ML15261A314
| ML15261A314 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 02/10/1994 |
| From: | Peebles T, Rogers W NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| To: | |
| Shared Package | |
| ML15261A311 | List: |
| References | |
| 50-269-93-25, 50-270-93-25, 50-287-93-25, GL-89-13, NUDOCS 9402230266 | |
| Download: ML15261A314 (54) | |
See also: IR 05000269/1993025
Text
pj% REG&
UNITED STATES
0G
NUCLEAR REGULATORY COMMISSION
A
REGIONlII
o
101 MARIETTA STREET, N.W., SUITE 2900
ATLANTA, GEORGIA 30323-0199
Report Nos.:
50-269/93-25, 50-270/93-25 and 50-287/93-25
Licensee:
Duke Power Company
422 South Church Street
Charlotte, NC 28242
Docket Nos.:
50-269, 50-270, and 50-287
License Nos.:
and DPR-55
Facility Name:
Oconee 1, 2 and 3
Inspection Conducted: November 1 through December 14, 1993
Inspector:
r Walter G. Rogers, Team Leader
Date Signed
Accompanying Personnel:
L. Mellen
C. Rapp
L. King
K. Kavanaugh (Intern)
D. Tamai (Intern)
P. Holmes-Ray
Approved by:
homas A. Peebles, Chief
Date Signed
perational Programs Section
e- Operations Branch
Division of Reactor Safety
SUMMARY
This routine, announced inspection was conducted in the areas of Service Water
System Operational Performance Inspection (SWSOPI) on November 1 through
December 14, 1993, in accordance with NRC Temporary Instruction 2515/118.
RESULTS
General Weaknesses:
The NRC Temporary Instruction for Service Water Inspections, SIMS item
2515/118, was not closed due 'to licensee inadequacies in response to GL 89-13. Design control measures contained numerous weaknesses.
Unvalidated and nonconservative assumptions were used in various
calculations. Calculations or analyses did not exist for some SWS
operating modes.
Engineering analyses of some conditions were
9402230266 940211
PDR ADOCK 05000269
a
2
inadequate. Vague criteria had been established for updating
calculations. The testing program had but omitted critical functions of
some systems and equipment. The procedural guidance for some abnormal
situations was weak. The safety classification system had numerous
omissions. Resolution to self-assessment findings were sometimes
untimely and occasionally inadequate.
General Strengths:
The SWSs were in good material condition. The design review portion of
the licensee's self assessment was thorough and comprehensive for the
system reviewed.
Instrument calibration procedures contained detailed
and complete descriptions of the instrument's function. The corrosion
monitoring program, though of limited scope, was excellent. The DBD
concept and the associated testing acceptance criteria were good
initiatives.
Findings
LPSW System - For some low probability situations required by the
facility's license, the system would be incapable of performing its-,
safety function. For example, RBCU cooling coil leak repair material
had not been qualified for accident conditions; failure of the material
would affect containment integrity. A fairly complete hydraulic
computer model had been developed, but inadequate controls existed for
maintaining the hydraulic model valid. Significant material condition
improvements had been accomplished (replacement of the unreliable
radiation monitoring system) and others were planned (replacement of all
RBCUs). Extensive analysis/calculations existed on which the system
design was based. However, analyses dealing with LPSW NPSH and RBCU
waterhammer were inadequate. Also, the RBCU performance evaluation
process contained two questionable inputs.
CCW System - Corrective actions to SITA findings associated with the
ECCW subsystem had been untimely. Portions of the CCW system necessary
to provide flow to the LPSW system were not properly classified as
safety-related. The situation had been recognized by the licensee, and
adequate corrective actions were being implemented. No analyses existed
to support Oconee's capability to withstand failure of the Keowee
Dam/loss of inventory of the Lake Keowee. Also, the procedures for this
scenario contained weaknesses. The test procedure and heat transfer
calculations for the ECCW subsystem were inadequate. Fortunately, a
large safety margin existed in the actual system's performance.
HPSW System - The system was not classified, constructed, tested, or
maintained commensurate with its importance to safety. The licensee's
engineering organization recognized this deficiency. However,
communication to the rest of the organization had been untimely. Also,
some of the corrective actions taken by the licensee in response to this
deficiency were weak.
3
SSF - The SSF would not remain operational following a failure of the
Jocassee Dam. Therefore, no system was available to provide decay heat
removal of the three units in this situation. Also, the decay heat
removal function of the SSF had not been adequately confirmed. The
minimum flow requirements to the steam generators were nonconservative.
Numerous calculations had not been updated following facility
modifications affecting the calculations. The periodic testing program
elements did not add up to an integrated test of the SWS systems.
Air
entrapment affecting ASW pump performance could not be identified during
periodic pump testing due to a procedure deficiency. Finally, certain
aspects of the licensee's GL actions had not been performed.
ASW System - The system was marginal in its capabilities and did not
contain flow instrumentation or provide the operators the ability to
control plant conditions from the control room. Testing of the system
failed to provide full assurance that the personnel could perform
necessary tasks within the requisite time constraints. The testing of
specific components in the system was inadequate, but the licensee had
recognized the deficiencies and was taking timely corrective actions.
Calculations for NPSH and pump minimum flow protection lacked rigor.
Keowee - The mechanical systems were very reliable. Keowee had been
excluded from the licensee's GL response. Corrective actions to
establish all aspects of the quality assurance program at Keowee had
some minor weaknesses in quality of implementation and full integration.
Also, some minor quality assurance program deficiencies were present.
The calibration program contained some weaknesses including not
verifying the annunciator panels alarm at the proper setpoint.
Four cited violations, two non-cited violations, two deviations, one
unresolved item, and six inspector follow-up items were identified.
The following items are included as attachments to this inspection report:
APPENDIX A Persons Contacted
APPENDIX B Generic Letter 89-13 Action Items
APPENDIX C Acronyms and Abbreviations
REPORT DETAILS
1. Inspection Objectives
Numerous problems identified at various operating plants in the United
States have called into question the ability of SWSs to perform their
design function. These problems have included inadequate heat removal
capability, biofouling, silting, single failure concerns, erosion,
corrosion, insufficient original design margin, lapses in configuration
control or improper 10 CFR 50.59 safety evaluations, and inadequate
testing. NRC management concluded that an in-depth examination of SWSs
was warranted based on these problems.
The team focused on the mechanical design, operational control,
maintenance, and surveillance of the SWS and evaluated aspects of the
quality assurance and corrective action programs related to the SWS. The
inspection's primary objectives were to:
Assess SWS performance through an in-depth review of the system's
mechanical functional design and thermal-hydraulic performance
including the content and implementation of SWS operating,
maintenance, and surveillance procedures, and operator training on the
SWS,
Verify that SWS functional design and operational controls could meet
the thermal and hydraulic performance requirements, and that SWS
components were operated in a manner consistent with their design
bases,
Assess the licensee's planned and completed actions in response to
Generic Letter 89-13, "Service Water System Problems Affecting Safety
Related Equipment," July 1989, and
Assess SWS unavailability resulting from planned maintenance,
surveillance, and component failures.
The specific areas reviewed are described in paragraph 2 of this report.
The observations and concerns identified are described in paragraphs 3
through 10 of this report. Personnel contacted and those who attended the
exit on December 14, 1993, are identified in Appendix A.
2. Inspection Areas of the SWSs Associated with Oconee
The SWSs at Oconee encompassed numerous systems. These were the LPSW;
HPSW; ASW; CCW (including the ECCW subsystem); the EDG cooling, HVAC
cooling, steam generator cooling, and submersible pump subsystems of the
SSF; and most of the mechanical systems of the Keowee hydroelectric
station.
The team reviewed the mechanical design of each SWS, including the design
bases, functional requirements, design assumptions, calculations, boundary
conditions, analyses and models to determine if the design met licensing
commitments and regulatory requirements. Each SWS's capability to meet
the thermal and hydraulic performance specifications during accident and
Report Details
2
abnormal conditions was reviewed. The design features associated with the
loss of the Jocassee and Keowee Dam were evaluated. Single and common
mode failure vulnerabilities, selected modifications and proper reflection
of SWS design in plant operations, testing, and maintenance procedures
were reviewed. The team reviewed maintenance history on selected
equipment, maintenance procedures, completed work packages, preventive
maintenance schedules, preventive maintenance procedures, and associated
LERs. The availability records of the LPSW system for the past two years
was compared to the licensee's PRA submittal.
Plant walkdowns were
conducted on all SWSs to assess present operating configurations,
conformance to design documents, housekeeping and material conditions.
Normal, abnormal and emergency operating procedures were reviewed for
adequacy. Simulator scenarios involving the LPSW system were evaluated.
The team reviewed preoperational test procedures, surveillance procedures,
and the IST program implementation to determine if sufficient testing had
been conducted to confirm system design requirements and system
operability. Also reviewed were the licensee's procedures, controls, and
other activities associated with the calibration of instrumentation in the
SWSs.
The team reviewed the licensee's self-assessment of the LPSW system
and select corrective action documents associated with the SWSs. The
minutes of off-site committee meetings were reviewed for.conformance to
Technical Specification requirements. Also, the team evaluated the
adequacy of the licensee's GL 89-13 actions associated with all the SWSs.
3. Generic Letter 89-13 Implementation
The NRC issued GL 89-13, "Service Water System Problems Affecting Safety
Related Equipment," requesting licensees to take certain actions related
to their SWS. These actions included establishing biofouling surveillance
and control techniques, monitoring safety-related heat exchanger
performance, establishing a routine inspection and maintenance program,
reviewing the design to assure intended safety functions could be
accomplished, and training personnel in the operation, maintenance, and
testing of the SWS.
The licensee's docketed responses to the GL of January 26, 1990, and
May 31, 1990, were broad in nature and not specific to each system
addressed. Also, the licensee's response indicated the GL actions had
been performed without taking exceptions.
However, the licensee's GL actions almost exclusively focused upon the
LPSW system and its support systems. The licensee's actions in response
to GL 89-13 did not address all the applicable GL systems. The SWS
associated with the Keowee hydroelectric station was not considered. A
number of GL actions were not considered for the ASW and the SWS portion
of the SSF. Also, a number of GL actions were not performed by the
licensee for the HPSW system due to the classification of the system as
nonsafety-related. Failure to apply the GL actions to all the applicable
systems is Deviation 50-269, 270, 287/93-25-01, "Failure to Adequately
Perform SWS GL Actions."
Report Details
3
The licensee had performed extensive corrective actions to the LPSW
system, but one LPSW design deficiency identified during self-assessment
activities was riot properly rectified. Also, corrective actions
associated with the support functions provided by the CCW system had not
been performed in a timely manner and/or did not fully address the
deficiencies identified.
Heat exchanger performance monitoring was adequate for the LPI coolers and
the smaller LPSW system coolers. The RBCU performance monitoring had
established relative changes in the fouling factor between monitoring
intervals but had not determined the true fouling factor. Also, some of
the inputs associated with RBCU performance monitoring were questionabl,
in that the licensee was continuing to improve the hydraulic model for
LPSW. See Appendix B for details on each GL 89-13 Action Item.
4. Low Pressure Service Water System
The LPSW system provided cooling to the RBCUs, LPI coolers, the motor and
turbine driven EFW pump coolers, HPI pump motor coolers, the control room
chilled water system, numerous room coolers, and nonsafety related turbine
building loads. Units 1 and 2 shared three 15,000 gpm pumps with one pump
capable of being powered from two separate safety related busses. The
Unit 3 LPSW system had two 15,000 gpm pumps. The LPSW pumps took a
suction from the 42" CCW discharge header within the turbine building.
The Unit 1/2 LPSW pumps discharged into a common header that split into
two supply lines; one supply line for each unit. The unit supply lines
further divided into two separate headers supplying the two trains of
safety related equipment. The two equipment supply lines then
interconnected into a common line which entered containment. This common
line then split into three parallel lines, each line supplying one RBCU.
These three RBCU supply lines then reconnected into one line on the
discharge side of the RBCUs before exiting containment. Also, branching
from the common discharge header was a supply line to the turbine building
loads.
The turbine building supply line then'split to provide cooling to
each unit's turbine building equipment. The Unit 3 RBCU and turbine
building cooling arrangement was similar. A normally closed crosstie line
allowed either LPSW system to supply the discharge header of the other
LPSW system.
Inspection findings related to the LPSW system were:
a. Turbine Building Isolation
(1) Design
The licensee's design for isolating the nonseismic turbine
building line from the seismic portion of the LPSW system was
inadequate. A single, motor operated butterfly valve was
provided, even though the two LPSW trains were designed and
operated as one interconnected system. The isolation valve for
Report Details
4
Units 1/2 was LPSW-139, and LPSW-45 for Unit 3. The valves did
not have an auto-closure feature, but could be electrically
closed by operator action from a station just outside the control
room. The isolation valves had not been originally specified as
seismic but were seismically qualified as a resolution to a 1987
SITA finding on the LPSW system.
The licensee had performed calculations to determine the effect
an earthquake would have on the LPSW systems. In the case of a
nonseismically supported turbine building line failure without
turbine building isolation, the calculation indicated the LPSW
system would not be able to supply adequate cooling to the
required safety related loads.
FSAR Section 9.2.2.2.3 stated in part, "The LPSW system provides
sufficient flow to the Low Pressure Injection coolers and Reactor
Building Cooling Units to ensure sufficient heat transfer
capability following a design basis accident and a single active
failure. The worst case design basis accident involves a
LOCA/loss of offsite power with seismic event."
The licensee stated that failure of a seismic/non-seismic
interface valve was outside the licensing basis for the facility.
The team disagreed. This is Unresolved Item 50-269, 270, 287/93
25-02, "Turbine Building Isolation Single Failure
Vulnerabilities."
