05000269/LER-2004-002
| Docket Number | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| Initial Reporting | |
| ENS 40724 | 10 CFR 50.72(b)(3)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident, 10 CFR 50.72(b)(3)(ii)(B), Unanalyzed Condition |
| 2692004002R01 - NRC Website | |
EVALUATION:
BACKGROUND
Oconee Nuclear Station (ONS) Technical Specifications (TS) 3.7.3 requires the Main and Startup Feedwater Control Valves (FCVs) to be operable to close to isolate Main Feedwater (MFM[EIIS:SJ] during a Main Steam (MS)[EIIS:SB] Line Break (MSLB) event. This report involves the recognition that some MSLB event scenarios require Instrument Air (IA)[EIIS:LD] to be available to close the FCVs at a time in the scenario after IA is no longer available. As a result the FCVs are considered to have been inoperable longer than allowed by TS. This event is reportable per 10CFR 50.73(a)(2)(1)(B) as a condition prohibited. by TS, 10CFR 50.73(a)(2)(ii)(B) as an Unanalyzed Condition and 50.73(a)(2)(V)(D) as a potential loss of safety function for Accident Mitigation. An ENS notification was made May 4, 2004 (NRC Event # 40724) which reported this event under 10CFR 50.72(b)(3)(ii)(B) Unanalyzed Condition and 50.72(b)(3)(v)(D) Accident Mitigation.
In 1993, Safety Analysis (an engineering group located in the Duke Power (Duke) general office (GO)) performed a reanalysis of the MSLB scenario. Safety Analysis determined that previous calculations, based on a vendor methodology, were non-conservative.
Using improved methodology, calculations indicated the containment pressure design limit could be exceeded without prompt operator action to isolate MFW. This was reported to the NRC, reference LER 269/93-06 dated July 1, 1993. Long term corrective actions resulted in a series of modifications to install automatic control circuitry now known as the Automatic Feedwater Isolation System (AFIS). AFIS circuitry is safety-grade, but the FCVs, which are actuated by the circuitry, remained non-safety-grade.
A MSLB is defined in Updated Final Safety Analysis Report (UFSAR) Section 15.13 as a double-ended guillotine rupture of 34 inch diameter piping in the Main Steam System. Other sections of the UFSAR, e.g. Section 15.17, address smaller breaks. In the event of a MSLB, the AFIS modification was designed to automatically isolate MFW, prevent operation of the turbine-driven emergency feedwater (EFW) (TDEFW) pump, and inhibit motor-driven EFW flow to the faulted steam generator. These functions are credited in both the MSLB containment pressurization analysis of UFSAR Section 6.2.1.4 and the MSLB tube stress analysis of UFSAR Section 5.2.3.4. For the Section 6.2.1.4 analyses, "It is assumed that failure of a feedwater control valve to close on a feedwater isolation signal is beyond the licensing basis." However, Section 15.13 specifically does not credit closure of the FCVs (because the NRC acknowledged that they were not safety grade and subject to single failure).
Section 15.13 concludes that dose consequences of a break inside containment are bounded by those of a break outside containment.
The IA system at ONS is non-safety. A loss of offsite power (LOOP) causes the loss of electrical power to the IA compressors, after which the available air is limited to the volume in air receiver tanks and the system piping. The IA system provides the motive force to operate the FCVs. These valves are designed to fail "as- is" to minimize a transient following a loss of IA during plant operation at power. For a MSLB/LOOP the valves must close.
Therefore the FCVs must be closed before the IA system inventory becomes inadequate to operate them.
At the time of discovery of this event Units 1 and 3 were operating in Mode 1 at 100% power with no safety systems or components out of service that would have contributed to this event. Unit 2 was at No Mode during a refueling outage. However, this event is a historical issue and all three units have operated in this condition.
