IR 05000250/1987054
| ML17347A710 | |
| Person / Time | |
|---|---|
| Site: | Turkey Point  |
| Issue date: | 03/18/1988 |
| From: | Brewer D, Crlenjak G, Mcelhinney T, Schnebli G NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| To: | |
| Shared Package | |
| ML17347A708 | List: |
| References | |
| 50-250-87-54, 50-251-87-54, NUDOCS 8803250294 | |
| Download: ML17347A710 (36) | |
Text
<p,g REGS<
)i>>*<<4 UNITED STATES NUCLEAR REGULATORY COMMISSION
REGION II
101 MARIETTASTREET, N.W.
ATLANTA,GEORGIA 30323 Report Nos.:,50-250/87-54
'and 50-251/87-54 Licensee:
Florida Power and Light Company 9250 West Flagler Street Miami, FL 33102 Docket Nos.:
50-250 and 50-251 License Nos.:
DPR-31 and DPR-41 Facility Name:
Turkey Point 3 and
Inspection Conducted:
December 28, 1987 January 18, 1988 Inspectors:
R. Brewer, Senior Resid t Inspector F.
Mc i ney, Resident Inspe or G. A.
hnebli, Re ident Inspe or Approved by:
V. Crle a, Sec on Chief ivision of Reactor Projects D te Signed 3/F >s ate igned
/7 EC'te i ned 3gg g8 te igned SUMMARY Scope:
This routine, unannounced inspection entailed direct inspection at the site, including backshift inspection, in the areas of annual and monthly surveillance, maintenance observations and reviews, engineered safety features, operational safety, facility modifications and plant events.
Results:
Two violations were identified.
4 SSQ3i 8EIQ325 Q+QQQ25 PDR AOOC DCD
REPORT DETAILS Persons Contacted Licensee Employees
"J
~
S.
Odom, Vice President
"C. J.
Baker, Plant Manager-Nuclear
"L. W. Pearce, Operations Superintendent
"F.
H. Southworth, Senior Technical Advisor
"J.
W. Kappes, Maintenance Superintendent
"L. L. Thomas, Outage Manager J.
P. Mendieta, Services Manager-Nuclear
"R. A. Longtemps, Mechanical Maintenance Department Supervisor T. A. Finn, Training Supervisor J.
D. Webb, Operations Maintenance Coordinator W.
R. Williams, Assistant Superintendent Planned Maintenance
"D. Tomaszewski, Instrument and Control (IKC) Department Supervisor
"J.
C. Strong, Electrical Department Supervisor
"L. W. Bladow, Quality Assurance (QA) Superintendent
- R. J. Earl, Quality Control (QC) Supervisor
"B. A. Abrishami, Acting Technical Department Supervisor
"R.
G
~ Mende, Operations Supervisor J. Arias, Regulation and Compliance Supervisor V. A. Kaminskas, Reactor Engineering Supervisor
~R. 0. Hart, Regulation and Compliance Engineer G.
Solomon, Regulation and Compliance Engineer J. Donis, Engineering Department Supervisor
"S. Hale, Engineering Project Supervisor
"P. Higgins, Site Engineering-Licensing
"W.A. Skelley, Manager Juno Plant Engineering (JPE) Technical Licensing
- M.J. Kobi, JPE-Licensing Other licensee employees contacted included construction craftsmen, engineers, technicians, operators, mechanics, and electricians.
"Attended exit interview on January 21, 1988.
2.
Exit Interview The inspection scope and findings were summarized during management interviews held throughout the reporting period with the Plant Manager-Nuclear and selected members of his staff.
An exit meeting was conducted on January 21, 1988.
The areas requiring management attention were reviewed.
No proprietary information was provided to the inspectors during the reporting period.