(2) Testing
The isolation valves had not been VOTES tested in response to GL 89-13, "Safety Related Motor Operated Valve Testing and
Surveillance."
LPSW-45 was scheduled for VOTES testing at the
next refueling outage. LPSW-139 was scheduled for VOTES testing
at the next outage of both Units 1 and 2. In response to the
team's request for design calculations supporting the closing
capability of these valves, the licensee performed calculation
OSC-6019, Valve LPSW-139 and 3LPSW-45, "Closure Against Maximum
Delta P," indicating that adequate closing thrust could be
developed.
Stroke testing of the valves had been limited. LPSW-45 was
stroke tested once per refueling outage. Due to operating
constraints associated with closing LPSW-139, it had been stroke
tested only once since initial operation.
b. LPSW Pump NPSH Considerations
Calculations extrapolating system testing results identified several
configurations involving loss of instrument air where LPSW flow demand
was greater than design. The most severe configuration was
Report Details
5
simultaneous operation of both LPI coolers on a shutdown unit and a
LOCA on the other unit with the LOCA unit's MTOTC temperature control
valve bypassed. For this case, there was insufficient NPSH for the
excessive LPSW flow demand causing significant cavitation of the LPSW
pumps. The licensee established procedural controls to throttle LPSW
flow within 30 minutes through operator actions, thereby eliminating
the cavitation. The inadequate NPSH condition was evaluated by the
licensee and considered acceptable.
(1) The licensee's NPSH acceptability evaluation was based upon
accepting the manufacturer's best judgement that no significant
pump degradation would occur during and following the inadequate
NPSH condition. Neither the licensee nor the pump manufacturer
performed any testing validating this judgement. Also, the pump
manufacturer did not warrant the LPSW pumps for operation with
insufficient NPSH. Therefore, the licensee failed to adequately
validate this critical design assumption. 10 CFR 50, Appendix B,
Criterion III, "Design Control," requires that adequate measures
be established for the selection of equipment. Also, as
committed through Duke Power Company Topical Report 1-A, Table
17.0-1; ANSI 45.2.11-1974, "Quality Assurance Requirements for
the Design of Nuclear Power Plants," requires NPSH be considered
as a design input in Section 3.2.11.
This is considered an
example of Violation 50-269, 270, 287/93-25-03A, "Failure to
Perform Adequate Calculations and Evaluations to Support Facility
Design."
(2) One of the operator actions to reduce flow demand within 30
minutes was throttling the LPI cooler isolation valves until
reaching 3000 gpm. The cooler isolation valves were gate valves
and, generically, not used for throttling. The licensee had
evaluated and tested these valves for throttling flow and
determined the valves could be throttled. However, after
throttling, the valves may not go full open or closed due to
internal damage suffered while throttled. This could result in
the inability to isolate a leaking LPI cooler subsequent to the
throttling activities.
c. The Hydraulic Model
(1) The licensee's hydraulic computer model for predicting LPSW
system response during an accident used the manufacturer's pump
curves. The manufacturer's pump curves did not include pump
degradation. Quarterly inservice pump testing allowed for up to
10 percent pump degradation without declaring the pump
inoperable. There were no procedural controls to evaluate the
inservice pump test results against the hydraulic model's flow
inputs. Although the situation was not identified during the
inspection, an acceptable inservice pump test could invalidate
the LPSW pump flow inputs to the hydraulic computer model.
Report Details
6
Contrary to the requirements of 10 CFR 50, Appendix B, Criterion
III, "Design Control," the licensee failed to provide the
adequate procedural controls to ensure the LPSW hydraulic model
was not invalidated. This is an example of Violation, 50-269,
270, 287/93-25-038, "Failure to Perform Adequate Calculations and
Evaluations to Support Facility Design."
(2) The manufacturer's pump curve indicated the possibility of
deadheading a degraded pump when the LPSW pumps were operating in
parallel. Trending of the one point flow/pressure check used in
the IST program was not the most reliable method of detecting
pump degradation. The development of an individual pump curve
would more accurately predict this condition. However, the
current testing method was consistent with regulatory
requirements.
(3) In 1992, the licensee reviewed Unit 1 and 2 hydraulic computer
model results and determined a waterhammer would occur during a
design basis LOCA with a single failure. The hydraulic model
predicted a LPSW pressure of -13.5 psig downstream of the RBCU
discharge throttle valves. Containment temperature would exceed
200*F in response to the design basis LOCA. The combination of
the low pressure (-13.5 psig) and the high temperature (200'F)
would cause the LPSW water to flash to steam. Upon condensation
of the steam, a waterhammer would ensue. Under condition adverse
to quality report PIP 92-454, the licensee evaluated the effects
the waterhammer would have on LPSW flow within the piping and the
reduction in RBCU cooling in calculation OSC-4922, "LPSW Woods
Model Flowrate Correction through RBCU's Due to Cavitation,"
issued September 25, 1992. The licensee did not evaluate the
effects the waterhammer would have on the structural integrity of
the RBCUs and the discharge piping. 10 CFR 50, Appendix B,
Criterion XVI, "Corrective Actions," requires conditions adverse
to quality to be promptly identified and corrected. This is
considered an example of violation 50-269, 270, 287/93-25-04A,
"Inadequate Evaluation of Conditions Adverse to Quality by
Engineering."
d. RBCU Operability Determination
A combination of LPSW flow test data and computer modeling of RBCU air
flow were used to determine if the RBCUs had adequate accident
condition heat removal capability. There were two questionable inputs
used in that determination as follows:
(1) Accuracy of the installed orifice used to measure LPSW flow
A reduction in the diameter of the piping in the area of the
orifice would result in higher indicated LPSW flow than was
actually occurring. Documentation and photographs showed fouling
Report Details
7
had occurred at various points within the LPSW piping. Anomalous
results in previous flow testing, though possibly due to other
reasons, could be explained by the flow instrumentation reading
high. The licensee was aware of the potential problem and
planned to replace the RBCUs and associated piping, including the
section containing the flow orifice, at the next refueling outage
for each unit.
(2) Validity of the RBCU non-uniform air flow distribution predicted
by the computer modeling
The calculation of the air side fouling factor was highly
sensitive to variations in the air flow distribution. The
computer code had been benchmarked by a vendor. However, an
airflow test performed in 1987, indicated airflow was
substantially less than expected. When questioned about the
results, the licensee stated this test was invalid due to
significant air side fouling. Further testing was not conducted.
These two concerns placed RBCU results in question. Further licensee
actions to determine the accuracy of these two inputs into AN RBCU
operability determination is considered an Inspector Follow-up Item
50-269, 270, 287/93-25-05, "Additional Validation of RBCU Evaluation
Inputs."
Also, a detailed discussion of RBCU operability
determination is contained in Appendix B, section II.
e. Use of Belzona for RBCU Leak Repair
The licensee had used Belzona to repair various plant components
including the pressure retaining braze joints on the RBCUs. The
commercial grade evaluation, CGD 2021.01-01-0001, specifically
addressed the use of Belzona as a pressure retaining material for
"pinhole" leak repairs on the Unit 2 RBCU coils. While the licensee's
calculation found that the shear stress was acceptable; the licensee
failed to evaluate or obtain test data to show that the RBCU repairs
would withstand accident conditions.
Failure of the Belzona presently
installed in Unit 2 coincident with a LOCA would significantly
increase containment leakage.
10 CFR 50, Appendix B, Criterion III,
"Design Control," requires adequate suitability of application of
materials reviews be performed. This is considered an example of
Violation 50-269, 270, 287/93-25-03C, "Failure to Perform Adequate
Calculations and Evaluations to Support Facility Design."
f. Simulator Observations
(1) During a LOOP/LOCA with failure of one LPSW pump on the shared
Unit 1/2 system, the operator stopped one of the two operating
LPSW pumps when no pump amperage was indicated. Redundant,
independent instrumentation was not used prior to stopping the
pump and was considered a performance weakness. Although
Report Details
8
expected and consistent with the facility's design, LPSW pump
suction valve position indication was lost.
Indication was
powered from a nonsafety related electrical bus which de
energizes in response to the LOOP. These valves were normally
aligned open and do not receive an ESF signal.
The lack of
indication contributed to the operator's decision to stop the
pump.
(2) With one operating LPSW pump supplying both units, the LPI cooler
flows required by the emergency procedure could not be achieved.
None of the licensee's procedures were applicable to this
situation. The operators used their judgement and secured LPSW
flow to the LPI coolers, isolated cooling to the control room,
and isolated numerous nonessential loads. After transferring LPI
pump suction to the containment sump due to depletion of the
BWST, the LPI coolers were returned to service at flows less than
required by the emergency procedure.
The lack of specific procedural direction was due to a deficiency
within the abnormal procedure for total loss of LPSW. The entry
condition for using this procedure was no LPSW pump operating;
instead of inadequate LPSW flow. The licensee acknowledged this
deficiency. Actions to improve operator response to inadequate
LPSW flow is considered part of Inspector Follow-up Item
50-269,270, 287/93-25-06A, "Actions to Improve Operator Responses
to Abnormal Events."
(3) After the simulator demonstration, the ramifications of reduced
LPI flow and the bases of the procedurally required 3000 gpm LPI
cooler flow was discussed. This parameter directly involved
maintaining containment temperature less than equipment
environmental qualification temperature limits. Licensee
responses were focused exclusively on reactor core cooling. The
3000 gpm bases for LPI cooler flow was not fully understood by
the individuals. This was due to the limited training on
containment temperature concerns during an accident. The
licensee responded that containment temperature ramifications
would be the responsibility of the Technical Support Center.
This is considered a training weakness.
(4) The simulator was certified. However, there was no simulation of
the HPI and LPI pump motor coolers, no deviation in LPSW flow to
the RBCUs in response to the ESF actuation, and no simulation of
the Unit 3 LPSW system crosstie.
Report Details
9
g. SITA Actions
In 1987, the licensee conducted a technical audit of the LPSW system.
The audit was thorough with a substantial number of findings. Some of
the corrective actions directly associated with the LPSW system were
adequately dispositioned. Examples included the replacement of the
unreliable radiation monitoring system for effluents from the LPSW
system, development of a hydraulic computer model, and the generation
of a substantial number of calculations to support LPSW design.
However, concerns by the licensee associated with some of the
corrective action resolutions, especially dealing with support
systems, prompted an October-November 1992 review of the SITA process
and revisiting a number of these outstanding issues. Subsequently, a
SWS Steering Committee was formed and charged with resolution of all
SWS issues.
The team concurred with the licensee's assessment that there had been
untimely progress of some critical SITA issues prior to the Fall,
1992.
The SITA process review in the Fall, 1992, was a good
initiative. Also, the resulting SWS Steering Committee had a number
of positive aspects including centralization of the issues and the
ability to focus the diverse sections of the Oconee organization on
resolution of a particular issue. However, resolution of some of the
outstanding issues was inadequately addressed. Examples included the
LPSW turbine building isolation, and HPSW piping seismic capability.
h. System Availability
Recent syst=m availability data compared favorably with the
availability assumed in the IPE report. Also, the material condition
of the LPSW system was good except for fouling of small diameter
piping. Recent machinery history records indicated the majority of
the repetitive corrective maintenance focused on unplugging fouled
instrument impulse lines. Also, flow testing of the Unit 3 HPI pump
motor cooler, the Unit 1 LPSW A pump's cooling line, and the TDEFW
pump cooling lines indicated fouling resulting in stainless steel
piping replacements in those areas.
5. Circulating Cooling Water'System
The CCW system was common to all three units and took suction from the
Lake Keowee intake canal.
Twelve pumps (four per unit) supplied a common
cross-connected 42-inch discharge header from which numerous other SWSs
took suction. From this header, cooling water passed through the three
condensers. Upon leaving the condensers, the water discharges through six
lines (two per unit) and returns to Lake Keowee upstream of the intake
canal.
Report Details
10
A subsystem of CCW was the ECCW system. If the CCW pumps lost power ECCW
actuated establishing siphon or gravity flow from the intake canal to the
42-inch header and through the condenser sections. Emergency condenser
discharge lines connect the condensers with the Keowee hydroelectric
station's tailrace and due to elevation differences. This was
gravity/siphon flow operated. Prior to entering the tailrace all the
discharge lines connected into one line. ECCW actuation involved the
automatic closure of the condensers' normal outlet valves, opening of the
condensers' emergency outlet valves and opening emergency discharge valve
to the Keowee tailrace, CCW-8, located in the common discharge piping.
The high points of the ECCW piping were connected to a vacuum priming
system which would remove air entrapped within the system that could
impede siphon operation. The licensee considered CCW supplying the LPSW
pumps as the first siphon and CCW passing through the condensers as the
second siphon.
The CCW system performed two distinct safety functions during the
LOCA/LOOP event:
First, it provided a suction source for other systems
including the safety-related LPSW system, and second it provided cooling
water to the condenser to remove decay heat in the emergency condenser
cooling water (ECCW) mode. The CCW pumps contributed to these safety
functions in two ways:
First, when power is lost and they are not
operating, they provided a siphon conduit from the intake canal to the CCW
piping from which the LPSW takes suction, and to the condenser for the
ECCW system. Second, at the time when the pumps can be restarted (up to
1/2 hours per emergency procedures), they continue to provide water for
these same functions. Since dissolved air will tend to come out of
solution when the system is in the siphon mode, at least one of the CCW
pumps must be operated after power is restored in order for the water to
continue to be supplied to the CCW piping.
Within the intake canal is an underwater dam which can trap approximately
67,000,000 gallons of water if Lake Keowee were to fall below the 770-foot
level.
With the CCW pumps operating the system is capable of
recirculating water from this impounded area, through the condensers,
through the condenser emergency discharge lines and through normally
closed valve, CCW-9, which discharges into the intake canal.