EVENT DESCRIPTION
In March 2000, a Problem Investigation Process (PIP) report was initiated due to unresolved items identified during a comprehensive review of event mitigation calculations. These items appeared to be assumptions which did not have supporting calculations. The PIP was to provide documentation of the issues and to track completion of the necessary supporting calculations. One corrective action was to validate the statements that the FCVs could actually close during the MSLB event if there is a coincident LOOP and/or loss of IA. This led to the creation of calculation OSC-8222 to quantify the amount of time that sufficient IA pressure would be available following a LOOP.
Calculation OSC-8222 was approved 1/30/2003 and showed that the FCVs would not be able to close after 2.1 minutes following a LOOP.
With allowance for valve stroke time, this limit required that the signal to close the FCVs in a MSLB/LOOP event must be generated within approximately 1.6 minutes of the break. During the 1993 event, Operations and Training personnel had performed a number of validations on the Oconee simulator and had verified that, following the worst case (large) break, the Operators could close the FCVs within times which met this limit. The MSLB/AFIS modifications were installed to automate this action for large breaks. Because a double-ended guillotine MSLB would generate an automatic AFIS actuation within a few seconds of a break, site engineering concluded that the OSC-8222 calculation result was acceptable. No consideration was given to smaller MSLBs, which the ONS licensing basis states are mitigated by manual operator action within ten minutes. Also, the results of this calculation were not communicated to Safety Analysis.
In January 2004 additional PIP corrective actions were initiated to revise the IA and FDW Design Basis Documents (DBDs) to include documentation of the requirements for the FCVs to close in the MSLB event and the requirement for IA to support those closures. When preparing 50.59 documentation for these revisions, site engineering personnel recognized an apparent discrepancy between the OSC-8222 results and the licensing basis documents related to AFIS. A meeting was held between Safety Analysis personnel from the Duke general office and site engineering. As a result of that meeting, site personnel learned that, in order to limit smaller breaks scenarios, operator actions were credited later in the event than they had previously understood. Safety Analysis personnel learned that earlier statements as to adequacy of IA had been based on the large break scenario expectation that operator actions were performed early in the event before IA reservoirs were depleted.
The small MSLB with LOOP design deficiency was identified on April 29, 2004, and a PIP was initiated to address the problem.
Operations shift personnel were notified and took action to assure continued operability by starting a back-up diesel air compressor.
This would maintain an air source for the FDW control valves in the event of a LOOP.
Operations initially considered that FCV closure was not credited in UFSAR 15.13 and concluded that the event did not meet reportability requirements per 10CFR 50.72.
On May 4, 2004 the operating backup diesel compressor experienced an oil leak and no diesel was in operation for a period of time while a second backup diesel was placed in service. During review of this additional event, ONS concluded that the issue was reportable and an ENS notification was made at 1908 hours0.0221 days <br />0.53 hours <br />0.00315 weeks <br />7.25994e-4 months <br /> on May 4, 2004 (NRC Event # 40724).
Subsequently, additional diesel air compressors were connected to the IA header as spares to improve reliability. Operations procedures were revised to require one diesel air compressor in operation at all times pending a more permanent resolution to this issue.
A root cause team was formed in June 2004 to establish the root cause for the event.
CAUSAL FACTORS
The root cause investigation identified two root causes which significantly influenced this event.
Root Cause #1 The first root cause was Analysis Deficiency. During the 1993-1994 time frame, the various MSLB scenarios were not adequately defined and analyzed. The conclusion by Safety Analysis that the large break was most limiting was based on the logic that smaller breaks could be successfully mitigated due to having more time available for operator response. The analysis assumed, and did not verify, that the required equipment would remain operable when needed for small break mitigation. Once made, this conclusion fostered a mind-set which affected subsequent documentation, reviews, and validations. Although the initial scope of a proposed modification included backup air or nitrogen, the scope was later changed because the existing analysis did not adequately document the necessity for such a backup.
Root Cause #2 The second root cause was Inadequate Communications. Written and verbal communications related to the changing licensing basis for MSLB accidents, including documentation of accident analyses, calculations, mitigating strategies, modifications, license amendments, design basis documentation, procedures, etc., contained various deficiencies.
