IR 05000220/1996016
| ML17059B388 | |
| Person / Time | |
|---|---|
| Site: | Nine Mile Point, Hope Creek  |
| Issue date: | 12/31/1996 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML17059B387 | List: |
| References | |
| 50-220-96-16, 50-410-96-16, NUDOCS 9701060263 | |
| Download: ML17059B388 (36) | |
Text
U.S. NUCLEAR REGULATORY COMMISSION REGION I
Docket Nos:
License Nos:
50-220; 50-410 DPR-63; NPF-69 Report Nos:
50-220/96-1 6; 50-410/96-16 Licensee:
Niagara Mohawk Power Corporation Facility:
Nine Mile Point, Units 1$.2 Location:
Scriba, New York Dates:
October 28 - November 1, 'l996, November 18-22, 1996, and December 17-19, 1996 (in-office)
Inspector:
Leonard S. Cheung, Sr. Reactor Engineer Approved By:
William H. Ruland, Chief, Electrical Engineering Branch Division of Reactor Safety 9701060263 96i23f PDR ADQCK 05000220
EXECUTIVE SUMMARY Nine Mile Point Engineering Inspection Report 50-220/96-16 and 50-410/96-16 This engineering inspection was conducted:
1) to review licensee corrective actions in response to the identification of inoperability of redundant control room chillers on August 14, 1996; 2) to review licensee corrective actions following the failure of RCIC turbine lube oil cooler pressure control valve (2ICS" PCV115) in January 1991; 3) to review a plant design change (SC2-0077-93) to ascertain whether the design and implementation met the regulatory requirements; and 4) to evaluate for closure of two previously identified inspection items.
EnrnineerinE The licensee responded appropriately following the identification of both control room chillers to be "inoperable."
The licensee entered a one-hour LCO and commenced plant shutdown in accordance with Nine Mile 2 Technical Specifications requirements.
The licensee promptly corrected the improper setting of the chiller's low condenser water flow trip setpoints, and exited the LCO within four hours.
The 1988 setpoint calculation for the control room chiller condenser water low flow trip and the 1992 review of the adequacy of this setpoint calculation failed to include the effect of pressure transient in the service water system, resulting in improper trip setpoints-being implemented (a violation of 10 CFR 50, Appendix B, Criterion III, Design Control).
The improper condenser water low flow setpoints for the redundant control room chillers were not identified and corrected although a chiller was tripped three times due to low flow in September, 1995 (a violation of 10 CFR 50, Appendix B, Criterion XVI, Corrective Action).
From June 1989, till August 14, 1996, both control room chiller subsystems were inoperable in that the chiller trip setting for the condenser water low flow was too high (250 gpm).
During a postulated design basis accident when the diesel generators start, the service water pressure transient could cause both chillers to trip, causing both control chillers to be inoperable (a violation of Nine Mile Point Unit 2 Technical Specifications, Section 3.7.3).
In June 1992, the licensee made a design change in the reactor core isolation cooling (RCIC) system by defeating the control function of the RCIC turbine lube oil cooler pressure control valve (2ICS" PCV115) without performing a safety evaluation in accordance with 10 CFR 50.59 (a violation) ~
The RCIC turbine lube oil cooler pressure control valve (2ICS" PCV115) was inoperable for more than five years, from January 26, 1991 to September 1996 (a violation of 10 CFR 50, Appendix B, Criterion XVI, Corrective Action).
The calculation that was used as the basis for two operability determinations was incorrect and had not been independently reviewed.
Use of this calculation had caused a wrong conclusion to be drawn for the operability determination (a violation of 10 CFR 50, Appendix B, Criterion III, Design Control).
There were no valid operability determinations to demonstrate that the RCIC system was operable from January 26, 1991, to September 1996 (a potential violation of Technical Specifications Section 3.7.4).
In 1985, the architect engineer for Nine Mile 2 changed the design of the RCIC turbine lube oil cooler pressure control valve (2ICS "PCV115) from a "self-contained downstream sensing control valve," to an "electro-hydraulic operated valve."
However, the licensee failed to update Section 5A.6.2.2, Item 4, of the FSAR to reflect the actual design condition (a violation of 10 CFR 50.71(e)).
The design for simple design change SC2-0077-93 was inadequate, in that an incorrect size for the restricting orifice was implemented due to a deficient calculation, This calculation used an incorrect downstream pressure of a pressure control valve (2ICS" PCV115) in the RCIC system, resulting in an operating pressure that could exceed the design pressure of the RCIC lube oil cooler and its associated piping system (a violation of 10 CFR 50, Appendix B, Criterion III, Design Control).
Because the operating pressure in the RCIC turbine lube oil cooler and its associated piping system could exceed their design pressure, an operability determination of the RCIC system in accordance with Generic Letter 91-18 was required to justify the plant's operation.
The operability determination was in progress at the close of the inspection period.
The inspector's review of the surveillance test result of the RCIC system indicated that the measured flow through 2ICS" PCV115 differed significantly with the calculated results.
