. The description format is parallel to that of Section 2.0 of this report.

The following General Design Criteria, as they appeared in 10CFRSO, Appendix A on July 7, 1971 apply to the EOG Fuel Oil System. A compariaoa, of the Palisades design against these GDCs is provided in FSAR Section 5.1.

l j GDC :10 GDC Title i* quality Standards and Records 2 Design Basis for Protection Against Natural Phenomena 3 Fire Protection 4 Environmental and Missile Design Bases 17 Electrical Power Systems 18 Inspection and Testing of Electrical Power Systems Table 4.1 identifies to what extent conformance to the 1971 General Design Criteria has been addressed in the current design of the system.

The column titled "Proposed Corrective Actions" refers to specific actions which can be performed to bring the design into full conformance with the original GDC or to reconcile the present design basis with CDC requirements as described in Section 5.0.

Table 4.2 shows which CPCo responses to the 1971 GDCs in FSAR Section 5.1 need revision. The revisions will identify exceptions to the GDCs for the EDG fuel oil system.

4.1 NRC ACCEPTANCE OF CURRENT DESIGN The following subsections describe NRG acceptance of current design during various programs such as the Systematic Evaluation Program (SEP),

Appendix R Fire Protection Program, the EDSFI, etc.

4.2 GDC #1 - QUALITY STANDARDS AND RECORDS Similar to the original FSAR, Revision 16 of the FSAR (Reference 9) continues to identify the system as a CPCo Class 1 system. However, as mentioned earlier in this report, the station has looked upon this system as nonsafety-related. Until the impact of maintaining this system as non-Q is assessed, it is not possible to say that the system meets GOG #1. Hence, Table 4.1 indicates that GDC #1 is not met and Section 5.0 recommends assessing the impact.

4.3 GDC #2 - DESIGN BASIS FOR PROTECTION AGAINST NATIJRAL PHENOMENA 4.3.1 Storage Tank T-10 Recent analyses have been performed by Stevenson & Associates as to the seismic adequacy* of T-10 (Reference 19) as part of the SQUG Program.

This effort established the seismic adequacy of T-10.

Further engineering analyses will be required to evaluate the ability of T-10 to withstand the effects of a tornado and tornado generated missiies.

As discussed in Section 2.3.l of this report, it appears that the seiche design (external flooding) condition can be satisfied, however further engineering analyses will be required as the current seiche level of

i*

593' -6" (per Reference 20) is higher than the original des1gn value of 590' -0" from the original FSAR.

4.,3.2 Buried Piping Based upon Reference 21, all buried p1p1ng for Palisades was qualified to withstand the earthquake event by choosing a typical line (Auxiliary Feedwate'r) and analyzing the line for the expected loads. By simi-larity, all other lines were considered qualified. To confirm this analysis, further reviews were required to document that the Reference 21 analysis fully complies with current earthquake, tornado, missile and external flooding design requirements. Stevenson & Ass6ciates performed a seismic load analysis and determined all of the buried piping from T-10" to the day tanks to be seismically qualified (Reference 2).

Without additional analyses the single buried line between T-10 and the Intake Structure and between the Intake Structure and the EDG rooms can-not be demonstrated to be single failure proof. A further review is re-quired to determine if a portion of these pipe runs is either encased in concrete or routed under the building basemats. If encased in concrete, the design will probably be acceptable to the NRG based upon Reference 13, however the portion that is buried below grade and not encased in concrete must be evaluated further. Draw~ngs C-7, C-5 and M-73 provide the routing of this piping:

Tornado, missile, wind and ice loadings and external flooding are not applicable to the buried piping wi.th the exception of the above ground piping at T-10. This portion of the piping is not protected from tornadoes and missiles and therefore Table 4.1 identifies this as "Not Probable."

4.3.3 Piping in Intake Structure and EDG Rooms The fuel oil piping in the Intake Structure must be further reviewed for seismic adequacy as this piping was excluded from the IE Bulletin 79-14 program per Reference 18. The fuel oil piping in the EDG rooms has been verified to be part of the IE Bulletin 79-14 program (Drawing M-110, Sheets 914 and 915). These drawings plus serial package 033395 plus Specification Cl73-Q, Revision 0, indicates the EDG room piping was walked down and evaluated per the chart method as seismically qualified.