Findings associated with the CCW system were:
a. The Siphons
(1) The 1987 SITA identified numerous support systems associated with
the first siphon which did not meet safety related standards such
as the non-seismically qualified vacuum priming system. The
original SITA response did not refute the finding, but considered
such requirements as outside the licensing basis of the facility.
Eventually, the safety related aspects of these support systems
were evaluated in a design study. Through a combination of the
design study and a SWS steering committee the vacuum priming
Report Details
11
issue was addressed by isolating the vacuum priming system in the
Fall, 1993. Outgassing of air was addressed by establishing
minimum CCW pump combinations for particular Lake Keowee levels.
Licensee actions on this matter were untimely. Another support
system, HPSW, for the first siphon is discussed in section 6.
(2) The CCW pump components necessary to support siphon operation to
the LPSW system (the first siphon) performed a safety related
function but, were not classified as safety related. For the
first siphon to operate, the physical interface between the pump
casing and the CCW piping must be leaktight, and the pump
mounting/structural supports must be capable of withstanding an
earthquake without allowing air inleakage. Examples of the
effects of the improper classification were as follows:
(a) Following failure of an ECCW flow test the licensee
determined the cause of the test failure to be air inleakage
between the pump casing and the CCW piping. In response the
licensee issued OE # 4072 dated 6/3/91 which authorized
installation of a rubber seal at this interface. Though the
design change appeared technically adequate, it was
designated as nonsafety related.
(b) During the inspection period, the overhaul/repair of the 2B
CCW pump was being performed using nonsafety related
procedures.
(c) Whenever a CCW pump was disassembled, as with the 2B pump,
the pump casing seal was disturbed. The subsequent post
maintenance test to confirm leak tightness was performed
without written procedural direction. Following discussions
w'th the licensee the test method appeared adequate but, the
conditions for testing, the instrumentation, the acceptance
criteria, etc. were not being appropriately controlled.
Independently, the licensee recognized the error and was
classifying the components as safety related in the most current
draft revision to the Quality Standards Manual. The failure to
properly classify the components is considered Violation 50-269,
270, 287/93-25-07, "Inadequate Classification of Siphon Support
Equipment for LPSW Supply."
However, based upon the corrective
actions in progress, the licensee's self identification of the
matter, no similar violations associated with the
misclassification of the first siphon's support equipment, the
lack of willfulness, and the nonescalated enforcement nature of
the violation, this is considered a non-cited violation
authorized under 10 CFR 2, Appendix C, Section VII.B.2.
Report Details
12
(3) The licensee did not consider the equipment associated with the
second siphon as safety-related. Therefore, some of the
equipment associated with the condenser cooling mode did not meet
safety-related design requirements.
The vacuum priming support system was not seismically supported.
A number of valves were not powered from safety-related sources
including some of the condenser emergency discharge valves,
midpoint vent valves, and the emergency discharge valve to the
Keowee tailrace.
Also, the single discharge valve to the Keowee tailrace was not
seismically protected. This valve was located in a concrete and
steel structure at elevation 730 feet. The top of this structure
was covered with nonrestrained metal deck plates. In a seismic
event, the plates could fall damaging the valve or the associated
electrical cables below.
Unresolved Item, 269,270, 287/93-13-03, "ECCW System Design and
Testing," had already been established on ascertaining the
licensing basis of the ECCW system, including the condenser
cooling mode. Therefore, the design aspects of the condenser
cooling mode discussed above have been encompassed by this
unresolved item. Resolution of this unresolved issue is
contingent upon further NRC review.
(4) Nonconservatisms existed within the calculations supporting ECCW
design and testing. Examples included:
(a) Calculation OSC-2349, "CCW Intake Piping Degassing in the
ECCW Mode", Rev 1, May 21, 1990, was performed to show that
the CCW system had the capability of providing the required
flow rate even with air inleakage and outgassing of
dissolved air from the water, both of which would tend to
break the siphon. The calculation also provided the
acceptance criteria for the intake piping water level for
the "Emergency CCW System Flow Test," PT/1/A/0261/07, and
the equivalent performance tests for Units 2 and 3.
The following discrepancies and nonconservatisms existed in
this calculation:
The maximum flowrate analyzed was 30,000 gpm. However,
for the LOOP case, the maximum flowrate may include the
maximum tailrace flow through the condenser and the
CCW-8 emergency discharge valve (in the range of 30,000
gpm), plus the flows to the LPSW pumps (design flow of
15,000 gpm per pump, 5 pumps). The various LPSW pump
combinations had not been analyzed, but initial
evaluation indicated that as many as four pumps could
Report Details
13
be operating. Therefore, the actual flows could be
significantly higher than what was analyzed, producing
more outgassing due to the higher mass flow rate.
Additionally, higher flow would require a higher
minimum level in the piping to overcome the increased
flow resistance.
The atmospheric pressure used was 14.7 psia. Per
"Atmospheric Pressure for Design Calculations," S. L.
Nader, File OS-3C, 7/23/87, the correct atmospheric
pressure for Oconee was 14.0 psia.
Conservatisms in the calculation and differences from the
actual operating configuration which would tend to offset
the non-conservatisms were as follows:
The calculation assumed an outgassing rate of 100
percent. The actual rate would be less.
Actual testing was done on one unit at a time with four
CCW pump flow paths open. The calculation assumed only
one open pump flow path.
The duration of the analyzed SBO event was longer than
the LOOP event (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> versus 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />).
It was not clear which will dominate, the conservatisms or
the non-conservatisms, without rigorous re-performance of
the analysis. Failure to reconcile the competing
assumptions compromised the calculation on which the
adequacy of the ECCW design requirements and test acceptance
criteria were based in part.
(b) Calculation OSC-2346, "ECCW System Performance Evaluation,"
Rev 3, February 17, 1993, was generated to show that the
condenser had the capacity to transfer the required decay
heat without exceeding the condenser pressure limitations or
causing flashing in the CCW piping which could cause loss of
the siphon. This calculation formed the basis for the
acceptance criteria of the Technical Specification required
system flow test.
(1) The methodology used to derive the heat transfer
capability of the siphon/condensers was nonconservative
as follows:
The calculation did not account for the potential
for outgassing of the CCW which would tend to
decrease the heat transfer capability of the
condenser. Such outgassing would be driven by the
Report Details
14
decrease in pressure in the CCW system due to the
siphon and by the increase in temperature of the
CCW as it passes through the condenser tubes.
The atmospheric pressure used in the calculation
was 14.7 psia. Per "Atmospheric Pressure for
Design Calculations," S. L. Nader, File OS-3C,
July 23, 1987, the correct atmospheric pressure
for Oconee was 14.0 psia.
The calculation did not account for the decrease
in heat transfer area as a result of condenser
tubes that were presently plugged and may be
plugged in the future.
The calculation did not account for the decrease
in heat transfer area due to plugging of the tubes
by the Amertap balls. The balls were continuously
recirculated through the condensers for tube
cleaning during normal operation. Due to the very
low differential pressure across the condenser
during siphon operation, the balls would stick
inside the tubes.
(2) The calculation did not address, as one of its
acceptance criteria, the requirement that the condenser
capacity in the ECCW mode should be such that the main
steam relief valves would not be open except in the
initial pressure spike transient. This criteria should
have been included to show that the system could
perform one of its primary functions, minimizing the
release of radioactivity and conserving condensate
inventory by condensing steam in the condenser rather
than exhausting it to the environment through the
relief .valves. Although the calculation was deficient
in this regard, the licensee was subsequently able to
demonstrate this capability.
(3) The calculation derived a minimum initial flow rate of
4,500 gpm to each unit's condenser to meet the heat
transfer requirements. Flow through the three
condensers was assumed to be equally split. Upon this
assumption, acceptance criteria for the Technical
Specification required flow test was derived. However,
the unit specific flow paths (the piping from the
condenser waterbox outlets to the common discharge
line) were different in length and configuration.
Also, there was not a flow analysis demonstrating the
equal flow split. Therefore, the assumed equal flow
distribution had not been validated.
Report Details
15
10 CFR 50, Appendix B, Criterion III, "Design Control," requires
that measures shall be established to assure that design bases
are correctly translated into design documents and to verify the
adequacy of design. Contrary to this requirement, the licensee
did not adequately translate the requirements for the ECCW system
into the analyses and test acceptance criteria which demonstrated
the system's capability to meet these requirements. This is an
example of Violation 50-269, 270, 287/93-25-03D, "Failure to
Perform Adequate Calculations and Evaluations to Support Facility
Design."
(5) ECCW Test Procedure
Procedure PT/1/A/0261/07, change 8, August 8, 1991, "Emergency
CCW System Flow Test," was the periodic Technical Specification
required test of the ECCW system flow capability. The flowrate
of the siphon was determined by measuring the distance between
the exit nozzle of the ECCW piping and the middle of the flume's
impact point with the tailrace. There were distance markings at
two feet increments painted on the tailrace for taking this
measurement.
Through licensee interviews, the probable width of the flume at
the point of impact was approximately three feet, and the center
of the flume was estimated to the nearest foot. Therefore,
determination of the flume's impact point entailed an error of as
much as + one foot, which represented an error of approximately +
2,000 gpm in the acceptance criteria. This potential error was
not accounted for in the test acceptance criteria. 10 CFR 50,
Appendix B, Criterion XI, Test Control, requires that, "Test'
procedures shall include provisions for assuring that.. .adequate
test instrumentation is available and used..."
This is
considered an example of Violation 50-269, 270, 287/93-25-08A,
"Inadequate Testing Methods for Testing SWS Equipment."
(6) Although the ECCW calculations and the test procedure were
inadequate, the most current test results of ECCW flow appeared
to support system operability. This was due to:
(a) The current test procedure verifying the ECCW mode
capability, PT/1/A/0261/07, change 8, August 8, 1991, was
based on the more conservative analysis in Rev. 2 of the
calculation which required an initial flow rate of 6,000 gpm
per unit instead of 4,500 gpm per unit. This procedure's
acceptance criteria started at 18,000 gpm flow and decreased
with time based on an implied assumption that flow through
the three unit condensers would be evenly distributed.
(b) Total ECCW flow was approximately 30,000 gpm.
Report Details
16
(7)
Under Minor Modification OE # 5514 dated September 16, 1993, the
licensee deleted the condenser cooling water mode or the "second
siphon" from the CCW system design basis document, Specification
OSS-0254.00-00-0003, Rev 2, March 31, 1992. The licensee's
safety evaluation justifying the deletion, considered the
condenser cooling mode of decay heat removal as only required for
the total loss of power (onsite and offsite) event discussed at
original licensing. In the more recent SBO submittal approved by
the NRC (SER dated January 28, 1992), the decay heat removal
pathway described was via lifting main steam relief valves, and
not the condenser cooling mode. Therefore, the licensee
considered the SBO submittal as superseding the original
requirements.
Deletion of the condenser cooling mode was not justified because:
Technical Specifications 3.4.5 required the ECCW system.
The Technical Specification bases stated "Normally, decay
heat is removed by steam relief through the turbine bypass
system to the condenser. Condenser cooling water flow is
provided by a siphon effect from Lake Keowee through the
condenser for final heat rejection to the Keowee Hydro Plant
tailrace."
It also stated that, "Decay heat can also be
removed from the steam generators by steam relief through
the main steam safety relief valves." Therefore, both the
ECCW condenser cooling mode and the SBO submittal method
were credited for decay heat removal.
Section 9.2.2 of the current FSAR, "Cooling Water Systems,"
stated that the CCW system, "...serves as the ultimate heat
sink for decay heat removal during cooldown of the plant.
Following a design basis event involving loss of the CCW
pumps, the Emergency Condenser Circulating Water
System.. .provides flow through the condenser for decay heat
removal."
It further stated, "The CCW system has an
emergency discharge line to the Keowee hydro tailrace...
Under a loss-of-power situation, the emergency discharge
line will automatically open and the CCW system will
continue to operate as an unassisted siphon system supplying
sufficient water to the condenser for decay heat removal and
emergency cooling requirements." Additionally, it stated,
"...the "second siphon" provides flow through the condenser
to remove decay heat."
And finally it stated, "In a loss of
off-site power situation, the ECCW System is required to
function until a CCW pump can be manually restarted by the
control room operator."
The licensee's SBO submittal did not request elimination of
the ECCW condenser cooling mode from the licensing basis.
The NRC's SBO SER did not state relief was granted from
Report Details
17
previous condenser cooling mode licensing requirements, nor
did it state that the condenser cooling mode was only
required for a total loss of power event.
On page 9, item 6, of a May 23, 1993, Notice of Violation,
the NRC stated, "The ECCW system is required to provide both
a suction source to the Low Pressure Service Water (LPSW)
pumps and cooling water through the main condenser for decay
heat removal if the Condenser Circulating Water (CCW) pumps
are unavailable."
In a February 11, 1987, letter concerning an enforcement
conference for failure of an ECCW system test, the NRC's
position was summarized on Page 3 of Enclosure 1 as, "The
NRC discussed the event in detail with DPC and expressed
concern that the load shed test had not been appropriately
conducted in the past to insure that the required gravity
flow (which relies upon a siphon) for the ECCW System was
available and effective upon demand."
On this page, the
siphon referred to was defined as the "second siphon" in a
statement that, "The ECCW System relies upon a siphon effect
to lift water from Lake Keowee and then exit by gravity flow
to Lake Hartwell at a lower elevation."
