IR 05000219/1989006

Insp Repts 50-219/89-06 on 890217-24.Violations Noted.Major Areas Inspected:Review of Preliminary Safety Concern Process Including Concerns Involving Standby Gas Treatment Sys, Automatic Depressurization Sys & Containment Spray Sys

ML20247H795
Person / Time
Site:	Oyster Creek
Issue date:	05/10/1989
From:	Cowgill C NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:
Shared Package
ML20247H792	List: IR 05000219/1989006 ML20247H785
References
50-219-89-06, 50-219-89-6, NUDOCS 8905310330
Download: ML20247H795 (16)

Text

__

. . - _ - - _ _ _ -

.

..iy .

.,

..

'"

.,

-

.

4*

U.S.' NUCLEAR REGULATORY COMMISSION

REGION I

-Report N /89-06 Docket N License No'. DPR-16 Priority -- Category C j Licensee: GPU Nuclear Corporation 1 Upper Pond Road Parsippany, New Jersey 07054 Facility Name: Oyster Creek Nuclear Generating Station e Inspection Conducted: February 17-24, 1989 Participating Inspectors: E. Collins

,

'

D. Lew J. Wechselberger l'

' Approved By:

C. J. Cowg'ill, dE_ f, Reactor Projects Section 1A Man /6/9/1 DVte ~

Inspection Summary:

Areas Inspected: A review of the preliminary safety concern process was con-ducted, and in particular, rev.iews of preliminary safety concerns involving the standby gas treatment system, automatic depressurization system and the con-

'tainment spray system were. conducte Results: Two apparent violations and three unresolved items were identifie .One violation involves the lack of corrective actions to prevent conditions

,

' adverse to quality in the processing of preliminary safety concerns. The other involves a failure to meet automatic depressurization system technical speci-fications and exceeding a limiting condition for operation action statement.

l- In addition, the licensee committed to review a preliminary safety conce'rn in-volving the containment spray system prior to startup and committed to regional management to review other preliminary safety concerns to determine if addi-tional unresolved safety concerns exist. Two other unresolved items concern reviews of the design basis documentation for the standby gas treatment (SGTS) ,

system and.the licensee's ' evaluation of the containment spray system preli- '

minary safety concerns 86-20 and 87-003. The licensee had not presented the l

SGTS design basis documentation prior to the end of the inspection, y i k[ M h %

G 890524m M 05000219 i

\ PNu l

1^

b_____________u_______ ___ _ _ - - - - )

. _ - _ _ _ _ _ _ _ _ _ . _ _ _ - _ _ _ _ _

. .

.

%

.

.

.

.

TABLE OF CONTENTS PAGE Summary.............................................................. I 2.0 Automatic Depressurization and Core Spray System and Interoperability Concerns.................. ............................ ........... 1 3.0 Containment Spray System PSC......................................... 4 4.0 Overview of Standby Gas Treatment System............................. 4 5.0 Corrective Action............................. ...................... 5 6.0 Unresolved Items..................................................... 6 ATTACHMENT Attachment A - Inspector's Review of Standby Gas Treatment System i

<

l

- - _ _ - _ _ - - _ _ - - . _ - _ _ _ - _ _ _  !

____-________ _

-

j

. -

i i

.

DETAILS

1.0 Summary s

This report documents the results of a review of the licensee's Prelimin-ary Safety Concern process. Specifically,' licensee corrective actions were evaluated concerning the Automatic Depressurization System, Contain-ment Spray System, and the Standby Gas Treatment Syste .

A review of the i nteroperability between the core spray system and the automatic depressurization system determined that removing a core spray system from. service reduces the redundancy of the automatic depressuriza-tion trip syste This is a condition contrary to the technical speci-fication requirements. A concern regarding the interoperability problems i between the core spray and the automatic depressurization system was first identified in a memorandum to the Plant Operational . Review Cor.imittee in '

1981 and later in 1986 in a Preliminary. Safety Concern. In both cases, the licensee took no action to correct the adverse conditio ;

A review of the Oyster Creek Standby Gas Treatment System actuation. logic j has shown that this Engineered Safety Feature System is vulnerable to single failures. Nuclear Regulatory Commission requirements, as specified in 10 CFR 50, Appendix A, are that this system be able to perform its safety function asruming a single failure. The licensee has reviewed this system design during its application for a. full term operating license and as a result of their submittal of an Updated Final Safety Analysis Repor During these submittals, the licensee did not identify or justify this departure from the General Design Criteri ,

