ML20203N604

Responds to NRC Re Violations Noted in Safety Sys Functional Insp Repts 50-269/86-16,50-270/86-16 & 50-287/86-16 on 860505-0611.Corrective Action:Mods Made Enhancing Emergency Feedwater Supply from Condenser Hotwell

ML20203N604
Person / Time
Site:	Oconee
Issue date:	10/01/1986
From:	Tucker H DUKE POWER CO.
To:	Taylor J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE)
References
NUDOCS 8610090298
Download: ML20203N604 (17)

Text

. . . _ . . _ . _ . _ . - _

i.

I Dum POWER GOMPANY P.O. box 33189 CHAmLOTTE, N.O. 28949

? HAL B. TUCKER TELEP,EONE

< vnos em -

(704)373 4531 wuctuam emoevenow October 1, 1986 l

i

! Mr. James M. Taylor, Director Office of Inspection and Enforcement U. S. Nuclear Regulatory Commission l Washington, D. C. 20555 l .

Subject:

Oconee Nuclear Station

? Docket Nos. 50-269, -270, -287

, Safety System Functional Inspection Report j Nos. 50-269/86-16

' 50-270/86-16 50-287/86-16

Dear Sir:

By letter dated August 1, 1986, the NRC forwarded the report of the Safety System

, Functional ~ Inspection (SSFI) performed by an NRC Inspection team over the period 1 May 5 to June 11, 1986. The NRC effort involved an assessment of the operational readiness of the Emergency Feedwater System (EFW) at the Oconee Nuclear Station.

j While the demands of the inspection and response have been substantial, Duke has

! derived a positive benefit in terms of reassurance of adequate design, l identification of enhancement, and correction of weaknesses.

1 Duke considers that the concept employed in this inspection, is a useful technique

in identifying concerns related to' safety. As a result, Duke would encourage the i

NRC to continue with the development of-the inspection technique through formulation of procedures, personnel training, and enhancement of approach to minimize the impact on a Licensee's resources, and to assure continued professional implementation.

l Within the report, the NRC team identified concerns regarding the ability of the EFW System to function. These NRC concerns involve the availability of sufficient l water supplies; the ability of the EFW system to function following a seismic event l or a high energy line break; design concerns, such as the' susceptibility of EFW l

. pumps to runout and the adequacy of the turbine-driven EFW pump steam supply; and maintenance concerns, such as the use of incorrect gresses in motor-operated valves

and repetitive equipment failures. Further, the report requested Duke to provide a response within 60 days which would describe actions that have been'taken or that

.$g will be taken in regard to the concerns identified in Section 2.1 and 2.3 of the

-No SSFI report. In this regard, please find attached Duke's response to the items

. 00' identified in Section 2 of the SSFI report. In addition, Duke has initiated a mo review of Section 3 of the SSFI report to identify any. additional concerns, unresolved items, or open items that may need to be addressed, which have not been m:c addressed by this letter. A supplemental response, if necessary, will be provided y by November 15, 1986.

, oc l 7 As was acknowledged during the inspection, a significant number of the items that Sg were noted by the inspection team had been identified by Duke prior to the g inspection. As a result appropriate corrective actions and improvements were already being pursued by Duke. [1 .

1 Mr. James M. 1.ylor, Dirsctor October 1, 1986 l Page Two These actions include plant modifications, procedural upgrades, personnel training, enhancements of current programs and the development of new programs.

Specifically, these activities encompassed:

(1) Modifications to enhance the emergency feedwater supply from the condenser hotwell.

(2) Modifications to improve the capability to manually dump steam to the atmosphere.

(3) Analyses of emergency feedwater flow rate at lov Steam Generator pressure.

(4) Modifications to improve the seismic capability of the Emergency Feedwater System.

(5) A review and upgrade of the plant lubrication program. .

(6) A comprehensive program for upgrading the maintenance for all motor-operated ,

valves.

(7) Improved guidance for conducting safety evaluations for plant modifications.

(8) A review of the design change process for conformance with ANSI N45.2.11.

(9) Development of a consolidated listing of Oconee instruments.

Duke is also reviewing the findings of this report to determine if more comprehensive actions need to be taken beyond the specific, system-related items identified in this report. As discussed above, there are already existing efforts that extend beyond the Emergency Feedwater System. The attached response also addresses areas that encompass more than the Emergency Feedwater System, such as review of electrical and mechanical system calculation files _to ensure that all such files are complete.

In certain cases the report calls into question the adequacy of the design basis of certain systems at Oconee. Duke's position on each of these items is contained in the attached responses. However, Duke considers the simplicity and versatility built into the design of Oconee's Emergency Feedwater System and related systems has resulted in a highly reliable means of providing feedwater under all realistic scenarios. l Duke would like to stress that Oconee has operated safely and reliably for over 13 years, during which time many noteworthy performaace related achievements have been accomplished. Such accomplishments could not have been obtained without above average operations, maintenance, surveillance, design, training, and quality as-surance programs. Although the report in many cases served to reenforce the need-for actions that Duke had already initiated, this inspection did identify areas where additional improvements are required. Duke will ensure that the lessons learned from this inspection effort and other industry experience will be reflected in our programs to further improve our performance. Duke will also continue to review operating experience and similar inspection results from other plants.

Very truly yours, d

Hal B. Tucker PFG/20/slb m

Mr. J mes M. Tcylcr, Dirsctor October 1, 1986 Page Three l

4 xc: Dr. J. Nelson Grace, Regional Administrator U.S. Nuclear Regulatory Commission - Region II 101 Marietta Street, NW, Suite 2900 Atlanta, Georgia 30323 Ms. Helen Pastis Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Mr. J.C. Bryant NRC Resident Inspector Oconee Nuclear Station 1

Item 2.1.1 Use of the Motor-Driven EFW Pumps for Long-Term Cooling (1) The motor-driven EFW pumps in Units 2 and 3 were able to directly access only about 3,000 gallons of water in the condenser hotwells at nominal operating level. The FSAR stated that the upper surge tank (UST) contains a nominal 50,000 gallons of water and that the condenser hotwell contains 120,000 gallons of water for EFW supplies. However, assuming for Units 2 or 3 a loss of the turbine-driven EFW pump, a source of EFW cannot be assured beyond approximately 100 minutes (at a nominal 500 gpm) without the use of non-safety-related pumps to replenish the UST.

