ML20209C215
| ML20209C215 | |
| Person / Time | |
|---|---|
| Site: | Prairie Island, Fort Calhoun, 05000000 |
| Issue date: | 01/21/1987 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML20209C178 | List: |
| References | |
| REF-GTECI-124, REF-GTECI-NI, TASK-124, TASK-OR TAC-61519, TAC-61520, NUDOCS 8702040222 | |
| Download: ML20209C215 (52) | |
Text
F' e
SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION AUXILIARY FEEDWATER SYSTEM RELIABILITY (GENERIC ISSUE NO. 124)
WITH RESPECT TO PRAIRIE ISLAND NUCLEAR GENERATING PLANT ONIT NOS. 1 AND 2 t
- b l
8702040222 870121 DR ADOCK 05000285 PDR
a Table of Contents A.
Executive Summary and Conclusions 11 B.
Introduction 1
C.
Resolution Approach 1
D.
Evaluations D.1 Design and Configuration 3
D.2 Maintenance, Surveillance and Testing 11 D.3 Emergency Operating Procedures 17 D.4 Instrumentation and Control 21 D.5 System Walkdown 25 D.6 Training 33 0.7 Operating Experience and Reliability Analysis 36 Appendix A - References 43 Appendix B - NRC and Licensee's Personnel 46
..w
-r e,;,
-i-J
b Prairie Island Units 1 & 2 - Auxiliary Feedwater System Reliability Assessment A.
Executive Summary and Conclusions This report contains the staff's assessment of the Auxiliary Feedwater Systems (AFWS's) overall reliability for Prairie Island Units 1 & 2.
This review was performed in connection with the resolution of the Generic Issue (GI)
No. 124.
GI-124, " Auxiliary Feedwater System Reliability," addresses the reliability of AFWSs.
Reliability analyses for AFWSs indicated that most plants fell in the high reliability range.
However, several plants fell in the lower reliability ranges.
Some of these plants implemented sufficiant modifications to increase their AFWS reliabilities to the acceptable range.
The reliability of the AFWSs for seven plants, including the Prairie Island Units 1 and 2, remained questionable.
The other plants are ANO-1 and 2, Crystal River, Ft. Calhour., and Rancho Seco.
The objective of this task is to determine whether the AFWS of each of the subject seven plants is sufficiently reliable and to document any recommendations for further licensee or staff actions.
The resolution approach adopted by the staff relied on an audit of several plant variables that directly or indirectly affect the availability and reliability of the AFW system.
These variables include design configurations; maintenance, surveillance and testing procedures and practices; operating procedures; personnel training; system layout; instrumentation and control; environment, and accessibility for operator recovery actions following any potential malfunctions.
The resolution approach also included the review of the plant post-TMI modifications, the licensee generated AFW system reliability analysis (RA), and plant modifications as a result of the licensee's RA.
l l
l 8
- ii -
9 d
A six person evaluation team reviewed documents and conducted interviews with maintenance, operations, engineering, and training personnel and management.
The team review included a four day plant site visit, and pre-visit and post-visit reviews.
Upon completion of the above described review the evaluation team concludes that after properly addressing the following concerns, the staff finds that the Prairie Island Units 1 and 2 Auxiliary Feedwater Systems are adequately designed, properly maintained, and well operated. We also conclude that the system design, maintenance, and operation adequately consider other staff generic concerns raised within GI-124 (i.e., GI-68 with respect to environ-mental qualifications of the motor driven AFW pumps, GI-93 with respect to steam binding of the AFW pumps, and GI-122.1.a b, and c with respect to '
isolation valve failure, and interruption and recovery of AFW flow).
Therefore, the evaluation team is reasonably assured that these AFW systems are sufficiently reliable.
Detailed discussions of the following staff concerns are included in the evaluation sections of the report. These concerns are as follows:
1.
The Condensate Storage Tank discharge manual valves are loosely blocked by a thin wire and clip.
If these valves were closed while the AFWS is required, operator recovery acticns could be significantly complicated.
These valves should be positively locked open.
(See Section D.5.2) 2.
If manual manipulation of Cooling Water supply valves to any of the four AFW pumps were necessary, difficulty of access to and control of these valves would be encountered.
Physical means of assisting the operator to open such valves should be provided and proper training should be conducted (Section D.5.2)
- iii -
t
l' O
e 3.
Emergency lighting at the turbine driven AFW pump cubicles is not adequate and should be improved (Section D.5.2).
4.
Engineering and Operations personnel should receive more maintenance l
training to enhance their trouble-shooting capability (Section D.6.2).
5.
The Loss of Heat Sink procedure instructs the operator to isolate the broken steam generator (in case of feedline or steamline break), and take any of several actions the last of which is initiating the " Feed and Bleed" cooling mode without reference to possible use of the broken j'
steam generator for decay heat removal.
The possibility of revising this t
procedure to use the broken steam generator prior to initiating " Feed and Bleed" should be investigated and an explanation of this capability added to the background information.
I 6.
The staff noted discrepancies in maintenance and surveillance procedures between the two units.
{
Updating these procedures should be closely coordinated between the Systems Engineers within the same time frame.
I 7.
The emergency operating procedures require that the motor driven auxiliary feedwater pump be started with the discharge valves in an open position when the pumps are in a cross connected mode.
There appears to be discrepancy in the procedures in that the pumps should )e started against a closed valve. This discrepancy should be resolved in the next procedure update.
8.
The eight motor-operated throttle valves downstream of the AFW pumps are not easily accessible for manual operator recovery action.
Since these valves would be used to control the AFW flow during the course of postulated transients, access to these valves should be improved and physical means to assist the operator to manipulate them should be provided.
Adequate training should also be performed.
1 I
- iv -
l
[
4 1
J t
The AFWS evaluation team discussed the staff concerns (including other concerns discussed in the evaluation sections of this report) with the licensee.
The licensee agreed to consider all staff concerns.
S S
}
-v-1
.y.,4.,y
--m---3-..--_r.
4 s
J a
Prairie Island Units 1 & 2 - Auxiliary Feedwater System Reliability Assessment B.
Introduction This report contains the staff's assessment of the Auxiliary Feedwater Systems (AFWS's) reliability for Prairie Island Units 1 & 2.
This is being done in connection with the resolution of the Generic Issue (GI) No. 124. GI-124,
" Auxiliary Feedwater System Reliability," addresses the reliability of AFWSs.
Reliability analyses for AFWSs indicated that most plants fell in the high reliability range. However, several plants fell in the lower reliability -
4 ranges.
Some of these plants implemented sufficient modifications to increase their AFWS reliabilities to the acceptable range. The reliability of the AFWSs for seven plants, including the Prairie Island Units 1 and 2, remained questionable. The other plants are ANO-1 and 2, Crystal River, Ft. Calhoun, and Rancho Seco.
The objective of this task is to determine whether the AFWS of each of the subject seven plants is sufficiently reliable and to document any j
recommendations for further licensee or staff actions.
This report contains the resolution approach and evaluation philosophy in Section C, and detailed evaluations in Section D.
Summary and conclusions are presented in Section A of this report. Appendix A contains the references.
Appendix 8 lists the names of the NRC and licensee personnel who participated in this resolution task.
C.
Resolution Approach The staff believes that a high degree of availability and reliability for the AFWS can only be achieved if such a system is adequately designed, properly maintained and well operated.
Proper maintenance and operating practices help reduce component failures. These practices are enhanced by good training
- - - - - - - - - - - - - - ~ - -
~"
~ ~ ' ' ~
~~~~
~~ '~
G programs for the maintenance and operations personnel. Good training programs also improve the operations personnel's understanding of the system's capabilities and its importance to safety.
System understanding improves the likelihood of recovery in case of unanticipated component failures.
The staff believes that assessment of the abrie variables should provide a significant indication of the degree of reliability of the AFWS.
Therefore, the resolution approach adopted by the staff relied on a thorough audit of several plant variables that directly or indirectly affect the availability and reliability of the AFW system. The main items of this task include the following:
1.
Consideration of relevant information pertaining to the AFWS and support systems capability and reliability (e.g., Systems Descriptions, Piping and Instrumentation Diagrams, Logic Diagrams, Safety Analyses Reports, AFWS Reliability Analyses, INPO Reports, AEOD and IE Reports, and staff Safety Evaluation Reports).
2.
Evaluation of plant operating experience with emphasis on the degree of failure repetitiveness and the rate of unanticipated automatic scrams.
3.
Evaluation of the ifcensee's practices for maintenance, surveillance and testing, backlog of maintenance work-requests, and ability for failure root-cause identification.