During the discussions of inspection results, the licensee committed to complete a review of the containment spray'PSC's 86-20 and 87-003 (se Inspectica Report 50-219/88-38 and 87-04) prior to plant restart from the current outage. The purpose of the licensee review was to ensure that simi-lar conditions did not exist with PSC 66-20 and 87-003 as was found with PSC's84-018'and 86-006. In addition, the licensee plans to review.some closed out PSC's as determined by corporate licensing to determine if any conditions as found in PSC's84-018 and 86-006 exist. This review will be accomplished sometime in the future as agreed to by regional managemen The inspectors will review the results of the licensee's efforts to deter-mine if any other safety concerns are found in closed PSC' This is an unresolved item (50-219/89-06-01).

2.0 Automatic Depressurization and Core Spray System Interoperability Concerns As a result of inspection efforts detailed in :nspection Report 50-219/

88-38, the inspectors chose to review PSC 86-006, dated 5/6/86. PSC 86-006 describes a concern regarding the loss of redundancy of the automatic depressurization system (ACS) when a core spray system is made inoperabl This PSC was reviewed by corporate licensing and determined not to be a

L

_ _ - _ - _ _ - - - _ - - _ _ - - -

- _ - _ _ - _ _ - _ _ _

.

-

.

l 2

)

valid safety concern on 7/17/86. Apparently, the licensing engineer simply reviewed Table 3.1.1 of the technical specifications, found no re-ference-to the' core spray system and concluded that core spray (CS) system

'inoperability had no effect on ADS operability. The inspectors reviewed the CS and ADS logics to determine if this was a technically valid concern and if technical specification requirements were addresse The inspectors review of the ADS and CS logics identified that the RV-40 A and C differential pressure instruments for the CS system I provide. inputs to only the "A" channel (trip system) of ADS and likewise, RV-40 B and D differential pressure. instruments for the CS system II only provide input to the "B" channel (other trip system) of ADS. The RV-40's measure the differential pressure across the two core spray booster pumps in each re-spective CS system. The core spray booster pumps provide the low pressure '

injection pump permissive, derived from the RV-40 instruments, to the ADS logic. The pump permissive contacts from the RV-40 A and C instruments are in parallel with each other and jointly in series with contacts for high drywell pressure and low-low-low level in the reactor vessel in both sub logic channels in the "A" channel (trip system) of AD A similar arrangement exists for RV-40 B and D instruments. Therefore, if both core spray booster pumps in one core spray system were inhibited from operating or if a core spray system was prevented from starting, the series logic made up of high drywell pressure, low-low-low level, and the CS pump permissives in an ADS trip system ("A" or "B" channels) would be prevented from fulfilling their function by the cpen CS pump permissive contact In this event one ADS trip system would be inoperable, but the second ADS trip system would remain functional and be able to completely fulfill.the ADS functio In reviewing the technical specifications, no requirements are provided for the CS pump permissive inputs to ADS, but requirements do exist for high drywell, low-low-low level and AC voltage. The inspector was unable to determine the basis for the AC voltage requirement. Specification G.,

automatic depressurization, of Table 3.1.1, Protective Instrumentation Requirements, states that the minimum number of operable or operating (tripped) trip systems is two at all time For a condition as described above when a CS system is actually made inoperable, an ADS trip system is also made inoperable. This is not in accordance with Oyster Creek tech-nical specifications which requires two operable or operating (tripped)

trip systems. If an ADS trip system was placed in a tripped condition an ADS actuation would occur, an undesirable condition. Therefore in this condition with an inoperable trip system and unable to satisfy technical specifications, an immediate plant shutdown to cold shutdown is required by technical specifications.

I:

The inspectors reviewed recent plant operating history to determine if any ,

conditions existed that would have rendered an ADS trip system inoperable as 1 a result of removing a CS system from service. The following events were dis-covered when the plant was operating and an operable ADS was required:

- _ _ _ _ _ _ ____- _ _ --_-

-

..

, . ..

.

%.

-

.