The rouc:,ing of the fuel oil supply piping within the EDG rooms must be reviewed-'for the single failure criteria for evaluations performed since 1971, such as 'HELBA since a common header is routed *first into the first EDG room and then to the second EOG.

All other scenarios such as tornado, missile, external flooding, internal flooding, wind and ice loadings are satisfied since the piping is located in the Intake Structure and EDG rooms which are designed to withstand these events.

There are no internal flooding sources that would affect the fuel oil piping in the EOG rooms.

• - f 4.3.~ Pumps P-18A.B I I

I

.-\nalvses to ensure that the pumps are designed to withstand the internal I flooding event due to large pipe breaks within the intake structure have not been located, nor has an exemption from this requirement. A curb is located around the pt.imps but it may not be high enough to protect against an internal flooding event.

Additional analyses are required to evaluate the effect of the design basis surge level (exterior flooding event) established per Reference

20. This document established the surge level as 593' -6 11 All other scenarios such as tornado, missile, earthquake, wind and ice loadings are satisfied since the pumps are located in the Intake Structure which is designed to withstand these events. The pumps themselves were designed to meet seismic loading conditions and were evaluated as part of the SQUG program and determined to be seismically adequate.

4.3.5 Fuel Oil Day Tanks T-25A.B Seismic adequacy of Tanks T-25A and T-25B was demonstrated in the Palisades SEP via References 22 and 23. During the 1994 NRG Diagnostic evaluation, the NRG provided an observation (Eng-005) which questioned the seismic qualification of the day tanks due to a lack of SEP documentation. Recently an evaluation was performed by NEGO structural group to determine the adequacy of the documentation associated with the structural integrity assessment of the day tanks. The evaluation concluded that the day tank floors have not been explicitly evaluated in the SEP work scope. However, the assumption that the. tank floor is non-limiting and need not be specifically evaluated is reasonable and the day tank, with modifications, is structuraily adequate.

The internal flooding event scenar:io is satisfied for T-25A,B as the tanks are located in individual rooms designed to restrict the spread of fuel oil. No other lines (eg, fire sprinkler) that could initiate the floodirig event are located in these rooms.

All other scenarios such as tornado, missile, external flooding, wind and ice loadings are satisfied since the day tanks are located in the Auxiliary Building which is designed to withstand these events.

4.3.6 Isolation of Non-Essential Demands Later revisions of M-214 show additional fuel demands have been placed*

on the EOG fuel oil system for non-essential items. These revisions are described below.

• M-214 Revision 3 (March 27, 1970) -

Two "non-essential" lines (Fire Pump line relocated to pump discharge in SWS intake structure). Line isolation at so.lenoid valves SV-1413 (Diesel Fire Pump) and SV-1414 (Heating Boiler).

• M-214 Revision 4 (June 9, 1972) -

Three "non-essential" lines (Line added for T-40). Branch line added to heating boiler line for.evaporator heating boiler tank T-39. Total

}!

of four branch lines with three isolated at SV-1413, SV-1414 and fourth isolation not identified.

• M-214 Revision 22 (J~nuary 10, 1984) to Present Revision 39 -

Three "non-~ssential" line~ with total of six branch lines.

Currently, all isolation valves on the non-essential .lines are non-Q per equipment database.

As indicated, since initial design, additional branch lines to the main supply header have been added and have imposed additional non-essential demands on the fuel oil supply from T-10. These non-essential lines are isolated with non-Q values. Thus, Table 4.1 shows this item as "does not meet" the proposed corrective action is referred to on the table.

4.4 GDC #3 - FIRE PROTECTION Table 4.1 specifies N/A for fire protection for tank T-10 and the buried p1p1ng. For Pumps P-18A&B, additional sprinklers were added during the 10CFRSO, Appendix R fire protection program (Reference 6). The day tank areas were reviewed, and determined to be adequate (Reference 7).

4.5 GDC #4 - ENVIRONMENTAL AND MISSILE DESIGN

'The EOG system has been designed to aid in achieving a safe shutdown of the plant in the event of a LOCA. Pipe whip considerations are not applicable for the EOG fuel oil system since these lines are themselves not high energy lines and there are no other high energy lines in the SWS intake structure or in the EOG rooms.