This could mean that the flow coefficient (C) of 2ICS" PCV115 might be different than the Cspecified ( an unresolved item pending licensee's evaluation to determine the actual Cof the valve).
Two previously identified inspection items (IFI 50-220/96-07-16 and URI 50-410/96-10-02) were close Re ort Details E1.1 Unit 2 Control Room Chiller Issue aa Ins ection Sco e
The inspector reviewed the corrective actions in response to the identification of inoperability of redundant control room chillers on August 14, 1996.
Observation and Findin s
~Back round There were two control room chillers at Unit 2, each rated 100% capacity, to cool the control room to an acceptable temperature.
Normally, the control room was maintained at about 70 F with both chillers running at all times.
Each chiller condenser was cooled by service water from the respective header (train A or B).
These service water headers also supply cooling water to other safety-related (including the emergency diesel generators (EDG)) and nonsafety-related equipment.
The service water flow to each control room chiller was measured by a Rosemount flow transmitter (FT29A,B), which provided signal to a tow-flow switch (FSL29A,B).
If the flow fell below the low-flow switch setting, the chiller would be deenergized (tripped) for chiller protection.
Operability of these chillers was required to maintain the control building temperature below an acceptable level, such that the electrical equipment in the control room, relay room, and remote shutdown room, could function properly during normal plant operation and during a postulated design basis accident (DBA)~ Originally, FSL29A,B was set at 215 gpm.
In 1988, this setpoint was recalculated to be 250 gpm because of two reasons:
(1) new vendor data for Rosemount transmitters (minor contribution for the change); and (2) anticipation of a planned modification to install a new I/E converter in the control circuit (major contribution for the setpoint change).
In the 1988 calculation, (No. 12177-CS-SWP"09, "Setpoint calculation for 2SWP" FSL29A,B Service Water for Control Building Chillers Low Flow Alarm," Revision 5, dated July 11, 1988), the licensee failed to recognize that pressure and flow transients in the service water system could cause the flow to dip below the setpoint, causing inadvertent trip of the control room chillers.
In 1989, the licensee implemented the setpoint change (from 215 gpm to 250 gpm) without realizing that the planned modification for the new I/E converter (Modification PN2Y87MX057) was never implemented.
In 1992, the licensee reviewed the new setpoint (250 gpm) following the cancellation of Modification PN2Y87MX057. The review concluded that the higher setpoint (250 gpm) was more conservative than the lower one (215 gpm).
Again, the reviewer failed to recognize that the pressure and flow transients in the service water system could cause the service water flow to the chitlers to dip below 250 gpm, thus tripping the control room chillers inadvertently, causing both chillers to be inoperabl During a postulated DBA, the start of the three emergency diesel generators (EDG)
would cause a pressure transient in the service water system.
This pressure transient could trip the chiller inadvertently, and could jeopardize safe shutdown of the plant if chiller operations were not restored on time. The inspector concluded that the failure to include the effect of pressure transient into the setpoint calculations constituted an apparent violation of 10 CFR 50, Appendix 8, Criterion III, "Design Control," which requires the design control measures to provide for verifying and checking the adequacy of the design, such as by the performance of design reviews or by the use of alternate or simplified calculation methods. (50-410/96-16-01)
The Event On August 13, 1996, while operating at 100% power, the Division II control room chillers tripped on low service water flow to the chiller condenser, during the performance of Division II emergency diesel generator (EDG 3) surveillance testing.
The licensee declared Division II chiller to be inoperable and entered a 7-day limiting condition for operation (LCO). The licensee determined that the low flow trip setpoint of 250 gpm was too high.
Further evaluation by the licensee indicated that the same condition could occur to Division I chiller when Division II EDG (EDG 1)
and Division III EDG (EDG 2) started following a postulated DBA. On August 14, 1996, the licensee declared both control room chillers inoperable and commenced a plant shutdown.
The licensee promptly completed an engineering calculation (A10.1-N-335) and determined that, under a severe transient condition, the service water flow to each of the chillers could dip to 221 gpm.
The licensee also completed another calculation (CS-SWP"09, revision 5) to include the instrument tolerance and uncertainty, and established the low flow trip setpoint to be 210 gpm.
Subsequently, the licensee changed the low flow setpoint from 250 gpm to 210 gpm and exit the LCO within four hours after commencing the plant shutdown.
The licensee also reported the event to the NRC in licensee event report (LER) 96-10 on September 12, 1996.
The inspector reviewed LER 96-10 and found the report to be generally accurate with the following exception:
ln Section II, "Cause of Event," the report stated: "ln September 1995, a chiller trip occurred concurrent with the start of an EDG. This occurred while the plant was in cold shutdown."
However, the inspector found that the same chiller had tripped three times in September 1995. Two of the trips were concurrent with the start of the EDGs.
