ML020980593

EA-02-048, Oconee Nuclear Station, Consideration for Escalated Enforcement Action

ML020980593
Person / Time
Site:	Oconee
Issue date:	04/08/2002
From:	Mccree V Division Reactor Projects II
To:	Mccollum W Duke Energy Corp
Shared Package
ML020980590	List: ML020980593 ML020980595
References
EA-02-048, IR-00-007 EA-02-048-1
Download: ML020980593 (15)

Text

April 8, 2002 EA-02-048 Duke Energy Corporation ATTN: Mr. W. R. McCollum Vice President Oconee Nuclear Station 7800 Rochester Highway Seneca, SC 29672

SUBJECT:

OCONEE NUCLEAR STATION - NRC INSPECTION REPORT 50-269/00-07, 50-270/00-07, AND 50-287/00-07; PRELIMINARY WHITE FINDING

Dear Mr. McCollum:

On December 30, 2000, the NRC completed a quarterly inspection at your Oconee Nuclear Station. The inspection findings were documented in the subject report, which was issued on January 29, 2001.

Section 1R20.2 of the subject report discusses the lack of adequate controls for ensuring containment closure upon a loss of reactor decay heat removal while Unit 1 was in reduced reactor coolant system inventory conditions during the Fall 2000 refueling outage. Using the significance determination process (SDP), this finding was preliminarily determined to be White (i.e., a finding with some increased importance to safety, which may require additional NRC inspection). As indicated in the enclosed SDP Phase III Summary, the finding appears to have a low to moderate safety significance because of the Large Early Release Frequency considerations associated with the potential for a fission product release to the environment approximately five hours following the loss of reactor decay heat removal capability.

This finding does not represent a current safety concern based on the February 26, 2001, revision to Abnormal Procedure AP/1,2,3/A/1700/26, Loss of Decay Heat Removal, which provided explicit instructions for closing the outer emergency hatch door upon a loss of reactor decay heat removal.

One apparent violation of Technical Specification 5.4.1 was identified concerning the related procedural inadequacy of Abnormal Procedure AP/1,2,3/A/1700/26, Loss of Decay Heat Removal, Revision 10. Specifically, the immediate manual actions of AP/1,2,3/A/1700/26 to establish containment closure lacked sufficient instructions to ensure that operators would direct the closure of an emergency hatch door upon a loss of decay heat removal. Based on discussions with a number of your operators, we believe that operators would have inappropriately relied on a non-qualified temporary emergency hatch cover to satisfy the containment closure requirements specified in AP/1,2,3/A/1700/26. This apparent violation is being considered for escalated enforcement action in accordance with the "General Statement of Policy and Procedure for NRC Enforcement Actions - May 1, 2000" (Enforcement Policy),

NUREG-1600.

2 DEC Before the NRC makes a final decision in this matter, we are providing you an opportunity to request a Regulatory Conference where you would be able to provide your perspectives on the significance of the issue, the bases for your position, and whether you agree with the apparent violation. If you choose to request a Regulatory Conference, we encourage you to submit your evaluation and any differences with the NRC evaluation at least one week prior to the conference in an effort to make the conference more efficient and effective. If a conference is held, it will be open for public observation. The NRC will also issue a press release to announce the conference.

Please contact Mr. Robert Haag at (404) 562-4550 within seven days of the date of this letter to notify the NRC of your intentions. If we have not heard from you within ten days, we will continue with our significance determination and enforcement decision and you will be advised by separate correspondence of the results of our deliberations on this matter.

Since the NRC has not made a final determination in this matter, a Notice of Violation is not being issued at this time. In addition, please be advised that the characterization of the apparent violation may change as a result of further NRC review.