The licensee stated that present practices (operation,
maintenance, testing, etc.) were not changed as a result of
deleting the condenser cooling mode from the design basis
document. However, the team considered that at a minimum, future
modifications could be impacted. Also, the minor modification's
safety evaluation became the basis for a licensee request to
delete ECCW from the Technical Specifications. The Technical
Specification change request was under review by NRR. Resolution
of the team's concerns associated with the licensing bases of the
condenser cooling mode and the prudence of the licensee's actions
are contingent upon NRR's decision (either approval or denial) of
the Technical Specification change request and completion of
NRC's review of Unresolved Item 50-269, 270, 287/93-13-03, "ECCW
System Design and Testing."
b. The CCW Pumps
(1) The active components associated with CCW pumps were not
classified as safety-related. However, the licensee credited CCW
pump operation 1/2 hour after accident occurrence to provide the
suction supply to the LPSW system. Therefore, the pumps were
improperly classified. Independently, the licensee recognized
the error and was classifying the pumps as safety related in the
most current draft revision to the Quality Standards Manual.
Report Details
18
Unresolved item 50-269, 270, 287/93-13-03, "ECCW System Design
and Testing," already identified concerns regarding the licensing
basis of the CCW pumps.
(2) The only documentation discussing CCW NPSH requirements was a
letter from the pump vendor which stated that the pump "...will
operate satisfactorily at a low water condition of elevation 770
feet."
This letter did not address the temperature of the water
on which this judgement was made. The design temperature for the
CCW pumps at the time of this letter is given in Table 9-12 of
the original FSAR as 750F. Since then, the design maximum lake
temperature was raised to 850F by Calculation OSC-2568, Revision
0, July 24, 1987. Also, the letter did not discuss operation
below the 770 feet elevation, the top of the intake canal's
underwater weir, which would be the initial conditions for the
loss of Keowee Dam event. Subsequently, the intake canal level
would decrease due to leakage and evaporation. Finally, the
intake canal temperature would steadily increase due to decay
heat and other heat input from the three units.
Prior to and during the inspection the licensee was attempting to
acquir, the necessary information from the pump manufacturer.
Acquisition of the information is Inspector Follow-up Item 5-269,
270, 287/93-25-09, "CCW Pump NPSH Information." The lack of CCW
pump performance evaluation during the loss of Keowee Dam event
is another facet of the inadequate Keowee Dam failure analysis
discussed in paragraph d. below.
(3) The power and control cables for all of the CCW pumps and the
pump discharge valves as well as all of the piping for the HPSW
supply to the pump seals and coolers were located in a common
trench at the CCW structure. This trench was covered with heavy
steel deck plates which were not bolted in place. In response to
a seismic event the plates in the horizontal portions of the
trench would not dislodge due to stiffeners welded to the plates.
However, there were sections of the trench running at
approximately 450 from horizontal, and the plates covering these
sections could be dislodged by a seismic event potentially
damaging the cables below. The licensee was able to demonstrate
that only the cables in the upper cable tray (powering the Unit 3
CCW pumps), and the cables in the bottom of the trench (powering
and controlling the CCW pump discharge valves) could be damaged.
Due to armored sheathing on the cables, damage could not spread
to adjacent cables from the resultant electrical faults.
Although CCW pump performance could be degraded, the total CCW
function of supplying water to the LPSW system and the condensers
would not be lost. The licensee initiated a work request to bolt
the covers in place.
Report Details
19
c. Keowee Loss of Dam Event
Part of the licensing bases for Oconee involved the ability to
withstand a loss of Lake Keowee as an ultimate heat sink. Section
10.4 of the original FSAR, "Condenser Circulating Water System"
stated, "In the unlikely event that the water level in Lake Keowee
should fall below 770 feet, an underwater weir in the intake canal
would act as a dam capable of retaining a large amount of water [67
million gallons] to serve as an emergency cooling pond. By operator
action, the condenser circulating water system normal discharge paths
would be closed and an emergency discharge conduit, provided for this
contingency, would be opened, permitting cooling by recirculation of
the cooling pond water. The capacity of this cooling pond is adequate
to provide core decay heat cooling indefinitely as long as electric
power is available to run the condenser cooling pumps in the intake
structure."
Therefore, for the dam break event, the impounded intake
canal would become the plant's ultimate heat sink.
Numerous weaknesses in the licensee's ability to respond to the Keowee
Dam failure were identified as discussed below.
(1) The licensee did not have analyses demonstrating the "...capacity
of this cooling pond is adequate to provide core decay heat
cooling indefinitely..."
Such analyses should have addressed
the heatup rate, the water inventory losses due to leakage,
evaporation, etc., and the effects of the increased temperature
and the decreased water inventory on the CCW system and the
various systems being served. Therefore, the licensee failed to
demonstrate the ability of the intake canal to perform as the
ultimate heat sink as described in the FSAR.
10 CFR 50, Appendix B, Criterion III, "Design Control," requires
in part that measures shall be established to assure that design
bases are correctly translated into design documents and
procedures. This is considered an example of violation 50-269,
270, 287/93-25-03E, "Failure to Perform Adequate Calculations and
Evaluations to Support Facility Design."
(2) Case B of Abnormal Procedure AP/1/A/1700/13, "Loss of Condenser
Circulating Water Intake Canal/Dam Failure," described the
actions to be taken in the event of a failure of the Keowee Dam
without loss of the CCW intake canal.
In Step 5.5.1, the
operator was directed to align the LPSW system to recirculate the
water back to the CCW crossover header between the units from
which it also takes suction in order to conserve circulating
water inventory.
In this closed loop condition, the temperature of the system
would rise very rapidly to the point where its ability to perform
its decay heat removal safety function would significantly
Report-Details
20
degrade. The licensee had no analyses supporting operation in
this recirculation condition. Without such an analysis LPSW
system operation was inconsistent with system design
requirements.
10 CFR 50, Appendix B, Criterion III, "Design Control," requires
in part that measures shall be established to assure that design
bases are correctly translated into design documents and
procedures. This is considered an example of Violation 50-269,
270, 287/93-25-03F, "Failure to Perform Adequate Calculations and
Evaluations to Support Facility Design."
(3) Procedure AP/1/A/1700/13, Case B, "Dam Failure Without Loss of
Intake Canal", required the operator to actuate ECCW by pressing
the "CCW DAM FAILURE" pushbutton. This action tripped the CCW
pumps and opened the emergency discharge valve to the Keowee
tailrace, CCW-8, to establish the ECCW flow. Upon restoration of
power to the CCW pumps the operator was directed to start a CCW
pump, verify that CCW-8 closed, and verify the emergency
discharge to the CCW intake canal structure valve, CCW-9, opened.
However, as a consequence of the Keowee Dam failure valve CCW-8
would be submerged. Per Calculation FERC Project Number 2503
dated December 18, 1992, "Final Summary of Analysis to Determine
the Extent of Inundation Due to Catastrophic Dam Failure for
Keowee Hydro Project," for the dam failure event, the water level
at the valve would reach a maximum of 776 feet for the "sunny
day" failure and 785 feet for the "postulated maximum flood"
failure. Valve CCW-8 was located within the flooded area in a
concrete and steel enclosure. According to this calculation, the
valve would be submerged by as much as 55 feet, and 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />
would elapse before the water would recede below the valve. Even
with the receding water, the water, mud and debris trapped within
the enclosure could impact valve operation.
The licensee's analysis had not considered the consequences of
the dam failure affecting valve CCW-8. Subsequent licensee
review concluded that all operator actions associated with the
valve's cycling would be accomplished prior to the flood water
reaching the valve. However, the procedure and previous operator
training did not indicate that these actions were time dependent.
Also, the calculation establishing the time available for
operator action was not very precise. Therefore, the ability to
perform the necessary actions without such procedural
direction/training was questionable.
(4) Procedure AP/1/A/1700/13, "Loss of Condenser Circulating Water
Intake Canal/Dam Failure," had other weaknesses including:
Report Details
21
Pressing the "CCW DAM FAILURE" pushbutton without
considering CCW pump power availability in Case B. This
action tripped the CCW pumps and opened the emergency
discharge to the Keowee tailrace valve, CCW-8, to establish
the ECCW flow. However, tripping the CCW pumps with power
available was not necessarily the most appropriate action at
that time.
Not providing a caution to ensure a CCW pump was ready for
immediate restart prior to closing the CCW discharge valves.
Closure of the discharge valves would break the ECCW siphon.
Therefore, the CCW pumps must be immediately ready for
starting to maintain a viable decay heat removal path
through the condenser.
The licensee stated that procedure AP/1/A/1700/13 would be
reviewed to ensure procedural content was appropriate. Review
and revision of this procedure is considered part of Inspector
Follow-up Item, 50-269,270, 287/93-25-06B, "Actions to Improve
Operator Responses to Abnormal Events."
6. High Pressure Service Water System
The HPSW system was the site's fire protection system and constantly
supplied cooling and sealing water to the CCW pumps. The system was
capable of supplying cooling water to specific components normally cooled
by the LPSW system, such as the HPI pump motor coolers and the TDEFW pump
coolers. The system could also provide backup cooling to the Unit 1, 2,
and 3 LPSW systems, though at reduced capacity, through interconnections
at the discharge of the LPSW pumps.
The system was composed of three pumps, an elevated water storage tank
(EWST), and interconnecting piping to fire protection deluge valves
throughout the site and to the CCW pumps. The three HPSW pumps, two with
6000 gpm capacity each and one jockey pump, took suction from the 42 inch
CCW discharge header. The jockey pump was normally in service maintaining
HPSW system pressure. The other two pumps were in standby to
automatically makeup lost water inventory in the 100,000 gallon capacity
elevated storage tank.
HPSW must remain operational for the CCW system to accomplish its safety
related function of supplying water from the intake canal to the suction
of the LPSW pumps. The CCW system relied upon HPSW as a necessary support
system in both the siphon mode and CCW pump operating mode. The interface
between the CCW pumps and the CCW piping must be leaktight to prevent air
inleakage which would break the siphon. Seal water from HPSW performed
this function. Also, in order for the CCW pumps to operate, cooling water
must be supplied to pump motor bearing coolers. Cooling water from HPSW
performed this function. This sealing and cooling water was supplied by
the HPSW system normally through operation of the HPSW jockey pump, and
Report Details
22
during accident conditions involving a loss of power, from the elevated
water storage tank. The HPSW pumps also performed an accident mitigation
support function since EWST replenishment would be necessary to maintain
long term cooling and sealing flow to the CCW pumps.
The original NRC Safety Evaluation Report discussed the HPSW as a backup
to the LPSW system and "...concluded that the LPSW and HPSW systems will
provide all needed normal and emergency services and are acceptable."
Neither the SER nor the original FSAR discussed the HPSW support function
for the CCW system. In the more recent licensee SBO submittal and the
subsequent NRC SER, HPSW gravity flow cooling of CCW from the EWST for up
to four hours was assumed. Without continual gravity flow, air inleakage
would form voids requiring extensive fill and venting actions prior to CCW
pump restart. Therefore, to allow immediate pump restart after four
hours, the assumed duration of the SBO, HPSW gravity flow had to be
maintained.
Inspection findings associated with HPSW were:
a. The HPSW system was not classified, constructed, tested or maintained
commensurate with its importance to safety. This determination was
based upon:
(1) The HPSW system was not designated or constructed to the seismic
standards of the FSAR, but to conventional commercial fire
protection structural standards of the late 1960s.
Failure in
virtually any portion of the system in a loss-of-power event
would cause loss of CCW sealing and cooling water due to
diversion of flow out the faulted piping section depleting the
EWST water source. Consequently, through the loss of the siphon
or the CCW pumps, the LPSW and CCW decay heat removal
capabilities to all three units would be lost.
(2) The safety function of critical HPSW valves were not tested
following maintenance.
During a LOOP/LOCA, SBO or any LOOP, the HPSW pump check valves,
HPSW-2, 5, and 8, must not leak or the EWST inventory would drain
into the CCW suction header. Such leakage would directly impact
the duration of EWST cooling and sealing flow to the CCW pumps.
Maintenance records indicated that the only post maintenance
testing on these check valves was an external leakage observation
and did not include a reverse flow test. Normal system operation
would only indicate gross leakage of the main HPSW pumps' valves
and would not indicate any leakage of the jockey pump valve since
it operated continuously.
Report Details
23
Maintenance records for the last 13 years contained 5 work
requests associated with the check valves. Three involved the
HPSW jockey pump valve, HPSW-8. The first of these three was
written in 1982 to repair a seat leak on HPSW-8. Although the
original work request was lost, a replacement work request was
closed out on November 10, 1986, with a note to the effect that
the valve was checked out by Operations, and no problems were
found. However, on the next day, the second work request was
written to investigate and repair HPSW-8 because of indications
it was not seating. Under this work request, the disk was found
installed backwards and the disk nut and washer found to be
broken off. Since there were no replacement parts available, the
valve was reassembled and placed back into service on November
18, 1986, without a disk "...to enable [sic] the sys. to be
used."
Under the third work request, a replacement valve was
installed on January 23, 1987. Therefore, EWST cooling/sealing
capability to the CCW pumps was questionable for an extended
period of time. It also appeared that during the last two months
of this period, the inoperable status of this valve was
recognized by plant personnel without any compensatory measures
taken.
The other two work requests in the maintenance records were to
disassemble, inspect, and refurbish valves HPSW-5 and HPSW-2
respectively in 1990. A responsible Maintenance Supervisor was
asked if this work were being done today, would current
procedural requirements have specified post-maintenance back
leakage testing for these valves. He responded that it would not
have.
(3) Although the system performed a safety-related function, it was
not classified as safety-related in the licensee's safety
classification document, the Quality Standards Manual.
One of the ramifications of the lack of safety-related
designation was not including HPSW within the IST program.
Therefore, the stringent, periodic reverse flow testing of the
HPSW check valves was not required. Also, the HPSW system was
not included in much of the SWS GL actions since the GL was only
applicable to safety-related SWSs.