The detail of this is discussed in "Previous Similar Events," later in this section of this repor The inspector also reviewed engineering calculation A10.1-N-335, "SWP to Control and Relay Room Chiller Minimum Flow Under Transient Conditions," Revision 1, dated August 16, 1996, and Calculation CS-SWP"09, "Setpoint Calculation for 2SWP" FSL29A/B, Service Water for Control Building Chillers Low Flow Alarm,"
Revision 5, dated August 16, 1996.
The inspector determined these calculations to be acceptable.
The inspector also reviewed another engineering Calculation, HVC-074, "Control Room Heat-up Assuming Degraded Control Room Cooling,"
Revision 1, dated September 10, 1996.
This calculation showed that when both control room chillers were inoperable, the control room temperature would take about 16 minutes to reach the unacceptable temperature of 90'F.
The inspector found this calculation to be acceptable.
Allthree calculations received proper independent reviews and were thorough.
Design input sources were appropriately identified and assumptions were properly justified.
However, the inspector determined that from June 1989 until August 14, 1996, both control room chiller subsystems were inoperable in that the chillers'rip setting for the condenser water low flow was too high (250 gpm).
During a postulated DBA when the diesel generators start, the service water pressure transient could cause both chillers to trip, causing the chillers to be inoperable.
This constituted a
violation of Nine Mile Point Unit 2 Technical specifications, Section 3.7.3, which requires two independent control room chiller subsystems to be operable when the plant is in operation modes 1, 2, 3 and when irradiated fuel is being handled in the reactor building and during core alterations and operations with a potential for draining the reactor vessel and uncovering irradiated fuel. (50-410/96-16-02)
Root Cause Anal sis and Lon -Term Corrective Actions The licensee completed a thorough root cause analysis for this event, and attributed the cause of the event to be a design analysis deficiency.
This root cause analysis also identified and recommended the following long-term corrective actions:
Review all service water trip functions to verify that transient conditions had been considered (completion date: December 31, 1996).
2.
Review other hydraulic systems, as deemed necessary, to ensure that a similar design deficiencies did not exist (completion date: March 31, 1997).
3.
provide a lessons-learned training to engineering staff to emphasize the importance of considering the impact of trip setpoints on plant operation during surveillance and transient conditions (completion date:
November 31, 1996).
Remove the trip function of chiller-low-service-water-flow, 2SWP" FSL29A/8, but maintain the alarm feature (the licensee had determined that this trip function was not essential, target implementation dated:
December 31, 1997).
The inspector reviewed the licensee root cause analysis and determined that this analysis was thorough and was technically accurate.
The identified long-term corrective actions were appropriate.
Previous Similar Events The inspector reviewed licensee's operation records for previous similar events, and found the following:
In September, 1995, while Unit 2 was shutdown, Division II chiller was tripped three times (once on September 6, 1995, and twice on September 9, 1995), all due to low condenser water flows. Two of these trips were due to start of the emergency diesel generators, causing service water flow dip below the low flow trip setpoint, which was identical to the August 13, 1996, event, although the plant operation modes were different. The licensee issued deviation/event report (DER)
2-95-2558 on September 10, 1995, to address this repetitive trip problem.
The inspector's review of this DER indicated that the licensee had declared the chiller to be inoperable at that time and had entered a 7-day LCO on September 9, 1995.
The licensee later performed an operability determination and determined the chiller to be operable.
Although the "Cause of Deviation/Event" of the DER had identified these repeated trips were caused by the pressure and flow transients, which was identical to that which caused the August 13, 1996, event, the licensee failed to take appropriate corrective actions to identify (by applying the pressure and flow transient to the setpoint evaluation) and correct the low flow trip setpoint problem at that time. This constitutes an apparent violation of 10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," which requires measures to be established to assure that conditions adverse to quality are promptly identified and corrected (50410/96-16-03).
The corrective actions taken by the licensee at that time included changing operator's response to the chiller trip alarm (to reduce service water flow to nonessential loads).
Conclusion The inspector concluded that the licensee responded appropriately following the identification of both control room chillers to be inoperable.
The licensee entered one-hour LCO and commenced plant shutdown in accordance with Nine Mile 2 Technical Specifications requirements.
The licensee promptly corrected the improper setting of the chiller low condenser water flow trip setpoints, and exited the LCO within four hours.
The licensee later issued LER 96-10 in accordance with 10 CFR 50.73 requirements.
The inspector's review of the licensee documents indicated that, in the 1988 setpoint calculation for the control room chiller's low condenser water flow trip setpoints, and in the 1992 review to determine the adequacy of the new setpoints, the licensee failed to include the effect of the pressure transient into the setpoint calculations.
The inspector determined this design deficiency to be a violation of 10 CFR 50, Appendix B, Criterion III, "Design Control," which requires the design control measures to provide for verifying and checking the adequacy of the desig The inspector's review of the licensee operation records indicated that in September 1995, white Unit 2 was shutdown, Division II control room chiller tripped three times, all due to low condenser water flows. Two of these repeated trips were identical to the Division II control room trip that caused the August 13, 1996, event.