'

,

i CS System II removed from service on 6/3/88 for approximately 8* !

hour . CS System I removed from service on 5/12/88 for approximately 7*

hour . CS System II removed from service on 7/15-16/87 for approximately 16*

hour & CS System II removed from service on 2/4-5/86 for approximately 26*

hour . CS System II removed from service on 7/2-4/85 for approximately 33*

hour . CS System I removed from service on 3/30-31/85 for approximately 13*

hour *

These hours only include actual times the equipment was posi-tioned or deenergized to prevent operation and does not include any surveillance time to ensure or verify system operabilit The inspector concluded that on at least six separate occasions in recent plant operating history that the ADS technical specification requirement of requiring a minimum of two operable trip systems was not met. In each case no attempt was made to reduce power or begin a plant shutdown to cold i shutdown. In addition, case 5 above indicates that the 30 eour action 4 statement in which the plant must be in cold shutdown was exceeded. This is considered an apparent violation of technical specifications (50-219/

89-06-02).

Additionally, the inspectors were concerned that the original problem de-scribed in PSC 86-006 was made known to the Plant Operational Review Com-mittee (PORC) in the form of a memorandum, dated August 25, 1981, with no apparent corrective actio The memorandum was very explicit in detailing precisely the ADS /CS inter-operability problem and resultant loss of redundancy of the ADS trip sys-tem and the technical specification requirements discussed above. This same safety concern was again submitted in the fonn of a PSC on 5/6/86 when the originating engineer questioned the status of corrective actio The PORC memorandum was also distributed to other responsible engineering managers and to the Oyster Creek licensing manager. Some of these re-sponsible personnel have remained in key positions onsite during the operational cases described above. The PSC as a minimum was again reviewed by the same licensing individual and determined not to be a safety con-cern. It is apparent that key personnel should have known or did know the safety significance of the ADS /CS interoperability concern and did not take proper corrective action, which resulted in an LC0 technical speci-fication violatio i

- - - _ - - . _ - _ _ - - - _ - _ - . _ _ _ _ - - - _ . -_

-- _ _ _ _ _ - - _ _ _ _ _ _ _ _ _ _ . .

.. .

.

.

.

3.0 Containment Spray System PSC The inspection effort did not involve a complete review of PSC's pertain-ing to the. containment spray system, but did obtain a commitment from the licensee to conduct a complete review prior to startup. Inspector con-cerns regarding' PSC's 86-20 and 87003 were raised previously in Inspection Reports 50-219/87-04 and 88-38. .LER 86-23 addresses the concern raised in PSC 86-20 regarding nonfunctioning of the containment spray system auto-

. matic initiation logic after a single failure of one 125 VDC power pane The-licensee had proposed eliminating the automatic initiation requirement of the containment spray system to resolve PSC 86-20. This is currently being reevaluated due to environmental equipment qualification concern ;

Other considerations include evaporative cooling provided by the spraying of cold torus water in a high humidity environment present during a LOCA condition. Licensee analysis indicates-a rapid depressurization may take place, lowering pressure to the subatmospheric range. The licensee plans to continue evaluating these dynamic conditions in the drywell in relation to eliminating automatic initiation of containment spray syste PSC 87-003 develops a concern regarding inadvertent spraying of the dry-well. The licensee's reevaluation should address this concern. Another concern that may be inferred from the FSC and that was specifically dis-cussed in IR 50-219/87-04 is the inability to use torus pool cooling (dynamic test mode) during certain accident and transient conditions. As discussed in 87-04 in the dynamic test mode, if a Lo-Lo-Level signal should occur the containment spray valves would realign to spray the dry-well and prevent torus pool cooling. To remedy this situation, jumpers could be installed. However, the emergency operating procedures for Oyster Creek, specifically EMG 3200.02, Primary Containment Control Torus Water Temperature, requires torus pool cooling to maintain torus tempera-ture below 90 degrees. Thus without any further operator action, torus pool cooling would not be available. This remains an unresolved item (50-219/87-04-03).

4.0 Overview of Standy Gas Treatment System Inspection Report 50-219/88-38 discussed a review of Preliminary Safety Concern (PSC) (84-018) that addressed a potential single failure vulner-ability of the Standby Gas Treatment System (SGTS). Inspectors reviewed this PSC, its conclusions, the electrical configuration of the SGTS logic, and the Updated Final. Safety Analysis Report (FSAR) in order to determine the validity of this concer This initial review concluded that the station FSAR described the SGTS as an Engineered Safety Feature (ESF) system. The safety function as de-scribed in the FSAR has three purposes. First, the system must auto-matica11y initiate during accident conditions whenever plant parameters exceed preset levels in order to establish a negative pressure in the Reactor Building (RB) thus preventing a ground level release of radio-active materia Second, it functions to treat the RB exhaust air by

_ _ - _ _ - _ _ _ _ _ _ - _ - _ - _ _ _ _ - _ _ - _ _ - - - _ - - _ _ . -- - _ _ . - - _ . _ __ - _ _ _ _ _ _ .

___ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

. .

.

.

'

.

5 filtering prior to release. Third, it functions to provide for an ele-vated. release of this exhaust ai The SGTS description in the FSAR, Sec-tion 6.5, referenced Instrumentation and Controls Section 7.3 as describ-ing the automatic initiation of the SGT Section 7.3.5 discusses the conformance of the instrumentation circuits to IEEE-279, Section The inspector concluded from these sections of the FSAR that the SGTS in-itiating circuits would automatically perform their protective function of initiating engineered safety features whenever plant conditions exceed preset levels and that no single failure can prevent the initiating cir-cuits from performing their protective function Since IEEE 279-1971, Section 4.2 states that "any single failure within the protective system will not prevent proper protective action at the system level when re-quired", the inspector concluded that the SGTS was being described as single failure proo In addition, General Design Criteria 41 (GDC), specifies that containment atmosphere cleanup systems be able to perform their safety function assum-ing a single fa11ure. Section 3.1 of the FSAR discusses conformance to GDC-41 and only states that the SGTS consists of two parallel, 100% capa-city systems and that it will fulfill its safety function even in the event of a loss of offsite power. The aspect of General Design Criteria 41 relative to the SGTS and of being able to perform its safety function assuming a single failure is not explicitly addresse However, Table 7.1-1 does address the General Design Criteria relative to the SGTS and GDC 41 is not include A review of the SGTS logic showed that this system is susceptible to single failures as only one logic system controls both SGTS filter train Further, the initiating logic has only one pair of relay contacts for the RPS initiation, and one pair of relay contacts for the non-RPS initiatio This deviates from the requirements of GDC 41. The licensee's evaluation concluded that the SGTS configuration was acceptable because it was ori-ginal desig This item was previously carried as an unresolved item 50-219/88-38-0 The details of the review leading to this conclusion are discussed in At-tachment A to this repor .0 Corrective Action Inspection Report 86-24 expressed a concern dealing with timely resolution of PSC' In a reply, dated 12/3/86, the licensee, in part, committed to revise the PSC procedure to establish the required time constraints. Dur-ing the inspectors review, documented in Inspection Report 50-219/88-38, the licensee had not completed the revision to the PSC governing procedure and had not included time constraints in the revision. Presently the lic-ensee plans to include time constraints in the procedure revisio _ - _ _ - _ _ _ _ _ _ _ - _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _

- _ _ _ - _ _ _ _ _ _ _ _ _ - - .___ .

.

-

.

Timely resolution of PSC's remains a concern as the following LER's demon-strat LER 88-20, dated 12/5/88, discusses a condition with radiation monitors for the isolation condenser and emergency service water system, regarding an incapability to detect a leak due to a design deficienc This was reported in a February 1985 PS LER 88-003 identified another design deficiency that had existed since 1976 with the containment par-ticulate monitor sample line isolation valves' control circuitry which does not meet single failure criteri This condition was identified in a i PSC, dated 1/88, and subsequently reported in LER 88-003 on 6/16/8 LER l 87-040, dated 11/16/87, reported a design deficiency resulting in the

.

torus oxygen sample line not meeting single failure criteria. This con-dition was first identified in September 1985 and described in a PSC the same month LERs88-003 and 87-040 describe conditions involving potential single failures that could place the plant outside its design basis con- y tainment leak rate during an accident. These LERs describe significant plant conditions due to design deficiencies that were identified by PSCs and required an extremely long time period to resolv PSC 84-018 and 86-006 were reviewed by the licensee and found not to be a safety concern. The inspectors reviewed these same PSCs, concluding to the contrary, that the PSCs were a significant safety concern (see para- ;

graphs 1.0 and 4.0) and were not properly resolved by the licensee. The '

lack of corrective action for PSC 84-018 is discussed in paragraph 4.0 and Attachment A. The concern described in PSC 86-006 was initially described in a memorandum to the PORC in 1981 (see paragraph 1.0) and was not pro-perly corrected. The failure of the licensee to identify and correct sig-nificant deficiencies is considered a violation of the requirement to establish measures to assure adverse conditions to quality are promptly identified and corrected. This is an apparent violation of 10 CFR 50 Ap-pendix B, Criterion XVI (50-219/89-06-04).