(2) The motor-driven EFW pumps in all three units were unable to take a suction on the condenser hotwell with a vacuum. However, if the condenser vacuum was broken, the plant may be unable to cool down by bleeding steam from the steam generators (SGs). The condenser steam dump valves cannot dump steam to the condenser without a vacuum, and the handwheel-operated atmospheric dump valves (12-inch gate valves) had apparently never been demonstrated to be capable of being opened at high differential pressures.

Response

(1) The Upper Surge Tanks (UST) for each unit, as stated in the FSAR, serve as the only fully safety-related water supply for the Emergency Feedwater System. The EFW pumps for each unit are normally aligned to this primary water supply. EFW from other units may also be aligned to supply the affected unit's steam generator (SG).

Non-safety-related systems and water supplies are also available to provide backup to normal EFW flow paths. The hotwell serves as~the secondary water supply, though with limited inventory available to the motor-driven pumps. A Hotwell Pump can be used to replenish the UST from the Hotwell. The Condensate Storage Tank contents may also be pumped to replenish the UST. In addition, the demineralized water system can also be used to make up the UST.

Furthermore, steam generator feedwater can be supplied by other plant systems in the unlikely event that all of the EFW inventory of a unit is exhausted. The safety-related low head Auxiliary Service Water pump can also supply water from the CCW piping following.SG depressurization.

Moreover, as mentioned before, the safety-related EFW inventory from another unit can be delivered to an affected unit via cross-connect lines.

Flow from the Main Feedwater System, if re-established or never lost, can also provide water from the condenser hotwell. If the MFW pumps are not available a Hotwell Pump / Condensate Booster Pump combination can supply feedwater to a partially depressurized steam generator.

Independent of Normal Plant Systems, the safety-related Standby Shutdown Facility Auxiliary Service Water Pump can deliver flow to the steam generators from the Condenser Circulating Water System piping.

In the absence of all steam generator feedwater, High Pressure Injection System feed and bleed cooling can be used to provide decay heat removal.

This mode is independent of the EFW System and has been shown analytically to provide adequate core cooling.

~

As noted in the report, Duke had initiated modifications to provide additional water directly from the hotwell to the motor-driven EFW pumps.

The modification, completed and tested in April 1986 for Unit 1, satisfied the. concerns of the SSFI team which were expressed only for Units 2 and 3.

Unit 2's modification was installed in September 1986. Unit 3's will be installed in March 1987, during its next scheduled refueling outage. In the interim period, the many sources of feedwater mentioned above assure adequate supply.

(2) As an alternative to cooling down by the condenser, adequate main steam atmospheric dump flow capacity is provided by the current system. The atmospheric dump valves are designed for cooldown using the motor driven EFW pumps, SSF ASW pump or the Low Head ASW pump. Operation of the dump valves has not been demonstrated at high differential pressures; however, similar manual valves used in high differential pressure applications have been operated with acceptable performance. If the low probability need to operate the atmospheric dump valves were to arise, it is firmly believed that these valves can be opened within the time constraints of the postu-lated event. In the unlikely event the atmospheric dump valves could not be opened, the main steam relief valves could be used to maintain hot shutdown conditions until other means of cooldown can be reestablished while condenser vacuum was being restored.

Although procedures do not exist, operators are aware of an additional contingency. 'A turbine bypass valve / condenser vacuum interlock can be defeated to allow steam bleed to the condenser without vacuum. Sufficient condensing capacity would be supplied by the Emergency Condenser Circulat-ing Water (CCW) system to remove decay heat, if the normal CCW system was not available.

As a final note, the Main Steam Atmospheric Dump System is being modified to enhance its capability to manually control the steam flow rate for decay heat removal. A pressure equalizing line around the first isolation valve and a flow control valve bypassing the second isolation valve are being added. This enhancement modification was initiated in March 1985, and has been installed on Unit 2 during the 1986 refueling outage, and will be installed on Units 1 and 3 during their next refueling outages.

Post-modification operability testing will be performed to demonstrate that a controlled plant cooldown can be accomplished.

Item 2.1.2 Turbine-Driven EFW Pump Reliability (1) A portion of the steam supply piping to the turbine-driven EFW pump was designed for 350 psig. Steam regulating valve MS-87 upstream of this piping was designed to fail open on a loss of air and backup nitrogen supply, both of which were not safety-related. Relief valve MS-92 down-j stream of MS-87 was undersized such that if MS-87 failed open, the steam line could be pressurized above its design rating.

(2) From April 1984 to February 1986, there were a significant number of corrective-maintenance work requests (11) relating to the speed control of the Unit 3 EFW pump turbine.

Response

(1) Reanalysis indicates that due to significant margin in the original design, there has been no potential impact on system function or personnel

~

safety due to perssure increasing above the steam supply system's original design rating. The design pressure can be raised without affecting relief valve capacity or set procedure. A proposed resolution for the inappro-priate design rating will be recommended by Design Engineering by November 1, 1986.

Additionally, Duke will be spot-checking other steam relief valve applica-tions at Oconee for appropriate sizing / pressure rating. A refresher training program for Design Engineering mechanical system engineers will also be conducted by the second quarter of 1987 to cover overpressure protection theory, code requiremente, and applications; and to reinforce the need to document the overpressure protection analysis in an auditable form which can be kept current.

(2) A thorough review of the Unit 3 EFW pump turbine maintenance from April 1984 to February 1986 does not substantiate a conclusion of ineffective corrective maintenance. The larger than normal number of corrective maintenance work requests " relating to speed control" covered a wide range of only loosely-related maintenance areas. These areas included the turbine control system, the steam supply system, and the main steam isolation system.

For example three cases have been identified in which corrective mainte-nance was requested but not necessary. In one case (April 29, 1984), a turbine overspeed test was improperly performed when the high speed stop nut was raised too quickly. A maintenance review indicated the controls were functioning properly. In another case (June 22, 1984), a perceived turbine governor problem was evaluated and proved to be a steam supply (MS-87) problem. In a third case (January 21, 1986), a work request was written based on an observed increase in steam header pressure above its normal setpoint of 310 psig to 360 psig. An identical pressure overshoot, which occurs immediately after the TDEFWP is secured and is of short duration, is inherent in the control system design of MS-87. No mainte-

• nance anomalies were discovered upon investigation.