In accordance with 10 CFR 2.790 of the NRCs "Rules of Practice," a copy of this letter and its enclosure will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records (PARS) component of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA/

Victor M. McCree, Deputy Director Division of Reactor Projects Docket Nos.: 50-269, 50-270, 50-287 License Nos.: DPR-38, DPR-47, DPR-55

Enclosure:

SDP Phase III Summary cc w/encl: Compliance Manager (ONS)

Duke Energy Corporation Electronic Mail Distribution Lisa Vaughn Legal Department (PB05E)

Duke Energy Corporation 422 South Church Street Charlotte, NC 28242 cc w/encl: Continued see page 3

3 DEC cc w/encl: Continued Anne Cottingham Winston and Strawn Electronic Mail Distribution Mel Fry, Director Division of Radiation Protection N. C. Department of Environmental Health & Natural Resources Electronic Mail Distribution Henry J. Porter, Assistant Director Div. of Waste Mgmt.

S. C. Department of Health and Environmental Control Electronic Mail Distribution R. Mike Gandy Division of Radioactive Waste Mgmt.

S. C. Department of Health and Environmental Control Electronic Mail Distribution County Supervisor of Oconee County 415 S. Pine Street Walhalla, SC 29691-2145 Lyle Graber, LIS NUS Corporation Electronic Mail Distribution Manager Nuclear Regulatory Licensing Duke Energy Corporation 526 S. Church Street Charlotte, NC 28201-0006 Peggy Force Assistant Attorney General N. C. Department of Justice Electronic Mail Distribution

4 DEC Distribution w/encl:

L. Olshan, NRR OE, MAIL OE, WEB C. Evans RIDSNRRDIPMLIPB PUBLIC PUBLIC DOCUMENT (circle one): YES NO OFFICE RII:DRP RII:DRS EICS SIGNATURE NAME RHaag WRogers CEvans DATE 4/03/2002 4/03/2002 4/03/2002 E-MAIL COPY?

YES NO YES NO YES NO YES NO YES NO YES NO YES NO OFFICIAL RECORD COPY DOCUMENT NAME: C:\\ORPCheckout\\FileNET\\ML020980593.wpd

Enclosure SDP Phase III Summary SRA Analysis Number: OCO0202 Analysis Type: SDP Phase III Plant: Oconee, Unit 1 I.

Background

On November 27, 2000 (four days after shutting down to begin the EOC-19 refueling outage), Oconee Unit 1 entered a reduced inventory condition to install nozzle dams in support of steam generator inspections. The calculated time to boil during this condition was 18 minutes. Prior to beginning this evolution, a temporary aluminum cover was installed on the reactor building (RB) emergency hatch. The aluminum cover contained two four-inch diameter penetrations filled with temporary services (e.g., cables, etc.) and Dow Corning silicone RTV foam (Firestop 3-6548). Since the penetrations were not coated with Dow Corning 1200 primer coat, the RTV foam did not adhere to the metal surface of the penetration. (The Dow Corning product information for Firestop RTV foam 3-6548 mentions that metallic compounds can inhibit the cure of the RTV foam).

Abnormal Procedure (AP)/1,2,3/A/1700/26, Loss of Decay Heat Removal, implements the licensees Generic Letter (GL) 88-17 containment closure commitments to ensure the RB equipment hatch, open penetrations, and at least one door of the personnel and emergency hatches are closed upon a loss of decay heat removal (DHR) thereby precluding a fission product release from containment. However, the immediate manual actions of the AP to establish containment closure lacked sufficient instructions to ensure that operators would recognize that the temporary cover does not satisfy containment closure requirements. As a result, the operators would not initiate, upon a loss of DHR, the disconnection of the temporary services running through the cover nor would they close one of the permanent emergency hatch doors (i.e., the outer door).

In SECY 97-168, the staff assumed that PWR licensees had the capability to close containment by remote or local manual actions before containment conditions become intolerable during cold shutdown operation. These assumptions were based on guidelines in NUMARC 91-06 (page 32) which state the licensee should ensure that containment closure can be achieved in sufficient time to prevent potential fission product release. In addition, GL 88-17 recommended procedures and administrative controls that reasonably assure that containment would be closed prior to core uncovery following a loss of DHR during reduced inventory operation. Containment closure was defined in GL 88 -17 as sufficient separation of the containment atmosphere from the outside environment is to be provided such that a barrier to the escape of radioactive material is reasonably expected to remain in place following a core melt accident.