Communications were further hampered by GO to site logistical considerations such as organizational interfaces, availability of documents and files, etc.
However, after the time period in which these errors occurred, Duke instituted a number of projects and program enhancements which should minimize the potential for a similar error in the future.
1. Beginning in 1995, Duke Oconee performed a Oconee Safety Related Designation Clarification (OSRDC) project which, in part, documented and clarified the functions of various systems, structures, and components, in event mitigation. This project included creation of a series of Event Mitigation Calculations which documented in detail the event mitigation strategy for specific identified events. Calculation OSC-6182 "Main Steam line Break Event Mitigation Requirements" was approved on March 13, 1997 and contained an Open Item which addressed the fact that no calculation "demonstrated conclusively that the (FCV) valves would close." Resolution of this open item eventually led to the creation of calculation OSC-8222 and discovery of this event.
2. A corrective action from Licensee Event Report 269/98-04, Revision 01 initiated a calculation enhancement project which, in part, reviewed the critical design inputs and assumptions in safety/risk significant calculations to confirm their validity and/or to identify problems or concerns with the inputs and assumptions.
3. Beginning in 1998, Duke performed a UFSAR Verification/ Completeness Review Project. This project identified UFSAR statements where there was not a verified source document for the UFSAR statement in question, or there was conflicting information between the UFSAR and a controlled document. The project either generated supporting documentation or resolved any conflicts.
4. In 1999, Duke initiated a project which performed a validation of the ONS Emergency Operating Procedure (EOP). Parts of this project included validation of EOP setpoints and time critical operator actions.
With respect to communication processes, several enhancements have occurred which might have prevented this event had they been in place earlier:
1.Prior to this event there was a recognized need to revise the Instrument Air and Main Feedwater DBDs to reflect the functions of IA and the FCVs to mitigate the MSLB scenarios. This event was discovered during reviews to support those changes. This event has revealed the need to revise additional DBDs such as the AFIS and Design Basis Events DBDs.
2.During the time period in which many of these errors occurred, it was difficult for site personnel to obtain copies of GO calculations for review or for GO personnel to obtain copies of site procedures, etc. Enhancements in networking and electronic storage of documentation now allow ready access to calculations, procedures, drawings, etc. as electronic files.
3.Another corrective action from LER 269/98-04 created a process to identify, control and maintain Oconee-specific calculation inputs and included requirements for two-way communication and review during the review/approval process of any change to the calculation input/output data. This was intended to ensure calculation revisions are reviewed for their impact on other calculations, station procedures, design deliverable documents, licensing documents, etc.
As a result of these various projects and enhancements, Duke concludes that this event does not indicate a general breakdown in the analysis/calculation and communication processes.
However, the event did indicate some weaknesses needing correction:
- The event indicates a potential that similar assumptions may have been made for cases where Operator actions have been credited to mitigate less severe or slower evolving events.
- The UFSAR treatment of Main Steam Line Breaks is spread over several sections in different chapters, addressing different aspects of the event, using different scenarios and significantly different assumptions. This is confusing and leads to mis-understanding of the licensing basis. A UFSAR revision is needed for clarification.
CORRECTIVE ACTIONS
Immediate:
1. Operations took action to assure continued operability by starting a back-up diesel air compressor.
Subsequent:
1.Additional diesel air compressors were connected to the instrument air header as spares to improve reliability.
2.Operations procedures were revised to require one diesel air compressor in operation at all times pending a more permanent resolution to this issue.
Planned:
1.A short term interim action will replace the current continuously operating diesel air compressors with models having automatic start capability. Once installed, these diesel compressors will typically remain in stand-by mode but will start upon detection of an appropriate parameter such as low IA header pressure.
2.An Engineering project team is evaluating proposals for permanent resolution of the problem of dependence on IA, which is not assured, in order to close the FCVs to mitigate a MSLB event.