In addition, one instance (July 3, 1984), was identified in which mainte-nance was requested apparently due to a less-than optimal previous

maintenance activity. In this case, MS-87 would not fully close. It was discovered that the air supply pressure was slightly low fa comparison with the operator bench set range. Although not substantiated, it is possible this condition originated following a previous maintenance activity on MS-87 required to address a minor valve stroke time / pressure control setpoint anomaly. In this instance, maintenance may have been less than optimal, however, no inoperability or significant performance degradation resulted.

In addressing the Sequence of Events described in Section 3.1.4(1) of the SSFI Report, an investigation of the maintenance and performance testing activities identified no cases in which operability had been misrepresent-ed or inaccurately evaluated. Specifically, the identified June 1984 sequence in which the TDEFWP evidenced sluggish response during perfor-mance testing, inoperability was not indicated. The pump was demonstrated capable of reaching its operating speed. The responsible technical personnel evaluated and documented the pump as operable, capable of performing its safety function, following each test. The sluggish, but operable, responses were dueEto low steam supply flow which was, in time, identified and corrected. The small amount of dirt discovered during the June 22, 1984 maintenance activity would not result in governor malfunc-tion. Again, although less than optimal performance may be indicated, less than acceptable performance is not indicated.

Further, the review of maintenance and performance testing activities in a wide range of pump and valve applications indicated numerous instances in which inoperability was declared. If a component demonstrates less than acceptable performance, it is so declared.

Finally, during the period between April 1984 and February 1986, the Unit 3 TDEFWP was required to function twice (August 19, 1984 and October 24, 1985) in response to loss of main feedwater events during power operation.

In both cases, no performance anomalies were identified.

l l

)

Item 2.1.3 No Runout Protection for EFW Pumps An analysis conducted by the licensee during the inspection revealed that EFW pump runout (pump flow beyond design levels possibly leading to cavitation and high vibration) could occur during normal EFW actuation at SG pressures as high as 700 to 900 psig as long as EFW flow control valves FDW-315 and FDW-316 remained full open. Conditions leading to runout would be worse if the EFW flow control valves failed open as designed or if a main steam or feed line break were to occur. Such an analysis on pump runout had not previously been performed by the licensee.

Response

To ascertain the specific conditions under which runout could occur, a thorough review of each design base scenario for EFW has been performed. In addition operator action that would have. resulted in termination of EFW pump runout has been identified. In each case, action has been performed (as demonstrated on the Oconee simulator within minutes of the start of the scenario. Scenarios considered are worst-case, including Main Steam or Feedwater line break and control valve failure to the full open position. Except for one scenario (high energy line break), runout of EFW pumps would not occur until several minutes into the event, meaning it is unlikely runout would even begin. In the high energy line break scenario, operator action to prevent /stop runout is almost immediate.

Although turbine-driven pump runout could occur at SG pressures as high as 750 psig during a loss of all AC Power, pressure would have to drop below 600 psig for a loss of off-site power event and below 400 psig for other events before EFW function would be threatened due to availability of multiple pumps of varying designs. It should also be noted that with runout occurring for just a few minutes, some pump performance degradation could occur, but total loss of the pumps is not anticipated. In the unlikely event that all EFW pumps for a unit are lost due to damage resulting from pump runout, feedwater to the steam generator can be supplied by other plant systems when necessary as described in the response to item 2.1.1(1). Although operator action would be expected to preclude loss of EFW function, the potential loss of function due to EFW pump runout was reported to the NRC per 10CFR50.73 on August 28, 1986, due to difficulty of quantifying loss of pump performance and associated operator action.

Duke Training personnel had noted that the Oconee simulator was modeling undesirable high flow rates of EFW. As a result of this observation, calcula-tions concerning EFW flow capacity were initiated by Duke January,1986.

Operating procedure revisions and training have been completed to alert opera-tors to the flow limitations of the EFW pumps. Design Engineering is investi-gating various options for a planned system modification that will ease the burden placed on Operations to prevent runout and reduce the potential for resulting pump damage. Design of the modification chosen will be initiated by May, 1987. In addition, as part of the review of calculation files (see response to Item 2.3.2(1)), Duke will verify that pump runout analyses.is documented.

l 1

4

Item 2.1.4 EFW System Reliance on Non-Safety-Related Equipment Operator reliance on instrumentation and control equipment that is not safety related was extensive. UST level indication and alarms, pneumatic operators and supplies for the EFW flow control valves and steam regulating valves (for turbine-driven EFW pumps), and EFW system valve motor operators were classified as not safety related. The inspection team determined that the licensee's maintenance practices and design activities were significantly less rigorous for non-safety-related equipment. The inspection team was concerned that these lower standards were applied to the non-safety-related equipment important to the operation of the EFW system.

Response

In responding to and mitigating the consequences of certain low probability events, safety-related as well as non-safety-related instruments and control equipment are used. Duke has a high degree of confidence in the overall reliability of non-safety related equipment. This high degree of confidence is based on an effective design process, quality construction practices, strong maintenance program and proven operating experience in both nuclear and fossil stations.

The design process is essentially the same for safety and non-safety systems, even though the documentation of the process is more rigorous for safety-related systems. The same technical expertise is used to perform the designs, and the designs are based on sound engineering practice and code requirements. In many cases non-safety-related equipment is similar or identi-cal to safety-related equipment.

Procedures are used to perform maintenance on both safety-related and non-safety-related equipment, although procedures are only rcquired for safety-related equipment. The procedures for non-safety-related equipment are as detailed as safety-related procedures and are maintained with the same degree of attention as with safety-related procedures. Duke has a review process for non-safety-related procedures and this guidance is in the Administrative Policy Manual for Nuclear Stations. The non-safety-related procedures are expected to meet the same standards in terms of acceptance criteria, documentation, and independent verification as safety-related proce-dures. Duke has identified some non-safety-related procedures that do not meet these high standards and those procedures are being upgraded as required by the Administrative Policy Manual review process.

In addition, all training and directions given technicians on systems and equipment meets the same standard whether the systems or equipment are safety related or non-safety related. All technician qualification to systems and procedures must meet the same standard without regard to the safety-related status of the system or procedure.

