United States Nuclear Regulatory Commission - Protecting People and the Environment

ACCESSION #:  9501240194
                       LICENSEE EVENT REPORT (LER)

FACILITY NAME:  Oconee Nuclear Station, Unit One          PAGE: 1 OF 6

DOCKET NUMBER:  05000269

TITLE:  TECHNICAL SPECIFICATION LIMIT EXCEEDED DUE TO VENDOR
        DESIGN DEFICIENCY

EVENT DATE:  12/15/94   LER #:  94-06-00    REPORT DATE:  01/12/95

OTHER FACILITIES INVOLVED:  Oconee, Unit Three      DOCKET NO:  05000287

OPERATING MODE:  N   POWER LEVEL:  100

THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR
SECTION:
50.73(a)(2)(i)(B)

LICENSEE CONTACT FOR THIS LER:
NAME:  Lanny V. Wilkie,                     TELEPHONE:  (803) 885-3518
       Safety Review Manager

COMPONENT FAILURE DESCRIPTION:
CAUSE:      SYSTEM:       COMPONENT:       MANUFACTURER:
REPORTABLE NPRDS:

SUPPLEMENTAL REPORT EXPECTED:  N

ABSTRACT:

On December 7, 1994, Unit 1, and 3 were at 100% full power.  Unit 2 was
at Hot Shutdown conditions following a unit trip.  Instrument and
Electrical technicians were performing routine calibration of Unit 1
Reactor Protective System loss of Feedwater pressure switches.  Switch
setpoint drift was identified during the calibration.  On December 12,
1994, the setpoint drift for some switches was determined by engineering
evaluation, to be excessive.  The vendor is testing and evaluating the
pressure switch to determine the cause of the excessive setpoint drift.
The root cause of the event is Vendor Design Configuration and Analysis;
Design Analysis; Component functional design deficiency.  Corrective
actions include increasing calibration frequencies and replacing or
repairing the pressure switches.

END OF ABSTRACT

TEXT                                                          PAGE 2 OF 6

BACKGROUND

The Reactor Protective System (RPS) [EIIS:JC] monitors several important
system parameters and will trip the reactor when any trip setpoint is
reached using two-of-four channel logic.  One trip parameter is loss of
Main Feedwater [EIIS:SJ], which is indicated when both Main Feedwater
Pumps (MFDWP) have either low hydraulic oil pressure or low discharge
pressure.  Each MFDWP has four discharge pressure switches providing
input to the RPS (one per channel).

The Emergency Feedwater (EFDW) system [EIIS:BA] is designed to start
automatically upon loss of Main Feedwater [EIIS:SJ] or low level in
either Steam Generator (SG).  The EFDW system consists of two motor
driven pumps and one turbine driven pump.  The Turbine Driven Emergency
Feedwater Pump utilizes the same logic as the RPS.  The Motor Driven
Emergency Feedwater Pumps have initiation circuitry which will start the
pumps automatically when both Main Feedwater Pumps (MFDWP) have low
hydraulic oil pressure or both MFDWP's have low discharge pressure.  Each
MFDWP has three discharge pressure switches providing input to start each
of the EFDW pumps.

ATWS Mitigation System Actuation Circuit (AMSAC) is an additional system
intended to mitigate the consequences of an anticipated transient without
scram event.  It functions by initiating EFDW and tripping the Main
Turbine (EIIS:TA] when both MFDWPs have low discharge pressure or low
hydraulic oil pressure.  This function is accomplished using additional
switches of a different model than the switches used to perform the
safety actuation.

Technical Specification (TS) 3.4 addresses the EFDW system and the bases
which require automatic EFDW initiation circuitry in the event of loss of
both MFDWP'S.  TS 3.5 Table 3.5.1-1 lists the requirements for
operability of the RPS.

EVENT DESCRIPTION

On December 29, 1993, a problem was recognized with pressure switch
components allowing water intrusion to render the switch inoperable.
This problem affected pressure switches that monitor low Main Feedwater
Pump discharge pressure and provide inputs to the Reactor Protective
System (RPS) trip signal and Emergency Feedwater (EFDW) initiation.  It
was reported as LER 270/94-01, "Technical Specification Limit Exceeded
Due to Equipment Failure."  Replacement switches were installed and
calibrated on Oconee Units 1, 2, and 3 between February and November
1994.  The switches are manufactured by Static-O-Ring and are model
number 9N6-W5-U8-C1A-JJTTNQ.

TEXT                                                          PAGE 3 OF 6

On December 7, 1994 the initial periodic instrument re-calibration of the
Unit 1 RPS pressure switches was completed.  Four of the eight Main
Feedwater Pump (MFDWP) discharge pressure switches that provide input to
the RPS exhibited setpoint deviations requiring engineering evaluation.