6.0 Unresolved Items Unresolved items are matters for which more information is required in order to ascertain whether they are acceptable, violations or deviation Unresolved items discussed in paragraphs 3.0 and Attachment A of this re-por I

.

!

I i

N ___ _ _- - --_____ ___ ___ _ _

_

. _ - - _ - - _ _ - _ _ - _ - _ _ _ -_ _ _ _ _ - _ _ . _ _ _ _ _ - _ _ -_ _ _ _ - -

t

'. (

.4 s

.

-

.:

7_-

ATTACHMENT A-

!

1.0 Technical Review of Standby Gas Treatment System  ;

The inspector reviewed,-with the licensee, what indications would be available..to the operators _of a loss of power to the logic, and what ef-fects this loss'of power would have on SGTS operatio .1' Indications of a loss of Power The licensee identified that this power source (VACP-1) is required to be operable, per plant technical specifications, and that loss of this panel is annunciated in the control room. In addition, the l

. panel is powered from two vital buses via an automatic transfer l switch. If power is lost at the panel output breaker, or somewher between the power panel and the control room panel 11R, indicating lights will be lost, signaling the operator that there is a defi-cienc ,

1.2 E_ffects of a Power Loss on SGTS Operation l l

The loss of power from panel VACP-1 would result in an inability to j-energize the SGTS initiating relays, which must energize in order to l automatically . initiate the syste Therefore, the ability of the  !

SGTS to automatically initiate is defeated. The control room opera- l tor would be able to manually start a SGTS fan, however, as it has a  !

different power source than the system control logic. Also, the fil- l

'

ter preheaters would not be operable, thus resulting in an elevated )

humidity and a reduced filter efficienc The licensee has indicated '

that the. expected filter efficiency in this mode is 78%. Normally, the filter would have an efficiency of >90%. The licensee indicated  !

that calculations have been performed indicating that this efficiency {

of the filters is acceptabl .

j

.l The system would also be degraded in that the filter train orificed  !

purge valve would remain open. This degrades system performance an- l other 2%. l Discussions regarding what indications the control room operator l would have for system operation indicated that the operator would i have a light indicating that the fan was running. No SGTS damper l positions would be available, and the licensee had no conclusion as '

to whether or not the filter train exit temperature indicators would be functionin The inspector indicated to the licensee that this degraded mode of l operation of the SGTS had not been described in any submittals to the j NRC, nor had the calculations indicating the acceptability of reduced i filter efficiency been reviewed by the NR j I

_ - -- __

__

. .

,

'

-

l

'

. t

)

. Attachment A ,

2 l 1.3 Other Logic Single Failure Vulnerabilities In addition to the susceptibility of the system to a loss of power in the controls circuits, the system is vulnerable to single failures in the relay contacts that must close in order to initiate the syste In each case (RPS and non-RPS), there is only one relay, and thus one pair of contacts for system initiatio If this single pair of con-tacts fails to close, then the system will fail to automatically in-itiat In addition, since the reactor building isolation signal is generated from the SGTS, reactor building ventilation will remain in its normal line-up. In this configuration, Reactor Building negative differ-ential pressure will be maintained by the normal supply and exhaust fans; therefore, the reactor building exhaust will be untreated and the low negative differential pressure annunciator will not be actu-ated. Secondary containment isolation and SGTS initiated would have to be manually actuate .4 Conclusions The SGTS is susceptible to single failures preventing automatic sys-tem operation. The control room operator will be able to manually start a filter train, but under conditions of a loss of control logic power, the filter train will operate in a degraded mode. Indication in the control room to reflect system operation will be limite .0 Review of Licensee Supnittals Concerning the SGTS Since the SGTS logic configuration is not designed to operate assuming a single failure , the inspector reviewed.with the licensee the system de-scription in the FSAR. The licensee indicated that even though Section 6.5 referenced Section 7.3 as describing the SGTS initiation, the Section 7.3 discussions in regard to IEEE 279, section 4.2, vere only applicable to the initiating instrumentation circuits. The licensee further indi-cated that these statements made no reference to the SGTS actuating cir-cuits. The inspector stated that IEEE 279, section 4.2, requires that any single failure in the protection system shall not prevent proper protec-tive action at the system level when required.