Performance Deficiency - There was a lack of reasonable assurance that containment closure would be achieved by implementing AP/1,2,3/A/1700/26, Loss of Decay Heat Removal, prior to the time at which a core uncovery and fission product release could result from a loss of decay heat removal. Specifically, the immediate manual actions of AP/1,2,3/A/1700/26 to establish containment closure lacked sufficient instructions to ensure that one of the emergency hatch doors would be closed upon a loss of DHR.

Based on discussions with operators, the inspectors concluded that operators would

2 have inappropriately relied on a non-qualified temporary emergency hatch cover to satisfy the containment closure requirements specified in AP/1,2,3/A/1700/26.

Exposure Time - 6 days (Time period that plant conditions existed for entry into the AP upon a loss of DHR)

Date of Occurrence - November 2000 II.

Safety Impact: WHITE III.

Risk Analysis/Considerations A.

Assumptions 1.

The two RTV penetration plugs within the temporary cover can be pushed out of the temporary cover with a small pressurization in containment. The basis of this assumption is:

(a)

During discussions with the resident inspectors, licensee personnel stated that the foam plugs could be removed by simply pulling them out.

(b)

The vendor recommended penetration pipe primer coating to promote RTV adherence was not applied since the licensee did not want the foam to adhere to the pipe (allow for easier removal of cables and foam).

2.

The Large Early Release Frequency (LERF) risk metric will be used to measure the risk impact of this finding since:

(a)

A postulated failure of the silicone RTV foam under severe accident containment loads would result in a large containment leakage area.

(b)

This finding occurred within the 5 days of the outage, so iodine inventory was roughly seventy percent of full power.

(c)

The time to core damage and the time to release given an extended loss of residual heat removal (referred to as DHR at Oconee) was approximately 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, and is considered early relative to the time required for effective evacuation. The time for evacuation includes the time for event recognition, offsite notification, and initiation/completion of evacuation. Therefore, accident sequences involving failure of long term cooling (after BWST depletion) were eliminated.

3.

Since the LERF risk metric was used to assess the risk significance of this finding, NRC Inspection Manual Chapter 0609, Appendix H,

3 Containment Integrity SDP, was used to estimate a delta LERF. This delta LERF estimate will be based on the change in containment closure failure probability given the performance deficiency (assumed to be 1.0 for those sequences that would result in core damage before evacuation) and the containment closure failure probability assumed for the base case of 0.25. In SECY 97-168, the staff estimated that the likelihood of the licensee choosing to open their containment during cold shutdown operation with the RCS open and failing to close it following a core damage event resulting in an unmitigated release as 0.25. (averaged over four shutdown initiators).

4.

Based upon observation the resident inspectors estimated that thirty percent of the cross-sectional area of the two penetrations were filled with wires and the rest consisted of foam. Therefore, the containment leak area was estimated as 0.12 ft2. A containment leak rate of about 250 percent containment volume per day was estimated. Detailed risk calculations for selected plants are presented in NUREG-1493, Performance-Based Containment Leak-Test Program. NUREG-1493 reported results of the dependence of reactor accident risk on containment leak-tightness for each of the five reactor/containment types analyzed in NUREG -1150. Based on the NUREG-1150 analyses for Surry reported in NUREG-1493 (Tables 5-4 and 5-5), a pre-existing leakage path of 0.1 ft2 is considered containment isolation failure; the consequences of containment isolation failure in the event of a severe accident are substantial. Based on this information, the two four inch penetrations were found to be a large leakage path for LERF purposes.

5.

Credit for establishing an adequate containment closure prior to containment pressurization was reviewed but, not considered appropriate. The basis of this assumption is:

(a)

There would be no cue prior to the foam seals being pushed out that the foam seals/temporary cover was not an adequate barrier.

(b)

Licensed operators stated to the resident inspectors that they would consider containment closure requirements met with the temporary cover installed on the RB emergency hatch.

(c)

There were no other specific procedural prompts directing closure of the outer emergency hatch door.

