05000269/LER-2002-002
| Oconee Nuclear Station, Unit 1 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 2692002002R01 - NRC Website | |
EVALUATION
BACKGROUND
This event is reportable per 10CFR50.73(a)(2)(i)(B), Conditions Prohibited By Technical Specification.
Each Unit's Low Pressure Injection (LPI) System [EIIS:BP] is used to remove decay heat during cold shutdown and refueling operations.
The LPI System also acts as a portion of the Emergency Core Cooling System (ECCS). Following the depletion of the Borated Water Storage Tank (BWST) after a Loss of Coolant Accident (LOCA), the LPI System takes suction from the Reactor Building Emergency Sump (RBES), located in the lower level of each Unit's Reactor Building [EIIS:NH].
On each unit, valves LP-19 and LP-20 (train A and train B respectively) are normally closed motor operated valves (MOVs) capable of being opened and closed from the respective Control Room to align the associated RBES to the suction of that Unit's LPI Pumps.
The Standby Shutdown Facility (SSF) [EIIS:NB] serves as a backup for existing Oconee safety systems to provide an alternate and independent means to achieve and maintain a Hot Standby condition for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for all three of the Oconee Units following sabotage, flooding, or a design basis (10CFR50, Appendix R) fire. The lower level of each Unit's Reactor Building contains an SSF Reactor Coolant Make-Up (RCMU) Pump designed to supply Reactor Coolant Pump seal injection flow in the event that the normal make up system (High Pressure Injection [EIIS:BG]) becomes inoperable during an SSF event.
Oconee Technical Specifications (TS) 3.10.1 Condition C requires that the SSF RCMU Pump be operable when any Unit is in a Mode 3 Condition or above. Should the RCMU Pump be determined to be inoperable, TS 3.10.1 Required Action C.1 requires that the RCMU Pump be restored to an operable status within 7 days. TS 3.10.1 further requires that the affected Unit be placed in a Mode 4 Condition (Hot Shutdown) within 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> if the RCMU Pump cannot be restored to an operable status following this 7 day period.
10CFR50 Appendix R Section L applies to plants that used Alternate Shutdown as a means to provide safe shutdown train separation.
10CFR50 Section L.7 contains the following requirement: "The safe shutdown equipment and systems for each fire area shall be known to be isolated from associated non-safety circuits in the fire area so that hot shorts, open circuits, or shorts to ground in the associated circuits will not prevent operation of the safe shutdown equipment. The separation and barriers between trays and conduits containing associated circuits of one safe shutdown division and trays and conduits containing associated circuits or safe shutdown cables from the redundant division, or the isolation of these associated circuits from the safe shutdown equipment, shall be such that a postulated fire involving associated circuits will not prevent safe shutdown.
The SSF RCMU Pump is presently considered operable (following the implementation of compensatory measures) but non-conforming with respect to licensing bases for adverse valve movement. � Without those compensatory measures in place, the RCMU Pumps on all 3 Oconee Units were technically inoperable for an extended period of time. Therefore, the TS 3.10.1 Condition C allowed action time of 7 days has not been met.
At the time this condition was identified, Oconee Units 1, 2, and 3 were operating in a Mode 1 condition at approximately 100 percent power. On March 23, 2002, Unit 1 was shutdown for its normal refueling outage.
EVENT DESCRIPTION
The original analyses for Oconee Appendix R fires included the consideration of the effects of one worst case spurious actuation.
Engineering analyses concluded that cable and conductor failures were not credible for Oconee due to armor sheathed cable construction. Subsequent to the initial Appendix R analyses, NRC Generic Letter 86-10, "Implementation of Fire Protection Requirements," addressing "hot shorts," was issued. Duke's evaluation of Generic Letter 86-10 reaffirmed that the construction of the metallic armor jacketed control cables, used for Motor Operated Valves, precluded cable to cable shorts. This evaluation concluded that the most likely failure mode was a conductor short to the grounded armor during a fire, thus causing the failure of the associated control power fuse, failing the valve "as is.