,

'

In regard to the FSAR's discussion of GDC-41, the licensee indicated that the absence of a specific discussion of a criteria indicated that the plant did not conform to that aspect of the criteri The departure from GDC-41, that the SGTS will not perform its safet.y function assuming a single failure, was not identified by the licensee in its Updated Final Safety Analysis Report.

l

. _ _ _ _ . _ _ _ - . _ . _ _ . _ _ _ _ . _ _ _ _ . _ _ . _ . _ . _ . _ -

- - _ _ _ _ _ _ _ __ - . - - _ _ - _ _ _

(.

,

- -

. u L' 1

. .

Attachment A '

,

The licensee further indicated that to actually understand the licensing l basis.of the' SGTS,'you had to review the original submittals in the ori-

'

ginal Facility Description and Safety Analysis Report (FDSAR). Copies of the pertinent portions of this document and also of Amendment 68 to the FDSAR'(the 6pplication for a full term operating license) wer requestm and provided to the inspector, which are discussed belo Since the licensee indicated that the SGTS was never intended-to be single failur'e proof, the inspector requested the SGTS design. basis documenta-tio Corporate engineering had not located the SGTS design basis infor-mation prior to the end of the inspection (Unresolved Item 50-219/89-06-05).

2. I' Comparison of FDSAR System Description to FSAR System Descriptio The inspector reviewed the FDSAR SGTS description and compared this to the FSAR system description. While the two descriptions generally agreed, one aspect of the system design found in the~FDSAR was absent in'the FSAR. This was that the_ system consisted of two. filter trains, and that either of the two filter trains is considered as an in-stalled' spar Licensing engineers stated that the system is essen-tially one system with an installed spare filter train. This is in contrast to the FSAR which states that the system consists of two parallel, 100% capacity systems. In addition, plant Technical Speci-fications require two separated and independent SGTS circuits. The inspector indicated _that the automatic control aspects of the two filter trains were not separate and independent. The licensee re-sponded by stating that these redundancy requirements only apply to the filter train component The FDSAR'also specifies that for the SGTS to be considered operable, it shall have at least one standby gas tre atment' fan with its associ-ated filters and isolation valves operable, have a filter efficiency not less than 90%, and start automaticall The inspector concluded that with the single failure of VACP-1, two of the three requirements would not be me Based upon the original FDSAR system description, the licensee has indicated tha+ the original system design was not intended to with-stand the effects of a single failure, and that this constitutes the original licensing basis of the system. The inspector concluded that the FSAR does not completely and accurately describe the SGTS design in that it 'Is necessary to review the original FDSAR to understand that the system is not two separate and independent subsystem .2 Licensee Application of Regulatory Guide 1.53 The licensee described in its application for a full term operating license, Amendment 68 to the FDSAR, their interpretation of Regula-tory Guide 1.53, Application of the Single-Failure Criterion to Nuc-lear Power Plant Protection Systems. The licensee indicated in this

__ _ _ _ _ - - _ _ _ _ - _ -

. __ _ _ _ _ _ - _ _ - _ - _ - - _ _ _ - _ _ _ - _ _ _ _ _ _ - _ - - - - - - _ - - - - - - - - _ _ _ _ - - - - _ _

- .

Le o .

,

Attachment'A 4 submittal that this criteria would be applied to plant systems'that

. protected reactor coolant systems. Section 4.3 of Amendment 68 re-flects this interpretation of Regulatory Guide 1.53, and lists and discusses plant systems' conformance to IEEE 279. This discussion does not include the SGTS. The licensee indicated that their omission of.the SGTS indicates that the system does not meet the single fail-ure criteria.

l l The guidance of 1.53 also specifies that in applying the single fail-

,

'

ure criteria, that single failures should be assumed in both the pro-tection circuits and the system actuating circuit .3 Licensee Evaluation of SGTS Against Regulatory Guide 1.52 In Supplement 6 to Amendment 68 of the.FDSAR, the licensee submitted a comparison of the.SGTS design against the requirements of Regula-tory Guide 1.52, Design, Testing and Maintenance Criteria for At-mosphere Cleanup System Air Filtration and Adsorption Units of Light-Water-Cooled Nuclear Power Plants. The licensee's conclusion stated that, in their opi.nion, the SGTS complies with the intent of the guide and will satisfactorily perform its function as an engineered