(d)

A sensitivity study on crediting action to close one of the permanent emergency hatch doors prior to containment pressurization concluded a failure probability of 0.34 or lower would be required to change the LERF results to GREEN (less than 1E-7). Recognizing the assumed base case failure probability was 0.25, which included adequate instructions for closing one of the emergency hatch doors, it is unreasonable to

4 believe a calculated failure probability would be low enough to change the final results of this significance determination.

(e)

Because of the factors discussed above, lack of cues that the foam seals/temporary cover was not an adequate barrier and no other specific procedural guidance that would direct closure of an emergency hatch door, developing a formal human error probability (HEP) using a tool such as the Accident Sequence Precursor HEP sheet would not provide reliable results.

6.

Containment pressurization of Oconee following core damage is consistent with that assumed and analyzed in NUREG/CR-6144, "Evaluation of Potential Severe Accidents During Low Power and Shutdown Operations at Surry, Unit 1." Both containment free volumes and licensed power levels are approximately the same. The containment cooling capability of Oconee (which Surry does not have) will have very little effect on containment pressurization since this cooling capability is approximately 10% of the heat production potential. Based on the Surry Shutdown PRA (NUREG/CR-6144 Vol. 6 Part 2), the containment pressurization rate with a closed containment following a shutdown severe accident is slow. Within the time period of interest for early releases, the Surry PRA estimated containment pressures ranging from about 3 psig at 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (the time of core damage) to around 10 psig approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after accident initiation (when there would be high confidence that evacuation would be complete for virtually all scenarios).

Subsequent hydrogen spikes reach 14 psig. Hydrogen generation rates and combustion behavior introduce significant uncertainties. Minor changes to the sequence definition, hydrogen generation rate, and ignition criteria could shift both the timing and the magnitude of the hydrogen burn. Refer to page E-28 of NUREG/CR-6144, Volume 6, Part 2 (Figure E.18 Containment Pressure For Case 2) for the representative pressurization curve.

7.

The licensee has generally implemented NUMARC 91-06 and GL 88-17 such that Oconee in shutdown can be considered in the low voluntary action case as defined under the proposed shutdown rule/SECY 97-168.

B.

PRA Model Used for Basis of the Risk Analysis Event trees developed to support SECY 97-168 and modified to accommodate site specific features were used to quantify the risk.

1.

Basic Model Construct Event trees developed to support SECY 97-168 involve four possible initiating events considered credible that would lead to core damage.

They are:

Loss of Offsite Power (LOSP)

5

Loss of Inventory - Unplanned drain downs of the RCS to the hot legs while maintaining a prescribed level.

Loss of Level Control - Unplanned drain downs of the RCS to the hot legs while intentionally changing the level within the RCS.

Loss of DHR See the figures at the end of this Enclosure for the event tree logic.

Certain parameters associated with shutdown are assumed in the construction of the basic SECY 97-168 event trees and the initiating event frequencies. These include:

The licensee has a 35 day refueling outage once per 18 months and a forced maintenance outage during each cycle which yields a net capacity factor of 87 percent.

The licensee would remain in midloop for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and reduced inventory operation would last approximately 90 hours0.00104 days <br />0.025 hours <br />1.488095e-4 weeks <br />3.4245e-5 months <br />. The RCS would be vented for 8 days until the refueling cavity is filled.

The low CDF voluntary case involves two onsite and one offsite power source, two standby emergency core coolant system (ECCS) injection pumps, two trains of decay heat removal, power operated relief valve operability (to meet PWR low-temperature over pressure protection TS), containment spray pumps (to supplement the DHR pumps), a recirculation capability, two sources of level indication at all times, and two sources of RCS temperature indication until preparations are made for vessel head removal, steam generator heat removal capability with the reactor coolant system (RCS) intact, gravity feed, a containment that can be closed by remote or local manual actions before containment conditions become intolerable and, operator recovery actions. The low CDF voluntary case represents improved initiating event frequencies and improved operation recovery actions over the high CDF case.

2.

Model Alterations From this basic low CDF voluntary case the model construct was altered in that:

The licensee does not have containment spray pumps as backup to the DHR pumps.

