IR 05000244/1989081

Insp Rept 50-244/89-81 on 891106-1208.Violations Noted.Major Major Areas Inspected:Safety Sys Functional Insp of RHR Sys Performed

ML17250B158
Person / Time
Site:	Ginna
Issue date:	04/25/1990
From:	Durr J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:
Shared Package
ML17250B156	List: IR 05000244/1989081 ML17250B154 ML17250B157
References
50-244-89-81, NUDOCS 9005160102
Download: ML17250B158 (49)

Text

U.S.

NUCLEAR REGULATORY COMMISSION

REGION I

Report No.

50-244/89-81 Docket No.

50-244 License No.

DPR-18 Licensee:

Rochester Gas and Electric Cor oration 49 East Avenue Rochester New York 14649 Facility Name:

R.

E. Ginna Nuclear Power Plant Inspection At:

Rochester and Ontario New York Inspection Conducted:

November 6 to December

1989 Inspectors:

J.

Carrasco, Reactor Engineer S.

Chaudhary, Senior Reactor Engineer (Team Leader)

F. Conte, NRC Consultant P. Drysdale, Reactor Engineer J.

Lara, Reactor Engineer R. Spi lker, NRC Consultant Approved by:

acque P. Durr, Chief Engineering Branch, Division of Reactor Safety, Region I d te Ins ection Summar

Ins ection conducted November 6 December

1989 Re ort No. 50-244/89-81 III d:

A

• d f

F <<1 I

tSEFI)

the residual heat removal (RHR) system was performed.

The interface between corporate engineering and the plant organizations also was examined.

Results:

Refer to the Executive Summary in the report.

>00gyg0102 900509 Pl)R ADOCK 05000244 lg PGC

TABLE OF CONTENTS Executive Summary.

~Pa e

1.0 Introduction.

2.0 Details of Inspection.

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

2. 1 Management, Engineering Support, and Engineering Assurance.

~...

2.2 Residual Heat'Removal System.....

~

~

~

~

~

~

~

~

~

~

~

~

~

~

2.2.1 2.2.2 2.2.3 2.2.4 2.2.5 Mechanical.......

Electrical.

Instrumentation and Control Operations Structural..

13

20

3.0 Conclusions..................................................

.0 Exit Meeting

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

A~endi x I

Persons Contacted II

Documents Reviewed

EXECUTIVE SUMMARY A team of NRC staff and contractor personnel examined the Residual Heat Removal System (RHR) and associated support systems to verify that the RHR system would fulfillits intended safety function under normal and postulated accident conditions.

The inspection was performed in five subareas of the system design:

Mechanical (2.2. 1), Electrical (2.2.2), Instrumentation and Controls (I&C)

(2.2.3), Operations (2.2.4),

and Structural (2.2.5).

In addition to the above engineering disciplines, the team also evaluated management and engineering support, and engineering quality assurance policies and practices established by RG&E.

Two violations and nine unresolved items were identified and are summarized below.

AREA SECTION A.

Violations 89-81-04 - Class lE Battery Testing 89-81-06 - Molded Case Circuit Breaker s and Undervoltage Relay Alarms 2.2.2.1 2.2;2.3 B.

Unresolved Items 89-81-01-89-81-02 "

89-81-03-89-8>.-05 89-81-07-89-81-08-89-81-09 89-81-10 89-81-11 Service Water System Single Failure Susceptibility Resolution of Safety Concerns RHR Pump NPSH Electrical Load Growth Control Program Calibration of Control Room Instruments Equipment Environmental qualification Evaluation Safety Relief Valve Testing and Documentation Control Room P&IDs Engineering Assurance 2.2.1.3 2'.1.4 2.2.1.5 2.2.2.2 2.2.2.3 2.2.3.1 2.2.4.2 2.2.4.1 2.1 The team did not identify any conditions that would prohibit the RHR system from performing its intended design safety functions under normal and design basis accident conditions.

However, complete verification of the RHR system reliability was not possible since the design basis calculations for the RHR system were not readily available and in some cases do not exist.

Further, the apparent error in the value stated in the FSAR regarding the time interval required to flood the RHR pump room, discussed in Section 2.2.4. 1 in the report, warrants prompt action to determine the correct value and establish the true design basis.

The team concluded that the control of documentation, engineering design interfaces, and engineering communications with external organizations is poor and that the process of independent review and approval of engineering design activities lacks depth (see Section 2. 1).

These deficiencies in engineering activities were considered serious enough to warrant further evaluation by the licensee.

The licensee was requested to provide their evaluation of those weaknesses within 120 days of the receipt of this repor I f

t

1. 0 INTRODUCTION The objective of the Safety System Functional Inspection (SSFI) at the R.

E. Ginna plant was to assess the operational readiness and design basis for the residual heat removal (RHR) system.

This was accomplished by determining whether:

a.

The RHR system is capable of performing the safety functions required by the design bases, b.

Testing is adequate to demonstrate that the RHR system would perform all required safety functions, c.

Maintenance is adequate to ensure reliable system availability, d.

Human factors considerations related to the RHR system (e.g., accessibility and labeling of valves),

the system's supporting procedures, and operator training are adequate to ensure proper system operation, and e.

guality program activities related to the RHR system are effective in identifying safety issues and in assuring their resolution.

The team reviewed the Updated Final Safety Analysis. Report (UFSAR), Plant Technical Specifications, modification packages and reference documentation, and examined the available calculations which support design and operation of the system.

System operating procedures'were evaluated to assess the detail, accuracy, and adequacy of direction provided to operators.

The team observed control room activities during the course of the inspection, and reviewed main-tenance procedures and programs related to the RHR system.

Additionally, the team performed system walkdowns to verify that the system configuration was in accordance with design documents.

Finally, the team assessed the overall design control program as applied to the RHR system.

This included inspection at the RG5E Engineering office activities in Rochester, NY.

The principle findings pertain to the operational readiness of this system and auxiliary support systems, the effectiveness of programs to ensure continued safe operation, and the adequacy of engineering calculations.

The following sections provide detailed findings in each of the functional areas inspected.

2.0 DETAILS OF INSPECTION 2. 1 Mana ement and En ineerin Su ort and En ineerin Assurance The team evaluated the areas of management and engineering support, and engineer-ing assurance throughout the course of the inspection for each team member's area of expertise.

The team discussed the role of the engineering organization in providing support to plant operations with plant management, engineering management and supervisory personnel.

Discussions included the role of safety oversight,

I

0

resolution of identified or potential technical problems or concerns and the programs in place for assuring that the design 'basis of the plant is not

,invalidated.

Items discussed included the following:

'ngineering review of plant operability procedures and test results.

Engineering support and involvement in licensing issues (i.e.

USNRC Bulletins, Notices, Generic Letters, LERs)

Design Basis Document commitment, development, and use by plant organizations Engineering role in Safety Evaluations Engineering involvement in corrective actions.

Role of the corporate engineers and interface with site plant engineering personnel Engineering studies performed to support plant organizations Methodology for written and verbal communication with site plant

. engineering and other plant organizations Translation of Design Basis criteria into plant operating procedures Pending plant modification status and budgetary commitments.

Based on these discussions, complemented by independent observations, the team established the following:

RG&E's corporate engineering department relies on contractors to perform highly technical analyses and evaluations.

The'refore, most complex engineering analyses are performed by contractor firms and consultant personnel.

The team further noted that the independent design review and verification process for in-house design and analysis does not strictly follow the documentation requirements of ANSI N45.2. 11 (See paragraph 2.2.1).

b.

C.

As described in Sections 2.2. 1 through 2.2,4, the team expressed concerns as to the lack of attention to detail in the review of completed Engineering Work Request (EWR) packages.

The team concluded that the licensee had performed

'an inadequate design review in the procurement of Class lE batteries.

Attention to detail in the review of system modifications and procurement of equipment is essential to ensure that systems will perform their intended function when required.

The depth of review is entirely dependent upon both the experience of the EWR reviewer and the established design control process requirements.

There appears to be a difference between engineering management and the staff regarding the policies and procedures to be implemented to establish and assure adequate design control.

The team found that each engineering discipline had 'its own interpretation of an approved engineering procedure to suit its perception of requirements.

Therefore, each discipline professed compliance with the same corporate engineering procedure despite substantial differences in implementation of the same.

The team further observed that the intent and requirements of these engineering procedures, as explained to the team by engineering management, was not entirely the same as understood by the engineering staf I I

I

d.

The lack of formal control of engineering and design documents within the engineering department was of significant concern to the team.

Some EWR packages remain open several years after physical changes have been made to the plant.