In 1997, a potential vulnerability was identified by engineering review of industry information obtained through the Operating Experience Program. The review recognized that LP-19 and 20, RBES suction valves, each had a single cable to provide open/close control and position indication for the associated valve. The review then postulated that a "smart fire" (one starting in the most vulnerable area) which damaged one of these control cables could potentially result in a conductor to conductor short within this single cable. Therefore a spurious actuation might cause the associated valve to open. If either valve on the affected unit opened, borated water from the BWST would flow to the RBES under the force of gravity head. Corrective actions to address this vulnerability focused on potential actions to recognize flow of this water to the RBES and to mitigate the occurrence by recovering the BWST inventory.
On March 22, 2002, subsequent changes to the operating procedures used to mitigate spurious actuation of LP-19 or LP-20 during an Appendix R fire event were receiving an engineering review. As a result of questions raised by the review, it was recognized that the volume of water lost from the BWST to the RBES as a result of the spurious actuation of valves LP-19 and/or 20 might challenge the operability of the RCMU Pump located in the lower level of the affected Unit's Reactor Building. The concern was that a loss of inventory from the BWST to the RBES would result in a water level 6 inches above the RCMU Pump motor center line. Since the SSF RCMU Pump motor is not designed for operation under water, Engineering concluded that, in this specific scenario, water would enter the stator housing and result in the failure of the RCMU pump motor.
A Problem Investigation Process (PIP) was written and an Operability Evaluation initiated. Operations implemented compensatory measures establishing periodic roving fire watches in the normally unoccupied areas along the cable routes where the control cables for LP-19 and 20 are subject to fire damage. These roving fire watches will remain in effect while any unit is in Mode 3 or above until modifications to re-cable the subject valve control circuits are completed. There are also operable fire detection and manual fire suppression systems in the areas where control circuit cables for these valves are susceptible to fire damage.
The Operability Evaluation concluded that the compensatory fire watch would allow sufficient response time to provide adequate assurance that LP-19 and 20 could be protected from fire damage.
Therefore the SSF RCMU pump is considered Operable. However, in retrospect, the SSF RCMU pump had been susceptible to failure due to this postulated spurious opening of LP-19 or 20 since October 1986 when the SSF was placed in service.
Modifications to control circuits for LP-19 and LP-20 are being prepared and implemented on a schedule commensurate with the safety significance of this issue. The modifications will address the separation of control circuit wiring in independent cables to inhibit the energized conductors from having the potential to "hot short" when exposed to fire damage and causing a spurious opening of these valves.
Because Unit 1 entered a refueling outage shortly after valves 1LP-19 and 20 were modified prior to Unit start-up on April 28, 2002. This modification separated the control circuit wiring into independent cables to inhibit the energized conductors from having the potential to "hot short," thus eliminating the possibility for spurious actuation of these valves. Therefore the Unit 1 roving fire watches were subsequently discontinued. Roving fire watches continue to patrol the Unit 2 and 3 equipment and cable spread rooms.
An Engineering review will be performed to identify any other potentially safety significant spurious actuation scenarios.
Appropriate actions will be taken to resolve any individual vulnerability identified.
CAUSAL FACTORS
The apparent cause of this condition is a historic design deficiency existing since the Standby Shutdown Facility was declared operational in October 1986. Contributing to the period of time in which this condition remained undisclosed was the failure to immediately recognize the possibility that the RCMU Pump could be rendered inoperable when the likelihood of a hot short resulting in the spurious actuation of valves LP-19 and 20 was first identified in 1997.
Although previous historic Oconee design deficiencies have been identified, no similar reportable events with the same apparent cause have occurred at Oconee within the previous 36 months.
CORRECTIVE ACTIONS
Immediate:
1. Interim roving fire watches were established in the areas where the control cables for LP-19 and 20 are subject to fire damage.
These fire watches will be in effect while any unit is at Mode 3 or above, until modifications to eliminate the vulnerability are complete.
Subsequent:
1. The control circuit cables for Unit 1 valves 1LP-19 and 1LP-20 were modified to provide independent cables to eliminate the possibility for spurious actuation of these valves.
Planned:
1. Control circuit modifications will be implemented to provide separation of Unit 2 and 3 LP-19 and LP-20 control circuit wiring to prevent a "hot short" from causing a spurious valve opening.
2. An Engineering review will be performed to identify any other potentially safety significant spurious actuation scenarios.