The inspector determined that the corrective actions for the September 1995 repeated chiller trips were inadequate in that the licensee failed to identify and correct the improper setting of the chiller's low condenser water flow trip setpoint.
The inspector determined this inadequate corrective action to be a violation of 10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," which requires deficient conditions to be identified and corrected promptly.
The improper setting of the control room chiller low service-water flow trip setpoint also caused both control room chillers to be inoperable in that when the three EDG started in response to a postulated accident, the pressure and flow transient in the service water system could cause both chiller to trip. The inspector determined this condition to be in violation of Nine Mile 2 Technical Specifications, Section 3.7.3, which requires two independent control room chiller subsystems to be operable when the plant is in operation modes 1, 2, 3 and when irradiated fuel is being handled in the reactor building and during core alterations and operations with a potential for draining the reactor vessel and uncovering irradiated fuel.
Unit 2 Reactor Core Isolation Coolin RCIC Pum Lube Oil Cooler Pressure Control Valve Ins ection Sco e
While reviewing the plant modification package for replacing the RCIC turbine lube oil cooler pressure control valve (2ICS" PCV115, discussed in Section E1.3 of this report), the inspector noted that this pressure control valve had not been functioning for an extended period before it was replaced by a valve of a different design during the September 1996 refueling outage.
The inspector reviewed licensee documents that pertained to this valve before the September 1996 replacement.
Observations and Findin s The RCIC system at Nine Mile 2 was a safety-related system which was used to provide reactor core cooling in addition to other core cooling systems, when the reactor was isolated from the turbine generator and condenser systems.
The RCIC system was also used to cool the reactor core during a postulated station blackout (SBO) condition.
Valve 2ICS "PCV115 was used to reduce the water pressure from the RCIC pump discharge pressure (varies from 264.5 psia to about 1290 psia)
down to about 125 psia for the RCIC pump lube oil cooling.
Upstream of this valve was a motor-operated valve (2ICS "MOV116), which opened when the RCIC pump was in operation.
The cooling water passed through these two valves to the tube side of the RCIC turbine lube oil cooler and then through a restricting orifice (2ICS" R0207), before returning to the suction of the RCIC pump.
All valve bodies and piping design in this subsystem were required to meet the ASME Section III Class 2 requirements.
The design pressure downstream of 2ICS" PCV115 was 150 psi There was a relief valve (2ICS "RV112) between 2ICS "PCV115 and the lube oil cooler.
This relief valve, which discharges to the equipment drain sump in the reactor building, was set at 150 psig to provide protection to the cooler and the piping.
All pipe sizes were 2 inches except the lube oil cooler, which had 1-inch cooling tubes.
Before initial startup in 1987, the piping downstream of 2ICS" PCV115 was subjected to a hydrostatic test of 225 psig, and the tube side of the lube oil cooler was hydrostatic-tested by the RCIC turbine manufacturer to 280 psig.
The RCIC system was designed and supplied by General Electric Company (GE).
In the original GE design, 2ICS" PCV115 was a self-contained downstream sensing pressure control valve.
In 1985, Stone and Webster (the architect engineer for Nine Mile 2) changed this valve to an electro-hydraulic valve and added a control loop with a Rosemount pressure transmitter (PT 115) and Foxboro controller (PC115) to provide control function of this valve.
This design change was documented in a GE engineering change notice, ECN No. NJ68503, dated August 12, 1985.
According to the licensee, the valve (2ICS "PCV1'l5) had been working unsatisfactorily since initial startup.
Because of the unique design of the valve actuator, replacement parts were very difficultto get and usually took a very long time for delivery.
The inspector's review of the operational records of this valve revealed that many repairs of the valve actuator had been accomplished before January 1991.
On January 23, 'l991, the licensee prepared a one-page evaluation, entitled,
"Justification for Operation with 2ICS" PCV115 Failed Open."
This evaluation assumed that the relief valve (2ICS" RV112) functioned ideally as a pressure control valve.
Based on the pressure setting of the relief valve, the licensee calculated that the pressure downstream of 2ICS "PCV115 could be maintained below 165 psig.
This evaluation did not have a conclusion whether an operating pressure of 165 psig was acceptable or not since the system design pressure was only 150 psig.
In addition, this evaluation used a wrong flow coefficient (C) of 1.14 for 2ICS"PCV115.
Cshould be 1.6 as the licensee found out later in a June 15, 1992, calculation.
On January 26, 1991, the licensee knowingly left valve 2ICS"PCV115 in the failed open position.
The failed open position of this valve was not corrected until September 1996, when the valve was replaced with an air-operated valve of different design.
This tack of prompt corrective action constituted an apparent violation of 10 CFR 50, Appendix B, Criterion XIV, Corrective Action, which requires measures to be established to assure that conditions adverse to quality, such as failures, malfunctions, and nonconformances are promptly identified and corrected (50-410/96-16-04).
On June 16, 1992, and again on August 24, 1993, the licensee issued two
"operability determinations" (same content, issued twice) to justify the operability of the RCIC system with 2ICS "PCV115 in the failed open position.