Furthermore, some EWRs are revised to expand the scope of original EWR which further extends the time for closure.

For example, EWR 3341,

"DC System Evaluation" was initiated in 1981.

This EWR incudes design criteria analysis for DC fuse coordination, Technical Specification EE-100, and ten additional design analysis for the DC system.

The design criteria and analysis for DC fuse coordination and the Technical Specification EE-100 are controlled in the licensee's document control system.

However, the remaining analyses, while they have been reviewed and approved and they provide the basis for an installed DC system and components, were not in the licensee's document control system since the EWR is still considered open by the licensee.

It should be noted that these analyses were completed and approved between September 1985 and September 1988.

Except for the violation discussed in Section 2.2.2. 1, the team found no additional deficiences in these analyses.

The EWR package remains in the personal control of the responsible engineer without any formal procedural control.

The team also noted that there was no formal accountability for the inclusion or deletion of any information within these documents.

Numerous EWR packages (including EWR 3341) reviewed did not contain any index and/or log to indicate the content of the package.

The team was informed by engineering management that these documents (EWR packages)

were not considered gA records until the EWR was closed, reviewed for completion and forwarded to document control for retention.

The team was concerned with this process since these documents provide the design basis for installed plant modifications and in some cases entire systems thorough review of packages for adequacy and completion cannot be assured without a formal index and/or log to indicate the required and contained information in the package.

Furthermore, since EWRs may be open for extended periods of time, they may not be processed into the document control system for years.

The team concluded that the licensee is relying more on the experience and good judgement of responsible EWR engineers and reviewers to determine the adequacy and completeness of EWR packages than on established formal procedure controls.

It is also evident that the engineering management has not provided clear guidance and adequate procedural control over the contents of, design inputs to, and timely closure of an open EWR that contains supporting analyses for the

"as-installed" configuration of system and equipment at the station.

The final submittal of a completed EWR to the document control organization after extended periods of time does not adequately provide design control measures for control of design interfaces, correctness and traceabi lity of design inputs, changes to computer codes or design approach, review and approval of design output, and any subsequent change in such documents or analyses.

The above conclusions indicate a generic weakness in the licensee's managerial and administrative controls for assuring that engineering activities are performed in accordance with NRC regulations and accepted industry engineering practices.

The violations, unresolved items and weakness identified in this

I I

e

report collectively raise a concern as to the effectiveness

.of the current practices to firmly establish engineering assurance.

Numerous weakness were identified with respect to design documentation and calculation controls.

These are noted throughout the report and summarized below.

SECTION a.

Deficienci es in documentati on, control and verification of design information 2.2.1.1 b.

Deficiencies in the control of the design process and documentation 2.2.1.2 Poor documentation and control of calculations Lack of information to effectively verify calculations Failure to followup on comments resulting from engineering reviews c.

Deficiencies in instrument setpoint control 2.2.3.2 Inadequate engineering analysis/evaluation Lack of comprehensive and controlled instrument list Instrument and setpoint inconsistencies Instrument loop accuracies do not take into account environmental and instrument tolerance effects d.

Deficiencies in the Plant Modification Process 2.2.3.3

~

Poor documentation and control of engineering modifications

~

Incomplete and inconsistent design outputs

~

Lack of construction specification for instrument tubing installation

~

Poor control of drawing change process

~

Lack of design verification and timely closure of engineering work packages Collectively, they have been categorized as an'unresolved item pending further review to determine the adequacy of the licensee's current engineering activities (50-244/89-81-11).

2.2 Residual Heat Removal RHR S stem 2.2. 1 Mechanical

~Back round The Residual Heat Removal (RHR) System at the Robert E. Ginna Nuclear Generating Station (Ginna)

was reviewed and evaluated for operational readiness.

The RHR System is designed to remove core decay heat and thermal energy stored in the primary system and reduce the temperature of the Reactor Coolant System (RCS)

during a plant cooldown.

In addition, the RHR System is a subsystem of the

" Emergency Core Cooling System (ECCS).

The ECCS delivers borated water to the Reactor Coolant System.

Specifically, within the ECCS operation, the RHR System provides low head, high volume safety injection from the refueling water storage tank (RMST) to the core barrel.

The RHR System also provides long term cooling following a Loss of Coolant Accident (LOCA) by transferring water from the containment sump to the inlet nozzle on the core barrel or to the RCS cold legs via safety injection pumps.

The RHR System consists of two (2) parallel flowpaths, each containing an RHR pump, an RHR heat exchanger, and the associated piping, valves and instrumenta-tion required for operational control.

The two parallel flowpaths are cross-connected so that either or both can supply the inlet nozzles on the core barrel or on the cold leg of RCS Loop B.

In addition, the RHR System can supply water to the suction of the Safety Injection (SI) System pumps and the Containment Spray (CS) System pumps.

The RHR System can be supplied from the RWST, Containment Sump B, or the hot leg of RCS Loop A.

During ECCS operation, the primary source of water for the RHR System is from the RMST.

During the injection phase of operation, component cooling water is not supplied to the RHR heat exchangers; consequently no cooling of the RHR water occurs.

The water is injected into two (2) inlet nozzles in the reactor vessel that are located above the core.

In the ECCS operation, when RWST water is no longer available, the recirculation phase commences.

During recirculation, the RHR pump(s)

take suction from the Containment Sump 8 and pumps reactor coolant through the RHR heat exchangers.

Also, during the recirculation phase of operation, component cooling water is supplied to the RHR heat exchangers to cool the recirculated RHR water.

Plant conditions may dictate continued operation of the containment spray pumps or safety injection pumps while in the recircula-tion mode.

The RHR pumps can be aligned to circulate water back to either the SI pumps or the CS pumps, as required.

The following mechanical systems which support the RHR System were also reviewed and evaluated:

Station Service Cooling Mater Auxiliary Coolant - Component Cooling Mater Containment Spray Safety Injection The reviews included an RHR system walkdown inspection and review of licensing, engineering and plant operations documents.

The findings are discussed below.

2.2. 1. 1.

Desi n Basis Documentation During the inspection, RGEE provided the team with limited documentation substantiating the mechanical design basis of the RHR System.

RG5E did not have a calculation list or any formalized overall listing of calculation I I

~

'l

The lack of documented calculations supporting the system design basis can be safety significant when changes are made to the plant hardware, software, or procedures.

The lack of design basis information could result in undesirable modifications of the system design basis.

The lack of a thoroughly documented design basis is a generic weakness in the existing documentation and design

. process for the Ginna plant.

2.2. 1.2 Mechanical Desi n Control During the review of recent engineering work requests and modifications to the Ginna plant, the team noted that RGEE and its contractors were not properly documenting, controlling or verifying design analyses and calculations.

However, the team did not identify any instance where the lack of control and/or verifi-cation lead to any technical inadequacy of analyses and results.

Nonetheless, the absence of documented control and verification indicates a lack of attention to details in complying with documentation standards and procedural requirements.

The following are some typical examples of problems noted:

A.

NUS Calculation 3S61-M-07 Rev.

1, ECCS Hydraulic Analysis for -Ro'chester Gas 5 Electric Ginna Station, dated October, 1988.

The stated purpose of this calculation was to document the development of a computer model of the Ginna ECCS system.

The calculation had no list of references, although it frequently referenced and took data and input from a previous model developed by Gilbert Associates.

Additionally, the calculation did not list the assumptions or the justification of assumptions used in developing this model.

On page 29 of the calculation, there were notes/comments/corrections to the calculation that were apparently made by an RGEE engineer.

There was no indication of the validity of these comments nor any indication that the comments, if valid, were ever incorporated into the model.

The team considered this to be an example of weak documentation and control of calculations.

B.

NUS Calculation 9939-M-15 Rev.

0, Dutchman Orifice Size, dated March 6, 1989.

This calculation was performed by a contractor and was labeled as "safety-related" with an independent verification.

However, the calculation did not list the underlying technical assumptions and the source of formulae used in the analysis; a statement indicated that a separate calculation (89939-M-12)

and a computer program were the bases for this calculation and analysis.

The team considered this to be an example of weak documenta-tion and verification of calculation because without the references and bases clearly listed and available for review, adequate and effective independent verification cannot be consistently assure C.

D ~

NUS Calculation 9836-M-08 Rev.

0, Hydraulic Model Modification for Safety Injection and RHR Systems, dated October 24, 1988 f

This calculation modified NUS Calculation 3S61-M-07 Rev.

1.

References 3,

4 and 7 were incomplete and therefore prevented the calculation from being properly verified.

Further, this calculation clearly stated that it was revising calculation 3S61-M-07 Rev.