4.
Evaluation of the clarity and accuracy of the AFWS-related Emergency Operating Procedures, with emphasis on ease of recovery from faulted conditions, accessibility of equipment and adequacy of instrumentation and controls.
l S.
Evaluation of the licensees training programs for maintenance, operations and engineering personnel.
6.
Appraisal of the system layout, accessibility, indication and control, environment during an accident, and cleanliness, etc. by a system walkdown.
l l
--l-----.,-_
.._,_,,-n-
. 7.
Review of the plant post-TMI modifications, the licensee generated AFW system reliability analysis (RA), and plant modifications as a result of the licensee's RA.
Because of the seismic qualifications reviews in response to Generic Letter 81-14, Seismic Resistance of AFW Systems, and Appendix R fire protection reviews by the staff, these review areas were not actively pursued during the AFWS reliability assessment.
In performing this AFW reliability evaluation the staff conducted reviews of documents at the NRC Headquarters, reviews of licensee-supplied documents at the plant site, and numerous interviews with the maintenance, operations, engineering, and training personnel and management.
The AFWS Evaluation Team consisted of five multidiscipline team members and a team leader.
The team review included four day plant site visit, pre-visit and post-visit reviews. The names and organizations of the NRC and licensee participants are listed in Appendix B.
At the conclusion of the plant-site visit the staff discussed its findings with the licensee who agreed to consider all staff concerns.
l D.
Evaluations D.1 Desian and Configuration l
j D.1.1 Approach The AFWS Evaluation Team (or, the staff) reviewed the design and configuration of the AFWS for Prairie Island, Units 1 and 2 in order to assess the overall system reliability.
In the conduct of our evaluation, we reviewed system
S
- descriptions of the AFWS and its support systems (Ref. 1), previous staff evaluations of the AFWS (Ref. 2), the plant Technical Specifications t
(Ref. 3), and several licensee safety evaluation reports that are required by 10CFR50.59 whenever the AFWS is modified.
The Evaluation Team also conducted a system walkdown to examine specific installation details and compare them to system drawings. The system walkdown is discussed further in Section D.5.
0.1.2 Evaluation The Prairie Island safety-related AFWS is seismic Category I, and consists 'of two five-stage, horizontal pumps per unit, one is motor-driven (MDAFWP) and the other is turbine-driven (TDAFWP). Each AFWP will discharge 220 gpm at l
1300 psia. This flow is then directed to both steam generators via a 3-inch discharge line.
Each MDAFW pump is driven by a 300 hp ac motor which is l
powered from one division of the unit's safeguards bus.
Each TDAFWP is driven by a Terry steam turbine supplied from both steam lines through a fail-open air-operated steam inlet control valve. An air accumulator is provided to permit a minimum of two valve cycles in the event of loss of normal instrument air. Also, a three way normal vent valve is provided on the air ifne to allow local manual opening of the air operated steam supply valve.
The turbine is j
equipped with a Woodward governor and an overspeed trip / throttle valve.
The overspeed trip is mechanically actuated by the speed of the turbine shaft.
Overspeed results in tripping the mechanical linkage that shuts the trip /
throttle valve and isolates steam flow to the turbine. The TDAFWPs are dedicated to their respective units. However, the MDAFWPs discharge lines are cross-connected by two normally closed manual valves to permit either pump to supply water to the steam generators of the opposite unit. This, in effect, can make (upon manual action) three AFW pumps available to the unit that needs AFW on an emergency basis.
)
The normal AFWS water supply for both units consists of three condensate storage tanks, each with a capacity of 150,000 gallons.
These tanks are normally connected through a common header, which can be manually isolated if l
1
i,
i necessary. Although the plant Technical Specifications require a minimum of 100,000 gallons of total water inventory in these tanks a spot check during our evaluation showed a total inventory of 330,000 gallons. Backup sources of water include domineralized water and the hotwell inventory with the ultimate supply being the cooling water supply from the Mississippi River.
Figure 1-1 shows a simplified flow diagram of the AFWS.
Table 1-1 lists the i
AFWS automatic actuation and trip signals. Actuation and tripping of the system can also be induced manually.
Flow control to the steam generators is achieved by throttling the normally open motor-operated discharge valves from the control room or locally. These MOVs are not easily accessible as discussed in D.5.
Support systems for the AFWS pumps include the Cooling Water System which normally cools the pump and turbine lube oil coolers with backup cooling provided by the normal process flow from the Condensate System. AFWP room coolers are also cooled by the Cooling Water System and are actuated automatically on start of the associated AFW pump. The review team observed the proper functioning of the room coolers during two scheduled AFWP surveillance tests.
Figure 1-2 shows one of the overhead room coolers.
A steam separator is provided on the turbine driven pump steam supply line to eliminate condensate in the steam line and thus reduce the potential for pump trip on overspeed as a result of water slug in the turbine on pump start.
Protection against possible steam binding of the AFW pumps due to back leakage j
of high pressure hot water from the main feedwater system through the AFWS check valves is provided (as required by IE Bulletin 85-01) by touching the i
AFWS discharge piping once every 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> and verifying that it is cold.
There is also a temperature-sensitive paint spot at each AFWP discharge.
The color of this paint spot will change from orange to brown if the piping temperature rises.
Figure 1-3 shows a MDAFWP and the orange temperature-sensitive spot down stream of the pump discharge check valve.
Procedures are in place to l
vent the pump casing should backleakage into the pump be suspected.
...-.-._.-____-.--..__-.-__,_-_-_a___.
a..,, a... <,
4 gg:<-pj +
z 1
?
u.
...a.
- m m.>;,,,.
w,....
M -8,-O W - -,
/
qa.,,, y,,;,
,;,. us <-m.n
... jlr,.~ y ; X-0
,'- w m,gy>,, ~ --..
qa,.,,.
y-O
,yc >
"*-Y.?> 0 X XD.":..y'<
~'GH j
g m
n co i
s
--"/AtXl-0 0-X,
- r/,::
.~r.;r=
=;ra'
, 1 v v X-O
.. u,.
- Y2:Xf] O-
- .r*0"
02""
"a.u z t
"=.1.t t 2 t?,'?.* mt13' "a.u {t taia* taa' s t e.m' "M I gg.
(
/
tar-81, e
- a ti mi _y to m, H_H esuas s.es aasse sete "iA:X
->c.a o :
o r:==> X z = Tal X ".=*
"du X o "-,geo y'"y,'; ss=w "ur'iU l 4U2' "d.u 2i llt "O" 2 i as~.'.T
"i sin /t
- 'tA 4 4 ='sil" O
1
-1
-1 C D17wf*
.}
.p}-[11.,1
{,
fu
.ccGp {.}] tl}d[-0 f7,,f'"
~
t h "#.L' t'a' C t'.*i.'
h TB.*g
- v M,"
mt 1
_N, r-(Il9,-
-p1- + -
- hY,i"
- h7.i'*
,a
'ty '
""6Yst
-- ;;XO
--'?/aO-X av-'?//,X O
--"*MO
- 67d*'
M
)
WL
)-M
)
9::;!
s ut:,;
%::al
)
N d.?r's.9
-PF-gt:,;
4".'./::
l
-M
$a*'
Figure 1-1 Simplified Flow Diagram of the Prairie Island Auxiliary Feedwate'r System i
. Table 1-1 AFWS Automatic Signals 1.
Automatic Actuation Signals:
Applies to:
- a. Steam Generator Lo.Lo Level (13% WR)
Both AFW pumps
- b. Safety Injection Both AFW pumps
- d. Under voltage to both MFW pumps T0AFW pump 2.
Automatic Trip Signals:
- a. Low suction pressure (4 inches of Hg Vacuum)
Both AFW pumps
- b. Low discharge pressure (500 psia)
MDAFW pump (200 psia)
TDAFW pump
- c. Motor overcurrent MDAFW pump
l' i
1.
o I
1
l l
I
-8 9
6
, - y~% p e, n ;;
3 '%gRjg~ 4:gI$L,
..:.;s
<a mwmywms N
. m f.<
m
~
n.n f{.1-h lg 17ph'0
..,x
_ 3 4
m,'?**-e 7
,J, 4M f,
..nge. g
(
g y....
o
_h b
)
I l'
L' s
-.1 9a
., x, p
I te a ta n.
n e-h44 wa;w-
}
oe-
}s. l.
y
~
- . h
. %'g newQ
- s.g,s L99 g%
"8 bNh h kjh
~
9 Y
%. 1,9,@a, S. m -
- 3 m.K'j[
g
.Y T
, y. : -
- 3.,
.E N
, 4,;j g
.1 a
p.
