Protecting People and the EnvironmentUNITED STATES NUCLEAR REGULATORY COMMISSION
ACCESSION #: 9501240194
LICENSEE EVENT REPORT (LER)
FACILITY NAME: Oconee Nuclear Station, Unit One PAGE: 1 OF 6
DOCKET NUMBER: 05000269
TITLE: TECHNICAL SPECIFICATION LIMIT EXCEEDED DUE TO VENDOR
DESIGN DEFICIENCY
EVENT DATE: 12/15/94 LER #: 94-06-00 REPORT DATE: 01/12/95
OTHER FACILITIES INVOLVED: Oconee, Unit Three DOCKET NO: 05000287
OPERATING MODE: N POWER LEVEL: 100
THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR
SECTION:
50.73(a)(2)(i)(B)
LICENSEE CONTACT FOR THIS LER:
NAME: Lanny V. Wilkie, TELEPHONE: (803) 885-3518
Safety Review Manager
COMPONENT FAILURE DESCRIPTION:
CAUSE: SYSTEM: COMPONENT: MANUFACTURER:
REPORTABLE NPRDS:
SUPPLEMENTAL REPORT EXPECTED: N
ABSTRACT:
On December 7, 1994, Unit 1, and 3 were at 100% full power. Unit 2 was
at Hot Shutdown conditions following a unit trip. Instrument and
Electrical technicians were performing routine calibration of Unit 1
Reactor Protective System loss of Feedwater pressure switches. Switch
setpoint drift was identified during the calibration. On December 12,
1994, the setpoint drift for some switches was determined by engineering
evaluation, to be excessive. The vendor is testing and evaluating the
pressure switch to determine the cause of the excessive setpoint drift.
The root cause of the event is Vendor Design Configuration and Analysis;
Design Analysis; Component functional design deficiency. Corrective
actions include increasing calibration frequencies and replacing or
repairing the pressure switches.
END OF ABSTRACT
TEXT PAGE 2 OF 6
BACKGROUND
The Reactor Protective System (RPS) [EIIS:JC] monitors several important
system parameters and will trip the reactor when any trip setpoint is
reached using two-of-four channel logic. One trip parameter is loss of
Main Feedwater [EIIS:SJ], which is indicated when both Main Feedwater
Pumps (MFDWP) have either low hydraulic oil pressure or low discharge
pressure. Each MFDWP has four discharge pressure switches providing
input to the RPS (one per channel).
The Emergency Feedwater (EFDW) system [EIIS:BA] is designed to start
automatically upon loss of Main Feedwater [EIIS:SJ] or low level in
either Steam Generator (SG). The EFDW system consists of two motor
driven pumps and one turbine driven pump. The Turbine Driven Emergency
Feedwater Pump utilizes the same logic as the RPS. The Motor Driven
Emergency Feedwater Pumps have initiation circuitry which will start the
pumps automatically when both Main Feedwater Pumps (MFDWP) have low
hydraulic oil pressure or both MFDWP's have low discharge pressure. Each
MFDWP has three discharge pressure switches providing input to start each
of the EFDW pumps.
ATWS Mitigation System Actuation Circuit (AMSAC) is an additional system
intended to mitigate the consequences of an anticipated transient without
scram event. It functions by initiating EFDW and tripping the Main
Turbine (EIIS:TA] when both MFDWPs have low discharge pressure or low
hydraulic oil pressure. This function is accomplished using additional
switches of a different model than the switches used to perform the
safety actuation.
Technical Specification (TS) 3.4 addresses the EFDW system and the bases
which require automatic EFDW initiation circuitry in the event of loss of
both MFDWP'S. TS 3.5 Table 3.5.1-1 lists the requirements for
operability of the RPS.
EVENT DESCRIPTION
On December 29, 1993, a problem was recognized with pressure switch
components allowing water intrusion to render the switch inoperable.
This problem affected pressure switches that monitor low Main Feedwater
Pump discharge pressure and provide inputs to the Reactor Protective
System (RPS) trip signal and Emergency Feedwater (EFDW) initiation. It
was reported as LER 270/94-01, "Technical Specification Limit Exceeded
Due to Equipment Failure." Replacement switches were installed and
calibrated on Oconee Units 1, 2, and 3 between February and November
1994. The switches are manufactured by Static-O-Ring and are model
number 9N6-W5-U8-C1A-JJTTNQ.
TEXT PAGE 3 OF 6
On December 7, 1994 the initial periodic instrument re-calibration of the
Unit 1 RPS pressure switches was completed. Four of the eight Main
Feedwater Pump (MFDWP) discharge pressure switches that provide input to
the RPS exhibited setpoint deviations requiring engineering evaluation.