The basic objective of Oconee's maintenance program is to assure a high degree of reliability of plant systems and equipment. Accordingly, the maintenance-performed is of a high standard without regard to whether the work is being performed on safety-related or non-safety-related equipment.

l l

l

. - .. . . - - . . . - - . ~ - - . . . -

1-1 I

I A task group was formed in September 1986, to review the issue of use of control grade hardware and operator response. This review will be completed by i November 15, 1986, and will address the-technical acceptability of reliance on

~

control grade-hardware and operator action as they relate to the Gconee.

Emergency Feedwater System. The results of this review will also be used to evaluate the need for expanding the review to other plant systems.

a j

i 1

i

]

I j .

4 J

.i i

,'l i

i 1

l l

4 l

i _ ___ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . - - _ - . . . _ _ _ _ _ _

Item 2.1.5 Reliability of Nitrogen Backup System for EFW Air-Operated Valves (1) Backup nitrogen systems that are not safety related were provided for the EFW flow control valves FDW-315 and FDW-316 and for the regulating valves MS-87, MS-126, and MS-129 that supply steam to the turbine-driven EFW pumps. The licensee committed to providing 2-hour backup nitrogen sys-tems. The nitrogen supply systems for flow control valves FDW-315 and FDW-316 were sized based on a 1-hour operating criteria. No design analyses were available providing the sizing basis for the steam pressure regulating valves.

(2) Post-installation testing was considered inadequate for these backup nitrogen systems because this testing only demonstrated that the nitrogen systems were capable of positioning the control valves under no flow conditions.

(3) No periodic testing was done to demonstrate the capability of these nitrogen systems.

'T (4) Unlabeled, undesignated, and apparently uncontrolled isolation valves were found in these nitrogen systems.

Response

(1) As pointed out in the inspection report, Duke did not maintain a 2-hour supply of nitrogen at all times. This, however, did not negate the ability of the Emergency Feedw, ter System to perform its safety-related functions. Furthermore, the high priority of returning to service the instrument air compressors to mitigate the consequences that loss of instrument air will cause is stressed during license operator training.

In response to this finding, Duke has initiated appropriate actions to assure that a minimum of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of nitrogen supply is continuously maintained for valves FDW-315 and FDW-316. Specifically, procedures will be revised by November 1, 198(, to require the replacement of nitrogen supply bottles prior to exceeding 2-hours of nitrogen supply.

The nitrogen backup system was added as an enhancement to the EFW System to provide system control in the event instrument air supply 'is lost. The EFW System is designed such that the flow control valves fail open (safe position) upon loss of air supply. Thus the EFW can perform its safety function without taking credit for the Nitrogen Backup System.

(2) The nitrogen system was functionally tested upon installation to verify that it was capable of properly positioning the regulating and the Flow Control valves. Additionally, bench testing was done to determine the pressure, and volume demands required for sustained operation.

Appropriately sized nitrogen supply bottles were installed with the capability to provide valve control for greater than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Since these valves have been reliably operated with instrument air supply,'and it is not expected that the valves will respond differently under nitrogen supply, it was determined to be unnecessary to test the nitrogen system under full flow conditions. Duke considers that the post-modification testing was appropriate for this valve control system.

1

(3) Periodic functional testing is currently under development and will be conducted during each future refueling outage.

(4) These valves were installed to provide instrument air isolation during the modification process when the Nitrogen Backup System was added, and these valves were retained to facilitate maintenance activities. Failure to apply positive controls on these valves at the completion of the modification was an oversight. This has been completed by incorporating these valves into the appropriate procedures to provide adequate control.

t t

4 4

t 1

i l

i i

i 1

i d I t

I.

a I

i t

Item 2.1.6 Ability of EFW System to Respond to a Main Steam Line Break Check valves MS-83 and MS-85 in the turbine-driven EFW pump steam supply lines were not tested in the backflow direction. Normally open isolation valves MS-82 and MS-84 and valve operators that were not safety related and, in some cases, 3MS-84 was not properly maintained. A main steam line break with a failure of check valve MS-83 or MS-85 to backseat could result in the blowdown of two SGs and the loss of the turbine-driven EFW pump.

Response

Check valves MS-83 and MS-85 are normally closed. Concern over failure.of check valves to close is based on industry experience with open valves failing to close. Normally closed check valves are less vulnerable to this failure.

Oconee's inservice testing (IST) program for valves is in compliance with ASME Section XI requirements and the testing of these check valves in the back flow direction is not required by ASME Section XI. To permit this testing, a major plant modification would be required. Based on experience, Duke believes that the marginal increase in plant safety that may be achieved by this testing would not be justified, especially when evaluated against the cost associated with the modification.

Maintenance anomalies identified relative to 3MS-84 between June 1984 and October 1985 are indicative of general weaknesses in the motor operated valve maintenance program at that time. A comprehensive review and redirection of this program, prompted in part by IE Bulletin 85-03, has been ini-tiated. This is addressed in more detail in response to Item 2.3.1.

As a final note, the scenerio including a main steam line break plus an isolation valve failure plus a (normally closed) check valve failure is considered to be an extremely low probability event and, additionally, beyond the licensing design basis of Oconee.

l l

l 1

I

Item 2.1.7 Ability of the EFW System to Respond to a Seismic Event (1) The FSAR stated that the EFW system is capable of withstanding a maximum hypothetical earthquake (equivalent to the safe shutdown earthquake). As identified by the licensee in LER 86-002 dated March 5, 1986, substantial portions of the EFW system were not seismically qualified.

(2) The safety-related batteries for the Keowee hydroelectric plant standby power supplies were found to be improperly installed to meet seismic requirements. The failure of these power supplies could result in a complete loss of emergency ac power.

Response

(1) Based on an internal review of the EFW system, Duke identified some portions of the EFW and LPSW systems that were in non-compliance with Final Safety Analysis Report (FSAR) Seismic criteria requirements. This was reported to the NRC by a letter dated March 5, 1986, which transmitted Licensee Event Report (LER) 269/86-02. Actions taken and actions to be taken are identified within the LER (LER 269/86-02). Prior to submitting the LER, a safety evaluation was performed and was submitted to NRC/ Region II by a letter dated February 6, 1986. An updated safety evaluation addressing additional items identified through Duke's review was provided to NRC/ Region II by a letter dated March 5, 1986. Briefly, the safety evaluation concluded that the EFW system would continue to function and that all three units could be safely shutdown following a Maximum Hypo-thetical Earthquake (MHE).