I) m N.,
i,ue -
J
- Y ET
,,7Li_';.
e k
+
I[
, ?"'
' l
((FyS
)
l
- w@k..m, t,56
{
')
Ar, T
y
\\
%.i
=g.
(g'.
W
. Ik
+Y
~
?&W'
.$m3 [
j f-
$,%E
' 11 a
+., Q"$:'.[. %}
P46
? 9 O'
'm~
s /M..,
p.3
. > - y
,.W 4%.y Rht $::6/,-M w..
' M-s)
['
' g$ r J,:e ' '
g
'l
!M.m;bY N.;f : b3 If
.*:x l
3 v
Mg m x:.
nv.,
QQ;'f, 9n. *}A, U.,h Nlyn1hll y p
g.pg h2 Q$
'I!
q y&
.nt ' q j1.\\'
g;~9 9
71 M '; p
' c. ; y,4 M[.
t, g
s.
,.2.,
r,i
"{ ]$
r.r-t W
s
,Q
~.{*'
8) uQ
'kg
+~x e
/f'
@erew-)%.S..MVh{
iag' hk
.3 r,
tMa.a -
r.
$h
$Ef Fig'ure 1-3 Temperature-Sensitive Spot (shown at
. arrow) will change colors from orange to brown if the discharge piping temperature increases
The evaluation team audited the licensee's safety evaluation process used during its 10CFR50.59 reviews and found the licensee to be thorough in accounting for safety margins when a system modification is made.
The 10CFR50.59 allows licensees to implement plant modifications if they can internally determine that there are no unreviewed safety issues raised by such modifications. The licensees can implement such modifications without prior approval by the NRC.
The staff finds from its review of the design and configuration of the AFWS that the licensee has provided features which will minimize the types of component failures experienced at other plants.
In particular, we note the following:
1.
A short steam supply line to the TDAFWP turbine with condensate removal capability in order to preclude turbine overspeed from a water slug.
2.
Removal of all temporary strainers in the AFW pump suction lines to preclude loss of suction if strainers are blocked.
3.
Frequent (every 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) monitoring of the AFW discharge lines for unacceptable check valve backleakage to preclude potential steam binding of the pumps.
Further licensee actions regarding the discharge check valves are discussed in Section 0. 5, Maintenance, Surveillance and Testing.
4.
A normally open discharge path which reduces the concern for motor operated valves failing to open.
5.
The AFWS is used for normal startup and shutdown, which reduces the chance of system valves being in an improper position when the system is in its standby status.
6.
The plant Technical Specifications require monthly testing to verify the operability of the main steam system power operated relief valves.
This enhances the reliability of decay heat removal means.
O*
. D.1.3 Conclusion On the basis of our evaluation, the staff observes that the AFWS design and configuration provide adequate means of delivering the design flow to the steam generators, are not subject to single failures that will compromise the system's safety function, have sufficient redundancy and diversity
, and sufficient water supplies.
The staff concludes that the AFW system design and configuration are, therefore, acceptable. The staff further concludes that the licensee's 10CFR50.59 evaluations provide adequate justification of safety margins when modifications are made to the system. The staff, therefore, finds that the AFWS's design and configuration and licensee's _
evaluation of system changes contribute to and enhance the AFWS reliabil D.2 Maintenance, Surveillance and Testina D.2.1 Approach The reliability of a system depends to a large. extent on the maintenance programs applied to such a system.
Proper maintenance of such a system will be reflected by component failure rate during operation, surveillance and testing.
The AFWS evaluation team conducted a detailed audit of the AFW maintenance Work Requests for the past 12 months.
Component surveillance results, and maintenance and surveillance procedures were also examined.
i Members of the team interviewed the systems engineers, maintenance and operations personnel, and management on the practices and organization of the maintenance programs.
Training of the maintenance and operations personnel was also explored, and is further discussed in Section 0.6.
1 I
o -
0.2.2 Evaluation The Prairie Island maintenance program is composed of two parts.
The first part is the periodic maintenance (or, preventive maintenance), and surveillence and testing.
These are identified in the plant operating procedures, maintenance procedures, and Technical Specifications.
These assure that the AFW system and its support systems are kept operable and capable of reliably performing their intended function.
The second part of the maintenance program is the corrective maintenance.
The responsibility of any plant worker is to spot potential system or component failures and report them.
The backbone of the maintenance program is the work request form, which is used to describe the work requested (component or system repair, or periodic maintenance), and the procedures to be followed.
The requestor describes the malfunction, its location, and the equipment or system affected, and submits the work request form to the Superintendent of Operations.
The Supertintendent of Operations in turn reviews the work request, then forwards it to scheduling, which logs the form, assigns a priority to the work, then routes it to the appropriate section (mechanical, electrical or instrumentation and control).
The plant has five priority classifications:
Priority 1 - to be done immediately Priority 2 - to be done as soon as possible Priority 3 normal maintenance no rush Priority 4 - to be done during Unit i refueling outage Priority 5 - to be done during Unit 2 refueling outage There is no clear distinction between priorities 2 and 3.
It is basically judgmental on the part of the classifier.
Depending on the problem, the systems engineer may be consulted on the priority assignment.
i i
9 In those cases when the work request involves a Type I system, that is a system in the Plant QA Program, scheduling sends the work request to the systems engineer assigned to that system.
The AFWS for each unit at Prairie Island has an assigned systems engineer.
The systems engineer inspects the problem area and evaluates it, and prepares the written maintenance procedure and isolation requirements.
The engineer also classifies the work as critical or non-critical.
Critical work applies only to the Engineered Safety Features if the component operability has a direct effect on system operation.
If the work is classified as critical, the work request is sent to Quality.
Assurance and the Work Request Authorization Coordinator (WRAC) for their r; view, before being sent to Maintenance.
Depending on its significance, a work request may be reviewed by the Operations Review Committee prior to forwarding it to Maintenance.
It takes approximately one-half day to 3 days for a work request to go through this process, depending on the severity of the problem.
In emergency situations, maintenance or repair work may commence prior to completion of the above formal process.
The maintenance personnel are not allowed to deviate from the written procedures in the work request or periodic maintenance procedures. Deviations require the approval of the systems engineer, the Operations Review Committee, or both.
l Based on the reviews of the AFWS-related work requests generated during the i
past 12 months, the team has the following observations.
1.
Very few work requests were classified as Priority 1, critical work.
This is significant since it shows that the equipment is being well maintained such that serious and unanticipated system failures are minimized.
l l
l l
-~ ~~ - -
, 2.
The procedures for accomplishing the work were of sufficient detail to properly complete the work.
Appropriate references were identified, and the necessary drawings, isolation requirements and fire precautions were attached to the work request.
This indicates that the system engineers are knowledgeable of the system and are capable of determining the cause of the problem.
3.
There were hardly any work requests dealing with repeat failures or problems.
The team also reviewed a computer listing of all work requests generated by the two units since 1976, and observed very few repetitive failures.. This suggests that the systems engineers and maintenance personnel are able to determine the root causes of failures.
4.
The majority of the Priority 2 through 5 work was completed within one month of the initial work request date.
This signifies a small maintenance backlog, and the timeliness and promptness of work completion 5.
The NRC staff review of the licensee's response to IE Bulletin 85-03, with respect to motor-operated valve (MOV) failures, is not yet complete at the time of review for this report..However, the methodology for setting MOV settings (MOVATS) described by the licensee during our review appears promising.
The review team also expressed a concern that was raised by INPO, SOER 86-2.
The concern is that throttle-type MOVs, that rely on bypass switch settings for position indication may show that the valve is closed when it is partially open.
The licensee stated that they were aware of the ccncern and are assessing its impact on Prairie Island.
The review team believes that the Prairie Island AFW throttle valves per pump) are not significantly affected by this concern; however, the licensee's awareness of such a concern is assuring of reliable operation of the AFWS.
The licensee's response to IEB 85-03 and INPO, SOER 86-2 adequately addresses the concerns raised by GI-122.1.a. c with
. respect to MOV failures and AFW flow interruption.
These two sections of GI-122 generally address the improper setting of valve setpoints and AFW flow interruption.
6.
It was stated that the rate of maintenance staff turnover is very low, and most of the maintenance supervisors have been with the company for over 20 years.
Plant officials take pride in being able to anticipate system or component failures and correcting them.
System engineers stated that root cause identification is a significant part of their job.