1 without stating whether this calculation superseded the original calculation.

The original calculation was not identified by notation or stamp that it was superseded and therefore should not be relied upon.

It was also not clear that RG&E controlled the changes to the hydraulic model or documented the current version of the hydraulic model.

The team considered this to be an example of weak documentation and control of calculations.

RG&E Design Analysis EWR-4675-M-8 Rev.

0, Evaluation of RHR Pump Data, dated September 14, 1989.

'eference 3.4'id not have enough information to trace the specific document.

If one assumed that this was the 'ECCS Hydraulic Analysis calculation performed by the contractor and numbered 3S61-M-07 as used in Attachment 4, then the revision indicated was incorrect.

There was no justification for the assumption in Section 4. 1.

In the analysis, the engineer evidently took inputs from Section 2. 1 and 3.4 without ever cross referencing the source.

The calculation was 18 pages long.

It appears that the licensee recognized the inadequacies noted above, because there was a

21 page addendum attached to the calculations containing the RG&E reviewers comments.

However, the basic calculation had not been revised to reflect the reviewers comments, nor was there any indication in the calculation to advise the reader that significant comments affecting the calculations were contained in the addendum.

The team considered this to be an example of the weak documenta-tion and control of calculations.

E.

RG&E Design Review EWR 4675 M-2, Rev. 4, dated April 5, 1989.

This document was prepared by RG&E as the independent design verification of an engineering work request.

This included the review of RG&E, Contractor and Vendor documents together as a package.

RG&E procedures require that the independent verification be performed by a competent individual not associated with the original design.

However, after the design review was prepared, it was reviewed and approved by individuals who did have direct involvement and approval of the original design.

The personnel responsible for the review and approval of the independent design verification do have the authority to affect the results of the review.

The team considered this to be a conflict of interest and an example of a weak independent design verification process.

The team did not identify any situations where these weaknesses had adversely affected the capability of the RHR system to function.

However, the calculation and documentation problems noted above indicate a weakness in the licensee's ANSI N45.2. 11 calculation control program, including a possible gerieric weakness in the review and approva] of calculation l

2.2.1.3.

Sin le Failure Susce tibilit in the Service Water S stem The Service Water used for cooling the water jacket heat exchanger and lube oil heat exchanger for emergency diesel generators A and B discharges to the lake through a

common non-safety, non-seismic 10" discharge line; that is the line is not designed to withstand a design basis earthquake at site for which other safety related equipment and systems have'een either originally designed or subsequently upgraded.

The Ginna 'Station was designed to the proposed Atomic Industrial Forum version of design criteria issued for comment by the AEC on July 10, 1967.

However, the Ginna updated FSAR compares the facility to the 1972 version of the General Design Criteria, 10CFR50, Appendix A.

General Design Criterion 44 Cooling Water - states that suitable redundancy in components and features, and suitable interconnections, leak detection, and isolation capabilities shall be provided to assure the system safety function can be accomplished, assuming a single fai lure.

Ginna UFSAR Section

~ 1.2.4. 15 states that the service water system is supplied by redundant pumps supplied from separate safeguards busses.

It is further stated that the system is operable either from offsite power, from normal onsite power, or from onsite diesel generators and that no single active failure can result in system loss of function.

The safety significance of this item involves a potential loss of cooling water to both diesel engines during or following a seismic event at site.

In order for such a failure to occur, the common discharge line would have to fail so as to prevent flow of cooling water.

Although a low probability event, the confidence in the ability of the piping to fulfill its intended function also is not high since, the piping was not designed as safety-related or seismic category I.

The severity of the consequences are such that both trains of emergency diesel generator power could be lost.

The team brought this issue to the attention of the licensee for review.

This item remains unresolved pending evaluation by the licensee (50-244/89-81-01).

2.2. 1'.4.

Unanal zed Safet Concern Pressure indicator controller (PIC) No.

629 provides an interlock to MOV 857B during high head recirculation.

During the review of EWR 4805 dated August 23, 1988 for the replacement of instrument PIC 629, it was noted that the attached documentation contained an analysis which considered a situation where high head safety injection during recirculation could not be achieved directly from the control room.

The analysis recommended that the configuration and/or IEEE standards which apply to instrument PIC 629 be reviewed.

Other than the review of the EWR form, the inspector could not determine that the licensee had taken any action to establish formal programs to resolve this potentially unanalyzed safety concerns

During the normal processing of an EWR, this item would be addressed as part of the 50.59 process performed for all changes in the plant.

However, the problem with this instrument was evidently solved by a correction in the maintenance and/or calibration procedure and the EWR was never processed by engineering.

The licensee was unable to provide the team with a documented or verifiable process available at RG&E that addresses how safety concerns raised outside of the normal engineering process are brought to the attention of the Nuclear Safety and Licensing Department of RG&E and resolved.

The team considers this to be a weakness in the licensee's procedure for resolving safety concerns.

This issue is an unresolved item pending further NRC and licensee evaluation (50-244/89-81-02).

2.2. 1.5.

Potential for Inade uate RHR Pum NPSH Durin Post-Accident Recirculation NRC Information Notice 88-74 alerted licensees to potential problems that could result in inadequate performance of the ECCS during the recirculation phase of operation following a LOCA in Westinghouse and Babcock

& Wilcox designed power reactors.

West'inghouse Letter RGE-88-681 stated that, for Ginna, all necessary NPSH calculations have been performed for the ECCS design as originally supplied by Westinghouse, and adequate NPSH is available for the RHR and HHSI pumps during the post-accident recirculation mode.

The licensee considered that the Westinghouse analysis may have been non-conserva-tive for the RHR pump.

Accordingly, the licensee contracted for the services of a consultant to independently evaluate the available NPSH during containment sump recirculation.

The preliminary results of the evaluation indicate that there may be some modes of operation under which adequate NPSH is not available.

The licensee is evaluating the validity of these modes of operation and the probability of occurrence.

Also, the licensee is evaluating whether the independent analysis by the consultant may have been too conservative in the modeling of the problem.

This is an unresolved item pending completion of the licensee evaluation and determination of the adequacy of the vendors calcula-tions (50-244/89-81-03).

2.2.1.6.

S stem Functionalit Throughout the course of the inspection, the team conducted in-depth reviews of available documentation, system walkdowns, and simplified alternate calculations to determine whether the RHR System would perform its intended safety function in the event of an injection signal.

Although the original comprehensive design basis calculations could not be verified, the team could find no indication that the system would not mechanically perform its safety function, based on the licensing basis contained the UFSAR, Technical Specification, and inspectors observation.2.2 Electrical In the electrical portion of the inspection, the team's objective was to assess the operational readiness and capability of the Class 1E electrical system to support the functions of the RHR system.

This review included evaluation of the effectiveness of testing and calibration of selected equipment to ensure system reliability.

Documentation reviewed by the team included Ginna Technical Specifications, UFSAR Chapter 8, electrical one-line diagrams, electrical calculations, procedures and design analysis.

The team performed a walkdown of selected portions of the Class 1E electrical system which serves the RHR system to verify configuration control.

The team observations and findings are described below.

2.2.2. 1 125 Vdc Batteries In 1985 and 1986, the licensee replaced the existing Class 1E system batteries (1050 A-H capacity) with batteries of greater capacity (1200 A-H).

This replacement was initiated because the existing batteries were nearing the end of their service life.

Design Analysis No.

1 of Engineering Work Request (EWR)

3341 "Class 1E Battery Testing Program" and 3891 "A 5 B Vital Battery System Replacements'ere initiated to procure the new batteries, evaluate the existing battery testing program, and establish all the standard and unique battery load requirements.

During review of the battery test procedures, the team requested for review the battery sizing calculations used to size the new batteries to ensure that all applicable loads were considered and incorporated into the battery testing load profile.

The licensee was unable to produce any sizing calculations to document that the batteries were in fact adequately sized.

The licensee indicated that since no major loads had been added to the battery since the initial battery installation no additional calculations had been performed.

The team noted that the load profile used during the battery 'service test consisted of loads identified by Westinghouse in 1971.

Review of these loads and their assumed current draw on the battery indicated deficiencies.

The deficiencies identified by the team are listed below.

1)

The load current draw was considered to be steady state whereas transient current draw for equipment such as motors is actually higher, 2)

Momentary loads such as current to flash the Diesel Generator field and for switchgear operations were omitted, 3)

4)

The 120 Vac inverters were assumed to be lightly loaded (approximately 40%

of full load) whereas the inverters were actually loaded heavier.