Both documents were signed by the Unit 2 engineering manager and the manager of licensing.
According to the licensee, the evaluation of these documents was based on a Niagara Mohawk calculation, entitled, "RCIC Pump Cooler Differential Pressure Evaluation," dated June 15, 1992.
This calculation had not been independently reviewed.
The inspector's review of this calculation indicated that this calculation was incorrect in that the licensee forgot to include the suction pressure (55.61 psia)
of the RCIC pump when calculating the downstream pressure of 2ICS "PCV115, assuming the relief valve failed to open.
The calculated pressure (199 psig)
provided a wrong basis (less than the hydrostatic-tested pressure of 225 psig) for the operability determination, when, in fact, the total pressure (differential pressure plus pump suction pressure)
should be above 225 psig.
The inspector concluded that this condition was in violation of 10 CFR 50, Appendix 8, Criterion III, Design Control, which requires that the design control measures shall provide for verifying and checking the adequacy of the design, such as by the performance of design reviews, or by the use of alternate or simplified calculational methods (50-410/96-16-05).
Since both operability determinations were invalid because of an incorrect basis that was being used, the licensee. had never demonstrated that the RCIC system was operable from January 26, 1991, until September 1996.
This condition could potentially violate Nine Mile 2 Technical Specifications, Section 3.7.4, which requires that the RCIC system shall be operable when the reactor steam dome pressure is greater than 150 psig (50-410/96-16-06).
In June 1992, the licensee defeated the control function of 2ICS "PCV115 by removing the power supply to the control valve.
Defeating the control function of 2ICS" PCV115 caused the following nonconformance with the Nine Mile 2 Updated Final Safety Analysis Report (UFSAR):
UFSAR Figure 5.4-9C for the RCIC system clearly indicated that valve 2ICS "PCV115 was controlled by the control loop consisting of pressure transmitter 2ICS" PT115 and pressure controller 2ICS "PC115.
Defeating the control function of 2ICS" PCV115 would make the control loop invalid.
UFSAR Table 3.9A-12 listed 2CIS" PCV115 as an active valve.
Defeating the control function of this valve essentially made this valve inactive.
~
UFSAR Section 5.4.6.2.2, "Design Conditions," indicated that the operating parameters were as shown in Figure 5.4-10.
Figure 5.4-10 showed that the design pressure downstream of 2ICS "PCV115 (GE valve No. F015) was 150 psig.
With the control function defeated and 2ICS" PCV115 failed to the open position, the operating pressure at this location, based on the licensee's calculations, was above 150 psig.
In addition, during the quarterly RCIC surveillance tests, which lasted about three hours for each test, the licensee confirmed that relief valve 2ICS" RV112 opened, indicating operating pressure exceeding 150 psig design pressur The above conditions indicated that design changes had been made to the RCIC system as described in the UFSAR, yet there were no design change documents, either for permanent design changes or for temporary design changes, for this action.
In addition, there were no safety evaluations in accordance with 10 CFR 50.59, that were performed by the licensee to ensure that no unreviewed safety questions existed.
System interactions with other systems were not evaluated at that time.
Examples for these interactions included, but not limited to:
1) During an SBO condition, when the RCIC was required to operate for four hours without ac (alternating current) power available, water from the condensate storage tank (CST) could be continuously discharged through the relief valve (2ICS" RV112)
to the equipment drain sump at 30 gpm; because both sump pumps would not be operable at that time, it could cause flooding in the surrounding areas, making SBO coping more complicated; 2) Following a postulated DBA and after the CST reached low level, suction of the RCIC pump from the suppression pool could cause excessive radioactive water to be discharged through the relief valve to the equipment drain sump, flooding the surrounding areas with radioactive water (the sump pumps might not be available because they were not safety-related);
3) The effect of the excessive drain, through the relief valve at 30 gpm, on the inventory of condensate for emergency core cooling was not addressed at that time.
In addition, the effect of operating the hydraulic system above the design pressure was not fully evaluated at that time. Although the licensee used hydrostatic test pressure to justify system operability, the requirements of ASME Section III, Class 2 on hydraulic components were not fullyjustified at that time.
The licensee later generated a deviation/event report (DER 2-96-1795) on July 31, 1996, indicating that a safety evaluation should have been performed for the valve function changes.
No safety evaluations were ever performed for the valve function changes before the conclusions of this inspection.
10 CFR 50.59, Section (a) states that the licensee may make changes in the facility as described in the safety analysis report.
10 CFR 50.59, Section (b) requires the licensee to maintain records of the changes in the facility. These records must include a written safety evaluation which provides the bases for the determination that the change does not involve an unreviewed safety question.
The licensee's failure to perform a written safety evaluation for the valve function changes is an apparent violation of 10 CFR 50.59, Section (b) (50-410/96-16-07).
The inspector reviewed Nine Mile 2, UFSAR Section 5.4.6.2.2, Item 4, "Valve Design Requirements,"
and found that the design description of pressure control valve 2ICS" PCV115 (GE valve No. F015) was a "self-contained downstream sensing control valve capable of maintaining constant downstream pressure of 125 psia."