The facility does not contain two diverse ECCS systems but, does have a third standby high-pressure injection (HPI) pump for RCS injection. This third HPI pump does not change the results significantly due to the high common cause failure probability of the third pump if the other two HPI pumps fail and operator error

6 represents a significant fraction of ECCS injection failure. The Beta factor for 3 HPI pumps failing to start due to common cause factor was 0.1 based on NUREG/CR-4550 Vol.1, Rev.1, Table 6.2-1.

The licensee entered into midloop operation 4 days after shutting down the reactor. During the initial midloop operation, time to boiling was calculated to be 18 minutes and midloop operation lasted approximately 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />. Based on the Surry shutdown PRA (assuming 5 days past shutdown), the time to core damage is estimated to be approximately 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after a loss of DHR with no successful operator recovery.

3.

Derivation of Initiating Event Frequencies Loss of Inventory, Loss of Level Control & Loss of DHR Initiating Events -

The source of these frequencies come from H. Desfuli, J. Meyer, S.

Pope, and D. Meyer, "Regulatory Analysis Support Document for the Proposed Shutdown Rule," Scientech, Inc., SCIE-NRC-250-96, October 1996. This information was transferred into Table A-2, Shutdown and Low Power Operation Event Rate Information for PWRs and the applicable exerts are provided below:

Loss of Inventory Event Frequency DHR LOCA leakage affecting 1 train 6.25E-6 / hr DHR LOCA leakage affecting both trains 7.14E-6 / hr DHR LOCA via flow diversion 8.04E-6 / hr DHR LOCA via open DHR relief valve 5.36E-6 / hr Total 2.7E-5 / hr Loss of Level Control Frequency Overdraining 1.35E-2 / demand Failing to maintain level 7.96E-6 / mid-loop hr The risk increase associated with loss of DHR was very small and has been excluded from a complete derivation.

An expert judgement was rendered in reducing the initiating event frequency for shutdown with the advent of licensees using NUMARC 91-

06. The original initiating event frequencies were calculated from historical data gathered prior to licensees implementing this guidance.

This alteration of the initiating event frequencies is consistent with SECY 97-168 projections on the effects of implementing NUMARC 91-06. The

7 adjustment factors by initiating event were 0.66 for LOSP; 0.25 for loss of inventory; 0.1 for loss of level control; and 0.45 for loss of DHR.

The initiating event frequency for loss of inventory = 2.7E-5 loss of inventory/hour

• 0.25 adjustment for use of NUMARC guidance

• 24 hr/day

• 8 vented cold shutdown days/outage

• 1 outage/18 months

• 12 months/year = 8.7E-4/yr The initiating event frequency for loss of level control = 1.35E-2/demand

• 1 demand/18 months

• 12 months/yr

• 0.1 adjustment for using NUMARC guidance + 7.96E-6/hr of mid-loop operation

• 24 hr of mid-loop operation

• 1 outage/18 months

• 12 months/year

• 0.1 adjustment for using NUMARC guidance = 9E-4/yr + 1.3E-5/yr = 9.13E-4/yr The source for the LOSP frequency came from a Memo from T.L. Chu (BNL) to Mr. Richard C. Robinson (NRC), dated December 9, 1995. The value was given as 1.07E-5/hour of shutdown operation. However, this value does not differentiate between Mode 4 where two offsite power sources are required by Technical Specifications. Therefore, a multiplier of 1.3 was used to account for only requiring one offsite circuit in Modes 5 & 6.

The initiating event frequency for loss of offsite power = 1.07E-5/

shutdown hour

• 1.3 (alteration for Modes 5 & 6)

• 24 shutdown hours/

shutdown day

• 6 shutdown days of open RCS operation/outage

• 1 outage/18 months

• 12 months/year *.66 adjustment for NUMARC guidance = 8.86E-4/yr 4.

Development of the mitigating capability - This inability to provide water addition to the RCS is dominated by the human actions. A failure probability of 2E-4 has been determined to be appropriate. The hardware failure probability of the numerous trains available for water addition is estimated at 6E-5. The collective failure probability of water addition to the RCS is estimated at 2.6E-4.