Appropriate actions will be taken to resolve any individual vulnerability identified.
There are no NRC commitment items contained in this LER.
SAFETY ANALYSIS
The cable of the control circuitry wiring for each of the LP-19 and LP-20 valve circuits has 8 conductors. One conductor is in the center of the cable, surrounded by the 7 other conductors, which are then surrounded by metallic armor sheathing. Only two of these conductors are energized while the valve is in its normally closed position. In order for a spurious actuation to occur, the cable must be damaged such that one of these two energized conductors contacts one specific "target" conductor connected to the "open" coil in the valve operator motor control center. Contact with the armor sheathing or one of the other 5 conductors should result in a short to ground, which would cause the control circuit fuse to blow and prevent any spurious actuation.
The cable is manufactured such that the conductors are not paired to be along side each other over the length of the cable. Instead they are randomly "braided" so that they change physical orientation to each other as they travel along the cable. Any two conductors which happen to be adjacent at one point in the length of the cable may not be adjacent at some point further along the length of the cable. Thus there are some orientations where the target conductor is not adjacent to either energized conductor, which would significantly reduce the potential for a "smart short" at those locations.
These physical attributes of the cable construction would indicate that a fire exposure at any random location along the length of the cable would cause the most outer conductor, closest to the armor sheathing, to have its insulation heated first such that it would make contact. Once the conductor voltage can overcome the decreased resistance of the decomposing insulating material, an electrical short to ground can occur and cause the control power circuitry fuse to fail. A fuse failure prior to a short to the target conductor would prevent any spurious actuation of the valve's motor breaker.
The predominant cable type for motor operated valve controls at Oconee is PVC insulated, galvanized metallic armor surrounding individual conductors. PVC insulation has an ignition temperature of 735 degrees Fahrenheitl. EPR Hyperlon insulated control circuit cables are used for valves LP-19 and 20 on Unit 1. Insulating material made of EPR Hyperlon has a higher ignition temperature than PVC.
A series of experimental fire tests2 were conducted involving energized electrical circuits using Oconee motor operated valve control circuit cable and circuit design. These circuits include control power transformers that limit available fault current and voltage. Based upon the test results, demonstrating the robust fire resistance characteristics of the cable, fire induced spurious valve actuations are not expected to occur. One of these experimental tests demonstrated that under conditions of extreme physical abuse (e.g., a right angle bend of the cable in the tray, without limiting current circuit design, conducted under severe exposure to fire) fire induced spurious valve actuation could occur. Thus, while the probability of fire induced spurious 1 R. J. Budnitz, "Spurious Actuation of Electrical Circuits Due to Cable Fires:
Technical Investigator's Report," Future Resources Associates, study managed by EPRI in coordination with NEI 2 Budnitz actuation cannot be ruled out, it is not expected to occur under plant conditions.
Based upon the conservatisms in test methodologies, it has been estimated that the cable must be exposed to a developed fire for a period in excess of 30 minutes in order to cause a fault in the LP- 19 and 20 control circuit cables.
Fire brigade drills have been practiced in the areas in which LP-19 and 20 valve control circuit cables are subject to fire damage.
These drills have shown fire brigade response times of less than 30 minutes. The brief response time allows the fire brigade to get positioned and initiate mitigating actions prior to fires becoming fully developed; therefore it is not expected that these cables will be exposed to the temperature at which cable degradation occurs (threshold temperatures greater than 700 degrees Fahrenheit) for any significant duration.
In summary, the likelihood of an actual spurious actuation occurring due to a "smart fire" causing the right two conductors to short together rather than shorting to ground has a very low probability. The additional contribution to core damage frequency resulting from the issue of spurious actuation of LP-19 or LP-20 has been calculated to be less than 3E-8 per year3 .
Therefore, there was no impact on the health and safety of the public due to this event.
ADDITIONAL INFORMATION
There were no releases of radioactive materials, radiation exposures, or personnel injuries associated with this condition.
No actual equipment failure occurred, therefore this condition is not considered reportable under the Equipment Performance and Information Exchange (EPIX) Program.
3 PRA Analysis of Spurious Operation of Oconee Valves LP-19 or 20