- safety feature syste . Instrumentation and Controls' Requirements '"

The inspector reviewed this submittal against Regulatory Guide 1.52. Paragraph 2.h of 1.52 Specifies acceptable power supply and instrumentation and controls requirement Specifically, 1.52 identifies IEEE 279 as acceptable design h for the instrumentation and equipment controls. IEEE 279 Section 4.2 specifies that the system function assuming a single failure. The licensee discussion of SGTS design against these requirements stated that the system was de-signed in accordance with.the standards in place at the time of construction. The licensee further stated that systems are provided with separate and independent emer- '

gency power supplie The intont of 1.52 for instrumentation and controls is that the system function assuming a single failure; the licensee did not address this in their evaluation of the SGTS sys-tem. The evaluation appears to be deficient in that it did not identify the inability of the SGTS to function under certain conditions of a single failure, and thus did not accurately portray the system desig .

- __a-m__m._.___m_-- _m_m_ .--__mm_m._-__.-__m.--m_ _ ___m

- _ _ _ _ _ _ _ -

.. .

.

.

-

.

'

Attachment A'. 5 2. Physical Separation Requirements Paragraph 2.b of 1.52 specifies the physical separation re-quirements of redundant ESF atmosphere cleanup system It specifies that they should be physically separated so that damage to one system does not also cause damage to the second system. The guide also specifies that the genera-tion of missiles from high pressure equipment rupture, ro-tating machinery failure, or natural phenomena should be considered in the design for separation and protectio The licensee discussion of the Oyster Creek SGTS physical separation identifies that the two filter trains are located in a compartment physically isolated from potential missiles generated from high pressure equipment rupture, rotating machinery failure, or. natural phenomena. While the licensee evaluation does identify that the exhaust fans are located above ground, in proximity to the_ turbine build-ing exhaust fans, the licensee does not address the fact that there is_ no physical separation or barrier between the SGTS filter trains themselve The intent of the guide was, in part, to specify physical separation between filter. trains. The evaluation also ap-pears to be deficient in that it did not address the lack of physical separation between the two filter trains, and '

thus did not accurately portray the system configuratio .4 Licensee Submittals Addressing Facility Conformance to GDC The General Design Criteria became effective on May 21, 1971 and the Oyster Creek facility was issues a license in 1969. However, in the process of obtaining a full term license and in meeting 10 CFR 50.71, the licensee has updated various sections of the FSAR which may have introduced conflicting statements.

i 10 CFR 50, Appendix A, GDC-41 requires Containment Atmosphere Cleanup l Systems be designed to fulfill their safety functions assuming a single failure. The regulations also specify that applicants are required to include principal design criteria as part of the appli-cation, and that these General Design Criteria establish minimum re-quirements for the principal design criteria for water cooled nuclear power plants. The regulations also recognize that some GDC cay not always be sufficient, and that some GDC may not be necessary or ap-propriate. The applicant is required to identify and justify depar-tures from the General Design Criteri ___.- - ___ _____

._ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - _ - _ - _ _ _ _ _ -

,

.m '

.

'

- Attachment A 6 2. Review of Sectinn f Licensee Application for Full Term

. 0perating License (Amendment 68 to the FDSAR)

In the licensee's application for a. full term operating license, Amendment 68.to the Facility Description and Safety Analysis Report, submitted in March of 1972, the'-

Oyster Creek Nuclear Generating Station was evaluated against the General Design Criteria, 10 CFR 50, Appendix The licensee stated in this submittal that "the cri-teria~have been used as a bases for conducting al reference audit of the system by subject matter". The licensee fur-ther stated that "the. design bases of the plant have been evaluated against'each of the six groups of the criteri In each group the current interpretation of the intent of the criteria is stated, and the plant design conformance to this interpretation is discussed".

In the paragraphs addressing GDC-41, the licensee does not identify that.the SGTS is not designed to perform its safety function assuming a single failure. The licensee was required to identify this departure from the GDC and provide justification for the departure from 10 CFR 50, Appendix NRC-issuance of the Full Term Operating License is pendin . Review of the Updated Final Safety Analysis Report (FSAR)

In Section 3.1 of the FSAR, December 1984, the licensee discusses conformance with NRC General Design Criteri The-licensee identifies that as part of the application for a Full Term Operating License (Amendment 68 to the FDSAR),

the design of the station, as of March 6, 1972, was evalu-ated against the requirements of 10 CFR 50, Appendix A,  ;

General Design Criteria for Nuclear Power Plants, in effect on July 7,1971. The licensee then states that the discus-sions presented in this section (FSAR) reflect'this evalu-ation, which was submitted as Amendment 68 to the original >

Facility Description and Safety Analysis Report (FDSAR).