C.

Significant Influence Factor(s) [if any]:

The capability of gravity feed as a viable core cooling method following a LOSP.

Acceptance that implementation of the NUMARC guidance has reduced the more credible initiating events in shutdown.

8 IV.

Calculations This finding is unrelated to those structures, systems, and components (SSCs) that are needed to prevent shutdown accidents from leading to core damage. However, if a core damage event were to occur during shutdown, there is the potential to have an unmitigated release. Since the containment function may be compromised, this finding can potentially affect all shutdown core damage accidents. From the CDF/LERF calculations using the event trees discussed above, the dominant accident sequences were derived from the Loss of Inventory and Loss of Level Control initiating events.

BASE CASE 8.7E-4 (inventory losses/yr)

• 7.5E-1 (RCS vented)

• 2.64E-4 (failure probability of RCS re-fill capability)

• 2.5E-1 (failure probability of containment closure) = 4.3E-8 LERF 9.13E-4 (level control losses/yr)

• 7.5E-1 (RCS vented)

• 2.64E-4 (failure probability of RCS re-fill capability)

• 2.5E-1 (failure probability of containment closure) = 4.5E-8 LERF 8.86E-4 (loss of offsite power)

• 3.08E-3 (onsite emergency power source failure)

• 8.63E-1 (failure to recover offsite power before boiling)

• 6.25E-1 (nozzle dams not present)

• 1E-1 (gravity feed failure)

• 1.23E-1 (failure to recover offsite power before core damage)

• 2.5E-1 (failure probability of containment closure) = 4.5E-9 LERF 8.86E-4 (loss of offsite power)

• 3.08E-3 (onsite emergency power source failure)

• 8.63E-1 (failure to recover offsite power before boiling)

• 3.75E-1 (nozzle dams present)

• 9.99E-1 (nozzle dams intact)

• 1E-1 (gravity feed failure)

• 1.23E-1 (failure to recover offsite power before core damage)

• 2.5E-1(failure probability of containment closure) =

2.75E-9 LERF Total Base Case LERF = 4.3E-8 + 4.5E-8 + 4.5E-9 + 2.75E-9 = 9.5E-8 NON-CONFORMING CASE 8.7E-4 (inventory losses/yr)

• 7.5E-1 (RCS vented)

• 2.64E-4 (failure probability of RCS re-fill capability)

• 1.0 (failure probability of containment closure) = 1.72E-7 LERF 9.13E-4 (level control losses/yr)

• 7.5E-1 (RCS vented)

• 2.64E-4 (failure probability of RCS re-fill capability)

• 1.0 (failure probability of containment closure) = 1.8E-7 LERF 8.86E-4 (loss of offsite power)

• 3.08E-3 (onsite emergency power source failure)

• 8.63E-1 (failure to recover offsite power before boiling)

• 6.25E-1 (nozzle dams not present)

• 1E-1 (gravity feed failure)

• 1.23E-1 (failure to recover offsite power before core damage)

• 1.0 (failure probability of containment closure) = 1.8E-8 LERF 8.86E-4 (loss of offsite power)

• 3.08E-3 (onsite emergency power source failure)

• 8.63E-1 (failure to recover offsite power before boiling)

• 3.75E-1 (nozzle dams present)

• 9.99E-1 (nozzle dams intact)

• 1E-1 (gravity feed failure)

• 1.23E-1 (failure to recover offsite power before core damage)

• 1.0 (failure probability of containment closure) =

1.1E-8 LERF

9 Total Non-conforming LERF = 1.72E-7 + 1.8E-7 + 1.8E-8 + 1.1E-8 = 3.8E-7 LERF DELTA CDF FOR EXPOSURE TIME 3.8E 9.5E-8 = 2.9E-7 LERF V.

Conclusions/Recommendations - Risk increase over base case was 1E-6 < x > 1E-7 for LERF = WHITE VI.

References Phase I Screening Sheets NRR Letter R. Barrett to R. Haag dated 12/7/2001 Analyst: M. Pohida Date:

12/7/01 Package Amplification: W. Rogers Date: 3/9/02