Inverters must also be considered as constant loads which result in a higher current draw on the battery as the voltage drops, The DC Air Side Seal-Oil Pump was assumed to be only running for one (1)

hour whereas Emergency Operating Procedures stated that its operating time was approximately four (4) hours'

These deficiencies were not identified during the procurement of the new batteries and the subsequent EWR which evaluated the battery loads.

Therefore, the battery system service test load profile did not include these load attributes.

The service test is performed to demonstrate that the battery is capable of powering all of the required safeguards loads during a

Loss of Offsite Power event.

Due to the above deficiencies, the battery service test load profile did not truly reflect the actual load requirements on the battery and therefore the battery was not tested adequately to demonstrate its capability to carry all required loads.

Subsequent preliminary licensee calculations indicated that there was margin present in the battery size to ensure that it would be able to power all the necessary loads.

Independent team calculations confirmed the licensee's conclusions.

These deficiencies indicate that the evaluations and analysis performed by the licensee were inadequate in that the 1971 load profile used was not reviewed to verify its adequacy and contrary to the objective of EWR 3341, all unique and standard loads were not identified.

Failure to test the batteries with a load profile which truly represented the load demand on the battery is considered a

violation of 10CFR 50, Appendix B, Criterion III (50-244/89-81-04).

2.2.2.2 Electrical Load Growth Control Pro ram The licensee's design process for modifications in the electrical system provides guidance to engineers to review system capacity and other attributes such as fuse coordination.

However, this guidance addresses only specific modifica-tions as they are performed.

There is no formal load tracking program to ensure that system capacity is reviewed for the integrated effect of several modifications instead of just one.

Although the current design process requires that affected system capacity be reviewed, it does not have a mechanism to ensure that plant calculations affected by modifications are updated to ensure that they are maintained up-to-date and accurate.

This leaves the potential for existing calculations to become obsolete after equipment such as circuit breakers, fuses, transformers, motor s, and other electrical equipment is re-placed.

Such modifications could affect battery and emergency diesel generator load capacity, short circuit calculations, electrical system coordination and system voltage regulation.

The licensee stated that an on-line program to capture electrical load growth and update affected calculations would be developed.

This is an unresolved item pending licensee program implementation and NRC staff review (50-244/89"81-05).

2.2.2.3 E ui ment Maintenance The Ginna electrical system design relies on ac molded case circuit breakers at Motor Control Centers (MCC) to provide selective coordination and protection to minimize plant transients due to electrical faults.

It is therefore essential that these protective devices be well maintained and incorporated in a preventive maintenance program to provide reasonable assurance that they will operate within stated operating times for circuit protectio During the team's review of maintenance activities, it was noted that these circuit breakers were not included in the licensee's Reliability Centered Maintenance (RCM) program for periodic testing to demonstrate the required trip characteristics.

The consequences of circuit breakers not operating within their required operating bands could result in the loss of an ac bus upstream of the breaker.

A properly coordinated electrical system along with well maintaiped circuit breakers sub-stantially improves the system reliability.

In response the team's concerns, the licensee stated that all of the MCC circuit breakers had been tested approximately 3 years earlier but had not been incorporated into a program to ensure periodic testing.

This condition had been noted by the licensee and the licensee was in the process of evaluating whether to include the breakers in the RCM program.

Subsequent to the inspection, the licensee initiated Corrective Action Request (CAR) No.

1985 to formally track this concern.

Nevertheless, lack of periodic testing for the circuit breakers does not comply with the requirements specified in Section 6.8. 1 of the Technical Specifications and Section 5 of the Ginna gA Manual which require that test procedures be established and implemented for safety related protective circuits.

The current dc system design includes undervoltage relays which monitor the battery system voltage and alarms whenever the low voltage setpoint is reached.

This relay, along with a battery charger failure alarm, provides continuous system monitoring to alert control room operators whenever the battery chargers fail or when the system voltage drops.

Review of periodic test procedure No.

PT 11,

"60 Cell Battery Banks "A" 5 "B"," indicated that the undervoltage relay is tested and the voltage at which the relay drops out and alarms in the control room is recorded.

The team noted that this voltage value is recorded but there is no acceptance criteria to determine whether the relay is drifting from its setpoint and requires calibration.

As specified in the UFSAR, the relay is adjusted to alarm at a system voltage of 127 Vdc.

However, the last recorded results from PT 11 indicate that the relay dropped out at 124.86 Vdc.

These results were not evaluated to determine if the relay setting was acceptable.

The above described findings of failing to periodically test the molded case circuit breakers and not establishing an acceptance criteria for the undervoltage relay alarms are a violation of facility Technical Specifications 6.8. 1, which requires testing of safety related components in accordance with established procedures (50-244/89-81-06).

During this review the team also noted that the control room dc voltmeters are likewise not calibrated on a periodic basis 'to ensure reliable system voltage indication to the operators.

The periodic calibration of control room instruments is considered an unresolved item pending licensee evaluation and proposed actions (50-244/89"81-07).

2..2.

The team also reviewed the following analyses pertaining to the electrical system:

EWR 3319,

"Thermal Overload Modification" EWR 4525-1, "Fault Current Analysis of Power Distribution System" EWR 4525-2,

"Adequacy of System Voltages"

I

0

A complete listing of a11 do'cuments reviewed is included in Attachment II.

No unacceptable items were identified.

2.2.2.5

~S<<N Ikd The team performed selective walkdowns of portions of the electrical systems.

The walkdowns were to verify as-built conditions for installed equipment and components'uring the walkdown of the "A" battery room the team observed a jumper cable between the upper and lower tier battery cells which appeared to exceed the minimum allowed bend radius.

The licensee is tracking this concern for evalua-tion and replacement of the cable, if necessary.

The team also noted that both battery support racks did not have a grounding cable to provide equipment ground for personnel safety.

The licensee is evaluating this concern to determine if'rounding is necessary.

The team also verified that installed dc fuses and circuit breakers were as specified in electrical drawings.

2.2.3 Instrumentation and Control The scope of the Instrumentation and Control design review during the Safety System Functional Inspection (SSFI) of the Residual Heat Removal (RHR) System was to evaluate all RHR system design changes to Ginna's original Design Basis Document (DBD) calculations.

However, since the DBD calculations were unavailable, the inspection consisted of a review of system design changes and their effect on associated Emergency Core Cooling Systems such as Safety Injection (SI),

Containment Spray (CS)

and Component Cooling Water (CCW) to assure that the present instrumentation and control configuration meets system requirements.

Documents reviewed included the UFSAR, Technical Specifications, gA Manual, Ginna Maintenance and Operating Procedures, system drawings, and industry standards.

2.2.3. 1 Environmental uglification of Electrical E ui ment Licensees have been required to establish a program for qualifying safety related equipment which must function during design basis accidents (10CFR 50.49).

The program must address environmental effects such as temperature, pressure, humidity, and radiation on electrical equipment.

The qualification basis for equipment located in the RHR pump room postulates a

RHR pump seal failure 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the beginning of the recirculation phase.

The team questioned the basis of the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period and requested RG5E to substantiate the method of detecting any leak in the RHR pump room if the pump seal were to fail before the stated

hour period.

An earlier than 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> failure of the pump seal could affect the environment under which the RHR pumps are presently qualified.

The team's concerns in this regard are as follows:

1)

In the event of RHR pump seal leakage occurring at the beginning of the recirculation phase, the environmental conditions could be significantly more harsh than previously analysed since the auxiliary building sump pump motors and its controls are not environmentally qualified for the harsh environment that would exist, thereby potentially making them inoperable.

Also, the leak detection equipment located in the auxiliary building RHR pump room sump pit area is not currently qualified for the harsh environment that would exist, and thus cannot be relied upon to alert the control room operators of a high sump water level indicating a possible RHR pump seal failure.

Therefore, a single failure of one RHR pump seal could result in the loss of both RHR pumps due to the flooding and other harsh environ-mental factors in the RHR pump'room.

(See Section 2.2.4. 1 for further discussion of RHR pump seal leakage and 2'. 1.3 for similar concerns regarding single failure susceptibility).

The licensee is presently evaluating the adequacy and basis of the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> seal failure analysis.

This item is considered unresolved pending licensee evaluation of this concern and NRC review (50-244/89-81-08).

2.2.3.2 Instrument and Set oint Control The licensee does not have a comprehensive and controlled instrument list, which identifies and,controls all setpoints for instruments, time delay relays or relief valves.

A comprehensive and controlled instrument list would provide engineering and plant staff information to recognize which instruments are important to safety and, therefore, would require prompt engineering attention to correct deficient operation.

RGEE currently uses

"P" Procedures as the (as-designed)

controlling document to identify safety related instruments and setpoints.