(4) CCW pump sealing flow indication was not properly maintained.
Consequently, operators may not be alerted to a low flow
condition jeopardizing siphon operation when required. Also, one
of the indications of inadequate motor bearing cooling flow was
not properly maintained.
Each of the 12 CCW pumps was instrumented with 2 rotameters. A
larger rotameter with a scribe mark was installed for sealing
flow and a smaller one without a scribe mark for cooling flow.
Report Details
24
These rotameters were input devices to low flow annunciators in
the control room. Also, operators took local rotameter readings
as part of their normal rounds.
Examples of improperly maintaining the rotameters were:
(a) The instrument procedure, IP/0/B/0261/004, used to calibrate
the low seal and cooling flow alarms, directed setting the
alarms nonconservatively with respect to the applicable
vendor information. The procedure directed setting the low
seal water alarm setpoint at 2.5 gpm + 0.5 gpm decreasing,
but the CCW pump vendor manual required a seal water flow of
3 to 5 gpm. The procedure directed setting the low bearing
cooling water alarm setpoint at 1.6 gpm + 0.2 gpm
decreasing, but the pump motor vendor drawing required a
bearing cooling water flow of 2.5 gpm.
Additionally, inconsistent with the rotameter's vendor
document, OM 267-0179, the procedure directed reading the
float from the bottom instead of from the scribe line on the
float or from the top if there was no scribe line.
(b) The material condition of some of the rotameters was poor.
Pump 2C's bearing cooler flow meter tube was installed
backwards with the scale in a difficult place to read.
Pumps 2A and 2D flow tubes, float, and guide rod for the
seal water flow meters were heavily coated with organic
contamination (slime).
This would tend to reduce the
accuracy of the instruments.
(c) The operator rounds sheet for taking local rotameter
readings contained no guidance on how to read the reference
marks. The Shift Manager was asked how the operators read
these gauges. He responded consistent with vendor guidance
on the larger rotameters with a scribe mark. However, he
stated that "It was the consensus of opinions of the
unlicensed operators that the float should be read to the
center of the cylindrical portion" for the smaller non
scribe mark types. As discussed earlier this was not the
correct reference point.
The seismic and safety classification concerns of the HPSW system were
encompassed in an outstanding unresolved item documented in NRC
inspection report 50-269, 270, 287/93-13. This unresolved item
concerned the licensing bases of the CCW pumps, the ECCW subsystem,
and their support systems. Resolution of this unresolved issue is
contingent upon further NRC review.
Report Details
25
b. Through various means (DBD effort, attempts to resolve outstanding
SITA issues on ECCW, and SBO submittal preparation) the licensee's
engineering organization recognized the safety significance of the
HPSW system. This was evident by the licensee's decision to evaluate
HPSW for seismic acceptability, adding the HPSW valves necessary for
CCW pump cooling and sealing to the most current draft revision of the
safety classification document and establishing a periodic disassembly
and inspection of the HPSW pump discharge check every fourth refueling
outage.
However, based upon interviews with operations and maintenance
personnel, this heightened safety emphasis on the HPSW system had yet
to be fully conveyed to the rest of the organization. Also, two of
the engineering actions associated with HPSW were not adequate or of
sufficient scope. The two actions are discussed below.
(1) In the licensee's most current draft revision to the Quality
Standards Manual, the safety classification document, some HPSW
components were included, but not the HPSW pumps or their
discharge check valves.
(2) The licensee recognized the lack of seismic qualification while
attempting to resolve ECCW siphon support system concerns during
design study ONDS 327 and PIP 92-084. The licensee concluded
that the HPSW system was structurally adequate because it was
"inherently rugged."
Inherently rugged was defined by the
licensee to mean that the system, in general, conformed to the
criteria in EPRI Report NP-5617, "Recommended Piping Seismic
Adequacy Criteria Based on Performance During and After
Earthquake," January 1988, which had yet to be endorsed or
accepted by the NRC. The licensee's evaluation criteria from the
EPRI report were:
A system walkdown has verified qualitatively that piping and
equipment in the system are adequately supported.
A system walkdown has verified that no large pipes are
restrained by small pipes.
A qualitative evaluation of the system has concluded that
corrosion does not threaten its structural integrity.
However, the licensee's evaluation failed to consider the
actuation of any of the fire deluge functions of the system due
to a seismic event, which would have the same effect as a pipe
break with regard to loss of water. Therefore, full
identification of the adverse condition and assurance of adequate
corrective action was not accomplished.
Report Details
26
Criterion XVI, "Corrective Actions," requires conditions adverse
to quality be promptly identified and corrected. This is
considered an example of violation 50-269, 270, 287/93-25-04B,
"Inadequate Evaluation of Conditions Adverse to Quality by
Engineering."
Also, The licensee's evaluation involved these weaknesses:
The determination of adequate support was of a qualitative
nature. The team observed some of the HPSW piping at the
CCW intake structure to be supported by simple threaded rod
hangers at relatively long intervals, and the hangers were
attached to the concrete by simple expansion bolts.
The conclusion by the licensee that corrosion did not
threaten the structural integrity of the system was inferred
from observations made in the similar LPSW system, and can
be challenged by direct evidence of corrosion deterioration
in the HPSW system. Although through wall leakage had not
been observed, excessive flow restriction in the small bore
HPSW piping to the CCW pumps caused the piping material to
be upgraded to stainless steel in Exempt Change OE 4625.
The licensee's safety evaluation for this change stated,
"Recently failures have occurred in the small diameter
piping, showing that the corrosion has reached the condition
of causing us to question the integrity of the pipe."
Also,
though it did not render the system inoperable, corrosion
had been identified in the LPSW system.
Only the portion of the system from the HPSW water source to
the CCW pumps was included in the walkdown.
The seismic and safety classification concerns of the HPSW system
were encompassed in an outstanding unresolved item documented in
NRC inspection report, 50-269, 270, 287/93-13. This unresolved
item centered around the licensing bases of the CCW pumps, the
ECCW subsystem, and their support systems. The lack of seismic
qualification for the HPSW system was specifically discussed in
the report.
The concept of "inherently rugged" as an acceptable
substitute for seismic qualification is another aspect of this
unresolved issue. Resolution of this unresolved issue is
contingent upon further NRC review.
c. There were numerous weaknesses in the management controls that assured
the HPSW system was capable of performing as indicated in the
licensee's SBO submittal.
Report Details
27
The SBO submittal discussed gravity flow cooling of the CCW pumps from
the EWST for up to four hours so the CCW pumps could be restarted
immediately upon restoration of offsite power. Without continual
gravity flow, air inleakage would form voids requiring extensive fill
and venting actions prior to starting the CCW pumps.
The management control weakness are discussed below.
(1) The ability to perform cooling via the EWST to the CCW pumps and
other necessary equipment for four hours was tested annually
using test procedure PT/0/A/250/38, "Elevated Water Storage Tank
Drain Test."
Per Section 8.2 of the procedure and the design
specification for HPSW, OSS-0254.00-00-1002, the normal level of
the EWST was 90,000 gallons or greater. Per Enclosure 13.3 of
the procedure, Step 5.0, the capacity of the tank in minutes was
calculated by dividing the EWST level at the beginning of the
test by the adjusted HPSW outleakage flow rate. The result must
be greater than 240 minutes (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) to be acceptable. However,
using the level at the beginning of the test for the calculation
rather than the minimum full level of 90,000 gallons, only
verified that the tank had sufficient capacity at that particular
time, not for any other time when the level may be lower but
still in the normal range above the "full" 90,000 gallons level.
For the last six tests (March 21, 1987-August 7, 1993) the tank
level varied between 87,500 gallons and 99,100 gallons.
Therefore, the procedure failed to establish the appropriate
initial test conditions. The licensee's submittal of January 26,
1990, states that adequate test procedures will be established to
ensure system performance during a SBO.
This is Deviation 50
269, 270, 287/93-25-10, "Inadequate HPSW SBO Test."
(2) The EWST drain test procedure had additional problems including:
0
It allowed test re-performance if the original test failed
due to HPSW discharge check valve leakage. Prior to test
re-performance the procedure directed the applicable pump be
isolated (closing its discharge valve) thus isolating the
leaking check valve.
Following completion of this second
test, the isolated pump could be returned to service with an
annotation on the operator turnover sheets to isolate the
applicable pump on a loss of power event to prevent
excessive losses of the EWST.
This method of assuring EWST cooling capability by isolating
the pump was not directed by emergency procedures, did not
provide for verification of the completed action and could
be forgotten or overlooked due to the numerous other tasks
associated with a LOOP or SBO event. Also, assuming the
operator action was performed, there was no provision in the
test's acceptance criteria to account for the EWST inventory
Report Details
28
lost through the leaking check valve prior to isolating the
pump. Therefore, the procedure allowed an equipment
deficiency that directly affected the test's acceptance
criteria to be excluded without proper compensation.
It directed the user to inform the operating manager for
leakage rates greater than 500 gpm, rather than the maximum
acceptable leakage rate of 375 gpm. Also, there was no
direction as to what action the operating manager was to
take upon being notified of the excessive flowrate. In an
interview with an operating manager, he did not know what
the appropriate response would be.
(3) For over seven months, the four hour gravity feed capability
lacked validation. On February 27, 1993, PT/O/A/250/3 was
performed and the system failed to meet the 240 minute acceptance
criteria by 45 minutes. Subsequently, the licensee recognized
that the procedure did not account for several water loss points
from the system which automatically isolate for a loss-of-power
event. The procedure was revised to account for these inventory
losses on April 27, 1993. However, even when accounting for
these losses, the test on February 27, 1993, would not have met
the acceptance criteria. On August 7, 1993, the test was
successfully re-performed. The team could not ascertain what
(system maintenance, improper recording of data, change in
equipment performance, etc.) caused the difference between the
adjusted test results of February 27th and August 7th test
results. The licensee was unable to provide any insights.
(4) Five of the CCW seal water rotameters and all of the bearing
cooling water flows (3A's was solid against the upper stop at 8+
gpm) were greater than the values used to calculate the four hour
availability of the EWST. Also, the operator rounds
sheets
contained no upper limit for these flows.
7. Standby Shutdown Facility
The SSF was a separate onsite building housing the necessary equipment to
maintain all three units in a safe shutdown condition following turbine
building flood, fire, sabotage, certain classes of tornados or station
blackout. The SWS portion of the SSF was composed of a high head, low
capacity pump and interconnecting piping to all steam generator EFW
discharge lines, solenoid operated flow control valves in the discharge
lines to the steam generators, a pump and piping to cool a tandem diesel
with a common generator, two pumps with a condenser unit to cool the HVAC
within the SSF and a moveable submersible pump. The SSF ASW, HVAC and EDG
pumps took suction from the Unit 2's CCW pumps discharge header. The HVAC
Report Details
29
and EDG pumps discharged to the CCW header. There was an option to divert
the EDG pump discharge water to the yard drainage system when high
temperature constraints warranted. The submersible pump allowed
replenishment of the CCW header from the intake canal.
a. Jocassee Dam Failure
In the licensee's IPE submittal for an event outside the facility's
licensing bases, the SSF was discussed as the system to mitigate the
consequences of a Jocassee Dam failure. This dam was located upstream
of the Oconee site and formed the uppermost boundary of Lake Keowee.
The IPE flood evaluation concluded that the Oconee site would be under
4.71 feet of water. With the exception of the SSF, this would render
all decay heat removal cooling systems inoperable. To assure the SSF
would not be affected by the flood, a 5-foot (4.71-foot plus
0.29-foot) high waterproof flood wall was constructed around the
ground level entrances to the SSF. The review of the SSF to withstand
this postulated flood was as follows:
(1) Contrary to the IPE submittal, the SSF could not withstand the
postulated flood. Therefore, core damage of all reactor units
would occur as a consequence of such a postulated flood.
In response to questions from the team regarding initial lake
height assumptions, the licensee stated that a recently completed
reanalysis of the Jocassee Dam failure for another regulatory
agency resulted in a flood height at least 10 feet above the SSF
wall.
The change in flood height was due to modeling a bridge
abutment downstream of the Keowee tailrace in the most recent
flood analysis. The abutment acted as a flow constriction
causing the flood waters to backup over the Oconee site. From a
PRA perspective the probability of core melt from the Jocassee
Dam failure as calculated by the team increased ten fold to
1.58E-05.
Licensee correction of the this error and subsequent corrective
actions as a result of the error are considered a part of
Inspector Follow-up Item 50-269, 270, 287/93-25-11A, "Jocassee
Dam Failure IPE Inaccuracies."
(2) Another aspect of the IPE submittal was in error. IPE Submittal
report, Section 3, Subsection 13, indicated there was an 8-foot
waterproof flood wall around the SSF ground level entrances. The
wall was 5-foot in height.
Licensee correction of the this error and subsequent corrective
actions as a result of the error is considered a part of
Inspector Follow-up Item 50-269, 270, 287/93-25-11B, "Jocassee
Dam Failure IPE Inaccuracies."
Report Details
30
(3) A watertight gate was installed in the flood wall to allow access
to and from the SSF. The gate was observed on more than one
occasion with the watertight dogs not properly secured.
b. SSF Calculations
(1) Following plant modifications performed in previous years, some
of the applicable calculations were not updated. Examples
included:
OSC-2030, Standby Shutdown Facility HVAC Load Calculations
The calculation conclusion section stated:
"The SSF Air Conditioning System can maintain design
conditions in the safety related areas (Control Room and
Battery Rooms) with the following actions:
(A) Start second condenser circulating water pump to
provide 41 GPM condenser water flow with both pumps
operating.
(B) Shed security computer load by the time control room
temperature reaches 85 F or temperature of condenser
water reaches approximately 93 F."