Plant management stated that in the conduct of the maintenance operations the emphasis is on long-term operability rather than short-term fixes. This signifies the plant's commitment to root cause
{
identification, which enhances long-term operability and safety of the plant.
7.
Plan management seems to take pride in their work force.
It was stated that reliance was placed on plant workers to notice the little problems and report them. This generally indicates a good working relationship, between the management and the work force, which is conducive of high moral and better work performance.
8.
All maintenance personnel hired by the plant start at the apprentice-repairman level and must go through the Northern States Power Company (the owner of Prairie Island units) training program.
This assures uniformity in training of maintenance personnel and their knowledge of the systems and procedures.
9.
During outages, additional maintenance crews are brought in from nearby Northern States Power plants, and given additional refresher training.
- 10. The licensee stated that there are procedures for maintaining sufficient parts inventory in the warehouse.
If an item is out-of-manufacture it would be replaced by another item by a different manufacturer, or the equipment changed appropriately.
rt_.___ _ _..
. 11.
If a job is unfamiliar or new, a pre-job meeting is held by the maintenance crew to discuss the procedures required and any special instructions.
12.
The plant personnel take pride in the very low unplanned automatic scram rate.
While the nuclear industry average in 1985 was 4.3 unplanned automatic scrams per unit (Reference 11), Prairie Island Unit I had two scrams, and Unit 2 had none.
This low scram rate is attributed, in part, to the thorough maintenance program and indepth system understanding by engineering, operations, and maintenance personnel, and to adequate root cause identification and resolution.
13.
Based on the licensee's good regulatory performance, including its high SALP ratings, Region III annoJnced in April, 1986 that Northern States Power would receive a reduced inspection program for its three nuclear plants including Prairie Island Units 1 and 2.
However, the staff also found that the periodic maintenance and surveillance procedures have some differences between Unit 1 and Unit 2 for similar pieces of equipment.
Plant personnel explained that the reason is that these proce-dures are reviewed by different system engineers and updated at different times depending on plant or system outages.
The system engineers do consult with each other and each has access to the procedures for the other unit.
It was stated that the Unit 2 periodic maintenance procedures would be updated to conform to the Unit 1 procedures prior to the next Unit 2 refueling outage.
The Review Team found the explanation acceptable; however, it was felt that in order for the procedures to be more consistent, and to avoid inadvertent omissions, these procedures should be reviewed and updated in the same time frame.
. D.2.3 Conclusions Based on our review of the maintenance, surveillance and testing procedures, the manner in which these procedures are implemented, and based on licensee statements, commitment and work related attitude of the maintenance and engineering staffs, we conclude that Prairie Island Units 1 and 2 have an excellent maintenance and surveillance program.
Subject to the staff's recommendations above and in Section D.6, we find that the maintenance and surveillance program contributes to, and enhances the AFWS reliability.
D.3 Emergency Operatina Procedures D.3.1 Approach The staff reviewed the Prairie Island emergency procedures for the use of the AFWS and other means of secondary system decay heat removal in accident and transient conditions (see Reference 4).
Of particular interest was the Response to loss of Secondary Heat Sink Procedure (IFR-H.1) which providas the guidance to the operator for establishing a means of decay heat removal following a transient and contains a hierarchy of the measures to be employed given various failures.
To gain additional insight into the application of this procedure, the licensee provided a demonstration at the onsite simulator of this procedure.
The demonstration was conducted with experienced operators who were unaware of the system or component failures selected.
The selection of these failures was coordinated by the staff and the instructors who were announcing the failures t
as they were assumed to occur.
Additional discussions of emergency operating procedures and function recovery are presented in Section 0.5 i
l i
' O.3.2 Evaluation Procedure 1FR-H.1 instructs the operator to attempt to establish a heat sink in the following order:
Establish AFW flow to at least one steam generator including the use of a.
the other unit's motor driven pump via the manual cross connect valve if needed.
b.
If AFW fit,w cannot be obtained, establish main feedwater flow to at least one steam generator (the Prairie Island main feedwater pumps are motor driven).
If main feedwater flow cannot be obtained, establish flow from a c.
condensate pump by rapidly depressurizing at least one steam generator.
d.
If flow from a condensate pump cannot be obtained, establish bleed and feed by initiating a safety injection pump and then opening both pressurizer PORVs.
The procedure instructs the operator to continually try to recover a secondary heat sink while taking the above actions.
In addition, at the end of each emergency procedure, the licensee provided comprehensive background information, which stated the basis for the actions to be taken for each step of the procedure. This provides the operators with an understanding of why the specific instructions are as stated in order that they may be more familiar with the procedural objectives.
The staff found this approach to be of great benefit and a sound practice.
\\
In general, the staff found the emergency procedures to provide sound guidance to the operator for coping with offnormal events where decay heat removal cap-
)
ability is compromised.
Further, during the demonstration transient for loss i
. of secondary heat sink, we nated that a significant amount of time (longer than 40 minutes) was available to take actions to restore a secondary heat sink before the need to establish bleed and feed. Although this was a simulator demonstration the time available is not inconsistent with calculated predic-tions for Westinghouse type systems. This time permitted the various actions specified to be taken in an orderly and unhurried manner without undue stress.
The procedures also provided explicit and clear instructions as to when to start or terminate the " Feed and Bleed" mode of decay heat removal.
The proce-dures caution the operator not to start bleeding the system, i.e., opening the two PORVs, before the feeding part, i.e., safety injection, has been assured.
One aspect of Procedure 1FR-H.1 did raise a concern to the staff.
Instruction is provided to the operator to isolate and maintain isolated a faulted (or ruptured) steam generator throughout the secondary heat sink restoration actions.
While the staff agrees that feeding a ruptured steam generator is not desirable, it appears preferable as a last resort prior to initiating bleed and feed for decay heat removal.
Therefore, the staff asked the licensee to consider revising this procedure to instruct the operator to use a faulted steam generator for decay heat removal when an intact steam generator is unavailable prior to initiating bleed and feed.
The licensee agreed with the staff position and is examining such a procedural change.
The evaluation team has the following observations:
1.
Plant operating procedures provide instructions that during a refuelir.g outage, although the operability of the MDAFW pump is not regulated, the outage time of this pump should be kept to a minimum.
The rationale for such a recommendation is that this MDAFW pump is important since it can be cross-connected to provide water to the next unit, and this in turn provides a significant increase in AFWS reliability.
. 2.
If a MDAFW pump is to be cross connected from one unit to the next, the operator is instructed to weigh the conditions at each unit carefully prior to the cross connection. After the cross-connection and when conditions allow, a tag is posted to alert the operators to the cross connection.
3.
A discrepancy was observed between different sections of operating procedure C28,1, and between C28.1 and emergency procedure ES, Rev 9,
relative to MDAFW pump start.
During normal start, the discharge valves are closed, the pump started, then these valves are opened.
- However, during cross-connection of a MOAFW,the discharge valves are opened first then the MOAFW pump started.
Good normal operating practice recommends that the pumps be started while the discharge valves are closed, then the discharge valves be opened.
This discrepancy has been discussed with i
the plant personnel and they agreed to consider it in the next procedures update.
1 0.3.3 Conclusions Based on the above and on other supporting discussions in Section 0.5, System Walkdown, the staff concludes that the licansee's emergency procedures for response to offnormal conditions involving loss of secondary heat sink generally contain adequate" guidance for acceptable operator actions.
~~
We further believe the response to loss of secondary heat sink will be enhanced by proper consideration of use of a ruptured steam generator.
Therefore, the staff concludes that given consideration of staff concerns, the clarity of the licensee's emergency operation procedures contributes to the reliability of the plant's means for achieving decay heat removal.
These means include the AFWS.
, 0.4 Instrumentation and Control D.4.1 Approach f
One of the objectives of the AFWS evaluation team was to audit the instrumentation and control circuits for the Auxiliary Feedwater System. As part of that audit we conducted a walkdown of the as built system and compared it to the design in the following areas:
1.
Electrical instrumentation and control system drawings conformance to IEEE Standard 279, 1971 (i.e., Independer.ce, Single Failure, Automatic and Manual Initiation) and NUREG-0737, Item II.E.1.2.
2.
Verify from the control room and drawings that the operator has indication for normal and abnormal conditions in accordance with the Emergency Procedures and Regulatcry Guide 1.97, " Instrumentation for Light Water Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following An Accident."
In conducting its evaluation the staff audited the documents listed in Reference 5.