However, a review of the P-4 and P-7 procedures revealed several instrument and setpoint inconsistencies for the RHR system.

Namely, LT 920, 921; LT 942, 943; and PIC 629 were either missing from the procedures or had setpoints that were different from what was currently shown on their respective as-installed calibration sheets.

The team considers this to be an example of weak control of engineering documentation.

The effects of environmental and calibration inaccuracies on instrument loop setpoints have not been confirmed by RGEE to ensure that sufficient margin exists between instrument setpoints and the limits imposed by the Technical Specifications for the RHR and other safety r elated systems.

Guidance addressing these attributes is provided in ISA Standard S67.04 which is endorsed by Regulatory Guide 1. 105.

Although RGKE is not committed to the ISA Standard or the Regulatory Guide, a

recent NRC Information Notice No. 89-68, identified instances where several licensees modified instrument loops but failed to verify that these modifications

'till met the original system design objective L S

,18 As an example, PIC 629, which provides an interlock to prevent the opening of valve MOV-857B during high head recirculation, appeared to be experiencing large setpoint drift.

The plant engineering staff revised the calibration procedure and arbitrarily increased the setpoint tolerance to encompass the drift value, without adequately evaluating the root cause of the setpoint drift.

The root cause was later determined to be a combination of instrument vibration and'

weak calibration procedures The team concluded that the above observations indicate a weakness in RG&E',s documentation and design process which could lead to errors in operating procedures.

The team noted that RG&E has recently initiated a Setpoint Verifi-cation Program (EWR 5126)

and an Instrument List Upgrade Program (EWR 4883)

to address the above inadequacies.

2.2.3.3 Instrumentation

& Control Desi n Process Several recent design modification packages affecting the RHR, SI, and CS systems were evaluated for their effect on system operation and compliance with RG&E engineering procedures.

The team identified several inconsistencies between completed design modifications and associated engineering procedures.

The fol.lowing are some examples of design control process discrepancies:

A.

EWR 2607D Transmitter Upgrade Pr'ogram and EWR 3262 Sump B Level Indication EWR 2607D installed environmentally qualified electrical equipment as described in Amendment 24 to the Technical Specifications and EWR 3362 installed qualified level indication systems for containment sump B.

For both of these design changes, RG&E failed to perform a Design Verification Analysis to confirm that these programs accomplished the objectives as specified in their respective Design Criteria and Safety Analysis.

Thus, these engineering packages have not been officially closed out.

The team considers this to be an example of a weakness in RG&E's management control system which does not assure that'adequate evaluation/verification is performed and modifications are properly closed out.

(See Section 2.2 for further discussion),

B.

EWR 4761 High Head Recirculation Evaluation This modification exchanged the power feeds and an instrument interlock contact on valves MOY-857A and MOV-857B.

The interlock contact of instrument PIC-629 is shown incorrectly on both the elementary and the control schematic drawings.

The contact is shown in the "normally open" position, when in fact i.s should be shown in the "normally closed" position to agree with the actual installed position.

This interlock prevents the opening of MOV-857B whenever the RHR system pressure exceeds 250 psig to protect the suction piping of the SI system.

Other discrepancies noted with this package included incomplete, undated, and illegible attachments on several Field Change Request (FCR) package The correct position of a11 electrical devices and equipment must be reflected on applicable engineering drawings.

Design documents should also be complete and legible.

The team considers..this to be an example of a weakness in the documentation and control of engineering modifications.

C.

EWR 3391E P&ID Upgrade Program This program was originally initiated in 1981 to identify and resolve drawing inaccuracies in the P&ID's.

RG&E engineering procedures require that any changes to engineering drawings be adequately evaluated and controlled.

RG&E recently issued over 140 drawings with changes such as control valve numbers, valve failure positions and miscellaneous system notes that were revised or removed from the P&ID's.

The team was concerned about how RG&E maintained traceability for these changes since no EWR package (Design Criteria, Design Analysis, etc.)

was prepared, no record or punchlist of the latest changes was available and no interdiscipline review took place prior to the P&IDs being issued.

The I&C engineering staff was not involved in the review process for these drawing revisions.

Only mechanical engineering staff reviewed these changes.

The team considers this to be an example of a weak control over the drawing change process and compliance with engineering procedures.

D.

EWR 4218 Instrument/Sample Tubing and Supports This modification revised the sensor tap location of several,.pressurizer instruments.

The EWR Design Criteria stated that the revised installation of instrument sensing lines would conform to the ISA Standard S67.02 and Regulatory Guide 1. 151.

However, the licensee's current construction specification (ME-85R3) does not invoke either of these two documents nor does it mention how it applies to tubing installations.

In addition, the spans between tubing supports for different tubing configurations were not identified in the attached figures as specified in the Design Criteria.

The'eam considers this to be a

weakness in the management control system to assure that complete and consistent design output is issued and distributed for implementation.

The team also noted that these drawings do not include the valve function/type designator, i.e.,

MOV, HCV, FCV, as previously indicated on these drawings.

However, these valve labels are still used by control room operators.

In addition, other engineering documents, procedures, UFSAR and QA Manual still identify these valves with their prefix designator included as part of the tag number.

Consistency in component identification reduces the likelihood of operational and testing errors from a human factor standpoint.

The absence of comp'lete and consistent valve identification nomenclature on P&IDs is significant during event responses by technical personnel not familiar with the new valve numbering

.

system.

This is essential information for individuals providing technical support during events which require offsite support.

In response to the team's concern, RG&E engineering initiated IDR 0089-89 to perform an evaluation of the valve identification differences that now exist and prepare a plan of action for resolutio C l

2.2.4 0 erations This portion of the inspection was intended to review various operational aspects of the RHR system and to assess activities in those areas with respect to the ability of the RHR system to perform its intended safety function.

The principle areas reviewed are listed below.

1.

Normal, abnormal and emergency operating procedures.

2.

Test procedures and test practices effecting the RHR system, including a review of the ISI and IST programs focusing on RHR.

3.

Operator training and knowledge of RHR normal and emergency operation.

4.

System walkdowns to confirm that RHR and associated PAID drawings agree with the existing system configuration.

5.

Status of RHR system documents maintained in the control room.

2.2.4. 1 Translation of FSAR Re uirements into 0 erational Procedures The Ginna UFSAR contains "operational" information and data which the inspectors determined to be invalid and without a supporting design basis.

Specifically, Section 5.4.5.3.5 states that in the event of a 50 gpm RHR pump seal leak and loss of both pump room sump pumps, operators have 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to isolate the leak before the RHR pump motors become flooded.

The team determined that a

gpm leak into the pump room, with two failed sump motors, cannot be sustained in the RHR pump room for four hours before flooding the pump motors.

Preliminary calculations by the team indicate that the RHR pump motor s will be flooded in approximately 2-1/2 hours under these conditions.

This was determined by direct measurement of the volume of the RHR sub-basement pit below the RHR pump motors.

This volume was found to be approximately 960 cu. ft. (24ft X 24ft X

20in).

This volume would fill in approximately 144 min. at 50 gpm.

In four hours,

gpm would fill approximately 1600 cu. ft. and would put the water level in the room at 32 in. above the floor, or 2 in. above the centerline of the motors.

The team interviewed a Westinghouse design representative who indicated that the original design basis for the system allowed operators 30 minutes to identify and isolate a 50 gpm leak in the RHR pump pit.

This was based upon the maximum worst case sump pump discharge volume available in the waste holdup tank being designed to accommodate 1800 gallons from the RHR pump room. It was suggested that the four hour allowance was originally intended just to indicate a rough system margin for coping with gross leakage in the pump pit.

The team was unable to find any consideration of this in any of the available design documents associated with the RHR system.

It also could not be found in any of the system operating or emergency proc'edures.

The alarm response procedure for the high sump level alarm requires control room operators to dispatch an

l l

'

auxiliary operator to investigate possible pump room flooding, however there is no reference to a maximum time limit to 'isolate a leaking RHR train if necessary.

During the walkdown of the RHR syst'm, the inspection team identified several piping penetrations in the ceiling of the pump room which could allow at least

gpm to enter the room.

Other major penetrations (hatches, ladderways, etc.)

have been surrounded by coffer dams to prevent gross flooding into the pump room.

The team reviewed the instrumentation devices available to control room operators which would indicate RHR leakage in the pump room.

The only known indication would be from a high level sump alarm.

However, the sump alarm instrument is not qualified for service in a harsh environment.

(See Section 2.2.3. 1 for further discussion on equipment environmental qualification)

~

Operating procedures, emergency procedures, and operator training material do not reflect the limiting design basis of the system.