No new information has been identified in the inspection that invalidates the conclusions of the safety evaluation that was performed. Duke con-tinues to have confidence in the present design of the system and that this system will function following a MHE event. The schedule for imple-menting the corrective actions being taken, as identified within the LER, to bring the EFW system at Oconee into full compliance with the stated FSAR commitments, is appropriate and consistent with the findings of the safety evaluation.

(2) During the Oconee SSFI field inspection, the NRC observed that the end stringers on the Keowee battery racks that restrain cell movement wara not installed in accordance with the manufacturer's installation drawing.

Specifically, the drawing notes state that the end stringer should be within 1/4" of the cell or that spacer material should be added between the end stringer and the cell to reduce the gap to 1/4" or less. The gaps observed by the NRC were noted as approximately 3" to 5" between the end cells and the end stringer.

As a result of this finding, Duke took immediate corrective action to install the appropriate spacer material between the end cell and the end stringer to bring the battery installation into conformance with the manufacturer's installation drawing. This corrective action was completed during the audit on the same day the discrepancy was observed.

To assure the operability of the Keowee Hydro Station to perform its intended safety function, Duke evaluated the installation discrepancy to

determine the seismic qualification acceptability of the Keowee batteries during.the time the discrepancy existed. The evaluation considered the

!- seismic capability of the batteries and racks as provided in the manufac-turer's seismic test report and analyses, the battery rack anchoring, the Keowee seismic response spectra, and the various effects of possible cell movement in a seismic event.

i Based on the evaluation,-Duke has concluded that the Keowee batteries,

, although not initially installed in.the manner prescribed on the design drawing, would have survived a one-time MHE event without loss of func-l tion. A LER (LER 269/86-09) addressing this situation which was l transmitted by a Duke letter dated July 14, 1986.

L F

4 1

4 i

i 4

i i

4 4

i

Item 2.2.1 Primary System Feed and Bleed Cooling This heat removal process relies on a supply of water from the high pressure injection pumps and a bleed path through the pressurizer power-operated relief valve (PORV) and the PORV block valve. Both the PORV and PORV block valve were found to be not environmentally qualified. The inspection team identified three instances where the PORV block valves were seated to prevent leakage during plant operations. This process used an insulated stick to manually shut the motor contacts, bypassing the torque switch, and applying full motor torque to seat the valve. The inspection team was concerned that the PORV block valve could be damaged or stuck shut in the process.

Response

Feed and bleed cooling is an alternate means of decay heat removal for the unlikely event that all sources of steam generator feedwater are lost. This mode of cooling involves using HPI to inject cold water into the RCS cold legs, and opening the pressurizer PORV to relieve primary system mass and energy.

Feed and bleed cooling is relied upon only for events beyond Oconee's design basis. As such the PORV and the block valve are not required to perform a safety function in a harsh environment and are therefore not within the scope of 10CFR50.49. The past practice of operating motor operated valves by the stick process has been discontinued.

The following failure modes and effects analyses addresses the situation of valve damage and the ability of the plant to achieve successful feed and bleed cooling.

l a) The PORV and/or its block valve will not open If the PORV flowpath cannot be established for feed and bleed cool-ing, the operators are instructed to open the environmentally-qualified RCS high point vents to provide some coolant discharge. Furthermore, in 1983 Duke performed an analysis of feed and bleed cooling without the PORV or the high point vents.

The results of the analysis indicate that relief through the pressur-izer safety valves and injection from two out of three HPI pumps will provide adequate decay heat removal.

Relieving water through the pressurizer safety valves raises the possibility that one or both of the valves will not reseat, thus creating a non-isolable small break LOCA. The consequences of such a failure have been shown to be acceptable by the licensing basis LOCA analyses.

b) The PORV and the block valve will not close This failure, as before, would result in a non-isolable LOCA with acceptable consequences per the licensing basis small break LOCA analyses.

As noted earlier, the practice of operating motor operated valves by the

" stick" process has been discontinued. Procedures to control how this practice is used and when have been implemented. Additionally, a trouble shooting procedure has been provided to the on-shift electricians. This procedure checks for possible interlock problems and gives corrective actions.

Operations and I&E personnel are allowed to operate a breaker manually with current meters in place to detect valve motor operability problems. ,,

1 i

)

1 i

-l l

i i

1

?

)

-_,m._.-v-r-- - - -- * --v- - -- - <, - - - - ,~ . - . - , - ---.. - -.e-te.------se--------=~ - - < -, + - ~-. v ,w-.-+ + - - - - t*-+e-- w--o---

e

Item 2.2.2 Auxiliary Service Water (ASW) System (1) This single pump system was designed to supply lake water at low pressure (approximately 85 psig) to the SGs of all three units. The routine testing conducted on the ASW pump was considered inadequate. The perfor-mance test did not record suction pressure, discharge pressure, or flow.

(2) The ASW system relied on the handwheel-operated atmospheric dump valves (12-inch gate valves) to depressurize the SGs. These valves had apparent-ly never been demonstrated to be capable of being opened under high differential pressure conditions.

Response

(1) The ASW system was designed for decay heat removal following the loss of all main and emergency feedwater systems and the decay heat removal system. Within the NRC Safety Evaluation in the matter of Duke Power Company, Oconee Nuclear Station Units 2 and 3, Docket Nos. 50-270/287, dated July 6, 1973, the staff concluded that the system provides adequate backup protection against the improbable total loss of the main condenser intake canal.

In addition, the ASW System would be utilized for decay heat removal in the rare case that all of the following proved ineffective:

a) Main Feedwater pumps b) Emergency Feedwater System (2 MDEFWPs, 1 TDEFWP) for each unit c) Emergency Feedwater cross-connect from another unit d) SSF ASW System e) Condensate booster pumps or hotwell pumps f) Primary system feed and bleed Further, a Relief Request from the requirements of ASME Section XI, IWP-3000 was granted by the NRC in letters dated January 18, 1978 and March 27, 1978. The relief request granted by the NRC permitted routine testing of the ASW pump without measuring suction pressure, discharge pressure or flow.

Based on the above discussion, the routine testing conducted on the ASW pump is considered adequate, and consistent with its present application.