The inspector also reviewed the Nine Mile 2 piping and instrumentation diagram (P&ID) symbols (Drawing No. PID-0-2D-4), which defined a self-contained pressure control valve and an electro-hydraulic operated valve.
In addition, the inspector reviewed a GE engineering change notice (ECN No. NJ68503) dated August 12, 1985.
This ECN documented a design change by Stone and Webster of pressure control valve 2ICS "PCV115 from "self-contained downstream sensing control valve..." to "electro-hydraulic operated valve.
~ ~" The inspector concluded that following the completion of this engineering change, the licensee failed to update Section 5 4.6.2.2, Item 4 of the UFSAR to reflect that an electro-hydraulic
valve was installed instead of a self-contained downstream sensing control valve.
This configuration deficiency constituted a violation of 10 CFR 50.71(e) which requires the licensee to update the final safety analysis report periodically to assure that the information included in the UFSAR contains the latest material developed (50-410/96-1 6-08).
Conclusion The inspector concluded that the licensee had failed to resolve the defective condition of the RCIC turbine lube oil cooler pressure control valve in a timely manner.
The valve was left in the failed open position for more than 5 years.
This condition is in violation of 10 CFR 50, Appendix B, Criterion XVI, "Correction Actions," which requires conditions adverse to quality to be identified and corrected promptly.
The licensee used an unreviewed, incorrect calculation as a basis for the operability determination, resulting in a wrong conclusion being drawn for the evaluation.
This action constituted a violation of 10 CFR 50, Appendix B, Criterion III, Design Control, which requires the design control measures to provide for verifying and checking the adequacy of the design.
Since there were no valid operability determinations to demonstrate that the RCIC system was operable from January 26, 1991, to September 199, Nine Mile 2 could be potentially in violation of Technical Specifications Section 3.7.4, which requires the RCIC system to be operable when the reactor dome pressure is greater than
'I 50 psig.
ln June 1992, the licensee defeated the control function of the RCIC turbine lube oil cooler pressure control valve without providing a written safety evaluation to determine that this change did not involve an unreviewed safety question.
This condition is in violation of 10 CFR 50.59, Section b, which requires the licensee to maintain a record containing a written safety evaluation, which provides a basis for the determination that the change does not involve an unreviewed safety question.
ln 1985, the architect engineer for Nine Mile 2 changes the design of the RCIC turbine lube oil cooler pressure control valve from a "self-contained downstream sensing control valve" to an "electro-hydraulic operated valve."
However, the licensee failed to update Section 5.4.6.2.2, Item 4, of the UFSAR to reflect the actual design condition.
This configuration deficiency constituted a violation of 10 CFR 50.71(e), which requires the licensee to update the final safety analysis report periodically to assure that the information included in the FSAR contains the latest material develope Review of Plant Desi n Chan es Unit 2 Ins ection Sco e
The inspector reviewed a plant design change package at Nine Mile 2 to ascertain whether the design and implementation of the design change met the regulatory requirements.
The plant design change package reviewed was SC2-0077-93, for the replacement of a pressure control valve 2ICS "PVC115 in Unit 2 RCIC system.
Observations and Findin s Plant design change SC2-0077-93 was issued to replace a defective pressure control valve (2ICS"PCV115), that was used to regulate the cooling water pressure for the RCIC turbine lube oil cooler, as described in Section E1.2 of this report.
The new valve was an air-operated drag-type valve, supplied by Control Components, Inc. (CCI). The valve body was not replaced.
Only the valve internal and the valve actuator were replaced.
In addition to the valve replacement, the restricting orifice (2ICS" R0207)
downstream of the RCIC turbine lube oil cooler was rebored to increase the orifice diameter from about.44 inch to 0.6 inch in diameter.
The purpose of this orifice-size increase was to ensure that with control valve 2ICS" PCV115 in the failed-open position, the relief valve (2ICS "RV112) would not open.
The licensee performed a calculation (No. A10.1-H-005) dated September 23, 1996, to determine the required orifice size.
This calculation was reviewed by an independent reviewer and was properly approved by management.
In this calculation, the licensee incorrectly used a downstream pressure of 165 psig for valve (2ICS" PCV115)
~ This incorrect pressure resulted in an incorrect orifice size being implemented.
Relief valve 2ICS" RV112 was set at 150 psig. At 165 psig, the relief valve would be fully open, which was not the intent of the calculation.
In addition, the design pressure for the piping downstream of valve 2ICS" PCV115 and for the RCIC turbine lube oil cooler was 150 psig.
Operating at 165 psig would exceed the design pressure.
This pressure issue was discussed with the licensee during the inspection.
The licensee stated that they had completed a draft calculation, which indicated a correct downstream pressure of 150 psig, and that this draft calculation was being reviewed by management and would be available for NRC's review at a later date.