The system operating margins do not reflect an accurate time limit to flood the RHR motors as reflected by the system design basis and the actual volume of the pump room below the elevation of the motors.

The apparently unsupported 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> flooding limit is considered an unresolved item pending verification of the value by the licensee or correction of the UFSAR (50-244/89-81-10).

2.2.4.2 Control Room S stem Drawin s

The team reviewed the, upgraded P&IDs for the RHR and its interfacing systems and noted that several items such as component nomenclature labels and valve failure modes had been deleted from the drawings because many such items had not been field verified prior to the deadline for issuing the revised drawings.

Revision 8 to the Chemical and Volume Control System P&ID 33013-1264 (upgraded P&ID) removed the setpoint designation for RHR safety relief valve SRV-203.

The drawings were revised with the intent of representing the current as-built condition of the plant; and although this type of information may have been available to RG&E Engineering, it was not entered onto the drawing because the SRV-203 setpoint had not been confirmed early enough before issuing the drawing revision.

The drawing revisions were a commitment outstanding from a Notice of Violation issued two years prior to this inspection.

Though the team noted drawing discrepancies, the drawing update program is still in progress.

2.2.4.3 Safet Relief Valve Testin The team reviewed UFSAR Section 5.4.5.3.2 (RHR overpressure protection),

safety relief valve test procedure RSSP-12, Maintenance Procedure M.37.35.1, and SRV test data obtained over the previous three year period.

The following observa-tions were made:

All plant safety relief valves are removed during the annual refueling outage (except main steam reliefs) and are bench tested after all necessary refurbishment or repairs are performed.

The bench test includes a relief setpoint test ("pop test")

and a leak test.

These tests exceed the requirements for type and frequency required by ASME Section XI (1977),

Procedures IWV-3510, IWV-3511, and IWV-3512 for safety relief valves which requires only a setpoint test once every ten year l

'

The safety relief valve test proce'dures contain. general and minimal instructions for performing the relief setpoint test.

Valve lift pressures have been recorded in 5 lb. increments and the test acceptance criteria procedure does not specify what the accuracy of the test equipment is or must be.

Standard test practices are not always performed or documented.

As written, the test procedure (M.37.35. 1) requires only one successful setpoint test.

However, maintenance department personnel reported that it is standard practice to perform two "pop tests" on any safety relief valve which has been disassembled or refurbished.

The inspectors noted that the number of setpoint tests is not always recorded in the test data sheets for refurbished safety valves.

For example, refurbished valve RV-97098 was tested on 3/14/86 with the results of only one lifttest documented.

Qs Data from relief valve testing has been recorded inaccurately and incon-

.

sistently in some cases.

For example, valve RV-283 was bench tested on 3/17/87 and three pop tests were recorded (2800 psig, 2740 psig, and 2740 psig).

A "1/2 flat up" adjustment was also recorded during this test.

This valve was reinstalled in the plant and subsequently removed because of a gasket leak.

It was retested on 3/19/87; however the same pop test readings as the 3/17/87 test were recorded (i.e.,

2800, 2740, and 2740 psig), but this test was performed'ith a "1 'flat up" adjustment to achieve the final setpoint of 2740 psig.

The licensee was unable to provide any documentation to confirm the later test results.

Subsequent to the inspection, the resident inspector verified that, the setpoint of the valve was acceptable as indicated by tests performed on March 20, 1990.

The inspection team concluded that RG&E should formalize SRV test procedures, instructions, and data recording requirements.

During the on-going procedure upgrade effort, RG&E should assure that valve test procedures incorporate all new (1986)

ASME Code Section XI, IMV-3512, and ANSI/ASME OM-1-1981 requirements for safety relief valves.

In particular, more than one successful

"pop test" at the designated lift pressure should be performed and the results completely and accurately documented.

Valve setpoint and leak testing should also be performed with the allowable specification listed in the procedure.

Valve test results and data should accurately reflect the results of all test activities.

RG&E should also consider the benefits of adding other periodic valve tests such as the as-found relief lift setpoint, valve accumulation, and valve capacity.

The 1990 ten year IST program plan is currently pending completion of review and approval by the NRC; however, the inaccurate and inconsistent recording of SRV test data is considered an unresolved item pending further review of SRV procedures and data results obtained during the 1990 refueling outage (50-244/89-81-09).

2.2.4.4 0 erations/En ineerin Interface and En ineerin Assurance A review of information available to the plant operators identified several documents used by the plant staff that are inaccurate or not updated.

Examples are listed below:

II a.

Piping and Instrument Diagram (P&ID) updates and Design Change Requests (OCRs) posted in the control room were reviewed by the team.

It was noted that the RHR system P&ID (33013-1247)

did not reflect the current valve position configuration for the RHR system.

Also, the existing DCRs out-standing against this drawing could not be used to derive the correct valve positions in that DCRs 1247-4, and 1247-5 had not been approved by RG&E Engineering and did not reflect the current position of valve 822B.

The control room supervisor'indicated that he would submit a

DCR to reflect current valve positions in the RHR system; however, this OCR was never posted on the drawing during the inspection period.

It was evident to the team that processing of OCRs does not always occur in a timely manner such that the control room P&IOs can be immediately updated.

It was also evident that when the plant operations organization makes permanent changes to system valve positions, there is not an immediate markup or annotation made on the effected drawings.

Drawings are eventually annotated when a

DCR is issued to RG&E Engineering; however, this also does not always occur in a timely manner, since DCR l247-5 was never entered on the RHR P&ID during this inspection.

b.

The team noted that permanent changes to valve positions in system operating procedures are occurring without the prior concurrence of RG&E engineering.

Criteria for deciding when to obtain engineering concurrence prior to making permanent procedure changes or valve lineup sheets, which could affect system operation or performance would enhance the Operations/Engineering interface.

This is particularly true in cases where engineering should evaluate the significance of reconfiguring valves, for example, before system operating procedure changes become effective that could affect design basis parameters.

This is considered a weakness.

C.

d.

UFSAR, sections 5.4.5.3.5 and 5.4.5.2, refers to two remotely operated valves which can be utilized to isolate an RHR loop from outside the pump room.

The system walkdown and the upgraded P&IDs indicate that there is no longer any method available to isolate an RHR loop remotely (i.e., via reach rods).

Although this information has been removed from the RHR P&ID, there is no identified punchlist item to delete this information from the UFSAR.

S During a review of documents in the control room, the team noted that uncontrolled training material (Lesson Texts)

have not been updated to reflect system changes accomplished during the last outage.

Lesson Texts were found to contain invalid or incorrect information which is outdated due to system modification l

>

~

I Cl

'

.24 For example, Lesson Text RGE-25 contains reference to an operator's ability to isolate one RHR pump from outside the pump pit by manipulating isolation valves via reach rods.

Only two valves in the pump pit are remotely operable by reach rods and these cannot isolate either RHR pump.

This text also contains reference to RHR system valves and piping which were changed during the 1989 refueling outage, and it also contains

'a reference to the invalid four hour RHR pump seal leakage allowance contained in the UFSAR.

(See Section 2.2.4. 1 for further discussion).

This material has not been designated as potentially out of date, or not useful for system operation.

Control room operators indicated that they referred to this material frequently since it contains extensive information on system functions, capabilities, tolerances, and operational limits.

However, there is no station requirement to maintain this training material current.

The inspection team considers that making this type of information available to control room operators in such an uncontrolled manner represents a notable program weakness due to the significant impact that it could have upon the operator's knowledge and their activities under accident conditions.

Information required by the operators in the control room should be available in up-to-date, controlled documents.

The lack of timely operating information updates for control room use is considered an unresolved item pending licensee evaluation and resolution (50-244/89-81"07).

2.2.5 Structural Desi n Review The team reviewed RGEE's seismic upgrade program for the piping and pipe supports of the Residual Heat Removal (RHR) system and the related segments of the components cooling and service water systems.

The piping supports reviewed were selected during a system walkdown, based on engineering considerations, such as:

location, geometric configuration of the line, types of supports, and adjacent system components located along the pipe run.

The inspector concentrated his review on the pipe stress analysis and pipe support design critical items below:

~ 2.2.5.1 Pi in Su ort Stress Anal ses The team reviewed the stress analysis for line RHR-400 in the RHR system.

This

'tress analysis was performed by Westinghouse, and the loads were transmitted to the licensee in document RGE-81-553, Stress analyses for two supports (RHU-53 and RHU-46) on this line were selected for review.