3 The EOP, Abnormal Procedures, UFSAR, and Event Mitigation calculations will be reviewed with respect to manual operator actions relied on for event mitigation. The actions will be re evaluated for similar scenarios, typically not designated as worst case, to assure that aspects of the scenario do not impact availability of required equipment at the time it is needed during the event.
4.Duke will perform an assessment of GO/Site communication processes and make revisions as necessary to provide an appropriate level of formality and documentation to assure that critical communications related to licensing basis and operability are clear, complete, accurate, and traceable.
5.The UFSAR and appropriate DBDs (IA, Main Feedwater, AFIS and Design Basis Events) will be revised to reflect the functions of IA and the FCVs to mitigate the MSLB scenarios and to clarify and improve the documentation of the MSLB licensing basis.
None of the corrective actions identified to date are considered an NRC Commitment item. There are no NRC Commitment items contained in this LER.
SAFETY ANALYSIS
There were no actual safety system functional failures associated with this event. However, this event scenario represents a potential failure on each of the three ONS units; therefore this event will count as three (3) safety system functional failures for the NRC/INPO Performance Indicator (PI) program.
MFW isolation is credited for some aspects of a MSLB inside containment event but not for other aspects. Specifically it is credited for control of steam generator tube stresses but is not credited for offsite dose, since the limiting scenario for offsite dose is a break outside containment.
Safety Analysis performed an analysis of the small MSLB with LOOP assuming the FCVs cannot be closed. The peak pressure for the largest break that does not actuate AFIS within 2 minutes is 106.2 psig (0.6 ft2 break). The containment pressure and temperature exceeds the Environment Qualification (EQ) envelope curve.
Operation outside the EQ envelope has a potential impact on the Reactor Building Cooling Units [EIIS:BK]. The Reactor Building Cooling Unit fan motors were replaced on all three units approximately two years ago. It would take significant analysis or testing to determine if the new RBCU motors would fail due to the expected environmental conditions during this postulated scenario.
However, it is known that the old motors did not have much EQ margin and it is assumed that they would have failed under the conditions of this scenario. The principle impact of this postulated failure is that the main mode of cooling the containment atmosphere would be lost, thus extending the duration of the exposure of other equipment to high temperatures. Thus there is increased potential for failure of additional components, but no potential failure was identified which would affect core cooling via Main/Emergency FDW or Reactor Coolant System [EIIS:AB](RCS) integrity, so there is no anticipated increase in radiological consequences (which therefore remain bounded by the large MSLB outside containment scenario).
The risk impact of the AFIS design deficiency is very low. The deficiency is judged to have no material impact on the core damage frequency (CDF). The frequency of a main steam line break leading to core damage is reported in the Oconee PRA Revision 2 at less than 1E-08. Even if this entire CDF were conservatively considered to lead to a large early release frequency(LERF), the resulting impact would fall well below the risk significant LERF threshold 1E-07.
When additional factors are considered such as the specific break size and location, the actual impact is expected to be considerably less. In particular, the Oconee containment has been shown to be very robust under overpressure conditions (Reference: Oconee IPE Submittal, Volume III, Appendix G, "Containment Capacity Assessment"). Up to a pressure of approximately 107 psig, the estimated probability of containment failure is less than 1 percent. The mean containment failure pressure is estimated to be 144 psig. Any contribution to LERF would be expected to be at least 2 orders of magnitude below the CDF contribution.
Therefore, there was no actual impact on the health and safety of the public due to this event.
ADDITIONAL INFORMATION
This event is considered recurring. Licensee Event Report 269/2002-04, (submitted September 9, 2002 and withdrawn October 14, 2003) addressed a potential loss of safety function due to deficient guidance contained in the EOP, with a root cause of deficient documentation because design documents, such as the system DBD, were not revised to document a known problem. The events leading to this report occurred prior to the events of LER 269/2002-04; therefore none of the corrective actions from that event could have prevented this event.
There were no releases of radioactive materials, radiation exposures or personnel injuries associated with this event.
This event is not considered reportable under the Equipment Performance and Information Exchange (EPIX) program.