Following the inspection, the licensee transmitted the revised version of calculation A10.1-H-005, dated December 18, 1996, to the NRC. The inspector reviewed this calculation which did show the downstream pressure of valve 2ICS" PCV115 to be 150 psig.
However, the resulting orifice size was different, 0.625 inch diameter instead of 0.6 inch diameter that was installed in the plant.
In a December 18, 1996, telephone conversation between the inspector and Mr. L.
Schiavone of Niagara Mohawk, the licensee stated that orifice 2ICS" R0207 would be rebored to the larger size during the next opportunity (forced outage or refueling outage)
~ This item is unresolved pending licensee's implementation of another design change to correct the deficient condition (50-410/96-16-09).
The licensee had performed a safety evaluation (No. 96-27), in accordance with 10 CFR 50.59, for design change SC2-0077-93.
This document was properly reviewed by an independent reviewer and by the SORC (station operation review committee), and was approved by the plant manager.
The inspector's review of this document indicated that the evaluation was extensive and covered broad areas.
However, the inspector noticed that an important statement that appeared on page 3 of this document was not true:
"With the valve full open, the pressure downstream will not exceed the design pressure of the lube oil cooler and will not liftthe relief valve 2ICS" RV112." The inspector reviewed the procurement data sheet for the RCIC turbine lube oil cooler and found the design pressure to be 150 psig.
This 150 psig design pressure was also shown in UFSAR Figure 5.4-9C.
The setpoint of 2ICS" RV112 was clearly indicated in the RCIC PAID and many calculations to be 150 psig.
In calculation A10.1-H-005 dated September 23, 1996, the calculated pressure downstream of 2ICS"PCV115 was about 165 psig, which was clearly above the lube oil cooler design pressure, and also above the setpoint of the relief valve 2ICS" RV112. The inspector concluded that:
1) the licensee's failure to use the correct pressure for the first calculation (A10.1-H-005, dated September 23, 1996); 2) the independent reviewer's failure to identify and correct calculation deficiency; and 3) the safety evaluation's failure to identify the design deficiency, constituted an apparent violation of 10 CFR 50, Appendix B, Criterion III, Design Control, which requires that the design control measures shall provide for verifying and checking the adequacy of the design, such as by the performance of design reviews, or by the use of alternate or simplified calculational methods (50-410/96-16-10).
The new valve actuator for 2ICS "PCV115 required instrument air for operation.
The instrument air at Nine Mile 2 was not safety-related, and might not be available during the following conditions when the RCIC was required to operate:
1) during a station blackout, the RCIC was required to operate up to four hours; and 2)
following a seismic event and a small line break accident.
If instrument air was not available during these events, valve 2ICS "PCV115 would be in the failed open position.
This would cause relief valve 2ICS" RV112 to open, and the operating pressure at the RCIC lube oil cooler to be above its design pressure.
On December 19, 1996, the inspector told the licensee that an operability determination of the RCIC system, in accordance with Generic Letter 91-18, was required to justify Nine Mile 2's operation.
This item is unresolved pending NRC's review of licensee's corrective actions (50-410/96-16-11).
Following the implementation of design change SC2-0077-93, the licensee conducted a surveillance test of the RCIC system on November 2, 1996, using station test procedure N2-OSP-ICS-0@002,
"RCIC Pump and Valve Operability Test and System Integrity Test and ASME XI Functional Test", Revision 3, including Procedure Change Evaluation dated October 30, 1996.
In this test procedure, the licensee had added a section to test the performance of control valve 2ICS" PCV115.
The inspector reviewed the test result and found the tested result differed significantly with calculated result.
With valve 2ICS" PCV115 in the failed open position, the measured flow through this valve was 61.1 gpm, when the RCIC pump discharge pressure was 1275 psig and the pressure downstream of valve 2ICS" PCV115 was 152 psig.
This indicated the valve flow coefficient (C) was higher than 1.82 (even with no pressure drops from the RCIC discharge side to the
valve inlet). However, in calculation A10.1-H-005, page 5, the calculated flow, based on RCIC pump discharge pressure of 1374.2 psig and the valve 2ICS "PCV115 downstream-pressure of 165 psig, was 49.20 gpm, with a Cof 1.4, which was consistent with the Cvalue given by the valve manufacturer, CCI. This is an unresolved item pending licensee's evaluation to determine the actual Cof valve 2ICS "PCV115 (50-410/96-16-12).
C.
Conclusion The inspector concluded that the design for plant design change SC2-0077-93 was inadequate in that an incorrect orifice size was implemented due to a deficient calculation.
This calculation used an incorrect downstream pressure of a pressure control valve, resulting in an operating pressure that could exceed the design pressure of the RCIC turbine tube oil cooler and its associated piping system.
This calculation deficiency was not identified and corrected by the independent reviewer.
This constituted an apparent violation of 10 CFR 50, Appendix 8, Criterion III, Design Control.
Because the restricting orifice with incorrect orifice size was implemented due to a deficient calculation, another design change was required to correct the deficient condition.