0.4.2 Evaluation Each motor driven pump is operated from the control room by an
" Auto-Manual-Shutdown Auto" r.clector switch and a " Start-Normal-Stop" control switch. When the selector switch is in " Auto" and the control switch is in
" Normal" the pumps start automatically on any of the following signals:
i ~
A low-low level in either steam generator (both AFW pumps),
a.
b.
A safety injection signal (both AFW pumps),
Loss of both main feedwater pumps (both AFW pumps), and c.
d.
Under voltage on the 4.16 KV buses (only TDAFW pump)
The low-low water level signal is activated on a two out-of-three (2/3) logic from either loop.
The safety injection signal is also a 2/3 logic for Low Pressurizer Pressure or Low Steam Pressure from either loop or a one-out-of-two (1/2) logic on High Containment Pressure.
The loss of both main feedwater pumps (breaker trip) is a two-out-of-two (2/2) logic signal.
The 4.16 KV bus undervoltage signal to start the TDAFW pump is based on a two-out-of-two (2/2) logic.
The Prairie Island design provides instrumentation for the operator to use during all modes of norcal operation, including operational transients, and to verify safety system performance following an accident and manually perform required safety functions.
The information for the AFWS includes indicators, recorders, (for level, pressure and flow) status lights for pumps, valve position indication, annunciators and alarms.
The scope of our audit included tables of system variables and component states to be indicated, functional diagrams, electrical drawings, emergency procedures and submittals on conformance to Regulatory Guide 1.97.
Table 4-1 shows a listing of information available to the operator in the control room.
The drawings were reviewed to determine if a single failure of equipment (or single errors by operators) could prevent the accomplishment of the safety function (to provide adequate cooling water to the steam generators following transients and accidents).
It was determined that adequate independence between trains was provided such that any single failure of components in a train will not prevent the other train from completing its safety function.
In addition, it was demonstrated that the automatic and manu-1 initiation signals and circuits for the AFWS also comply with the single failure criterion.
l 23 -
Table 4-1: AFWS Information Available to the Operator in the Control Room 1.
Steam Generator Level 2'.
Steam Generator Pressure 3.
Steam Flow 4.
Main Feedwater Flow 5.
Auxiliary Feedwater Flow 6.
Condensate Storage Tank Level 7
MOVs, TTVs,* and OTMs* positions 8.
Lube Oil Temperature Alarm for the MDAFWPs and TOAFWPs 9.
Pump Suction Alarm 10.
Turbine Overspeed Alarm 11.
MDAFWP Locked Out Alarm (Iow suction or discharge pressure, low lube oil pressure)
- 12. MDAFWP Overload Alarm (motor current)
- 13. Accumulator Air Pressure Low Alarm
~.
- TTVs: Trip and Throttle Valves OTMs: Overspeed Trip Mechanisms
.er
,,,-----w-,-
- - - = - -, - - - -, - ~, - - - -
-r
l ~_
The staff has the following observations on Table 4-1 items:
1.
For item 1, Steam Generator level, R.G.1.97 recommends two channels of Category 1 instrumentation per steam generator.
At the present time two channels exist, but only one is environmental qualified.
In Reference 5.b, the licensee committed to replace the non qualified instrumentation with fully qualified instrumentation.
2.
For Item 5, AFW flow, R.G. 1.97 recommends that flow instrumentation have a range of 0% to 110% of design flow. The staff found that AFW flow meters indicate from 0 to 200 gpm. The latter value (200 gpm) is the AFW pump design flow.
The licensee has committed, in Ref. 5.c, to expand the range of the flow meters to indicate flow from 0 to 250 gpm.
3.
For Item 6, CST level, R.G. 1.97 recommends seismically qualified instrumentation.
In Reference 5.c, the licensee committed to upgrade the CST level instrumentation to Seismic Category I.
The Prairie Island units 1 and 2 have two diesel generators (OGs) that are required to be operable by plaat Technical Specifications, if any of the two units is operating.
If one of the DGs is not operable, it must be restored to operable status within seven days or the plant is shutdown.
The Prairie Island DGs are highly reliable.
This is discussed further in Section D.7.
D.4.3 Conclusion Based on our audit we conclude that the Prairie Island AFWS design conforms to the design bases requirements of IEEE Standard 279, 1971. We also conclude that the information important to AFWS includesappropriate variables and that their ranges are consistent with the guidelines identified in R.G. 1.97 The staff, therefore, concludes that the Instrumentation and Control (I&C) system at the Prairie Island plants is sufficiently adequate and will effect satisfactory initiation and operation of the AFW system.
It is, therefore, concluded that the I&C system contributes to the reliable operation of the AFW system during normal and abnormal conditions.
0 S
. D.5 System Walkdown 0.5.1 Approach A key part of the staff's site visit to Prairie Island was an AFWS walkdown.
The walkdown afforded the staff the opportunity to examine the as-built system configuration, specific components, location of equipment, and potential interaction with surrounding equipment.
The system walkdown had two main objectives, one was to confirm that the installed system conformed to the staff's understanding of the system design basis as identified in previous evaluations, and to determine if the system may be subject to any previously unidentified common mode failure mechanism or hazard (e.g., flooding, fire',
missiles, suction strainers, etc.).
The other main objective was to examine the ease of operator access to vital equipment for performing necessary recovery actions. This includes assessment of emergency local lighting, communications and other factors.
The walkdown covered the entire piping and component layout from the condensate storage tanks, through the pumps to the containment penetration and included the turbine driven AFW pump steam supply lines, support system piping, switchgear, and the instrumentation and control.
0.5.2 Evaluation On the basis of the walkdown, the staff was able to confirm that the "as-built" configuration was in conformance with the design basis and previous evaluations, particularly the NUREG-0737, Item II.E.1.1 evaluation with one exception.
The licensee's interpretation of " locked" valves is somewhat different from the staff's understanding during the Item II,E 1.1 review.
Generally, locked valves are physically secured in one position by a locking mechanism, e.g., chain and padlock, valve stem blocking device, etc. However, the licensee has defined " locked" valve to be one which is equipped with a
thin wire attached to the stem and secured by a padlock. This device does not provide a significant physical restraint to valve manipulation.
An additional licensee categorization, " blocked" valve, used in some cases, I
consists of a thin wire clipped around the valve stem and identified as i
being " blocked" by a sign.
Of particular concern were those manual valves in the parallel AFW suction lines from the condensate storage tank, which the staff observed were not locked properly. These valves (C-27-1, 200-27-1, and 2C0-54-1) are open and
" blocked" in that position by a thin wire and a wire clip that is readily removable (see Figure 5-1).
The staff expressed a concern that since these valves are readily accessible and do not have their positions indicated in the control rooin, their intentional closure can be rather easily done and can have serious consequences for system integrity, operator responsiveness and for event recovery. Although sabotage is not a specific review item for this 3
t evaluation effort, the above listed manual valves were thought to be easy targets and their closure could result in potentially serious consequences.
The licensee agreed to lock these valves in the same manner as other " locked" valves.
l The staff also confirmed from the walkdown that no additional source of common
),
mode failure appeared to be present in the areas containing AFWS components.
The staff did note. however, that two of the AFW pump discharge lines (one in each unit) were pressurized to approximately 800 psig when the pumps were not running.
This was caused by feedwater backleakage through two check valves in l
series.-
The leak rate was not sufficient to heat the discharge lines because i
they were cold to the touch. The licensee was aware of this condition and indicated that they plan to replace the leaking check valves at each unit during its next refueling cutage.
In the mean time, the continued surveillance of the piping by touching it every 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> will confirm that the pumps are not becoming steam bound.
l
.27 -
y,%W! 4% % n;4;sg4 rp?".
.~s.
G w7 2
.....= gp, l y 25 d. C.-
f} JRfl'-
. rR ~ j% %
hf L
gy 2?Q 'g;,h
- ~
9
~
?; g,g #35
- .>c
- e,
.w
~s.
u w
> <.itw m
y,_W,.
,e u c a+g.3 s
+ m x.
- . m.wims; s-
[
.,m _y
{
.Q^
, px5 p
T
, w.
,muy.,s
,s 1
w o..
s' {
$, J
)
- s..