The manufacturer was advised of the situation. The manufacturer stated
that some setpoint drift would be expected after initial installation and
that the magnitude of the drift would be significantly less an subsequent
calibrations. Previously, Oconee Engineering was not aware of this
condition.
On December 12, 1994, Oconee Engineering concluded that setpoint drifts
of four of the switches were excessive. A Problem Investigation Process
report was initiated, an evaluation of the operability of the switches
was begun, and the remaining switches on Unit 1 were calibrated. Also,
the switches on unit 2 and 3 were scheduled for immediate calibration.
On December 14, 1994, calibration of the switches was completed with
setpoint drifts identified on all of them. In addition to the four Unit
1 switches, excessive setpoint drift was noted on nine of the fourteen
Unit 3 switches. All of the switches were successfully re-calibrated
within tolerance. Replacements were installed for several switches which
were removed and sent to the manufacturer for evaluation.
On December 16, 1994, Oconee Engineering completed the operability
evaluation and concluded that the switches were conditionally operable
contingent upon calibration every fourteen days for the Unit 1 and 2
switches and every seven days for the Unit 3 switches. This was based on
evaluation of the current calibration data, discussions with the
manufacturer, and the minimum allowable setpoint value for each Unit.
Due to system differences, Unit 3 has the least amount of margin for
setpoint drift. It is conservatively assumed that the setpoint drift
occurred shortly after initial pressurization, based on vendor
information.
Based on a review of the as-found data for the Unit 1 switches, three
switches were found to be below the minimum allowable setpoint. The
function of two of these switches rendered the auto initiate circuit of
the Motor Driven Emergency Feedwater Pump (MDEFDWP) B and the Turbine
Driven Emergency Feedwater Pump (TDEFDWP) inoperable on low MFDWP
discharge pressure since late June 1994. The third switch was associated
with the input to the RPS. The other seven RPS switches were acceptable,
therefore the function of the anticipatory trip on low MFDWP discharge
pressure would be operable in the past.
TEXT PAGE 4 OF 6
No Unit 2 switches were found to be below the minimum allowable setpoint;
therefore, their RPS and EFDW safety related functions were operable.
Unit 3 had nine switches found to be below the minimum allowable
setpoint. Based on the conservative assumption, the auto initiate
circuit for the MDEFDWP A, the TDEFDWP, and the RPS anticipatory trip on
low discharge pressure were inoperable since February 1994.
The present calibration results indicate the increased frequencies are
adequately maintaining the pressure switches within the specified
setpoints.
CONCLUSIONS
The root cause of this event is Vendor Design Configuration and Analysis;
Design Analysis; Component functional design deficiency. Based on
information from the vendor, the cause of the setpoint drift is possibly
the design of the non-wetted diaphragm.
A review of previous events for the last two years, revealed that LER
270/94-01, "Technical Specification Limit Exceeded Due To Equipment
Failure" was reported due to failure of a pressure switch in this same
application. A diaphragm failure allowed water to contact electrical
components in the pressure switch resulting in the failure of the switch
to perform the automatic initiation function. The corrective actions
were to replace all the pressure switches with these new switches which
would not exhibit the diaphragm failure. However, these replacement
switches corrected the problem with the diaphragm deterioration but
exhibited unexpected setpoint drift. The setpoint drift was not
recognized because the switches are scheduled for their periodic
calibration annually. This frequency was in accordance with manufacturer
recommendations. When informed of the setpoint drift encountered, the
manufacturer indicated that this was not an acceptable amount to be
expected.
Since the equipment which failed was performing the same function as in
the previous event, the event is considered recurring. However, the mode
of failure, manufacturer, and design of the switch is different.
The pressure switch identified in this event is not NPRDS reportable.
There were no personnel injuries, radiation exposures, or releases of
radioactive materials associated with this event.
TEXT PAGE 5 OF 6
CORRECTIVE ACTIONS
Immediate
1. The manufacturer of the pressure switches was notified of the
calibration findings.
2. All pressure switches of this type were calibrated and the results
reported to engineering for evaluation.
Subsequent
1. An increased calibration frequency was established to maintain the
Reactor Protective System and Emergency Feedwater safety function of
these switches.
2. The manufacturer observed the calibration of the switches by Oconee
Instrument and Electrical technicians and determined that equipment
and methods used are acceptable.
3. The manufacturer is conducting drift testing on this switch model as
well as alternate designs to attempt to identify the exact problem
causing the excessive drift.
Planned
1. Replace or repair the pressure switches as necessary to allow normal
calibration frequencies to be resumed.