Hence, Table 4.1 identifies GDC #4 as being met for LOCA and as N/A for pipe whip. Internal flooding has been addressed in sections above for individual components and additional action has been recommended.

The plant as a whole has been evaluated for light aircraft in the vicinity hitting the plant as a missile (Reference 8), and the '.

evaluation shows that this is not a concern for the Palisades plant.

4.6. GDC #17 - ELECTRICAL POWER SYSTEMS I I

GDC fl.18 - INSPECTION AND TESTING OF ELECTRICAL POWER SYSTEMS '[

As previously discussed, original GOG #39, "Emergency Power," applied to the eme~cy diesel generator fuel oil system. The requirements of this original GDC are now enveloped by 1974 GOG No 17, ".Electrical Power Systems," and 18, "Inspection and Testing of Electrical Power Systems.*

With regard to whether the present design of the fuel oil system meets 1974 GOG No 17 and 18, the discussion contained in Section 2.5 of this report is still applicable to the current GOG requirements. Subsequent system design activities and programs have not affected the conformance of the emergency diesel generator fuel oil system to these GOG. Thus, the separation required by-today's pr~ctices would need to be met to conform to GOG 1117*.

~

r -:.

TABLE 4.1 '*

CliHJlEllT COlmHWICE ro CEIGlllAL GEllEllAL DESIGll CRITERIA AllD l'HOl:'OSED <nlBECTIVE ACTIONS DOES CURRINT DESIGN HEET GDC?

NOT SURE DOES ORIGINAl; NOT PROPOSED CORRECTIVE ACTIONS GDCf ~rmt N/A HEETS PROBABLE NOT PROBABLE HEET <SEE SECT ION ))

l QuaUt.y St.uidorda x Item lA thcu IL. 2A, 21l Eart.hquaka x 2

St.oraga Tank Tornado & Hiaail* x Items IA, 11, IJ, IL T-10 Ext.arnal Flooding x Item IA, IJ Wlnd, Ice x Earthquake x Tornado & Hiaalle x Item IF, IJ, IK Buriad.Plping (Welded) External Flooding x Wind, lea x Earthquake X(EDG) X(SWS) Item 18, IK Piping in,sws Tornado & Hiaaila x Int.aka Structure and EOG Rooma External Flooding x Wind, Ice x Earthquake x Tornado & Hiaaile x Plmipa P-18A&ll External Flooding x Item IC. lD, I.I. IK Wind, Ice x Earthquake x Tornado & Hiaail* x Day Tanka -

External Flooding x Wind, Ice x

r* ....

TABLE 4.1 CUJlREllT ootm:.litWICE TO CIUGlllAL GEllJ!llAL Dl!SIGll CIUTl!IUA AllD PllOPOSl!D COIJU!CTIYE ACTICIIS (Cont.ioued)

DOES CURRENT DESIGN MEET GDC?

HOT SURE DOES ORIG I MAL HOT f'ROPOSEU COJ{){ECTIVE ACT ION::>

GDCf l'HH H/A MEETS PROBABLE HOT PROBABLE MEET (SEE SECTION ))

3 Fir* Protection T-10 x Buried Piping x Pumpa P-18A&ll x Independent x Item IJ, zc Redundant x Item l.J. zc 39 T-10 E.lectrical Testable x Single Failure x I tein I.I* 2C Proof Independent x Item lJ, zc Pump* P-18A&ll Redundant x Electric el Testable x Single Failure x Item IJ, zc Proof Independent x Day Tanke Redundant x Electrical Testable X*

Single Failure x Proof Iaolation of Piping From the x It~m::t IE, JG, I.I Non-eaaential/ Hon-safety related Demands

~-*~ __.___ ...__

---

- - - - ---~-"-=-~--~

TABLE 4.2 REQUIRED REVISIONS TO FSAR SECTION 5.1 (CPCo Response to 1974 GDCs)

FSAR 5. 1 REVIS ION 1974 ITEM REQUIRED GDC#

YES NO 1 Quality Standards & Records x 2 Design Bases for Protection x Against Natural Phenomena

-~- 3 Fire Protection x LOCA x 4 Environmental Pipe Whip x and Missile Internal x Design Bases ;Flooding Aircraft x Internal x Missiles 17 Electrical Power Systems x 18 Inspection and Testing of x Electrical Power Systems

• 5. 0 PROPOSED CORRECTIVE ACTIONS

1. REQUIRED ACTIONS LEADING TO BRING PLANT INTO CONFORMANCE WITH ORIGINAL GDCs AND LICENSING COMMITMENTS, INCLUDING TEMPORARY MEASURES.