The manufacturer was advised of the situation.  The manufacturer stated
that some setpoint drift would be expected after initial installation and
that the magnitude of the drift would be significantly less an subsequent
calibrations.  Previously, Oconee Engineering was not aware of this
condition.

On December 12, 1994, Oconee Engineering concluded that setpoint drifts
of four of the switches were excessive.  A Problem Investigation Process
report was initiated, an evaluation of the operability of the switches
was begun, and the remaining switches on Unit 1 were calibrated.  Also,
the switches on unit 2 and 3 were scheduled for immediate calibration.
On December 14, 1994, calibration of the switches was completed with
setpoint drifts identified on all of them.  In addition to the four Unit
1 switches, excessive setpoint drift was noted on nine of the fourteen
Unit 3 switches.  All of the switches were successfully re-calibrated
within tolerance.  Replacements were installed for several switches which
were removed and sent to the manufacturer for evaluation.

On December 16, 1994, Oconee Engineering completed the operability
evaluation and concluded that the switches were conditionally operable
contingent upon calibration every fourteen days for the Unit 1 and 2
switches and every seven days for the Unit 3 switches.  This was based on
evaluation of the current calibration data, discussions with the
manufacturer, and the minimum allowable setpoint value for each Unit.
Due to system differences, Unit 3 has the least amount of margin for
setpoint drift.  It is conservatively assumed that the setpoint drift
occurred shortly after initial pressurization, based on vendor
information.

Based on a review of the as-found data for the Unit 1 switches, three
switches were found to be below the minimum allowable setpoint.  The
function of two of these switches rendered the auto initiate circuit of
the Motor Driven Emergency Feedwater Pump (MDEFDWP) B and the Turbine
Driven Emergency Feedwater Pump (TDEFDWP) inoperable on low MFDWP
discharge pressure since late June 1994.  The third switch was associated
with the input to the RPS.  The other seven RPS switches were acceptable,
therefore the function of the anticipatory trip on low MFDWP discharge
pressure would be operable in the past.

TEXT                                                          PAGE 4 OF 6

No Unit 2 switches were found to be below the minimum allowable setpoint;
therefore, their RPS and EFDW safety related functions were operable.

Unit 3 had nine switches found to be below the minimum allowable
setpoint.  Based on the conservative assumption, the auto initiate
circuit for the MDEFDWP A, the TDEFDWP, and the RPS anticipatory trip on
low discharge pressure were inoperable since February 1994.

The present calibration results indicate the increased frequencies are
adequately maintaining the pressure switches within the specified
setpoints.

CONCLUSIONS

The root cause of this event is Vendor Design Configuration and Analysis;
Design Analysis; Component functional design deficiency.  Based on
information from the vendor, the cause of the setpoint drift is possibly
the design of the non-wetted diaphragm.

A review of previous events for the last two years, revealed that LER
270/94-01, "Technical Specification Limit Exceeded Due To Equipment
Failure" was reported due to failure of a pressure switch in this same
application.  A diaphragm failure allowed water to contact electrical
components in the pressure switch resulting in the failure of the switch
to perform the automatic initiation function.  The corrective actions
were to replace all the pressure switches with these new switches which
would not exhibit the diaphragm failure.  However, these replacement
switches corrected the problem with the diaphragm deterioration but
exhibited unexpected setpoint drift.  The setpoint drift was not
recognized because the switches are scheduled for their periodic
calibration annually.  This frequency was in accordance with manufacturer
recommendations.  When informed of the setpoint drift encountered, the
manufacturer indicated that this was not an acceptable amount to be
expected.

Since the equipment which failed was performing the same function as in
the previous event, the event is considered recurring.  However, the mode
of failure, manufacturer, and design of the switch is different.

The pressure switch identified in this event is not NPRDS reportable.

There were no personnel injuries, radiation exposures, or releases of
radioactive materials associated with this event.

TEXT                                                          PAGE 5 OF 6

CORRECTIVE ACTIONS

Immediate

1.   The manufacturer of the pressure switches was notified of the
     calibration findings.

2.   All pressure switches of this type were calibrated and the results
     reported to engineering for evaluation.

Subsequent

1.   An increased calibration frequency was established to maintain the
     Reactor Protective System and Emergency Feedwater safety function of
     these switches.

2.   The manufacturer observed the calibration of the switches by Oconee
     Instrument and Electrical technicians and determined that equipment
     and methods used are acceptable.

3.   The manufacturer is conducting drift testing on this switch model as
     well as alternate designs to attempt to identify the exact problem
     causing the excessive drift.