Two violations were identified:
Failure to maintain adequate design control in the preparation of Plant Change Modifications (PCMs)
for the Auxiliary Feedwater (AFW)
Backup Nitrogen System, four examples
(paragraph ll); and the failure to meet the requirements of Technical Specification (TS) 6.8. 1, four examples; in that a Nuclear Plant Operator misaligned the AFW Backup Nitrogen System (paragraph 5);
a compensatory continuous fire watch was found asleep (paragraph 8);
I&C personnel performed maintenance on the Rod Control System without documented instructions or drawings appropriate to the circumstances (paragraph 6);
and the failure to promptly incorporate an On The Spot Change (OTSC) into an Off Normal Operating Procedures (ONOP) (paragraph 8).
3.
Unresolved Items (URI)
Unresolved items are matters about which more information is required to determine whether they are acceptable or may involve violations of requirements or deviations from commitments.
,No unresolved items were identified in this report.
4.
Followup on Unresolve'd Items (URIs),
Inspector Followup Items ( IFIs),
Inspection and Enforcement Information Notices (IENs), IE Bulletins (IEBs)
(information only), IE Circulars ( IECs),
and NRC Requests (92701).
(Closed)
URI 250,251/87-27-02; resolve NRC concerns that safety evaluation JPE-L-85-38, Revision
failed to meet appropriate regulatory requirements.
.This item is discussed in detail in paragraph 10.
~
Monthly and Annual Surveillance Observation (61726/61700)
The inspectors observed TS required surveillance testing and verified:
That the test procedure conformed to the requirements of the TS, that testing was performed in accordance with adequate procedures, that test instrumentation was calibrated, that limiting conditions for operation (LCO) were met, that test results met acceptance criteria requirements-and were reviewed by personnel other than the individual directing the test, that deficiencies were identified, as appropriate, and were properly reviewed and resolved by management personnel and that system restoration was adequate.
For completed tests, the inspectors verified that testing frequencies were met and tests were performed by qualified individuals.
The inspections activities:
witnessed/reviewed portions of the following test TP 398 4~P-49.
4-OSP-75.
3/4-0SP-75.3 3/4-0SP-75.6 3/4-0SP-75.7 Emergency Containment Coolers Periodic Test Reactor Protection System Logic Test AFW Train 1 Operability Test AFW Nitrogen Backup System Low Pressure Alarm Setpoint and Leakrate Verification.
AFW Train 1 Backup Nitrogen Test AFW Train 2 Backup Nitrogen Test
Auxiliary Feedwater System Nitrogen Bottle Misalignment On January 6,
1988, a Nuclear Plant Operator (NPO),
discovered that Train 2 of the Unit 4 Auxiliary Feedwater (AFW) Backup Nitrogen System was not properly aligned.
Each AFW nitrogen train contains 5 installed bottles,
of which are kept isolated for use after the receipt of a
header low pressure alarm.
One of the 3 bottles required to be in service was found.
to be isolated.
The bottle was immediately returned to service and a
nitrogen system alignment verification was promptly performed.
No additional configuration deficiencies were identified.
The licensee promptly began a
review of the circumstances which led to the misalignment.
Operations Surveillance Procedure (OSP) 4-0SP-075.3, entitled AFW Nitrogen Backup System Low Pressure Alarm Setpoint and Leakrate Verification, revision dated November 5,
1987, had recently been performed for the Unit 4 system.
When the te'sting is completed the system is restored to service as specified in step 7.2.20:
Verify that Nitrogen bleed-down has stopped and valve in a
new Nitrogen bottle Record Nitrogen Bottle placed in service:
The bottle selected for al ignment i s chosen from the remaining fully charged bottles at the discretion of the NPO. It was determined that only 1 of 2 valves located in series between the selected bottle and the header had been opened.
The failure to open both valves occurred due to inadvertent personnel error.
Procedures 3/4-0SP-075.3, containing instructions identical to those above, have been performed numerous times without error.
However, procedures 3/4-0SP-075.3 were deficient in that they did not contain comprehensive independent verification requirements.
Although the procedures required a
second worker to verify the correct
"as left" alignments of steam supply valves and water discharge valves, no such requirement existed for nitrogen supply valves.
Consequently, if a worker inadvertently.left a steam supply or water discharge valve in an incorrect position during system restoration subsequent to testing, an opportunity, existed for a second worker to identify and correct the discrepancy before the te~ae-considered complete.