~l f&c.w+h,..!hM%hi..,l$$l~ilm&k 1 f. 9\\ un+- ? + r '.;[;g*; h wr% ', ~ h .~-i ^~t * *l: ':+ +; c _ ' ~; + . e s.. -= - *;pl:h. ' .sh Wl "b 'N Y
- $,,.. V Q 7p y p... -
f.id8%.e.,Q-2- a;,. 4%? ;.i. - E ' } .a, y %.+s . M;ae.. q:Q,J_ gregg
- f I
Nk[$j )f$f h Figure 5-1 Condensate Storage Tank Discharge Valve, Blocked by a Wire Clip
'- 28 ~ Part of the system walkdown included an evaluation of the plant communication and lighting systems in the AFW cubicles. The communication system for this area consists of a sound powered system, a telephone system, the plant PA system and hand-held radios. The review team found this to be satisfactory for this area. The lighting system for this area consists of the normal and emergency AC fluorescent fixtures, a DC incandescent light in front of the safe shutdown panel powered from the station batteries, and battery pack lighting in the motor driven AFW pump cubicles. The lighting was found to be inadequate particularly during the postulated station blackout scenario when dependence on proper operation of the turbine driven AFW pump is imperative. The staff was informed that the licensee was in the process of upgrading the emergency lighting in the AFWS area. The staff wishes to 1 stress the significance of adequate lighting for the turbine driven AFW pump cubicles as well as the turbine and motor pump control panels. The illumination level should be a mi-nimum of 10 foot-candles at the work s to conform to the NRC's criteria for station lighting (NUREG-0700). The evaluation team has the following general observations: 1. The positions of the trip and throttle valve and the mechanical overspeed mechanism are indicated in the control room. Both of these indications help diagnose a turbine driven AFW pump overspeed trip (see Figure 5-2). Also, clear instructions for resetting the trip mechanism are posted on the wall next to the TDAFW pump location. The staff observed operators training on resetting operations. Resetting operations are straight forward and take about one minute to complete. 2. The motor-operated throttle valves downstream of the AFW pumps are not easily accessible (see Figure 5-3). Manual operator manipulation of these valves may be required to avoid thermal stresses (as suggested by plant startup procedure C28.1), however, there does not appear to be a means of getting to the valve hand wheels or a means of applying the necessary force to them. The applicant, while admitting the deficiency, stated that in emergency conditions the thermal stresses may be of secondary importance to the task of delivering AFW to the
G e, jhg&QIf%fn, ;&~ AhN_A h
- ,4RPw;l941 t&
s ']-]pfr
- 4.,, d. V4 s
.o ..W,M' .s
- t qw Y
N Q Mi** $T } \\% y
- k* --
h. ~ & ["MQL% h , ' i sy.,, u, v. ooyy 2.g. ~ ' y/' 3 ..d .v. ..o , h h J 'f a : 2, .,3 s,p f e: e 'j k, ',,y - A. to, e f g< 4 ge .s+ g ',g m L y ;'- m
- 1. x.
<n Tza. ..,,t:- waa ,a - S. p,.f, c i,#3 ,.a k. t ...) /., tn QJ - > g= c e, .g% mg.. G &,
- f ~ [$9' ;- '.
3' _' \\' QQ4\\ s 00 s r, - 4 s*/ g. g o b- -+~ # . -.r x' h, A- "U n x .}l}}&.. "vQ = \\ ?: c n
- o.,
-u , _ j, W,7. N' ~ u f. f.
- 1 :.f'.
-n3 s ),$hYb 'fg /$,. 3. '4 ^ ffffc h " ' ..i ? *% ' h b stb 4bh @lkfD bI,[y d ( h % 6 v
E n li~ t.),L a y . 1.Q;,,,, rir -.4 ~w LN , u.$,. s (-8. ["- b't p.: 6 f T a s c ' s '*~ ! 3 i ~ b ' N,% 5 ),, hgi - {'i A, 'N K'4 g i E' -.: 3 it ] ',' g-%'%, 1 7 l, -yg,l h i g%. } Yy dt. ' Q'~' % gdq fg : h 'y y 'hg 4 "~' A s Ikw j f l.k,j l Y ?y nY, f. 'b.( f .1 tid Y chlb k_ $:0 : z,;,_L. g 1 I u Figure.6-3' MDAFWP Motor Operated Throttle Valves, not easily, access'ible for manual control'. Arrow shows valve handwheel close to ceilirig
. steam generators. While we generally agree with the licensee's rational we note that these valves would be throttled to control the AFW flow during the course of a transient, and we believe it is prudent to be abie to exercise these valves manually. Therefore, a means to assist the operator in operatin'g these valves should be provided. The staff believes this will improve the AFWS reliability. 3. Sight glass oil level indicators for the lube oil system are direct visual local indicators of the lube oil conditions. 4. Local AFW pump suction and discharge pressure and flow indication are mechanical type instruments driven by the differential pressure between two points in the system. These instruments do not depend on any power supply and, therefore, are available anytime the pumps are running. 5. There are several control room alarms that annunicate if a component is not aligned for proper operation. 6. To address concerns identified in GI-68 relative to environmental qualifications of the NDAFW pumps subsequent to a postulated break in the TOAFW pump steam supply line, the team observes that if the MDAFWP is assumed to fail under this scenario, the operator can cross-connect the other unit's MDAFWP if he can gain access to the cross-connect valves. If that fails, the operator is instructed to use the condensate water system or the Feed and Bleed method for decay heat removal. The evaluation team notes that given the very low probability of the postulated steam line break which disables its associated TOAFWP, and the above remedial actions by the licensee, it is believed that the GI-68 concerns are adequately considered. 7. If local manual manipulation of the cooling water motor-operated valve (MOV-32025, -32026, 32027, 32030) were necessary, access to the valves' hand wheels requires a high ladder and potentially other equipment (see Figure 5-4). Although the cooling water system provides the safety grade water source to the AFWS, its use to feed the steam generators is considered as a last resort and would be used only if other sources of
~ '..s .f.,,. e '- 4 ',,/,x / k h a.i. ,f ( I'^' j n~ ,ai' s ~ Figure 5-4 Cooling Water Supply Valve to the AFW Pump, not easily. accessible
. water are not available. However, the evaluation team recommends that the plant operators be trained on manipulating these and similar valves (see Item 2 above). 8. Other than the above observations, access to vital equipment for restoration and surrounding cleanliness was found by the evaluation team to be excellent. Operators hands-on experience, cleanliness of the surroundings, and ease of access to vital equipment increase the likelihood of successful recovery in case of malfunctions when the AFW system is required. This adequately addresses staff concerns raised in GI-122.1.b, and c with respect to AFW interruption and recovery. D.5.3 Conclusions The staff concludes that the licensee is taking appropriate action to address staff concerns identified during the walkdown. Therefore, the s,taff finds that the "as-built" configuration of the AFWS agrees with the design basis documentation, and therefore able to perform its intended safety function. - Provided appropriate consideration is given to the staff concerns identified above, the staff concludes that the AFW system as installed, instrumented and operated is conducive to safe and reliable operation during accident or transient conditions. D.6 Training D.6.1 Approach The evaluation team reviewed the training program to establish an under-standing of the licensee's commitment to maintain and enhance the proficiencyf level of its maintenance, operations and engineering staffs. The team review consisted mainly of interviews with training instructors, training coordinator, and trainees. The team also inspected some training documentation.
_ 34 - - D.6.2 Evaluation All maintenance personnel hired by the plant start out at the apprentice repairman level and must take the Northern States Power Company training program. This program consists of six years of both schooling and on-the-job (0JT) training. The training program also includes continuing training and refresher courses. The apprentice-repairman undergoes two years of training after he is hired. During these two years, he attends a company-owned offsite training school six weeks per year. This schooling introduces the trainee to the basic courses (mathematics, mechanics, electricity, etc.) as well as providing some hands-on experience in disassembling and reassembling equipment similar to that found at the plant. The balance of the two year training is spent at the plant as on-the-job training. The on-the-job training consists of a check-off 1ist of typical jobs and duties which the apprentice-repairman must complete prior to advancing to the next level. Upon completion of the apprentice-repairman program, the trainee becomes a journeyman-repairman and selects an area of specialization: machinist, rigger, steam fitter / welder, or electrican. The first three areas of specialization require additional training, in addition to the journeyman-repairman course, which must be completed prior to assuming the responsibilties of a machinist, rigger, or steam fitter / welder. The journeyman-repairman course, includes schooling and on-the-job training over a four year period. Both the apprentice-repairman and the journeyman-repairman courses are INPO certified, and take full advantage of manufacturer material. In addition to the formal training courses, the Prairie Island Maintenance Training Department is setting up a continuing / refresher training program. This program will consist of two-weeks of training per year per person. It
s o ., would make use of in-house (plant) training facilities, company training facilities and manufacturer training programs. Its purpose is to maintain and enhance the skills of the maintenance personnel. By inspection of training documentation and through interviews, the evaluation team found the maintenance training program to be thorough and detailed. It makes extensive use of manufacturer materials, technical bulletins, sales brochures, technical manuals and demonstration models, as well as on-the-jcb training. During the discussions on the maintenance training program it was brought out that the Engineering and Operations Departments were not fully incorporated into this training program. The System Engineers responsibile for the AFWS have taken some of the continuing and refresher maintenance courses.