(2) The capability of the handwheel-operated atmospheric dump valves (ADVs) has been addressed in Item 2.1.1(2). These valves are not periodically tested at differential pressure conditions. In general, manual valves are not periodically tested at design pressures. Once the capability has been demonstrated by testing (see response to Item 2.1.1(2) for information of  ;

testing for these valves), a periodic stroking is considered sufficient verification of the valve's operability. As noted in the response to Item 2.1.1(2), the Atmospheric Dump Valves are being modified to enhance their capability to manually control the steam flow rate for decay heat removal.

After the modification to these valves are completed on each unit, periodic testing will be performed on a refueling frequency.

Item 2.2.3 Standby Shutdown Facility (SSF) ASW System (1) This single pump system was designed to supply lake water at high pressure to the SGs of all three units. Design analyses were not available and testing apparently had not been conducted to demonstrate that sufficient SSFASW pump head was available to meet decay heat removal flow require-ments to multiple SGs.

(2) The SSFASW system was not single-failure proof. This was significant because the EFW system may not be capable of withstanding a maximum hypothetical earthquake.

Response

(1) Calculations demonstrating the ability of the SSF ASW system to provide decay heat removal flow requirements were performed prior to SSF ASW pump procurement in 1979. These calculations were not formal and were not available in controlled calculation files. As noted in the response to Section 2.3.2, formal control of these older calculations was not as stringent as to current standards and procedures.

Regular pump performance tests demonstrate the SSF ASW pump's capability to provide the head and flow which the original calculation showed was needed for steam generator cooldown. If necessary, flow balancing to each of the six steam generators is achieved from the SSF control room.

Formal calculations demonstrating SSF ASW capability will be completed by February 1, 1987.

(2) By letter dated April 28, 1983, the NRC forwarded the Safety Evaluation Report (SER) for the SSF. The SER concluded that the SSF design meets the appropriate requirements of Appendix R to 10CFR50, Sections III.G.e and III.L and those requirements applicable for flooding and seismic events.

Further the SER states that "the systems are not designed to meet the single failure criterion, but are designed such that failures in the system do not cause failure or inadvertent operations in existing plant system." As such, the application of the single failure criterion to the SSFASW is beyond the licensing design basis.

As discussed in response to Item 2.1.7, Duke has complete confidence that the present EFW system will continue to provide its intended safety function following a MHE event. However the redundant SSF ASW system is fully capable of providing water to the steam generators to safely shut-down any or all units.

In sum, Duke believes the proper way to characterize the design is that there are two safety-related systems, including three full pressure trains, capable of providing water to the steam generators to remove decay heat. The two systems are the EFW system with its own redundancy versa-tility and flexibility, and the SSFASW system. In addition, a back-up low pressure safety-related train (ASW) is also capable of removing decay heat.

Item 2.3.1 Motor-Operated Valve Maintenance Program (1) The lubrication program for motor-operated valves (MOVs) did not adequate-ly control lubricants or provide coverage for all safety-related and environmentally qualified valves.

(2) The program for control of MOV torque switch and limit switch set points was considered inadequate due to reliance on skill of the craft to estab-lish critical switch settings, inadequate procedures, lack of testing under differential pressure conditions, and repetitive failures.

(3) The overall maintenance program was considered weak because of the repeti-tive equipment failures that were identified and because the corrective maintenance activities did not appear to identify or correct the cause of the failure.

Response

The Motor-Operated Valve (MOV) maintenance program is currently being upgraded at Oconee Nuclear Station. This is a comprehensive program to refurbish approximately 900 MOVs on the three units over a five year period and to establish torque and limit switch setpoints. This large scale effort was initiated in late 1985, and goes beyond what was required by IE Bulletin 85-03. Although this effort was initiated prior to the SSFI, the inspection resulted in Duke accelerating the implementation of the program.

On August 1, 1986, a meeting was held in Atlanta with NRC/ Region II personnel to discuss in detail Oconee's MOV program. As discussed in Atlanta, Oconee's MOV program consists of the following three main elements:

(a) The Mechanical Valve Repair Program (b) The Operator Refurbishment Program (c) The MOV Diagnostic and Setup Program The mechanical valve repair program assures that the valve itself is properly maintained. This is accomplished, in part, through an aggressive preventive maintenance program which requires the rebuilding of valves on a regular basis. For instance some 130 valves are to be rebuilt during the upcoming Unit 3 refueling outage.

The objective of the motor operator valve refurbishment program is to refurbish a total of 900 valve operators over the next 5 years. On the average, some 100 operators will be refurbished during each refueling outage. This will result in some 300 operators per unit being refurbished over the next 5 years. For example during the upcoming unit 3 refueling outage, the following operators area being refurbished and/or tested using Motor Operated Valve Analysis and Testing (MOVAT) equipment.

(a) 19 IE Bulletin 85-03 Limitorque Actuators rebuilt and MOVAT tested.

(b) 5 ID Bulletin 85-03 ROTORK MOVAT tested (c) 50 Environmentally Qualified (EQ) Limitorque Actuators rebuilt and approximately 40 MOVAT tested

(d) 25 Balance of plant actuators rebuilt The refurbishment process will include the removal and disassembly of the operator. The operator will be cleaned (degreased) and thoroughly inspected. . Gaskets and "O" Rings will be replaced and any other parts showing unacceptable wear.

The motor operator valve analysis and testing (MOVAT) program is to verify proper MOV set-up under specified conditions and to perform diagnostics of the valve operator. The MOVAT . equipment can be used to determine operability of the valve and its operator by verifying if the motor operator output exceeds valve design requirements. To illustrate how M0 VATS can be used, the following example involving ILP-1 is provided:

(a) ILP-1 is as 12" Walworth Gate valve with a Limitorque SMB1 operator.

(b) 1.5 was the as found torque switch setting and 1.5 was the as left torque switch setting.

(c) The maximum system delta pressure is 320 psi and the calculated valve thrust required at this delta pressure is 12676 lbF.

(d) The calculated operator capabilities with a torque switch setting of 1.5 and 1.75 is 1328 lbF and 17045 lbF respectively. As can be seen the calculated operator capability exceeds the valve requirement at system conditions.

(e) The measured operator capability using MOVAT for a torque switch setting of 1.5 is 17543 lbF and with a setting of 1.75 is 24454 lbF.

(f) As shown above, the valve is verified to be operable since the measured operator capability exceeds the valve requirements at system conditions.

As an example of the MOVAT program, the following discussion addresses the application of the program during the Unit 2 outage.