A. Prepare a request for modification to upgrade T-10 for tornado and flooding protection and/or generate a cost estimate to replace the existing T-10 with a tornado, seismic, flood, fire protection, and environmentally qualified tank.

B. Evaluate/analyze the above ground piping in the SWS intake structure for earthquake adequacy, and upgrade as appropriate.

C. Evaluate P-18A,B for external flood adequacy, and upgrade *as appropriate.

D. Provide sand bags around P-18A, B up to Elev 593.5 ft.

E. Evaluate necessary operator actions and .controls to minimize or eliminate diversion of dedicated EOG fuel oil through

/,A CJ

.J'-, 'i: ~\

nonessential/nonsafety-related lines. Revise procedures and analyses as appropriate.

F. Because the buried piping is not encased in concrete as originally stated to the NRC, determine whether to encase it or evaluate the risk from tornadoes. missiles, excavation, ecc. and notify the NRC of a position change.

G. Evaluate nonessential branch piping up to first isolation point for seismic, tornado adequacy. Upgrade as appropriate.

H. After developing the appropriate review criteria, evaluate and assess the impact of maintaining the transfer system as nonsafety-related, non-Q since installation. Issue a letter to NECO and Palisades staff personnel indicating the EOG fuel oil storage and transfer system is to be considered safety-related.

State the electrical power and controls are "Q" but not lE.

I. Evaluate above ground (ie, above 590 el) piping at T-10 for tornado, and upgrade as appropriate.

J. Finalize Procedure SOP-22 Attachment 5 to provide alternate means of filling the day tanks in the event of loss of the primary transfer method.

K. Provide a barrier (eg, sawhorses) around the exposed pipe, and seal its penetration on the South side of the SWS Intake structure.

L. Provide a barrier (eg, sawhorses) around T-10 and provide additional cover over the exposed pipe at east end of tank to prevent inadvertent damage.

M. Evaluate internally generated missile events for common fuel oil supply line in SWS intake structure and EOG room.

2. REQUIRED ACTIONS TO COMPLETE AND MAKE ACCURATE THE PLANT RECORD.

A. Perform Q-list interpretations for transfer system (safety-related) which are curr*ently identified as non-Q.

8. Update all design basis documents eg, OBDs, Tech Spec, FSAR, etc as appropriate.

C. Revise the FSAR to reflect the "as licensed" electrical design of the EDG Fuel Oil Transfer System.

6.0 HUMAN PERFORMANCE EYALUAIION This evaluation has been discussed with HPES. No problems were identified for two reasons. First, E'~PAL-93-026 concerned the quantity of fuel required for seven days, while this event report deals with a GDC issue - tornadoes. Though seismic requirements became an issue on E-PAL-93-026 when discussing T-926, it was not the primary focus of the event report . . Second, during the time E-PAL-93-026 was discussed, the tornado protection issue was believed to be a missing documentation

21 issue which would be successfully resolved as over 95% of the DBD issues normally are. It wasn't until recently a legitimate problem was suspected.

7. 0 i CONCLUSION II Based upon the above evaluation, it appears the o.riginal designers of the EOG Fuel Oil Transfer System in~ended it to be safety-related.

Correspondence between CPCo and the NRC also supports the original intent to provide a safety-related transfer system .

. The system has not been maintained as safety-related as evident by the Q-list and other design documents and procedures.

As a result of the activities presented in this evaluation, a 10CFRS0.59 safety evaluation was performed and an unreviewed safety question was identified.

Two CARB meetings have been held since the initial writing of this evaluation. Consequently, this evaluation has been revised and the following additional acti'ons *per.formed:

1. Review of open*work orders on the EOG fuel oil transfer system.

2. Industry survey of.EOG fuel oil transfer_ system design.

The results of these actions are included as Attachments 1 and 2.