However, an electrical interlock had been installed
preventing simultaneous operation of the two condenser
circulating water pumps. The condenser circulating water
pumps were of different sizes, and their simultaneous
operation would cause flow instability and eventual pump
runout.
This interlock could not be bypassed. Also, the
SSF HVAC system had been modified excluding portions of the
security complex and portions of the HVAC had been rerouted.
Prior to the conclusion of the inspection the licensee re
performed the HVAC calculation with acceptable results. The
design document had not reflected the as-built condition of
the facility at the time of the inspection.
OSC-3233, SSF Service Water System Hydraulic Model
The last revision of the model was January 23, 1989. Since
then, the HVAC pump motors had been changed from 1750 rpm to
3600 rpm motors, pressure breakdown orifices had been
installed, the 3 way valves located upstream of the SSF HVAC
condensers had been replaced, and the SSF ASW impellers had
been changed twice. Other calculations were performed which
Report Details
31
partially encompassed the changes to the hydraulic model
but, did not reconcile those results with the total
hydraulic model.
Therefore, this design document did not
reflect the as-built condition of the facility.
The administrative controls for updating calculations, EDM-101,
Engineering Calculations/Analysis, Section 2.4.4 only required
these calculations be updated in a timely manner, rather than
establishing a definitive length of time.
Criterion V, "Instructions, Procedures, and Drawings," require
appropriate acceptance criteria for determining that quality
related activities have been satisfactorily accomplished. This
is an example of Violation 50-269, 270, 287/93-25-12A, "SWS
Procedure/ Drawing Content or Procedure Implementation
Inadequacies."
(2) Calculation OSC-4171, "SSF ASW Pump Minimum Flow Line Design
Inputs Calculation," contained invalidated or nonconservative
assumptions as follows:
Each unit or steam generator pair had only one flow
instrument associated with it. Calculation OSC-3303, "SSF
ASW Flow and SSF ASW Pump Suction Pressure, Instrument
Accuracy Calculation: CCW FT0225," determined the
methodology for calculating the instrument loop error for
the flow instruments. The result was +/- 54 gpm for an
individual flow instrument. The three flow instruments
errors were averaged through the square root sum of the
squares method resulting in an error of +/- 31 gpm. The
instrument error used in calculation OSC-4171 was +/- 31
gpm.
However, if just one of the flow instruments were at or near
it's negative maximum error that particular unit's minimum
required flow would be inadequate. According to accepted
industry methodology, the square root sum of the squares
methodology is used to combine dependent and independent
variables to calculate loop uncertainties. In this instance
the methodology was misapplied, in that it was used to
reduce an individual error contribution and not calculated
loop uncertainties. The use of this nonconservative
assumption resulted in a flow to a pair of steam generators
that was 23 gpm below the minimum analyzed flow. During the
inspection period the licensee indicated that a calculation
was being prepared that would lower the minimum required
flows such that the 23 gpm difference would not invalidate
the conclusion of OSC-4171. However, the calculation was
not ready for NRC review. 10 CFR 50, Criterion III, "Design
Control," requires the design basis and applicable
regulatory requirements be translated into appropriate
Report Details
32
documents. This is considered an example of Violation 50
269, 270, 287/93-25-03G, "Failure to Perform Adequate
Calculations and Evaluations to Support Facility Design."
Calculation OSC-4171 assumed the flows were equally balanced
between all six generators. That assumption had never been
validated.
Calculation OSC-4171 and numerous other calculations assumed
certain flow distributions among the three SWS operating
pumps (SSF ASW, HVAC, and EDG cooling water pump). Also,
the discharge flow of the operating HVAC pump was assumed to
equally split between the two parallel SSF HVAC condenser
coolers. These two assumptions had not been validated.
c. SSF Testing
(1) Post-construction Testing
Post-construction SSF testing in the mid-1980s did not adequately
confirm critical functional requirements of the SSF design and
was not performed in accordance with committed quality standards.
Examples included:
(a) The flushing procedure provided by the licensee for the
discharge lines was a gravity fill and drain from HPSW prior
to the piping being connected at the SSF ASW pump discharge
or in the penetration rooms. There was no acceptability
criteria for the flush in the procedure. This fill and
drain did not provide assurance that the lines were not
blocked or partially restricted.
(b) The calculations supporting SSF design assumed certain
flowrates and flow distributions to the steam generators.
No documentation existed validating that flow could be
achieved to any of the steam generators. The licensee
verbally confirmed that there was no flow testing performed
which involved the discharge lines beyond the test line
connection. Therefore, flow control valve capabilities were
not verified, and assumptions associated with equalizing
flow to units and steam generator pairs were not verified.
(c) The calculations supporting SSF design assumed certain flow
distributions among the three SWS operating pumps (SSF ASW,
HVAC and EDG cooling water pump). The three pumps were not
tested simultaneously to confirm the assumed flow
distributions and that the equipment would perform as
predicted.
Report Details
33
The preoperational testing portion of ANSI N45.2.8-1975,
Section 5.2, dealing with assurance of operation in
accordance with SSF design and proper flow alignments was
also applicable to this aspect of the facility's design.
10 CFR 50, Appendix B, Criterion XI, "Test Control," requires a
preoperational testing program demonstrating facility
acceptability to the design requirements. Also, the licensee was
committed to ANSI N45.2.8-1975 and ANSI N45.2.1-1973 through Duke
Power Company Topical Report 1-A, Table 17.0-1. ANSI N45.2.8
1975Property "ANSI code" (as page type) with input value "ANSI N45.2.8</br></br>1975" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process. and ANSI N45.2.1-1973 requires in part that flushing
procedures with velocities and acceptance criteria based on
filter, turbidimetric or chemical analyses. The preoperational
testing portion of ANSI N45.2.8-1975, Section 5.2, states in part
"This testing involves the operation of all items in a system ...
to assure that operation is in accordance with the design
criteria and functional requirements. The testing shall include,
but not be limited to, ... service requirements for initial
operation such as flow alignments ... " Therefore, critical
aspects of the SSF's design were not demonstrated prior to
placing the facility into service. This is an example of
Violation 50-269, 270, 287/93-25-088, "Inadequate SSF and ECCW
Testing."
(2) Periodic Testing
(a) The periodic testing program for the SSF was accomplished
through component specific testing. There were specific
tests for the SSF ASW pump, HVAC pump, etc., which were
performed at different test intervals. The periodic SSF ASW
pump test discharged through a test line connection and not
through the full extent of the steam generator discharge
lines. Therefore, the deficiencies of the post-construction
testing previously discussed in paragraph c.1 above were not
rectified by the periodic test program.
b. Beyond the post-construction testing deficiencies discussed
in paragraph c.1, the sum of the component specific periodic
testing did not constitute an integrated test. Certain
aspects of system design could only be provided by the
licensee through the completion of actions during emergency
response drills. An example of this was the unwinding and
connecting of the submersible pump's electrical cable to its
emergency bus and operating the pump. These actions were
not part of any periodic test program and had only been
accomplished once during an emergency response drill.
c. Emergency Procedure AP/O/A/1700/25, Standby Shutdown
Facility Emergency Operating Procedure, Enclosure 6.1, Step
2.5 and 2.12 instructed the operator to start the SSF ASW
Report Details
34
Pump with no preparatory action beyond aligning a flow path
to the designated unit. The periodic pump operability test,
PT/O/A/0400/05, directed an additional action of pump
venting in Step 12.2 just prior to starting the pump in Step
12.4. This action preconditioned the pump, possibly masking
air entrapment within the pump which would affect pump
performance.
10 CFR 50, Appendix B, Criterion XI, "Test
Control," requires test procedures direct the establishment
of suitable environmental conditions when performing the
test. This is considered an example of Violation 50-269,
270, 287/93-25-08C, "Inadequate SSF and ECCW Testing."
d. Other Observations
(1) There were few material condition deficiencies observed.
Preventive and corrective maintenance was effective. Repetitive
corrective maintenance actions were not evident. Most work
requests were completed in one to three months.
(2) Operator training met normal industry standards and emphasized
strict adherence to procedures. The information supplied by
training matched the information in the procedure.
8. Auxiliary Service Water System
ASW was originally designed for a non-design bases event, the loss of the
intake canal/structure. However, following NUREG 0737 review of the
facility for tornado vulnerabilities, the system was discussed in the July
28, 1989, NRC Safety Evaluation Report to mitigate the consequences of the
most severe classes of tornadoes.
For these severe tornados the ASW
system in conjunction with the HPI system were required to maintain the
units in a safe shutdown condition by providing adequate decay heat
removal via the steam generators and RCS makeup.
ASW was a shared system common to all three units. It consisted of a
suction connection at the Unit 2 CCW pump discharge piping, a low head,
high capacity pump, piping with manual valves connected to the EWF
discharge piping of all three units for cooling all the steam generators,
and piping with manual valves connected to the LPSW piping for cooling the
HPI pump motor coolers. The ASW pump was operated from the tornado
protected, safety related AuxService Water Switchgear.
The only other actions necessary in the severe tornado event was operation
of the HPI pump. Since normal HPI pump power was not tornado protected,
one HPI pump motor per unit could be manually connected to the AuxService
Water Switchgear through spare power cables staged for this purpose.
Inspection findings associated with the ASW system were:
a. Emergency Procedure EP/1,2,3/A/1800/01, Section 502, Step 10.1
Report Details
35
required approximately 200 gpm be provided to each steam generator by
the ASW pump. The step further stated that if one steam generator was
isolated, flow should be increased to approximately 400 gpm to the un
isolated steam generator. The ASW discharge lines or the
interconnection with the EFW system to the steam generators did not
contain any flow instruments. Therefore, there was no way to verify
the directed actions had been accomplished.
Criterion V, "Instructions, Procedures and Drawings," requires
adequate written procedures be provided for activities affecting
quality. This is an example of Violation 50-269, 270, 287/93-25-12B,
"SWS Procedure/Drawing Content or Procedure Implementation
Inadequacies."
b. To support the licensee submittal that ultimately led to the tornado
SER, Calculation OSC-2262, Tornado Protection Analysis, was generated.
The calculation indicated that ASW system operation must be
accomplished in about 40 minutes to prevent core uncovery.
(1) Job performance measures existed for the alignment of ASW to the
steam generators, alignment of ASW to the HPI pump motor coolers,
and establishment of electrical power to a HPI pump motor.
Documentation indicated that the tasks could be accomplished in
approximately 30 minutes after the operators recognized the need
for ASW. No integrated drill/test verifying that all the tasks
could be accomplished within the requisite time had been
performed.
(2) There was no abnormal procedure specifically for a tornado event.
Entrance into the emergency operating procedures for inadequate
secondary side heat transfer would eventually direct use of the
ASW system. These procedures attempted to establish normal
feedwater, emergency feedwater, and SSF service water prior to
initiation of ASW. However, there was only 10 minutes available
for the operator to direct initiation of ASW in lieu of these
other systems (10 minutes to decide to use ASW + 30 minutes to
initiate ASW from training documentation = 40 minutes before core
uncovery).
The procedure provided the system options, but system
selection was based on operator judgement depending upon the
extent of the tornado damage. No test or drill had been devised
confirming the operator's ability to make this judgement within
the 10 minutes available.
(3) Other procedures associated with flow through the EFW header to
the steam generators included a caution to limit flow to less
than 1000 gpm to reduce tube vibration. Procedures associated
with ASW operation did not contain such cautions and the
hydraulic model indicated that flow to the Unit 3 steam
generators would exceed 1000 gpm in certain conditions. The
licensee indicated that flows of this magnitude would be for a
short period and the tube integrity concerns due to vibration
Report Details
36
were only a factor in extended operation. However, the licensee
decided to review this item and determine if procedural guidance
should be included.
Licensee initiatives to improve operator guidance for response to a
severe tornado are considered a part of Inspector Follow-up Item, 50
269,270, 287/93-25-06C, "Actions to Improve Operator Responses to
Abnormal Events."
c. Certain equipment associated with the ASW system were not included
within a periodic testing program. However, licensee actions
associated with the DBD effort identified the situation and
appropriate corrective actions were being taken. Examples included:
Cooling water flow to the HPI pump motors had never been
established using the ASW system. However, a test procedure was
being developed to establish and verify flow to the HPI motor
coolers.
Certain check valves within the LPSW system which must close to
establish HPI flow were not tested in the closed direction per
the IST program. This lack of reverse flow check valve testing
had been previously identified by the licensee. Corrective
actions were in progress to revise the IST program and develop
testing procedures for the valves. This is Violation 50-269, 270
287/93-25-13, "Omissions of LPSW Check Valves from IST Program."
However, based upon the corrective actions in progress, the
licensee's self identification of the matter, no similar
violations associated with omissions in the IST program, the lack
of willfulness, and the nonescalated enforcement nature of the
violation, this is considered a non-cited violation authorized
under 10 CFR 2, Appendix C, Section VII.B.2.
The discharge check valves to the steam generators were being
incorporated into a test/inspection program for the first time.
d. Some of the calculations associated with the ASW system lacked rigor.
Examples included:
(1) Calculation OSC-4989, Auxiliary Service Water Flow Model, did not
model cooling water flow to the HPI pump motors. The licensee
performed preliminary calculations indicating flow would be
sufficient. Also, complete bench marking of the ASW hydraulic
flow model had not been performed.
(2) In the formal ASW pump NPSH analysis and in a subsequent informal
analysis the licensee used incorrect assumptions. These were:
Report Details
37
(a) Calculation OSC-5125, ASW NPSH Analysis, assumed siphon flow
from the intake canal to the ASW pump suction would be in
operation following the tornado. Consequently, an
administrative minimum level, 780', associated with Lake
Keowee was selected as the minimum suction height for the
NPSH calculation. However, the ECCW siphon lacked tornado
protection, and would not be operational. Therefore, the
minimum suction height was contingent upon the inventory
losses in the CCW piping as a result of ASW pump operation.