- However, the maintenance personnel interviewed would like to see more of the engineers and operations personnel attend. The review team endorses this recommendation based on the number of work requests cancelled due to an incomplete under-standing by the work requestor of normal component operation.
The staff believes that such courses will enhance trouble shooting capability. Since operator training is a regulated activity and has been extensively considered by the NRC, the evaluation team spent only a modest effort in that area. The Prairia Island operator training program consists of non-licensed operator (NLO), reactor operator (RO), and senior reactor operator / shift supervisor (SR0/SS) training. The NLO training is a 3 year program and includes OJT and course work at the Prairie Island Training Center (TC). The next level is the RO training and it includes six months of fundamental courses at the TC, three months of shift training, seven weeks of initial simulator training, and three months of training in diagnostics, communication and team work. The SR0/SS training is about seven months long and includes three months of OJT, followed by review and special subjects such as supervisory and emergency plan training.
Prairie Island management emphasized the licensee's commitment to training, and stated that more than 40% of the plant engineers, and all plant superintendents hold current SRO licenses. It was also stated that the engineers with SRO licenses and most of the superintendents occasionally serve as shift technical advisors. The staff strongly encourages this approach since it raises the level of awareness of plant operation and systems interrelations. 0.6.3 Conclusions The evaluation team finds that the licensee's commitment and implementation of the training programs as discussed above promotes good understanding of plant operation in general, and in particular enhances the licensee's ability to minimize system malfunctions and improve the likelihood of recovery once a malfunction takes place. The evaluation team, therefore, concludes that the Prairie Island training program significantly contributes to and enhances the AFWS reliability. D.7 Operating Experience and Reliability Analysis D.7.1 Approach: The evaluation team reviewed and inspected several documents including the AFWS Reliability Study, Ref. 6, and the Licensee Event Report (LER) and Nuclear Plant Reliability' Data System (NPRDS) files pertinent to the Prairie Island units (Ref. 7 and 8). The team also reviewed some LERs generated by this plant to evaluate the adequacy of the licensee's corrective actions and any followup actions. D.7.2 Evaluation The staff searched the LER and NPRDS files for the period of 1981 through 1985 for data pertinent to the Prairie Island AFW systems. The search for both units revealed a total of seven malfunctions, four LERs and three NPRDS records. Four of these reported malfunctions are readily recoverable by operator action
~ . at the equipment location. Another malfunction was the failure-to-open, after closing during a test, of the normally open condensate supply valve to one of the AFW pumps. Since the extent of reporting to the LER system and the NPRDS may be somewhat subjective, the staff's findings in this area should be viewed in light of the other evaluations in this report. The licensee's operating experience relative to unscheduled automatic reactor scrams (scrams in this plant design almost always lead to AFWS actuation), has been discussed in Section D.2, Nintenance, Surveillance and Testing. The Prairie Island units compare well with the average nuclear power plant. While the average plant had 4.3 scrams in 1985, Prairie Island Unit-1 had only two scrams while Unit-2 had none. A survey of the failure rate history of the emergency diesel generators on all operating nuclear power plants in the period of 1983 through 1985 (Ref.
- 12) shows that the two Prarie Island emergency diesel generators are highly reliable and meet the reliability criterion identified in the proposed Regulatory Guide, " Station Blackout." This Regulatory Guide has been issued for comment and identifies a DG reliability acceptance criterion of no more than 0.025 failures / demand.
The two Prairie Island DGs have average failure rates of 0.02 and 0.00 per demand respectively. The team raised a question to the licensee on whether it conducts any trending l analysis of equipment performance so that malfunctions may.be anticipated and corrected. The following are a number of measures the licensee undertakes in that regard: The licensee had just implemented a limited computerized trending system l a. by listing the measured values of key variables during surveillance testing. This system has been in existence for about one year; however, the licensee is in the process of incorporating data obtained in previous l years into the system. This system applies only to the ASME Section XI pumps and valves in the AFW system (4 AFW pumps, 4 motor-operated valves, and 6 air-operated valves).
e a e b. The licensee is implementing a trending tool for the Main Feedwater Pumps (MFPs) and attached piping and supports for the purpose of anticipating and avoiding malfunctions in this system that may degrade plant conditions and challenge the AFW system. This trending tool consists of a vibration analysis that is done periodically and compared with a base-line vibration spectrum signature of the system. Deviations from the system's signature will be analyzed every time such measurements are taken. Based on this and other trending tools, the licensee refines preventive maintenance, and surveillance procedures and increases or decreases their frequencies as appropriate. The licensee assigns dedicated engineers to certain systems. The c. engineers develop a thorough understanding of their assigned system which helps identify system performance degradation. The team also reviewed the AFW System Reliability Study submitted by the licensee (Ref. 6). The team has the following observations: 1. The Reliability Study considered the following: (a) Plant specific data for equipment failure rates; (b) Support systems contribution to AFWS unavailability; (c) Operator errors; and t (d) Common cause failures. The plant specific data base used the operating history of the components of both units over 23 combined reactor years. The licensee's analysis was conducted using the WAMCUT computer code. As discussed in Section 0.2, Maintenance, and in Item b above, the i licensee has attempted to reduce the challenge rate to the AFW system by reducing the unanticipated automatic reactor scram rate and by l improving the MFW system operating conditions. The Prairie Island i { l I
. reactor scram rate is significantly better than the industry average. The licensee estimated the loss of main feedwater rate to be about 0.04. events per reactor year for Prairie Island (Reference 6) as compared to an estimated rate of about 0.6 events per reactor year as a best estimate for all nuclear power plants, Reference 9. The licensee also estimated the rate of loss of offsite power (LOOP) for Prairie Island to be 0.02 events per plant year (Ref. 6). This is similar to the national average which ranges between 0.016 and 0.034 events per reactor year for a LOOP of two hour and 40-minute duration, respectively (Ref. 10). 2. The licensee's baseline best estimate reliability analysis considered all plant modifications since the TMI accident. These modifications include the following: Plant compliance with NUREG-0737 requirements II.E.1.1 and II.E.1.2. a. b. Plant compliance with requirements of Generic Letter 81-14, Seismic Resistance of AFW system'. s Plant compliance with 10 CFR 50.49, Equipment Qualification of c. Electrical Equipment. d. The turbine driven AFW pump turbine steam admission valve was modified;
- 1. to be ac-independent, and
- 2. to allow local start of the pump.
Manual valves outside containment are locked open (see Section e. D.5.2 for staff concern relative to 3 such valves) and are monthly ~~ inspected per the plant Technical Specification requirements. f. Manual valves inside the containment have their open positions double verified before plant startup. The open positions of these valves are confirmed during the startup since the AFW system is used as the feedwater source until about 15% power level is achieved at which time the main feedwater system is used and the AFW system is put in the normal standby mode. Also, any disturbance of these valves (testing, maintenance, etc.) can only be done at shutdown.
e - 40 ~- g. Emergency operating procedures have been revised to include: 1. Cross-connecting the MDAFW pump for the other unit, and 2. transfer of the AFW pumps' suction to alternate water source. h. The plant Technical Specifications have been revised to limit the allowable outage time of an AFW pump to 72 hrs. before the unit has to be shutdown. i. Control room annunciation if the TDAFW pump overspeed mechanism is tripped or if the trip and throttle valve (TTV) is closed. This provides quick diagnosis if overspeed trip occurs or if the TTV is inadvertently closed. Therefore, this annunciation leads to speedy recovery. j. To protect against steam binding of AFW pumps the licensee checks the temperature of the pump discharge piping as discussed in Section D.1.2 above. The probability of inadvertent simultaneous closure of the manual valves (2 per unit) inside the containment (see Item 2.f above) was the primary contributor to the Prairie Island AFW system unavailability, as analyzed for the NUREG-0611 tabulation. Tne data base used for the NUREG-0611 analyses assumes a probability of simultaneous closure of the two manual valves inside the containment of IE-3. Tne Prairie Island AFW systems were estimated to have an unavailability of the order of IE-3 per demand which is dominated by the above failure. Closure of these valves would disable the steam generators as heat sinks, and since these valves are inside the containment, opening them may not be readily achievable during the course of an event. Implementing the open position double verification (by two different individuals) of these valves prior to startup, in addition to flow path verification during normal plant startup, eliminates the primary cause of AFW system unavailability.