In Section 3.1, the licensee presents the evaluations per--

formed in Amendment 68, and describes these evaluations as i being the design of the station as compared to the require- ,

ments of 10 CFR 50, Appendix The discussions of Amend-  !

ment 68 did not constitute a review of the design of the station-as compared to the requirements of the GDC, but was *

a review of the design of the station as compared to the licensee's "... interpretation of the intent of the cri-

'

teria".

l l

__-_---__-__-_----__-_---__._L._-_.--_-_ _---------------------------------------------------------------L-----------------------------------

.

_ - _ -

. .

Attachment A 7 2. Conclusions .

As presented in Amendment 68, application for a full term operating license, Section 4, the licensee's discussions represent a comparison of Oyster Creek design as compared to the licensee's "... interpretation of the intent of the criteria." As such, they do not meet the requirements specified in 10 CFR 50, Appendix A, in that the licensee does not identify and justify all departures from the GD Since the discussions submitted in the Updated Final Safety Analysis Report, Section 3.1, are essentially the same as those presented in Amendment 68, the licensee again failed to identify and justify departures from the GDC. Speci-fically, the licensee did not identify the fact that the SGTS is not designed to perform its safety function assum-ing a single failur Fur ther, Table 7.1-1 describes in-strumentation systems, specifically the standby gas treat- i ment system, e.nd the GDC against which they were receive GDC 41 is not listed as being applicabl .0 Licensee Evaluation of Standby Gas Treatment System Preliminary Safety Concern

The licensee was alerted to a potential safety concern involving the SGTS design by a Preliminary Safety Concern (PSC). This concern stated, in part, that the SGTS may be susceptible to single failures. NRC inspectors l reviewed the licensee " Preliminary Safety Concern" process, and this '

evaluation is d ucussed in Inspection Report 50-219/88-38. 1he inspector reviewed this specific PSC in order to evaluate the licensee's approach in handling self identified potential safety concern The licensee evaluated this concern by reviewing the SGTS design, regula-tory requirements, and SGTS licensing basis. The licensee concluded that the SGTS was vulnerable to single failures but that the system design was in accordance with the original system design. A Technical Functions Work Request (TFWR) was submitted requesting evaluation for potential design change. This TFWR was closed out with no design change performe .0 Conclusions I 4.1 The Oyster Creek SGTS is vulnerable to single failures in the loss of electrical power to the logic, and in a failure of one pair of relay contacts to close. These failures would defeat the automatic initi-ation of an Engineered Safeguards Featured system that is required to mitigate the consequences of postulated accident The system would be able to be manually started, but would operate in a degraded mode. Indications available to the control room operator would be limited. This degraded mode of operation is not presented l in licensee submittals to the NR _ _ _ _ _ _ _ - _ _ _ _ _ _ - _ _ _ _

'

.. .

.

,' y .

- -.

s

! Attachment A 8 4.2 The FSAR discussions of the design of.the SGTS ' initiating circuits

.are conflictin .3 Pertinent information concerning the design features of the SGTS con-

~ tained in the FDSAR was omitted from the FSA .4 The licensee interpretation.of Regulatory Guide 1.53 was'not compre-

'hensive in that it omitted from consideration the SGT .5 The licensee evaluation.of the SGTS against Regulatory Guide 1.52 was inadequate in that it did not identify that the SGTS instrumentation and controls do not conform to the requirements of IEEE 279; and that-the SGTS filter train configuration does not' meet the.specified physical separation requirements.

, 4.6 In the licensee application for a full term operating license, and the Updated Final Safety Analysis Report, the licensee. failed to identify-and justify all departures from the General Design Criteri 'Specifically the licensee did not identify that the SGTS'would not

,

perform its safety function assuming a single failur .7 The licensee evaluation of this Preliminary Safety Concern was in-adequate'in that.it did not resolve discrepancies within the design basis documents and clearly justify: the deviation j i

.I I

.

i