Planned

1.   Replace or repair the pressure switches as necessary to allow normal
     calibration frequencies to be resumed.

SAFETY ANALYSIS

The Motor Driven Emergency Feedwater Pump (MDEFDWP) B and the Turbine
Driven Emergency Feedwater Pump (TDEFDWP) for unit 1 would not have
automatically started at the required Main Feedwater Pump (MFDWP) low
discharge pressure.  MDEFDWP A and the TDEFDWP for Unit 3 would not have
automatically started at the required MFDWP low discharge pressure.
However, the second MDEFWP remained operable on both Units.

If Main Feedwater had been lost while the low discharge pressure switches
were not within tolerance, the Emergency Feedwater (EFDW) system would
still have been automatically initiated by this or other signals.
Specifically, for scenarios where the MFDWPs trip off, if the pump
discharge pressure switches did not initiate, the low hydraulic oil
pressure signals would have initiated EFDW.

TEXT                                                          PAGE 6 OF 6

If the MFDWPs do not trip off, the switches to start one MDEFDWP on low
discharge pressure remained operable on each affected unit.  The Final
Safety Analysis Report (FSAR) Chapter 10 discusses the fact that one
EFDWP would meet system needs.  Since FSAR Chapter 10 states that one
EFDWP is adequate for decay heat removal, the EFDW system could still
function.  If there is an additional single failure affecting that pump
and/or its flow path, the low Steam Generator (SG) dry out protection
signal would automatically initiate the EFDWP in the other train.

Also, other means of actuating the pumps were available during the time
period of this inoperability.

ATWS Mitigation System Actuation Circuit (AMSAC) was available to
automatically initiate the EFDW system, including the emergency feedwater
pumps identified in this report, since this is a separate and independent
circuit.

In addition, the low SG level (SG dry out protection) signal would
automatically initiate both MDEFDW pumps, when the SG level dropped low
enough.

Furthermore, during a loss of MFDW event, the operators are directed by
the Emergency Operating Procedure (EOP) and Abnormal Procedures (AP) to
verify that all Emergency Feedwater Pumps (EFDWP) have started.  The
operators would have manually started the EFDWP's from the affected
Unit's control room.

If all of these efforts failed, the EOP and AP's provide for use of High
Pressure Injection [EIIS:BG] forced cooling and/or use of the Standby
Shutdown Facility Auxiliary Service water Pump [EIIS:BA].  Analyses have
been performed to verify that sufficient time is available for an
Operator to line up these systems before any care damage would occur.

If the Unit 3 Reactor Protective System anticipatory reactor trip signal
had not functioned to trip the reactor, the AMSAC actuation using
redundant switches would have produced a turbine trip, which would
provide a redundant path for the anticipatory reactor trip.  Also, if
this redundant trip did not function, the loss of MFDW would result
in-high Reactor Coolant System (RCS) [EIIS:AB] temperature/pressure,
resulting in a high RCS pressure trip of the reactor.  Therefore, with
the MFDW pump discharge pressure input to the RPS anticipatory reactor
trip out of calibration, the reactor trip would have occurred by other
methods.

Therefore, sufficient redundancy exists to assure that, even with the
MFDW discharge pressure switches out of calibration, the health and
safety of the public was not compromised by this event.

ATTACHMENT TO 9501240194                                      PAGE 1 OF 1

Duke Power Company                                J. W. HAMPTON
Oconee Nuclear Site                               Vice President
P. O. Box 1439                                    (803)885-3499 Office
Seneca, SC 29679                                  (803)885-3564 Fax

DUKE POWER

January 12, 1995

U. S. Nuclear Regulatory Commission
Document Control Desk
Washington, DC 20555

Subject:  Oconee Nuclear Station
          Docket Nos. 50-269, -270, -287
          LER 269/94-06

Gentlemen:

Pursuant to 10 CFR 50.73 Sections (a)(1) and (d), attached is Licensee
Event Report (LER) 269/94-06, concerning a Technical Specification limit
exceeded due to a vendor design deficiency.

This report is being submitted in accordance with 10 CFR 50.73
(a)(2)(i)(B).  This event is considered to be of no significance with
respect to the health and safety of the public.

Very truly yours,

J. W. Hampton
Vice President

/ftr

Attachment

xc:  Mr. S. D. Ebneter                       INPO Records Center
     Regional Administrator, Region II       700 Galleria Parkway
     U.S. Nuclear Regulatory Commission      Atlanta, GA 30339-5957
     101 Marietta St., NW, Suite 2900        Atlanta, Georgia 30323

     Mr. L. A. Wiens                         Mr. P. E. Harmon
     Office of Nuclear Reactor Regulation    NRC Resident Inspector
     U.S. Nuclear Regulatory Commission      Oconee Nuclear Site
     Washington, DC 20555

*** END OF DOCUMENT ***


Page Last Reviewed/Updated Thursday, March 29, 2012