An operability determination of the RCIC system in accordance with Generic Letter 91-18 was required to justify the plant's operation.
The inspector's review of the surveillance test result of the RCIC system indicated that the measured flow through 2ICS "PCV115 differed significantly with the calculated results.
This could mean that the Cof 2ICS" PCV115 might be different than the Cspecified.
E8 Miscellaneous Engineering Issues (92903)
E8.1 Closed Ins ection Followu Item 50-220 96-07-16 Pertainin to Parallel Transfer of Unit 1 Diesel Generator During the April 1996 IPAP (integrated performance assessment process)
inspection, the inspection team identified that the emergency diesel generator (EDG)
synchronizing system at Nine Mile 1 did not have the capability for parallel transfer of electrical loads from the EDG to the offsite power source.
The Nine Mile 1 power transfer system was designed as follows: When a loss of offsite power (LOOP)
occurred, the EDGs would start and power the emergency bus within 10 seconds.
When the offsite power restored later and if the operators wanted to manually transfer the emergency bus loads to the offsite power source, the emergency bus must be deenergized first (dead bus) before it could be connected to the offsite power source.
The inspector reviewed Nine Mile 1 Updated Final Safety Analysis Report (UFSAR),
Section 4.1, Diesel Generator System, which described the power transfer interlock system and found that the above bus transfer arrangement was consistent with the interlock feature described in the UFSAR. The interlock feature would prevent the closure of offsite power source breaker when the breaker from the EDG source was closed.
This interlock feature was to protect the EDG from being damaged by
out-of-phase current from the offsite power source.
Besides, the Nine Mile 1 bus-transfer arrangement did not affect safe shutdown of the plant. Therefore, the inspector considered this item closed.
E8.2 Unresolved item 50-410 96-10-02 Pertainin to the Au ust 13 1996 Event That Caused the Licensee to Declare Both Control Room Chillers to be Ino erable on Au ust 14 1996 The licensee issued LER 96-10 on September 12, 1996 to report to the NRC of this event.
The detail and followup of this issue were discussed in Section E1.1 of this inspection report.
This item is closed.
E9 UFSAR Reviews A recent discovery of a licensee operating their facility in a manner contrary to the updated final safety analysis report {UFSAR) description highlighted the need for a special focused review that compares plant practices, procedures and/or parameters to the UFSAR descriptions.
While performing the inspections discussed in this report, the inspector reviewed the applicable portions of the UFSAR that related to the areas inspected.
Nonconformance with the UFSAR for the RCIC system was discussed in Sections E1.2 and E1.3 of this report.
The inspector verified that other reviewed sections of the UFSAR wording were consistent with the observed plant practices, procedures and/or parameters.
X1 Exit Meeting The inspector met with the licensee personnel at the conclusion of the site inspection on November 22, 1996, and summarized the scope of the inspection and the inspection results.
No proprietary materials were reviewed during this inspection.
The licensee acknowledged the inspection findings at that meeting.
The inspector amended the exit meeting in two telephone calls, on December 5, 1996 and December 20, 1996, to Mr. D. Baker of Niagra Mohawk. The inspector stated that after NRC review of additional licensee supplied documents, two additional apparent violations and one additional unresolved item were identifie PARTIAL LIST OF PERSONS CONTACTED Licensee A. Zo NRC R. Abbott, Vice President 5 General Manager J. Aldrich, Maintenance Manager - Unit 1 M. Batduzza, Operation Manager - Unit
C. Beckham, Manager, Quality Assurance U. Buiva, Lead Engineer - Unit 2 W. Connelly, QA Auditor R. Dean, Engineering Manager - Unit 2 T. Egan, ISEG A. Julka, Supervisor - Unit 2 Electrical J. Oxford, QVSA S. Pabby, Lead Mechanical Engineer - Unit 2 N. Rademacher, Plant Manager - Unit 1 K. Sweet, Technical Support Manager - Unit 1 C. Terry, Vice President
- Nuclear Engineering K. Ward, Technical Support Manager - Unit 2 D. Wolniak, Manager - Licensing W. Yaeger, Engineering Manager - Unit 1 L. Vavra, MATS, Inc.
llnick, Engineer - Licensing
- Nuclear B. Norris, Senior Resident Inspector R. Skokowski, Resident Inspector
LIST OF ACRONYMS USED ac CFR CST C
DBA DER ECN EDG GE GPM ISEG LCO LER NRC P&ID PSIA PSIG RCIC SBO UFSAR Alternating current Code of Federal Regulations Condensate Storage Tank Flow coefficient Design Basis Accident Deviation/Event Report Engineering Change Notice Emergency Diesel Generator General Electric Company Gallons Per Minute Independent Safety Engineering Group Limited Condition for Operation Licensee Event Report Nuclear Regulatory Commission Piping and Instrumentation Diagram Pounds Per Square Inch Absolute Pounds Per Square Inch Gauge Reactor Core Isolation Cooling Station Blackout Updated Final Safety Analysis Report