The team's review of pipe and pipe support stresses consisted of confirming the adequacy of critical parameters such as:

the geometric configuration of each individual support, the basic design assumptions and techniques, the correct application of Westinghouse pipe stress loads in the pipe support design, the adequacy of computer models (inputs and outputs)

used for selected individual supports; and, finally, to ensure that the 1983 Edition through winter 1985 addendum of the ASME Boiler and Pressure Code, section III, subsection NF was

used for the. new supports designed for, the recirculation pipi'ng (modification package EWR 4675).

The team also reviewed the stress analysis for line CC-200 in the component cooling system.

This stress analysis also was performed by Westinghouse; and the loads were transmitted in document RGE-84-644.

The stress analysis for support CCU-151 was selected for review.

The latest stress analysis shows lower values than the previous one; therefore, the support as designed meets the requirements of code, in terms of allowables.

The stress analyses for section SW-1000 of the RHR piping system and the four associated supports were reviewed (SWU-191, SWU-192, SWU-210, SWU-214).

The pipe stress analysis results were transmitted in document RGE-024.

The review disclosed that support SWU-191 had its shear lugs removed, and the support was declared inactive, until Westinghouse performed an evaluation to assess the overall effect of the missing lugs.

The evaluation showed that the stresses in the pipe remained acceptable.

The team also reviewed a major modification to the RHR system.

This modification consisted of the installation of a new RHR pump recirculation line (modification package EWR-4675).

In this particular case, the pipe stress analysis was performed by Westinghouse, but the pipe supports were designed by NUS in calculation

¹NUS 9939-5-01.

For this particular analysis, the team confirmed that the new recircu-lation piping was compatible with the previous analysis performed on the RHR main pipe run.

This was done to include any stresses in the connecting welds between the new recirculation line and the RHR piping due to differential displacement.

Based on the review described above, the inspector found the design calculations for pipe supports to be acceptable.

These calculations were generally complete, neat and legible with detailed documentation of assumptions and design inputs.

Nevertheless, the inspector identified a concern regarding the control of past stress calculations for modification and upgrade.

Except for the cognizant engineer, who is well aware of the past stress calculations, there is no index or other mechanisms to track past calculations.

In response to this NRC concern, the licensee stated that a computerized system which will track and provide guidance to new engineers regarding past stress analyses will be prepared.

This system also will clearly identify the loads used to design, modify and/or upgrade existing pipe supports.

2.2.5.2 Check Valve Pro ram The inspector verified and reviewed RG8E's program on check valve reliability.

For this purpose, the licensee evaluation entitled,

"Check Valve Design Applica-tion Review" was reviewed.

This evaluation was performed by Gilbert/Commonwealth in accordance with EPRI R&D project RP-2233-20,

"Application Guidelines for Check Valves in Nuclear Power Plants."

A total of forty check valves were evaluated.

Twenty-nine of these check valves were identified as being in

"severe service" and fourteen valves of the "severe service" category were classified as Priority 1 for inspection and preventive maintenance purpose After the release of RG&E's evaluation, dated 12/15/89, RG&E's check valve program scope was revised, and enhanced to incorporate comments from a review performed by the NRC and its contractor EG&G.

The new program incorporated the following considerations:

~

All safety related check valves of any diameter were lumped under discrete groups of similar characteristics.

Flow tests were performed for represent-ative samples of each group.

-Based on the licensee's record on status, dated December 4,

1989, the team noted that 16 check valves were not tested because of pipe configuration or lack of flow meters; therefore, some of these valves were disassembled, or will be disassembled for visual inspection of the internals.

The team also reviewed procedure M-37. 107, as a representative procedure to ensure the existence of clear instructions necessary for personnel to disassemble, inspect, clean, repair and reassemble swing check valve V-867A during 1989 ISI outage.

No deficiencies were identified in the procedure.

In conclusion, based on this inspection no unacceptable conditions were identified in the check valve program at Ginna Station.

3. 0 CONCLUSION The team concluded that the design control measures as implemented/practiced by the licensee's engineering department were weak, and did not favorably compare to good engineering assurance practices generally accepted in the industry.

There was lack of consistency in the implementation of approved engineering procedures among the various departments and engineering management did not appear to be cognizant of this inconsistency.

In addition, management had not assured an effective process to resolve any safety concerns raised by an individual or department.

Furthermore, there was a lack of formal design interface control, lack of control over external communication with design consultants and a lack of.control over design documents/modification packages during the development and implementation phase.

In summary, the above conclusions could be termed as a lack of engineering assurance practices within the engineering departments'.0 EXIT INTERVIEW J

At the conclusion of the inspection on September 1,

1989, the inspection team met with the licensee representatives, denoted in Attachment II.

The team leader summarized the scope and findings of the inspection at the time.

The team gave no written material to the license ATTACHMENT I PERSONS CONTACTED Rochester Gas

& Electric RG&E C.

0 ~

J.

G.

G.

G.

J.

G.

D.

M.

F.

D.

R.

J.

D.

R.

B.

T.

J.

M.

B ~

R.

J.

J.

L.

W.

H.

G.

J.

p.

G.

Anderson, Manager, Quality Control Baker, Electrical Engineering Baker, Electrical Maintenance Engineer Daniels, Supervisor, Electrical Engineering Services Eng, Maintenance Hermes, Nuclear Safety and Licensing (Engineering Te Huff, Maintenance Training (Schlegel Rd.)

Joss,'esults and Test Klemz, Ginna Team Coordinator Lilley, Manager, Nuclear Assurance Maciuska, Operator Training Mar kowski, Mechanical Engineering C. Mecredy, General Manager Metzger, Mechanical Engineering Morrill, Operations Assessment Ploof, Minor Modifications Popp, ICC Maintenance Schuler, Manager, Operations Department Smith, Manager, Materials Engineering and Inspection Smith, Station Modifications Snow, Chief Engineer E. Smith, Sr. Vice President Sweet, Temporary Modifications St. Martin, LERs and Corrective Action Sucheski, Structural Engineering Tono, NUS Corp., Structural Engineering Van Houte, Station Configuration Management Voci, Manager, Mechanical Engineering Wahl, Mechanical Wilkens, Director, Nuclear Engineering Services Wrobel, Manager, Nuclear Safety and Licensing am Coordinator)

Services U.S.

NUCLEAR REGULATORY COMMISSION USNRC C.

N.

Marschall, R.E.

Ginna Senior Resident Inspector Perry, R.E.

Ginna Resident Inspector

'

l

ATTACHMENT II'HR SSFI DOCUMENTS REVIEWED ORIGINAL DRAWINGS AND WRITE-UPS UFSAR Sections 3.1, 3.2, 3.5, 3.6, 3.9, 3.11, 5.4 and 9.2 Draft 1989 UFSAR Section 5.4 RGE-23 Lesson Test, ESF RGE-25 Lesson Text, Residual Heat Removal FSAR Figure 9.3-1, Auxiliary Coolant System Flow Diagram FSAR Figure 6.2-1, Safety Injection System Flow Diagram Gilbert Associates Drawing No. D-304-611 IX, RHR Plan Gilbert Associates Drawing No. D-304-612 VII, RHR Sections Pacific Pump Drawing No. D-2098, RHR Pump Sectional Assembly Gilbert Associates Drawing No. D-381-354, Sheets 1-12,'sometric Drawings Joseph Oat Drawing No. 4807, RHR Heat Exchanger Pacific Pump, RHR Pump Performance Test Data Sheet and Curves P&IDs CCW 33013-1245 CCW 33013-1246 RHR 33013-1247 Service Water 33013-1250 Safety-Related Service Water 33013-1251 Non-Safety Containment Spray 33013-1261 Safety Injection and Accumulators 33013-1262 Chemical and Volume Control 33013-1264 Pum Performance Curves Manufacturers Manufacturers Manufacturers Manufacturers Pump Performance Curves SI Pump Performance Curves -

RHR (Same as E2-38)

Pump Performance Curves CCW Pump Performance Curves SW PIPING ARRANGEMENT DRAWINGS Safet Injection S stem D-304-642 XV D-304-643 XII D"304-644 XXIII D-304-645 X

D-304-646 XII

I Attachment II Com onent Coolin S stem D-304-621 XV D-304-622 XIII D-304-623 IX D-304-624 II D-304-625 VII D-304-626 Y

D-304-627 XVII D"304-628 XII D-304-629 XVII Service Water S stem D-304-202 V

D-304-203 III D-304-693 XX D-304-694 XVII D-304-694

D-304-695 XIX D-304-696 XIV D"304-221 XV D-304-222 XV ENGINEERING WORK REQUESTS EWR 4675 RHR Pum Recirculation Modification Packa e

EWR 3319 "Thermal Overload Modifications" EWR 3341 "Design Analysis" EWR 3341

"DC Voltage Regulation" EWR 3341 "Class 1E Battery Testing Program" EWR 3341

"DC System Load Survey" EWR 3891

"A8B Vital Battery System Replacement" EWR 4525 "Adequacy of Electric System Voltages" EWR 4525-1 "Fault Current Analysis of Power Distribution System" En ineerin Studies ECCS Hydraulic Analysis for R.E. Ginna, NUS Report No. 3S61-M-07, Rev.