SAFETY ANALYSIS
The Motor Driven Emergency Feedwater Pump (MDEFDWP) B and the Turbine
Driven Emergency Feedwater Pump (TDEFDWP) for unit 1 would not have
automatically started at the required Main Feedwater Pump (MFDWP) low
discharge pressure. MDEFDWP A and the TDEFDWP for Unit 3 would not have
automatically started at the required MFDWP low discharge pressure.
However, the second MDEFWP remained operable on both Units.
If Main Feedwater had been lost while the low discharge pressure switches
were not within tolerance, the Emergency Feedwater (EFDW) system would
still have been automatically initiated by this or other signals.
Specifically, for scenarios where the MFDWPs trip off, if the pump
discharge pressure switches did not initiate, the low hydraulic oil
pressure signals would have initiated EFDW.
TEXT PAGE 6 OF 6
If the MFDWPs do not trip off, the switches to start one MDEFDWP on low
discharge pressure remained operable on each affected unit. The Final
Safety Analysis Report (FSAR) Chapter 10 discusses the fact that one
EFDWP would meet system needs. Since FSAR Chapter 10 states that one
EFDWP is adequate for decay heat removal, the EFDW system could still
function. If there is an additional single failure affecting that pump
and/or its flow path, the low Steam Generator (SG) dry out protection
signal would automatically initiate the EFDWP in the other train.
Also, other means of actuating the pumps were available during the time
period of this inoperability.
ATWS Mitigation System Actuation Circuit (AMSAC) was available to
automatically initiate the EFDW system, including the emergency feedwater
pumps identified in this report, since this is a separate and independent
circuit.
In addition, the low SG level (SG dry out protection) signal would
automatically initiate both MDEFDW pumps, when the SG level dropped low
enough.
Furthermore, during a loss of MFDW event, the operators are directed by
the Emergency Operating Procedure (EOP) and Abnormal Procedures (AP) to
verify that all Emergency Feedwater Pumps (EFDWP) have started. The
operators would have manually started the EFDWP's from the affected
Unit's control room.
If all of these efforts failed, the EOP and AP's provide for use of High
Pressure Injection [EIIS:BG] forced cooling and/or use of the Standby
Shutdown Facility Auxiliary Service water Pump [EIIS:BA]. Analyses have
been performed to verify that sufficient time is available for an
Operator to line up these systems before any care damage would occur.
If the Unit 3 Reactor Protective System anticipatory reactor trip signal
had not functioned to trip the reactor, the AMSAC actuation using
redundant switches would have produced a turbine trip, which would
provide a redundant path for the anticipatory reactor trip. Also, if
this redundant trip did not function, the loss of MFDW would result
in-high Reactor Coolant System (RCS) [EIIS:AB] temperature/pressure,
resulting in a high RCS pressure trip of the reactor. Therefore, with
the MFDW pump discharge pressure input to the RPS anticipatory reactor
trip out of calibration, the reactor trip would have occurred by other
methods.
Therefore, sufficient redundancy exists to assure that, even with the
MFDW discharge pressure switches out of calibration, the health and
safety of the public was not compromised by this event.
ATTACHMENT TO 9501240194 PAGE 1 OF 1
Duke Power Company J. W. HAMPTON
Oconee Nuclear Site Vice President
P. O. Box 1439 (803)885-3499 Office
Seneca, SC 29679 (803)885-3564 Fax
DUKE POWER
January 12, 1995
U. S. Nuclear Regulatory Commission
Document Control Desk
Washington, DC 20555
Subject: Oconee Nuclear Station
Docket Nos. 50-269, -270, -287
LER 269/94-06
Gentlemen:
Pursuant to 10 CFR 50.73 Sections (a)(1) and (d), attached is Licensee
Event Report (LER) 269/94-06, concerning a Technical Specification limit
exceeded due to a vendor design deficiency.
This report is being submitted in accordance with 10 CFR 50.73
(a)(2)(i)(B). This event is considered to be of no significance with
respect to the health and safety of the public.
Very truly yours,
J. W. Hampton
Vice President
/ftr
Attachment
xc: Mr. S. D. Ebneter INPO Records Center
Regional Administrator, Region II 700 Galleria Parkway
U.S. Nuclear Regulatory Commission Atlanta, GA 30339-5957
101 Marietta St., NW, Suite 2900 Atlanta, Georgia 30323
Mr. L. A. Wiens Mr. P. E. Harmon
Office of Nuclear Reactor Regulation NRC Resident Inspector
U.S. Nuclear Regulatory Commission Oconee Nuclear Site
Washington, DC 20555
*** END OF DOCUMENT ***