8.0 REFERENCES

1. Bechtel Calculation dated February 27, 1967, Diesel Oil Storage Tank Sizing (0231/0230)

2. Stevensons & Associates Calculation 92C2750-C013 dated March 17, 1994, Check Buried Piping for Displacement.for Palisades IPEEE Program *

3. Appendix A, Original Palisades FSAR

4. Appendix I, Original Palisades FSAR

5. Section 9.6.2.1, Original Palisades FSAR, Pages 9-34

6. :Palisades Nuclear Plant, Fire Protection Program Report, Volume 1, Part II, Attachment 1, Commitment #77

7. Palisades Nuclear Plant, Fire Protection Program Report, Volume 1, Part III, Page 19 8 .. NRG Letter to CPCo dated August 3, 1981, SEP Topic III-4.D, Site Proximity Missiles (2642/1678)

9. F'.SAR, Revision 16, Page 5.1-2, Table 5.2-3, Sheet 13

.;.('

.~.

~*;

CJ

• I f

I

' )

10. ,Palisades Specification M-71, Revision 0, dated March 27, 1967, 1

Diesel Oil Storage Tank T-10

11. Drawing C-228, Miscellaneous Yard Structures

12. Drawing ~-214, Piping & Instrument *Diagram, Lube Oil. Fuel Oil and Diesel Generator Systems 13.; CPCo Meeting Minutes dated March 24, 1969, Discussions with DRL, March 18-19, 1969 (0616/0414)

14. Palisades Specification M-34, Revision 2 dated November 25, 1968.

Diesel Oil Transfer Pumps and Mot9r Drivers

15. Drawing 950W48*Ml2, Sheets 67 and 68, Revision 0, dated March 18,

• ._ ~

1981, Fuel Oil Day Tank T-25A

""'-.... ~----

16. Drawing 950W48*Ml2, Sheets 69 and 70, Revision 0, da_ted March 18, 1981, Fuel Oil Day Tank T-258

17. Drawing F&K-C-104-30(Q)

18. CPCo Internal Correspondence K E*Osborne to J H Palmer dated February 20, 1980, Seismic Category I Piping - Diesel Generator Fuel Oil Supply (0566/0399)

19. Analysis, Stevenson and Associates dated August 20, 1993, Seismic Analysis of T-10 (Later)

20. NRG Letter to CPCo dated October 7, 1982, SEP Topics II-3.A, II-3.B, II-3.B.l and II-3.C (2669/1002)

21. NUREG/CR-1833 dated January 1981, Seismic Review of the Palisades Nuclear Power Plant Unit 1 as Part of the Systematic Evaluation Program (2640/2104)

22. NRG letter to CPCo dated March 27, 1981, SEP Topics III-6 and III-11 - Seismic Revi~w (2641/0395)

23. NUR.BG-0820 Supplement No 1 dated November, 1983, Integrated Plant Safety Assessment Systematic Evaluation Program (3119/1494)

24. Palisades Design Basis Document DBD-5.06, Revision 1, "Control and Monitoring Systems for Emergency Generator and Auxiliaries"

25. Deleted 26.

27.

Deleted Palisa~es Design Basis Document DBD-5.01, Revision 1, "Diesel I

Engine and Auxiliary Systems"

28. Palisades Design Basis Document DBD-5.03, Revision 2, "Emergency Diesel Generator Performance Criteria"

29. Palisades Electrical Circuit and Raceway Schedule dated August 1993

. I

J.i -t..-!~ r~

• ) ) *;>> -* "-

'. l 1

~. .)

30. Palisades Drawing_ E-1, Sheet 1, Revision AS, "Plant Single Line Diagram"

31. Palisades Drawing E-1, Sheet 2A, R~vision 2, "Plant Single Line Diagram"

32. Palisades Drawing M-12, Sheet 97, Revision OB, "Engine Starter I DG 1-1"

33. Palisades Drawing M-12, Sheet 104, _Revision OB, Engine Starter DG 1-2"

34. Palisades Drawing E-87, Sheet 2, Revision 13, "Level Indicator and Al.arm Instrumentation

35. Palisades Drawing E~l78, Sheet 1, Revision 17, "Di.esel Oil Transfer rumps"

36. Palisades Drawing E-178, Sheet 2, Revision 17, "Diesel ~il Transfer Pumps"

37. Palisades Drawing E-178, Sheet 4, Revision 2, "Diesel Oil Transfer Pumps"

38. Palisades Design Basis Document DBD-3.05, Revision 1, 11 480V AC System" I

I

_l