Nitrogen valves were susceptible to undetecte'd misalignment resulting from personnel error because no similar backup check was required to be performed.
Administrative Procedure O-ADM-031, entitled Independent Verification, revision dated February 10, 1987, specifies in section 1.2 that,
"Independent verification of component position or state is required to preclude personnel errors that could cause serious nuclear safety
problems.
This program of independent verification will minimize the consequences of such errors by providing a very large measure of assurance that any such errors will be caught and remedied."
Section
~ 1.2 of the procedure specifies that,
"The Operations Superintendent is also responsible for assuring that procedures under his cognizance requiring component manipulation without a clearance are revised to properly specify and provide for documentation of independent verification." Additionally, section 5.2. 1.4 specifies that independent verification shall be applied to'he AFW system.
Section 5.2.2.6 requires that independent verification be performed for manipulations which remove a
component or system from service for surveillance testing.
Section 5.2.2.7 requires that independent verification be performed for manipulations which restore the normal lineup following surveillance testing.
The failure to include the independent verification requirements of procedure 0-ADM-031 in procedure 4-0SP-075.3 is a violation which contributed to the misalignment event.
This fact was recognized by the licensee and procedure changes were promptly made which incorporated the required independent verification steps. into the surveillance procedures for both Units.
However, independent verification could not have precluded the initial personnel error.
Consequently, the licensee considers personnel inattentiveness to be the root cause of this event.
On January 7 the licensee completed calculations which demonstrated that sufficient nitrogen had been available for Train 2 to fulfill its design function while only the 2 bottles were aligned.
This was possible because the measured nitrogen consumption rate was significantly less than the maximum allowed (design) rate.
The failure to properly implement surveillance procedure 4-0SP-075.3 and administrative procedure 0-ADM-031 is an example of violation (250,251/87"54-02).
An evaluation of the guidelines specified in 10 CFR 2, Appendix C,Section V.A has been performed and, even though the discrepant condition was identified and promptly corrected by the licensee, a Notice of Violation is being issued because the discrepant condition constitutes a
second occurrence of a Unit 4 AFW nitrogen bottle misalignment within the past six months.
On July 15, 1987, a Unit 4 AFW misalignment occurred during which both trains -ef-n-i.trogen were inadvertently isolated causing a 'loss of system function.'he July event was a concern because the NPO chose to ignore numerous procedural requirements prior to manipulating the system configuration.
Escalated Enforcement Action (EA 87-85)
was taken.
The January 6,
1988, misalignment did not cause a loss of either train of nitrogen and no procedural requirements were intentionally ignored by the NPO.
Consequently, the two events are not considered simila It should be noted that the licensee demonstrated a much improved ability to identify the discrepant AFW alignment over that observed in July 1987.
The previous event went undetected for many hours and was not initially identified by a NPO tasked with verifying alignment status during periodic rounds.
On January 6,
the misalignment was identified by the NPO during the first round performed subsequent to the misalignment.
Additionally, the NPO in July 1987 willfullydeviated from several procedural require-ments in unilaterally deciding to change the alignment of the nitrogen bottles.
The alignment error made by the NPO in January 1988 was inadvertent and occurred during valve manipula-tions performed to implement the requirements of a surveillance procedure.
6.
Maintenance Observations (62703/62700)
Station maintenance activities of safety related systems and components were observed and reviewed to ascertain that they were conducted in accordance with approved procedures, regulatory guides, industry codes and standards and in conformance with TS.
The following items were considered during this review, as appropriate:
That LCOs were met while components or systems were removed from service; that approvals were obtained prior to initiating work; that activities were accomplished using approved procedures and were inspected as applicable; that procedures used were adequate to control the activity; that troubleshooting activities were controlled and repair records accurately reflected the maintenance performed; that functional testing and/or calibrations were performed prior to returning components or systems to service; that gC records were maintained; that activities were accomplished by qualified personnel; that parts and materials used were properly certified; that radiological controls were properly implemented; that gC hold points were established and observed where required; that fire prevention controls were implemented; that outside contractor force activities were controlled in accordance with the approved gA program; and that housekeeping was actively pursued.