O 3. The staff met with a representative of the licensee's contractor (Delian Corp.) for the reliability study. The staff expressed a number of Examples of concern areas are (a) the integration of plant concerns. specific data with similar industry data, and (b) the application of the Multiple Greek Letter approach in treating the Common Cause Failures. The staff believes that the concerns it raised would not substantially reduce the AFWS reliabilities estimated by the licensee to below the minimum accpetable value per the Standard Review Plan (SRP) Section 10.4.9, Rev. 2. 4. As a result of the reliability study, the licensee undertook certain plant and procedural modifications to boost the AFW system reliability. Examples are discussed below: Ensure that the cross-connect MDAFW pumps have a high availability, a. proceduralize their use, and ensure'the operability of the cross-connect valves (see D.7.2.2.g above). b. Provide procedures for, and train operators in manual start and control of TDAFW pumps. Reroute the AFW pump recirculation flow through lube oil-coolers to c. j reduce reliance on cooling water system. l Some of these modifications have been implemented, while others are planned for plant refueling outage. 5. With proceduralizing the cross-connection of the MDAFW pumps, and ensuring the operability of the cross-connect valves, and since the Westinghouse designed steam generators normally operate with a substantial water inventory (as demonstrated by the plant simulator loss-of-heat-sink run) sufficient time exists for operator action to cross-connect a MDAFW pump if needed. Therefore, the staff concludes
- - ' ~ ~"
s--- J w ' ' ' - ' ~
s ' that the Prairie Island AFW system configuration resembles those of some other plants that have been found by the staff to be sufficiently reliable. Those other plants also have two AFW pumps per unit configuration. The licensee's emphasis on the operability of the MDAFW pump, even if its associated unit is shutdown (see Section 0.3.2.1 above) increases the availability of redundant water pumping capacity, thus enhancing the overall AFW system reliability. 6. The licensee estimated the AFW System reliability with and without the modifications listed in Item 4 above. The licensee's estimates of probability of system failure for the Loss of Main Feedwater (LOMF) and the Loss of Offsite Power (LOOP) events are presented below: Failure Probability LOMF LOOP Without Modifications 2.0E-5 8.7E-5 With Modifications 2.9E-6 8.7E-6 SRP Section 10.4.9, Rev. 2, states that the reliability criterion of AFW systems is a failure probability no greater than 1.0E-4 per demand. These above failure probability estimates are not inconsistent with the other staff evaluations as discussed in this report. D.7.3
Conclusion:
Based on the above evaluation and based on the measures taken by the licensee after the TMI accident, and those taken or planned as a result of the licensee's reliability analysis, we conclude that the licensee is actively pursuing improvements in the AFW system reliability and in reducing challenges to such a systera. A large contributor to this staff finding is the licensee's reliability study and its reliability-based plant modifications. This dpproach by the licensee reduces the challenges to the AFW system and enhances its reliability. i
t . Appendix A References 1. System descriptions:
- a. Auxiliary Feedwater Syste, B-28B, Rev. O
- b. Cooling Water System, B-35, Rev. O
- c. Instrument and Station Air, B-34, Rev. O
- d. Main and Auxiliary Steam System, B1-27, Rev. 0 2.
Staff evaluations of the AFWS:
- a. NUREG-0611, Section X.10
- b. Safety Evaluation Report for TMI Task Action Plan, NUREG-0737, Items II.E.1.1 and II.E.1.2 transmitted to the licensee by letter dated March 22, 1982 3.
The Prairie Island, Units 1 and 2 Technical Specifications 4. Procedures during emergency decay heat removal:
- a. Response to Loss of Secondary Heat Sink, IFR-H.1, Rev. O i
- b. Loss of Reactor or Secondary Coolant 1E.1, Rev. 3
.c. Loss of Feedwater Supply, E5, Rev. 9
- d. Loss of All AC Power, 1EAC-0.0, Rev. O
- c. R'eactor Trip or Safety Injection, 1E-0, Rev. 3
6 . Appendix A (Continued) References (Continued) 5.
- a. Drawings Audited for Conformance to IEEE 277 and NUREG-0737, II.E.1.2.
Title DWG. No. 1. Simplified Reactor Protection System B8-3 2. Instrument AC Distribution B20.8-1 3. Train A DC Power B20.9-1 4.' 480 Volt Safeguards B20.6-2 5. Typical Reactor Protection Channel RP-36 6. Reactor Protection System X-H1AW-1-947-SH.18 7. Steam Generator Trip Signals X-H1AW-1-241-SH.7 8. Auxiliary Feedwater Pump Startup X-H1AW-1-249-SH.15 9. Safeguards Actuation Signals X-H1AW-1-242-SH.8
- 10. Instrument Black Diagram X-H1AW'-1-549-SH.1
- 11. Terminal Block Wiring Diagram X-H1AW-1-472-SH.2
- 12. Interconnection Wiring Diagram X-H1AW-1-580-SH.2
- 13. Reactor Protection System X-H1AW-1-939-SH.4
- 14. Reactor Protection System X-H1AW-1-934-SH.6
- 15. Reactor Protection System X-H1AW-1-947-SH.8
- 16. MCC #111TD AFWP NE-40009-SH.97
- 17. MCC #12 AFWP NE-40006-SH.59
- 18. Power Disp. One Line Diagram NF-93186-1-SH.1 l
- 19. "B" Train DC/AC Supply NF-40024-2-SH.2
- 20. "A" Train DC/AC Supply NF-40024-1-SH.1
- 21. 480V MCC-1A NF-40026-SH.1
- 22. 480V Distribution NF-40022.SH.1 23, 4.16MV Distribution NF-40020-1.SH.1
s a I . Appendix A (Continued) References (Continued) b. Letter, D. Musolf, Northern States Power Co. to Director, NRR, NRC " Additional Information Related to Confonnance with R.G.1.97, Rev. 2," June 6, 1985. Letter, D. Musolf, NSF Co. to Director, NRR, NRC "Conformance with c. R.G.1.97, Rev. 2," January 18, 1985. 6. Prairie Island Units 1 and 2, Auxiliary Feedwater System Reliability Study, April 1986. 7. Memorandum, F. Hebdon, AEOD, to T. Speis, NRR, " Preliminary Review of AFW-Related LERs," March 11, 1986. 8. Memorandum, F. Hebdon, AEOD, to T. Speis, NRR, " Review of AFW-Related LER and NPRDs Data." 9. NSAC-60, "A probabilistic Risk Assessment of Oconee Unit 3," June 1984 l
- 10. NUREG-1032, " Evaluation of Station Blackout Accidents at Nuclear Power Plants," Draf t Report for Comment, May 1985.
11. INP0 86-012, " Unplanned Automatic Scrams in U.S. Electric Generating Units in 1985," April 1986.
- 12. NSAC-108, "The Reliability of Emergency Diesel Generators at U.S. Nuclear l
Power Plants in 1983 through 1985," September 1986, 1
- 13. Memorandum, C. J. Heltemes, AE0D to H. R. Denton, NRR and J. M. Taylor, IE,
" Case Study Report - Operational Experience Involving Turbine Overspeed Trips," August 20, 1986, i l I t
t o' o. Appendix B NRC Personnel AFWS Evaluation Team Paul Norian, Team Leader, NRR Sammy Diab, Task Manager, NRR { Jerry Wermiel, NRR Robert Giardina, NRR Joseph Joyce, NRR Fred Manning, AE00 Dominic Dilanni, Prairie Island Licensing Project Manager James Hard, Senior Resident Inspector, Region III Moser Morris, Resident Inspector, Region III Northern States Power (NSP) Personnel Leon Eliason, General Manager for Nuclear Plants, NSP Ed Watzel, Plant Manager, NSP Dave Mandel, Plant Superintendent, NSP Gary Miller, Superintendent of Operations Engineering, NSP Richard Pearson, Senior Production Engineer, NSP Arnie Hunstead, Senior Production Engineer, NSP Robert Fraser, Lead Production Engineer, NSP Dick Lindsey, Plant Superintendent of Operation and Maintenance, NSP Jim Hoffman, Superintendent of Technical Engineering, NSP Julie Kulzick, Systems Engineer, NSP Bill Phillips, Maintenance Coordinator, NSP Don Burman, Lead Machinist, NSP Walt Sullivan, Delian Corporation ,n. ,-y-ce-,.-- ,.w. . - - -- -, -,- -. - - - -}}