(a) For a valve to be testesd, Design Specification and Information concerning the valve and operator is obtained. System requirements are specified.

(b) Data and information is obtained from the field, such as torque switch settings, and limit switch settings.

(c) The MOVAT equipment is setup to obtain data regarding the performance of the operator motor to verify that system requirements are met.

(d) The valve is tested under differential pressure.

(e) The results of testing and all data and information obtained is reviewed to determine valve operability.

In summary, Oconee's MOV program is to refurbish approximately 900 MOVs on the three units over the five year period (300 per unit). Approximately 100 MOV's will be rebuilt each refueling outage for the next three outages of each unit. Torque switch settings will be checked, verified, and documented to be between the maximum and minimum settings required. The Limit Switch settings will be verified to be appropriate and the As-Found and As-Left value will be documented. Testing with MOVAT equipment will ensure proper operation at differential pressure conditions. Procedures will be used to document all work performed. A preventive maintenance program will be implemented to maintain proper condition of all MOVs. As a final note, Duke concludes that the programs developed and implemented

will ensure that all MOVs at Oconee are operating and being maintained properly.

(1) As noted above, Duke was already in the process of upgrading the Lubrica-tion Program at Oconee prior to the inspection. A comprehensive evalua-tion and modification of the Lubrication program was initiated as a result of a Duke Quality Assurance Audit in 1985. This effort was directed towards centralizing responsibility for valve lubrication and ensuring all lubrication requirements are met. The program rework included preparation of data sheets in the Station Lubrication Manual for each application, line-by-line review of maintenance lubrication procedures, turnover of all lubrication responsibility to Maintenance, and upgrade of lubrication issue, storage, and training. This comprehensive effort will reach full implementation by January 1987.

The following information addresses the apparent mixing of different chemically based lubricants in environmentally qualified motor operator valves. Briefly, Texaco Marfak 0 grease had been used at Oconee for lubricating Limitorque operat ors since the first lubrication program had been developed in the early 1970s. The Limitorque manual at the time referenced Texaco Marfak 0 grease as a substitute for Exxon Nebula EP-0.

Compatibility studies performed by Texaco for Duke in 1975 reaffirmed Texaco Marfak 0 as a substitute. Texaco Marfak 0 grease had been used since this period of time with.no indications of any degradation of MOVs.

A more detailed discussion of the EQ MOV lubrication program and commit-ments for corrective actions have been detailed in a Special Report submitted to Region Il by a Duke letter dated July 29, 1986. The report concluded that the two types of grease used in the limitorque valve operators were compatible and their mixture would withstand the post-accident environment to which it could be exposed without rapid degradation. By letter dated August 21, 1986, the NRC concurred with this assessment.

(2) A review of torque switch settings, in early 1986 in part responding to Inspection Report 85-37 and in part responding to Bulletin 85-03, indicat-ed these settings were not readily available to plant personnel. A Set Point Document is being established to provide the maximum and minimum torque switch settings. These maximum and minimum settings are being developed from design engineering evaluations. The Limit Switch Settings will be verified to be appropriate and the As-Found and As-Left valve will be documented. This information should greatly aid in proper valve setup and in early identification of degraded conditions.

(3) The Maintenance Program at Oconee is transitioning from a corrective emphasis to a preventative emphasis, from a reactive approach to a proactive approach. The implementation of this change in philosophy has resulted in initiation of new programs and the enhancement of current programs. The following is a list of some of the initiatives that were undertaken prior to the inspection:

(a) A review and upgrade of the plant lubrication program.

(b) A comprehensive program for upgrading the maintenance for all motor-operated valves.

(c) The development of mean time Failure Analysis as an effective mainte-

^

nance tool.

(d) Participation in industry programs to identify equipment / components with less than average performance.

(e) The replacement of outdated transmitters.

(f) Hardware upgrades to the Integrated Control System.

(g) The Implementation of the Employee Training and Qualification System (ETQS) to ensure all maintenance is performed by qualified individuals. -

(h) A construction of an Advance Training Facility to allow for hands-on experience with major equipment mock-ups.

Even though the maintenance program is undergoing noteworthy upgrade, it does not follow that maintenance had previously been less than adequate.

Since 1980, Oconee has had 14 incidents in which emergency feedwater has been required. In every case, all three emergency feedwater pumps prompt-ly actuated and performed their . intended safety function, consistent with their design. Two incidents did indicate minor anomalies with feedwater valve control; however, these control anomalies had no significant impact on post transient response. Overall, the EFW System has performed as required. These incidents support the high degree of confidence in the Oconee EFW System.

Duke's incentive is to have a totally reliable plant in terms of both safety and performance. Maintenance of plant reliability is critical in realizing the benefits of this incentive. Over the last several years, Oconee has repeatedly proven its maintenance performance. Station capaci-ty factor has averaged 79% since 1983. Oconee achieved the highest national single unit capacity factor in both 1983 and 1984 (94.7% - Unit 3

- 1983, 96.6% - Unit 2 - 1984); the availability factor for the Oconee Nuclear Station during 1983 through 1985 was 82.7%; and Unit 2 achieved a world record continuous run of 439 days in 1985. This type of performance could not be achieved with less than an effective maintenance program.

Item 2.3.2 Design Change Process (1) Some modifications were done without related critical design analyses being performed or completed.

(2) The licensee's design engineering group, in some cases, did not provide post-modification testing requirements. Personnel performing post-modification testing were not required to consult with the design engineers responsible for the modifications. Several examples were found of' weak post-modification testing.

(3) Examples were found of apparently incorrect or missing safety-related classification of instrumentation.

(4) The programmatic design requirements of ANSI N45.2.11 were not adequately implemented into the licensee's design change program.

(5) The program governing safety evaluations performed in accordance with 10CFR50.59 was considered generally weak. Examples were found of inade-quate safety evaluations.

Response

(1) Formal control of calculations has evolved from minimal control in the early 1960's design stages of Oconee to current day implementation of ANSI N45.2.11. Duke maintains that overall, though not fully retrievable or fully documented, design analyses have been performed to establish the capability of plant systems and modifications to operate safely and to meet their design bases, thus fulfilling the intent of ANSI N45.2.11.