Safety Injection Mini-Flow Performance, Engineering Calculation No.

9836-M-10 (NUS), October 26, 1988 Hydraulic Model Modifications for Safety Injection and RHR Systems, NUS Calculation No. 9836-M-08, Rev.

0, October 24, 1988 Other Documentation Relevant To Present S stem Status P&ID Upgrade Report on RHR System

Attachment II DOCUMENTATION RELATED 70 ENGINEERING ACTIVITIES Generic Letter 88-17 Packa e

NRC Bulletin 88-04 Packa e

EGGS H draulic Anal sis Gilbert Associates Report No. 428-4824-027-2R, Hydraulic Analysis of Containment Spray, Residual Heat Removal, and Safety Injection System, March 11, 1982 Maintenance Records Mech. Preventative Maint. Overview (RHR)

Elect. Preventative Naint. Overview (RHR)

EQ and/or I&C Periodic Maint.

(RHR)

RHR (RCM) Failure Nodes Effects and Criticality Analysis ECCS Unavailability Monitoring Study A-1005 - Elect.

PN Program A-1006 EQ Maintenance Program A-1010 Mech.

PM for Rotating Equip.

CP-64

"Calibration and/or Maintenance of the "A" or "B" Diesel

'enerator Instrumentation M-1008 - Electrical Preventative Maintenance of Batteries, Chargers, Inverters and Miscellaneous Electrical Systems N-1104 Ginna T.S.

Surv.

Program Maintenance Department ME-256 Snubber Inspection

& Test Program S stem Com onent And Test Records M-37.35. 1 Safety Relief Valve Inspection and Maintenance PT-RHR System PT-2.2A RHR System S/D OP Test PT-2.4 - Cold/Refueling MOV Surv.

PT-2. 1 RHR Check VLVS 853A & 853B PT-2. 10. 10 -

RHR Check VLVS Full Flow Verif.

PT-2. 10. 12 - Open Exercising of Check VLV 702 PT-A/B, 853A/B, 700, 701, 720, 721 Seat Leakage RSSP-1.1 -

RHR Verif.

RSSP-12 Testing of Primary and Secondary Relief Valves on Test Stand PT-1 Station Battery 1B Service Test PT-1 Station Battery lA Service Test PT-10.4 - 1A Station Battery Discharge Test PT-1 B Station Battery Performance Test PT-11 - 60 Cell Battery Banks "A" & "B" PT-12. 1 - Emergency Diesel Generator 1A

l )

~

h

'I l

Attachment II LERs80-010 81-011 82-002 82-017 83-015 83-017 83-018 84-002 84-003 84-005 87"001 87-007 87-008 0 eratin Procedures O-l - Plant Startup 0-1. 1 Plant Heatup CSD

>HSD 0-1. 1D - Pre-Heatup Check List 0-2.2 - S/D From HSD to Cold 0-2.3 - Plant at Cold or Refueling S/D 0-2.3. 1 - Mid Loop OPS 0-2.3. 1A -

CNMT Closure in Two Hours at Mid Loop 0-2.3.2 - Fill 5 Vent RCS 0. Natural CIRC Cooldown HSD

>CSD 0-6. 14 - Monthly Surveillance Sch.

0. 10 Crevice Cleaning S-2.4A Draining the Pressurizer (RCS Degassed)

S-8A CCW Startup

OP Valve Alignment S-13A -

RHR Lineup S-13B RHR Pump Isolation S-13C 1A RHR HX Isol 8 Restor S-13F 1B RHR HX Isol 5 Restor S-13G.-

RHR 1989 Outage Special OPS S-13H - Isolating 4 Draining of the RCS and SIS S-13I RHR SYS Outage Restoration S-30.2 -

RHR SYS Valve & BKR PCS Verification S-3 Safeguard Valve Posit Verif (Inside CNMT)

AP-RHR. 1 " Loss of RHR AP-RHR.2 - Loss of RHR While Operating at RCS Reduced Inventory Condition ES-1.3 - Transfer to Cold Leg Recirculation ECA-Loss of All AC Power

L r

Attachment II

STRUCTURAL DESIGN DOCUMENTS Rochester Gas and Electric Corporation

"Design Criteria Ginna Station Seismic Upgrade Program" EWR 2512 Revision 5 dated April 11, 1989 Rochester Gas and Electric Corporation

"Design Review Ginna Station Program SW-1000" EWR 251200 Revision 1 dated July 22, 1987 Rochester Gas and Electric Corporation

"Design Review Ginna Station Seismic Upgrade Program RHR-300" EWR 2512LL Revision 1 March 21, 1989 Rochester Gas and Electric Corporation "Control of Station Modification" Technical Review Procedure No. A-301 Rev.

20 September 27, 1984 Rochester Gas and Electric Corporation "Station Modification Installation and Acceptance" Technical review procedure No. A-301.3 Rev.

November 2, 1989 Rochester Gas and Electric Corporation "Station Modification Completion" Technical review No. A-301.4 Rev.

5 April 26, 1989 Rochester Gas and Electric Corporation

"Design Review Ginna Station Residual Heat Removal Pump Recirculation (mechanical)"

EWR 4675 ME-2 Rev.

4 April 5, 1989 Rochester Gas and Electric Corporation

"Ginna Review of Design Inputs for Major Modification" January 20, 1989 Rochester Gas and Electric Corporation

"Design Criteria Ginna Station RHR Pump Recirculation" EWR 4675 Rev.

1 September 14, 1988 Rochester Gas and Electric Corporation "Cooling Water Chlorination Procedure" WC-19, Rev.

3 April 19, 1989 R.

E. Ginna Nuclear Power Plant Pump and Valve Inservice Testing Program Response to EGKE guestions and Comments Rochester Gas and Electric Corporation "Interoffice Correspondence Ginna Station CAR Meeting for CAR 1698 on Generic Letter 89-13" November 29, 1989 Rochester Gas and Electric Corporation "Service Water System PT-2.7" Gilbert/Commonwealth Check Valve Application Review for R.

G. Ginna Station Rochester Gas and Electric Company RGEE P.O.

CP-71141-C-RD G/C W.O. 04-4824-070 December 15, 1987 Gilbert Associates, Incorporated Evaluation of pipe support ACH-104 (MK-CCU-151) No. SU-CC200-IV November 18, 1981 Isometric No. C-381-356 Sh.

5 Rev.

2 November 18, 1981 Gilbert Associates, Incorporated Evaluation of pipe support N-201 (MK-RHU-53) No. SU-RHR400-IV Isometric No. C-381-354 Sh.

8 Rev.

Gilbert Associates, Incorporated Pipe support ACH53 (MK-RHU-46) No.

SU-RHR400-IV Isometric No. C-381-354 Sh.

7 Rev.

Gilbert Associates, Incorporated Support Evaluation for SWAH-N703s (MK-SWU-214) No.

SU-SW1000-IV Gilbert Associates, Incorporated Support Evaluation for SWAH-42 (MK-SWU-210) No.

SU-SW1000-IV

Attachment II Gilbert Associates, Incorporated Support Evaluation for SWAH-40 (MK-SWU-192) No. SU-SW1000-IV Gilbert Associates, Incorporated Evaluation of pipe support SW-115 (MK-SWU-191) No. SU-SW1000-IV Isometric C-381-358 Sh.

1 Rev.

C-381-358 Sh.

2 Rev.

NUS Evaluation of Support RHU-141, 143 Isometric 33013-2085 Rev.

EWR 2607D, Transmitter Upgrade Program EWR 2512, Seismic Upgrade Program EWR 3262, Sump B Level Indication EWR 4761, High Head Recirculation Evaluation EWR 4218, Instruments/Sample Tubing and Supports EWR 3391E, P&ID Upgrade Program EWR 4960, Time Delay Relay Upgrade Program EWR 4805, PIC 629 Evaluation CAR 1828, RHR Pump Recirculation CAR 1831, Potential Lose of RHR Pumps CAR 1842, Non lE/1E Time Delay Relay Replacement CAR 1942, CCW Pump Discharge Pressure (PIC 617)