(b) Once the incorrect assumption was identified to the
licensee, the licensee re-evaluated the situation and
determined the minimum NPSH for the ASW pump was -2.22 psig
and NPSH considerations did not restrict pump operation. A
required NPSH of -2.22 psig meant that the pump could draw
water from 5.12 feet below the pump's impeller eye and still
have adequate NPSH. However, the licensee failed to
consider the actual configuration of the CCW piping going to
the suction of the ASW pump. Therefore, when the water in
the CCW piping dropped to a height of 770.46 feet,
inadequate NPSH would occur.
Subsequently, the licensee performed preliminary calculations of
the water volume between 791 feet, the assumed initial suction
height of the calculation, and 770.46 feet. Results indicated
that a substantial amount of water inventory still existed
allowing ASW operation for an extended period. Therefore, the
assumed replenishment of the ASW supply source before reaching
770.46 feet appeared reasonable. Issuance of a revised
calculation is considered an Inspector Follow-up Item 50-269,
270,287/93-25-14, "Review of Revised ASW Pump NPSH Calculation."
(3) Abnormal Procedure AP/1,2,3/A/1700/11, Loss of Power, Enclosure
6.3, Aux Service Water to HPI Pump Motor Coolers, required the
recirculation test line valve, CCW-247, be opened approximately 2
turns prior to starting the ASW pump. This flow path through the
test line was also the minimum flow pathway to prevent
deadheading the pump. No data or calculations existed showing
that enough flow could be achieved with CCW-247 throttled to
protect the pump. Subsequently, the licensee performed
preliminary calculations indicating a flow between 400 and 450
gpm could be achieved with valve CCW-227 in the throttled
position. The 400 gpm flow appeared acceptable for minimum flow
protection. However, the licensee decided to completely open
CCW-247, fully assuring minimum flow protection, prior to
starting the ASW pump.
Report Details
38
9. Keowee Hydroelectric Station
Lake Keowee was the motive and cooling source for the two hydroelectric
generators which functioned as Oconee's onsite emergency power. Water
flowed from a common penstock, through the turbines and into the tailrace.
Cooling flow came from a single pipe located in the penstock. Once the
line entered the building housing the hydroelectric units it split into
two lines, one for each unit. Cooling flow for the turbine bearing oil
cooler, the stuffing box, eight thrust bearing heat exchangers and six
generator air coolers came from the unit specific main line.
Inspections findings associated with Keowee were:
a. Corrective Actions
Previous NRC inspections identified that numerous aspects of the
quality assurance program had been omitted from Keowee. In response
to NRC observations the licensee established an integrated corrective
action plan entitled the "Emergency Power Management Plan."
Prior to
the management plan, the licensee had initiated design study ONDS 258
to correct design document deficiencies at Keowee. ONDS 258 was not
part of the committed Emergency Power Management Plan.
(1) Under the design study the licensee revised the Keowee Turbine
Generator Cooling Water System drawings, KFD-100A-1.1 and KFD
100A-2.1. However, errors were still present on the drawings
including an inconsistent piping class break in the supply line
to the thrust bearing coolers, the connection of the supply line
to the air compressor coolers on Unit 1 was indicated in the 12
inch portion of the main line instead of the 8" portion, a valve
downstream of valve 2WL-3 for Unit 2 was not indicated even
though one was present, and the piping downstream of WL 76 in
both units was indicated as carbon steel instead of copper.
Subsequently, the licensee initiated a condition adverse to
quality report to correct drawing errors. 10 CFR 50, Appendix B,
Criterion V, "Procedures, Drawings, and Instructions," requires
in part that drawings reflect the as-built condition of the
facility. This is considered an example of Violation 50-269,
270, 287/93-25-12C, "SWS Procedure/Drawing Content or Procedure
Implementation Inadequacies."
(2) Numerous errors existed in the I&C portion of drawings KFD-100A
1.1 and KFD-100A-2.1 and other related I&C drawings. The I&C
drawing update portion of the design study was in progress and
the licensee had already identified these same discrepancies for
resolution. It was noted that the I&C drawing update portion of
design study had not been met. As stated previously, the design
study was not part of the committed Emergency Power Management
Plan. Also, there was no definitive mechanism to assure the I&C
drawings (part of the design study) were correct prior to
Report Details
39
transferring instrument calibration responsibilities from the
Keowee staff to the Oconee staff (part of the Emergency Power
Management Plan).
Prior to the end of the inspection period the
two organizations involved discussed the situation and the
licensee indicated that the appropriate integration would occur.
(3) Although the valve positions observed at Keowee were -consistent
with design requirements, no operating procedures existed for the
mechanical systems reviewed. Therefore, no specific procedural
controls existed for the throttled, manual valves in the
generator air and thrust bearing discharge lines. The Keowee
staff was aware of this deficiency and planned to generate
procedures in the future. Also, the safety significance of this
situation was reduced since these valves were locked throttled
and rarely manipulated. However, the creation of these
procedures was not identified as a corrective action under the
management plan or the design study.
b. Turbine Bearing Oil Cooler Maintenance
During the inspection period, the licensee removed the Unit 2 safety
related turbine bearing oil cooler from service to perform the
triennial cleaning and inspection. While reinstalling the cooler, a
coupling was broken and required replacement prior to completing the
installation. Subsequently, a condition adverse to quality report was
initiated.
(1) As part of the response to the adverse condition report,
engineering personnel discussed Unit operability without the
turbine bearing oil cooler installed. Engineering personnel
verbally determined that the cooler was only needed during
extended high ambient temperature conditions (the summer) and
unit operability was not effected. However, Nuclear Generation
Department Directive 2.8.1, "Problem Investigation Process," step
3.4 directed that adverse conditions requiring engineering
assistance be processed as an upper tier adverse quality report
which receive a written operability evaluation. Subsequently,
the cooler was reinstalled in the unit for emergency operation
and PIP 93-0994 initiated for not performing the written
operability evaluation.
10 CFR 50, Appendix B, Criterion V,
"Drawings, Procedures and Instructions,"
requires in part that
established procedures be followed. This is considered an
example of Violation 50-269, 270, 287/93-25-12D, "SWS Procedure/
Drawing Content or Procedure Implementation Inadequacies."
(2) The work request for oil cooler maintenance specified
housekeeping zone 4 for the cleanliness requirements. However,
Oconee Nuclear Site Directive 1.4.1, "Cleanliness in Safety
Related Areas," Section 3.1, stated the highest level zone
designation allowed for safety related equipment was 3. The
Report Details
40
difference between level 3 and 4 was zone 4 lacked personnel and
tool accountability. A review of numerous completed safety
related work requests on other equipment revealed that zone 4 was
routinely designated. Contrary to the 10 CFR 50, Appendix B,
Criterion V, "Instructions, Procedures and Drawings,"
requirements for procedure adherence, the licensee did not
designate the correct housekeeping zones on safety related work
requests. This is an example of Violation 50-269, 270, 287/93-25
12E, "SWS Procedure/Drawing Content or Procedure Implementation
Inadequacies."
c. Other Observations
(1) The scope of the calibration program was weak. Annunciator
actuation was not verified in any of the calibration procedures
reviewed and the licensee stated that this was generally the case
with all calibration procedures at Keowee. Generator and thrust
bearing cooling flow setpoints and the associated timers were not
checked. The transmitter for the packing box's local pressure
indicator was not being calibrated. The licensee indicated that
these procedures would be reviewed for improvement. However, the
description of the instruments being calibrated and how they
affected system operation in individual calibration procedures
was complete, accurate and well written.
(2) Historically, the mechanical systems at Keowee performed well.
Little corrective maintenance was needed. Preventative
maintenance was appropriate and consistent with operating
experience and vendor manual recommendations where applicable.
The hydroelectric station was operated almost daily. The daily
operation functioned as a performance test in many respects and
placed much of the mechanical systems under no worse conditions
than would be experienced when operating as an emergency power
source. However, no equipment performance trending, especially
of the safety related heat exchangers, was being performed.
(3) One common mode failure vulnerability was identified. Within the
common stretch of piping for cooling both units' mechanical
support systems was a manual gate valve.
Prior to the end of
this inspection the licensee locked the valve open.
(4) Minimal housekeeping and material condition discrepancies were
observed. Personnel were knowledgeable of their safety-related
duties.
10. Miscellaneous Matters
Findings not tied to a particular system were:
Report Details
41
a. The DBD concept and the associated testing acceptance criteria was a
good initiative by the licensee. Generally, the DBDs provided the
best description of the system, the system's function, the licensee's
understanding of the licensing bases and the design requirements.
There were, however, some implementation weaknesses resulting in
errors and discrepancies in the DBDs. Also, the licensee partially
attributed the lack of reconciliation and failure to update the SSF
calculations to the lack of a completed DBD for the SSF.
b. There were FSAR omissions which could have clarified and more
completely explained the actual design parameters for select
components. An example was the flow to the RBCUs which the FSAR
discussed as 1400 gpm whereas, certain testing configurations only
exhibited 800 gpm flow and the system was considered as performing its
design function.
c. Offsite review committee minutes contained the proper content,
indicated that a proper quorum was present and met within the required
frequency. Resumes indicated that personnel qualification
requirements were met. Committee performance was consistent with
regulatory requirements.
d. Design calculation OSC-3528, Establish an Administrative Minimum Lake
Level for Keowee, contained unsubstantiated and nonconservative
assumptions, and a variety of other calculational irregularities. The
licensee indicated that the calculation was a theoretical "look see"
calculation and the title was misleading. There were no other
calculations associated with minimum Lake Keowee water volume.
Further licensee initiatives to perform an actual analytical
calculation to establish a minimum Lake Keowee level to assure
adequate water volume is maintained is Inspector Follow-up Item
50-269, 270, 287/93-25-15, "Administrative Controls for Lake Keowee."
11. Follow-up on Previously Identified Items
(Open) Unresolved Item 50-279, 270, 287/93-13-03, "ECCW System Design and
Testing":
Sections 5.a.3, 5.a.7, 5.b.1, 6.a., and 6.b.2 discussed
different aspects of this matter. However, further NRC review is
necessary to ensure any regulatory action taken is consistent with the
original licensing requirements.
12. Exit Interview
The team conducted an exit meeting on December 14, 1993, at the Oconee
Nuclear Power SLation to discuss the major areas reviewed during the
inspection, the strengths and weaknesses observed, and the inspection
results.
Licensee representatives and NRC personnel attending this exit
meeting are documented in Appendix A of this report. The team also
discussed the likely informational content of the inspection report. The
licensee did not identify any documents or processes as proprietary.
Report Details
42
There were dissenting comments at the exit meeting associated with
recommended regulatory action concerning the inadequate NPSH conditions in
the LPSW pumps and the possible regulatory action involving the lack of
dual turbine building isolation in the LPSW system. The licensee
indicated a thorough review of the inspection findings would be necessary
to ascertain the appropriate responses or corrective actions to the issues
identified. Also, on February 3, 1994, NRC management discussed the
unresolved LPSW turbine building isolation issue with the licensee via
telephone.
ITEM NUMBER
STATUS
PARAGRAPH
DESCRIPTION
93-25-01
Open
3
DEV - Failure to Adequately
Perform SWS GL Actions
93-25-02
Open
4.a.1
UNR - Turbine Building
Isolation Single Failure
Vulnerabilities
93-25-03
Open
4.b.1,
VIO - Failure to Perform
4.e,
Adequate Calculations and
5.a.4,
Evaluations to Support
5.c.1,
Facility Design
5.c.2,
7.b.2
93-25-04
Open
4.c.3,
VIO - Inadequate
6.b.2
Evaluation of Conditions
Adverse to Quality by
Engineering
93-25-05
Open
4.d
IFI - Additional Validation of
RBCU Evaluation Inputs
93-25-06
Open
4.f.2,
IFI - Actions to Improve
5.c.3,
Operator Responses to
8.b.3
Abnormal Events
93-25-07
Closed
5.a.1
NCV - Inadequate
Classification of Siphon
Support Equipment for LPSW
Supply
93-25-08
Closed
5.a.5,
VIO - Inadequate SSF and
7.c.1.c,
ECCW Testing
7.c.2.c
93-25-09
Open
5.b.2
IFI -
Information
Report Details
43
93-25-10
Open
6.c.1
DEV - Inadequate HPSW SBO Test
93-25-11
Open
7.a.1,
IFI - Jocassee Dam
7.a.2
Failure IPE Inaccuracies
93-25-12
Open
7.b.1,
8.a
Procedure/Drawing Content or
Procedure Implementation
Inadequacies
93-25-13
Closed
8.c
Valves from IST Program
93-25-14
Open
8.d.2
IFI - Review of Revised ASW
Pump NPSH Calculation
93-25-15
Open
10.d
IFI - Administrative Controls
for Lake Keowee
93-13-03
Open
11
UNR - ECCW System Design and
Testing
APPENDIX A
Duke Nuclear Power Plant
Persons Contacted
L. Azzarello, Mechanical/Nuclear Engineering
S. Baldwin, Systems Engineer -
Raw Water
H. Barron, Station Manager - Oconee Nuclear Station
R. Colainanni, Nuclear Licensing - General Office
D. Coyle, Systems Engineering Manager
J. Davis, Safety Assessment
B. Dolan, Mechanical/Nuclear Engineering Manager
P. Farish, Nuclear Engineer -
K. Grayson, Mechanical/Nuclear Engineering
J. Hampton, Vice President - Oconee Nuclear Station
H. Harling, Mechanical/Nuclear Engineering
R. Harris, Senior Engineer -
Systems Engineering
J. Hemminger, Mechanical/Nuclear Engineering
M. Hipps, Mechanical Maintenance
D. Hubbard, Component Engineer
D. Kelley, Civil Engineering
R. Ledford, Instrumentation and Controls
T. Ledford, Electrical Engineering
E. LeGette, Operations
G. McAninch, Systems Engineer
S. Nader, Mechanical/Nuclear Engineering
M. Patrick, Regulatory Compliance Manager
D. Patterson, Regulator Compliance -
Oconee Nuclear Station
B. Peele, Engineering
M. Tuckman, Senior Vice President -
Nuclear Generation
J. Weir, Component Engineer
U.S. Nuclear Regulatory Commission
L. Mellen, Reactor Inspector
D. Prevatte, Powerdyne Corporation
C. Rapp, Reactor Inspector
W. Rogers, Team Leader
L. King, Reactor Inspector
A. Gibson, DRS Division Director
M. Lessor, DRP Section Chief
L. Weins, NRR Licensing Project Manager
P. Harmon, Senior Resident Inspector
K. Portner, Resident Inspector
L. Keller, Resident Inspector
- Indicates those present at the exit meeting on December 14, 1993
APPENDIX B
Generic Letter 89-13 Action Items
I.