Calculations "not performed or completed" (as cited in Section 3.4.7 and 3.4.8) were performed less formally for modifications six or seven years prior to the SSFI. Specifically, these calculations are being completed i and filed. In addition, similar mechanical safety system calculation files will be re-indexed and reviewed for completeness. If significant

calculations are found to be not retrievable, then system capability will )

be verified either by regenerating the analysis, testing, operating experience, or documented design reviews. The re-indexing and review will be completed by March 31, 1987.

(2) In accordance with 10 CFR 50 Appendix B Criterion III, Duke Power Company has designated its Nuclear Production Department as the responsible organization for implementing the post-modification testing program.

Operational test requirements / criteria are defined by the Nuclear Produc-tion Department, with input from the Design Engineering Department, as appropriate, and tests are performed by the Nuclear Production Department.

The Nuclear Production Department Administrative Policy Manual, which defines fundamental administrative policies for the conduct.of operations at Duke Power Company nuclear stations, requires testing for the purpose of confirmation that station modifications reasonably produce expected results and do not adversely affect the safety of operations. It further requires that special testing procedures (if required) state the criteria for evaluating the acceptability of the results of the specified testing.

In addition, the Nuclear Production Department has controls which meet 10

CFR50 Appendix B Criterion III, ensuring that system design information from the Design Engineering Department is reviewed for consideration in development of post-modification testing requirements. Design documents normally provide the necessary design parameters and performance parame-ters such as flow rates, pressures, temperatures, levels, and instrument or electrical considerations. This information is used to form the basis for the acceptance criteria specified in the post-modification test procedures. If Nuclear Production personnel responsible for generating post-modification testing procedures determine that insufficient informa-tion exists to establish appropriate acceptance criteria, Design Engineer-ing may be contacted to provide additional input.

In order to improve the process for providing post-modification test requirements, Duke has initiated in undertaken an effort to define the type of information that should be included by Design Engineering in a modification package. This guidance will be used as the basis for imple-menting a program in early 1987 for Design Engineering to provide test acceptance requirements in Modification packages.

As to the adequacy of specific post-modification testing referred to in Sections 3.3.4 and 3.3.5, Duke has the following comments:

(a) Station management reviewed the proposed testing criteria supplied by Design Engineering and determined that this criteria did not reflect the mode of operation that would be used for this system. Thus, the alternate test criteria was correctly generated and employed for this test.

(b) Testing of emergency feedwater valves is discussed in response to item 2.1.5.

(3) Duke is currently reviewing all instrumentation with respect to safety classification and will update the appropriate instrument drawings by March 1, 1987. While this review was in progress prior to the SSFI, the inspection reenforced the need for this effort. Additionally, a consoli-i dated I&C list of will also by March 1, 1987 which designates the safety classification of the instruments. This effort was in progress prior to the inspection as a part of the Oconee Document Upgrade Program.

(4) Duke believes that it conforms to the intent of ANSI N45.2.11 in its design change process. Duke committed to ANSI N45.2.11 as a part of the Quality Assurance Plan. The design process, in conjunction with the QA program, has produced a safe and effective plant design. However, Duke has noticed a recurring difficulty in the auditing of the process by third parties who have the exact format of ANSI N45.2.11 in mind as their model.

This recognition led to the formation of a task force to investigate both ANSI and other programs (INPO, EPRI, etc.) which could provide enhance-ments to the existing Design Engineering program. This task force has recommended revisions to the design change process to require formal documentation of design inputs and documentation of the integrated review of the total design. The changes cover both the Design Engineering Quality Assurance Manual and other procedures which control the NSM process. Implementation of program changes is expected by the end of the -

first quarter of 1987.

(5) Beginning in April, 1986, changes were implemented in the Design Engineer-ing Department which have resulted in details being documented in the written 10CFR50.59 evaluations for significant nuclear station modifica-tions. In May 1986, Duke Power established a task force to examine the 10CFR50.59 safety evaluation process for plant modifications and to propose appropriate enhancements. Proposed revision to the 10CFR50.59 program presently envisioned would require clearly traceable documentation of FSAR sections reviewed, and of applicable nuclear safety considerations supporting the unreviewed safety question evaluation conclusions.

These enhancements are scheduled to be fully implemented by the second quarter of 1987, and will thoroughly demonstrate that appropriate consideration and documentation are given to the safety aspects of plant modifications including the bases for determining that no unreviewed safety questions exists.

In response to the individual examples identified in Section 3.4.12 of the audit report, Duke offers the following comments and response:

Item 3.4.12(1) (a) and (b)

Documentation concerning equivalency of replacement components as designed under NSHs 2346 and 2422 was performed by the individual responsible for the design and is shown in design calculations (i.e. stress analysis, pressure drops, etc.) and on output documents. In determining the poten-tial for unreviewed safety questions, this information is used but is not redocumented.

Item 3.4.12.1.c The current UST instrumentation includes a low level alarm at 2 feet which prompts the operator to switch the EFW suction supply to the condenser hotwell. This setpoint was established to provide adequate EFW pump suction inventory throughout the swap over sequence. The basis of the setpoint was confirmed by a recent analysis which considered the maximum time required for the operator to complete the necessary swap over se-quence, including an allowance for instrument error. The same analysis also indicates that the minimum UST level should be increased to 6 feet to include an allowance for instrument error. Although the minimum Technical Specification requirement for UST level is currently 5 feet, level is normally maintained between 8 - 10 feet. To ensure that the minimum UST liquid volume of 30,000 gallons is available to the EFW pumps, Duke will submit a proposed Technical Specification change which increases the minimum UST level to 6 feet. A Technical Specification Amendment request will be submitted for NRC review and approval by the first quarter of 1987.

Item 3.4.12(1)(d)

The original 10CFR50.59 Safety Evaluation on NSM ON-1012 was performed by the lead engineer before the responsibility for 10CFR50.59 evaluation was assigned to the Research and Projects section. Subsequently, the lead engineer released additional design documents providing breaker coordina-tion, because the original 10CFR50.59 evaluation was still valid.

Regarding the issue of valves FDW-347 and CCW-269 being energized without Design Engineering concurrence, the unenergized status of these valves was changed when the procedures governing the alignment and routine verifica-tion of EFW system valves were changed to include these valves. It is necessary that the SSF circuit remain energized in order to power the indicating lights to carry out this procedure, since the actual valves are inside containment. Design Engineering personnel are evaluating this change, and affected documents will be revised as required.

]