Biofouling Control and Surveillance Techniques
Action I of GL 89-13 requested licensees to implement and maintain an
ongoing program of surveillance and control techniques to significantly
reduce the incidence of flow blockage problems as a result of
biofouling. The actions requested included intake structure
inspections, periodic SWS flushing/flow testing and chemical treatment
of the SWS.
SWS Intake Structure Biofouling Inspections - The licensee had developed
a program to monitor, sample, and analyze the intake structure for
Asiatic clams. This program was conducted once per refueling cycle or
annually. The program had identified the presence of clams but at a low
population density. There was no increasing trend in the number of
clams. Also, some minor corrective maintenance in the LPSW, SSF and
HPSW systems had been due to clam presence. The team considered the
program adequate.
Periodic SWS Flushing/Flow Testing - The licensee had implemented a flow
testing and piping inspection program to identify reduced and blocked
flow to equipment. Hydraulic models had been developed for the ASW, SSF
and LPSW systems. No periodic flushing program was established.
LPSW - The licensee's efforts had been very effective in identifying
inadequate flow to numerous pieces of LPSW equipment through small bore
piping. The hydraulic model had been fully benchmarked. However,
instrument impulse lines had been excluded from the program. The
corrective maintenance history indicated repeated instrument failures
due to flow blockage. Subsequent actions under the SWS Steering
Committee recognized the situation and prompted revision to the
instrument calibration procedures to include flushing. Revision of the
procedures was scheduled for completion in March, 1994. Also, without a
flush program the LPSW crosstie line between Units 1/2 and 3 received no
evaluation. As a result of other regulatory correspondence this section
of stagnant piping was to be inspected and flushed at the next refueling
outage.
Other Systems - The benchmarking of the SSF hydraulic model was
incomplete with respect to the SSF diesel service water pump portion of
the flow model and the SSF ASW pump discharge piping to the steam
generators. The hydraulic model of the ASW system excluded the piping
to the HPI pump motor coolers. Also, the flow downstream of the
discharge valves to the steam generators had not been benchmarked. No
program had been developed for the Keowee SWSs.
SWS Chemical Treatment - The licensee's biofouling monitoring program
did not indicate a level of clam infestation that would warrant chemical
treatment.
Appendix B
2
II. Monitoring Safety Related Heat Exchanger Performance
Action II of GL 89-13 requested licensees to implement a test program to
periodically verify the heat transfer capability of all safety related
heat exchangers cooled by the SWS. The test program was to consist of
an initial test program and a periodic retest program.
In response to this item, the licensee established a performance
monitoring program for LPSW heat exchangers. The program was a
combination of inspections, performance tests and computer modeling.
The program specifics and the team assessment were:
Low Pressure Injection Coolers - These coolers were tested during each
refueling outage when the coolers were placed in service for decay heat
removal.
This test was conducted at a heat load less than would be
experienced during accident conditions. A fouling factor was developed
based on the test results and compared to historical data to identify
any adverse trend that would indicate increasing fouling.
The team considered the LPI cooler performance monitoring as adequate.
Reactor Building Cooling Units - To determine operability of the RBCUs,
the licensee used a computer code to predict the heat removal under
accident conditions based on heat removal data taken during normal
operations.
The team had two concerns with this process. The first concern was the
ability of the computer code to predict RBCU heat removal under accident
conditions. This computer code was divided into two separate
calculations. First, a fouling factor was calculated based on data
taken during normal operations. The fouling factor was then used to
predict the heat removal during accident conditions. Because the
airflow distribution was non-uniform, the licensee used another computer
code that predicted the airflow distribution based on the data taken
during normal operating conditions. This computer code was obtained
from a vendor and the licensee relied on the vendor's benchmarking of
the computer code. A non-regulatory required airflow test performed in
1987, indicated the airflow was substantially less than assumed in the
computer code; however, the licensee stated this test was invalid due to
significant air side fouling. The ability of this computer code to
accurately predict the air flow distribution has a direct effect on RBCU
operability.
The second concern was the accuracy of LPSW flow measurement. The
determination of RBCU heat removal capability relied on the accuracy of
the LPSW flow measuring device which was an installed orifice. The
inspectors reviewed documentation and photographs that showed the LPSW
Appendix B
3
piping had fouled at various points. A reduction in the diameter of the
piping in the area of the orifice would result in higher indicated LPSW
flow. The licensee had performed a special test to determine the
accuracy of the LPSW flow instrumentation by subtracting the indicated
flows from other LPSW supplied components from the total LPSW flow;
however, this resulted in unrealistically high LPSW flow to the RBCUs.
The licensee also performed testing of the LPSW pumps using ultrasonic
flow measurements which indicated substantially lower flows than the
installed instrumentation. The licensee stated this was a special test
for gathering data and did not constitute a valid performance test.
The team concluded that without field validation of the RBCU airflow
distribution and stronger-assurance of flow element accuracy, the RBCU
computer results were questionable.
Small LPSW Heat Exchangers - Periodic flow verifications were performed.
The team had no concerns.
The Main Condensers - The main condenser were cleaned and inspected each
refueling outage. The team had no concerns.
SSF Diesel Engine Jacket Water Heat Exchangers - The ISI requirements
for the SSF diesel lube oil and jacket water coolers was on a 10 year
cycle verses the 5 year criteria in the GL. No other monitoring program
was in place. The team considered the performance monitoring of these
heat exchangers inadequate.
SSF HVAC Condensers - A semiannual preventive maintenance activity for
the SSF air handling unit required cleaning of the condenser tubes if
the head saturation temperature was more than 10OF higher than the
outlet temperature. The licensee stated the condenser tubes had not
been cleaned based upon the above conditions. The team had no concerns.
Keowee - No formal performance monitoring of the SWS heat exchangers had
been established. In the licensee's informal SWS Program Manual the
Keowee heat exchangers were discussed indicating that normal operation
of Keowee by operators would identify any problems. The team considered
the present monitoring methods as inadequate.
First, the
instrumentation that would be relied upon to inform the operators of a
problem was not being fully maintained as discussed in Section 9.c.1.
Second, there was no documented trending or operator rounds program in
place for the SWS heat exchangers.
In summary the heat exchanger performance monitoring program had been
inadequately implemented, mainly due to a lack of scope.
Appendix B
4
III.
Routine Inspection and Maintenance
Action III of GL 89-13 requested that licensees implement a routine
inspection and maintenance program for open-cycle SWS piping and
components. This program was to ensure that corrosion, erosion,
protective coating failure, silting, and biofouling would not degrade
the performance of the safety related systems supplied by the SWS.
In response to this action item, the licensee had established periodic
inspections, cleaning as needed, and piping replacements.
Piping - Design Study ONDS-252 evaluated SWS piping configurations for
the sections with the highest potential for corrosion. The criteria for
determining the most probable area of corrosion was piping material,
piping diameter, duration of flow through the pipe and velocity of flow.
Corrective action in the form of stainless steel piping replacements was
accomplished in a number of the potential corrosion areas. Also, an
aggressive program of pipe section inspections were in place. With the
help of the SWS Steering Group a Service Water Piping Corrosion
Management Program Manual dated October 29, 1993, had been developed to
assure appropriate management control and attention were maintained for
this effort. This piping inspection program did not include the Keowee
SWSs. No other program encompassed Keowee.
The team considered the piping inspection and replacement program
excellent except in terms of scope. This caused the licensee's actions
to be inadequate due to the omission of the Keowee SWS piping from the
program. For the systems where licensee actions were applied the
maintenance program was adequate except in select equipment associated
with the HPSW system and the CCW pumps. These pieces of equipment
suffered from inadequate safety classification that reduced the rigor of
assurance that the materials used in repair activities were proper and
the work was performed properly. This also included the rigor used in
post maintenance testing.
Pumps and Valves - Following the 1987 SITA a preventive maintenance
schedule for the LPSW pumps was established. However, pump rebuild and
refurbishment could not be accomplished within the TS LCO time allowed
which caused maintenance constraints on the shared Unit 1/2 LPSW system.
Pump performance deficiencies had centered around high temperatures in
the stator of the motors. The CCW pumps were experiencing long term
vibration/fatigue with adequate corrective actions being taken to
address the issue. Valves were being adequately maintained.
Heat Exchangers -
Periodic inspections and cleaning frequencies had
been established for a number of heat exchangers.
Appendix B
5
IV. Design Function Verification and Single Failure Analysis
Action IV of GL 89-13 requested to licensees confirm that the SWS would
perform its intended function in accordance with the licensing basis for
the plant. This confirmation was to include a review ensuring requisite
safety functions were accomplished even with the failure of a single
active component.
In response to this action item, the licensee utilized the 1987 self
assessment of the LPSW system and the ECCW support (first siphon) to the
LPSW system. Also, design calculations were performed to verify that
safety functions were accomplished with a single failure occurring.
The team considered the LPSW design review of the 1987 self-assessment
as thorough and comprehensive. However, some of the corrective actions
did not adequately address the issues identified such as isolation of
the LPSW turbine building header. Resolution to problems identified
while implementing corrective actions to the self-assessment were
occasionally inadequate as with the inadequate NPSH for the LPSW pumps
and the postulated waterhammer in the RBCU discharge piping. Also, a
number of corrective actions were untimely such as safety classification
of the CCW pumps and, seismic suitability of the vacuum priming and HPSW
systems which support ECCW (first siphon) operation. The self
assessment did not include the ASW, SSF SWS, Keowee, HPSW, and the other
operating modes of the CCW system (second siphon and loss of Keowee
Dam).
In summary the licensee's corrective actions to this action item
were inadequate.
V.
Training
Action V of GL 89-13 requested licensees to confirm that maintenance
practices, operating and emergency procedures, and training involving
the SWS were adequate to ensure safety related equipment cooled by the
SWS would function as intended.
In response to this action item the licensee evaluated LPSW maintenance
practices, all LPSW operating (normal and abnormal) procedures, and LPSW
training, as part of the 1987 self-assessment. Beyond this specific .
review, the licensee considered the established personnel qualification
2 year procedure review, 10 CFR 50.59 safety evaluation, qualified
reviewer, operating experience and operator requalification programs as
adequate to address this action item.
The team identified LPSW weaknesses which were within the scope of this
aspect of the 1987 self-assessment. Examples of these weaknesses
included the lack of an abnormal procedure addressing inadequate LPSW
flow and, limited operator training on containment temperature concerns
during an accident. Also, beyond the specific self-assessment, the
established generic programs did not identify numerous weaknesses.
Examples of these weaknesses included the lack of operating procedures
Appendix B
6
for Keowee SWSs, weak operator direction in response to the Keowee Dam
failure, the inability to verify flow to the steam generators from the
ASW system and incomplete verification that ASW actions could be
accomplished within the 40 minute required timeframe. A review, similar
to that performed on the LPSW system, of Keowee would almost certainly
have identified the lack of key quality assurance elements in the
operation, maintenance and training associated with the Keowee
hydroelectric station years before operational events in 1992 brought
them to light. In summary the licensee's corrective actions to this
action item were inadequate.
APPENDIX C
Acronyms and Abbreviations
ANSI
American National Standards Institute
ASW
Auxiliary Service Water
BWST
Borated Water Storage Tank
Condenser Circulating Water
Component Cooling Water
Design Basis Document
DEV
Deviation
Duke Power Company
ECCW
Emergency Circulating Cooling Water
Emergency Feedwater
Emergency Procedure
Electric Power Research Institute
Engineered Safety Feature
EWF
Emergency Feedwater
EWST
Elevated Water Storage Tank
Final Safety Analysis Report
GL
Generic Letter
GPM
Gallons per Minute
High Pressure Injection
High Pressure Service Water
Heating, Ventilation, and Air Conditioning
IFI
Inspector Follow-up Item
Individual Plant Examination
Inservice Inspection
Inservice Test
LCO
Limiting Condition for Operation
LER
Licensee Event Report
Loss of Coolant Accident
Low Pressure Injection
Low Pressure Service Water
MTOTC
Main Turbine Oil Temperature Control
Noncited Violation
Net Positive Suction Head
PSIA
Pounds per Square Inch Absolute
Pounds per Square Inch Gauge
RBCU
Reactor Building Cooling Unit
Station Blackout
Safety Evaluation Report
SSF
Safe Shut Down Facility
Service Water System
SWSOPI
Service Water System Operational Performance Inspection
Turbine Driven Emergency Feedwater
Total Developed Head
TS
Technical Specification
Unresolved
Violation