Troubleshooting to Determine Cause of Dropped Control Rod N-9 for Unit 3 On January 13, 1988, with Unit 3 at 100% power, shutdown bank "A" rod N-9 dropped during the performance of Operating Procedure (OP)
1604. 1, Full Length RCC [Rod Control Cluster] Periodic Exercise.
Attempts to realign the control rod per procedure 3-0NOP-28, Reactor Control System Malfunction
, failed and the I&C department immediately began to determine the cause.
Initial troubleshooting was conducted in accordance with General Maintenance Instruction 0-GMI-102. 1, Troubleshooting and Repair Guidelines, and Nuclear Plant Work Order (PWO)
WA 880130509.
The initial troubleshooting indicated an open in the control rod drive movable coi 1 circuitry, which required a reactor shutdown for further troubleshooting and repair.
During the unit shutdown, while driving rods in, two additional control rods (L-9 and M-10) unexpectedly dropped into the core.
Operations personnel responded appropriately by initiating a
manual reactor trip as required by procedure 3-0NOP-2 Subsequent investigation found that the initial troubleshooting of control rod N-9 required two fuses be removed from both the stationary and the movable coil circuitry to allow for electrical testing.
The movable coil fuse for the neutral bus of rod N-9 is the same fuse used for the neutral bus circuits on rods L-9 and M-10.
The power supply bus for these three rods utilizes three separate fuses.
In addition, this electrical circuitry for the fuses differs from the stationary coil circuitry, in that the stationary coil has separate fuses for both the power supply and neutral busses to each control rod.
Therefore, when attempting to shutdown the unit by driving in control rods, L-9 and M-10 dropped when sequenced to move inward because fuse FU 48 (the neutral bus fuse common to all three rods)
was removed.
The root cause of the problem was failure to recognize that the removed fuse was common to two additional control rods.
The inspectors expressed a
concern that actions were taken to facilitate troubleshooting (fuse removal)
and the outcome of those actions were not clearly understood by all personnel involved.
This resulted in a
rod configuration which necessitated a manual reactor trip.
Discussions with responsible licensee personnel indicated the following:
a
~
The common fuse exists only in the movable coil circuit and not the stationary coil circuit.
In the past, the majority of the failures have been in the stationary coil circuit and troubleshooting this circuit would not have resulted in the same problem due to the independent fuse arrangement.
b.
If rod movement did not'ccur during the period the fuses for N-9 were removed, rods L-9 and M-10 would not have dropped because the stationary coils would still have remained continuously energized.
The drop occurred only when the stationary coils were de-energized as part of the programed rod mo'tion sequence.
C.
Personnel involved in the troubleshooting used a table posted inside the rod control cabinet to determine which fuses to remove for the testing.
Although the table identified the proper fuses to remove for each specific rod and coil circuit, it did not readily identify that the movable coil neutral bus fuses were common to the three rods.
It should also be noted that the table was not a controlled document or drawing.
Consequently, its accuracy was not verified.
d.
Although the vendor technical manual was available, it was not used
.to-determine which fuses to remove during the troubleshooting.
Personnel normally used the table, discussed above, for this information.. If the electrical schematics in the technical manual had been used, the rod -drops might not have occurred because the diagrams show the common fuse and operations personnel could have avoided rod motion until the common fuse (FU 48) was replaced.
The root cause of the inadvertent rod drops was use of a non-controlled table rather than the vendor technical manual to determine the proper fuses to remove.
This problem occurred because a
general philosophy
existed that the posted table provided sufficient troubleshooting guidance such that the vendor technical manual was not needed for detailed review.
TS 6.8. 1 requires that written procedures and administrative policies shall be established, implemented and maintained that meet or exceed the requirements and recommendations of Section 5. 1 and 5.3 of ANSI 8 18. 7"1972.
ANSI N18.7-1972, Section
~ 1.6.1 requires that maintenance that can affect the performance of safety-related equipment shall be properly pre-planned and performed in accordance with written procedures, documented instructions, or drawings appropriate to the circumstances which conform to applicable codes, standards, specifications and criteria.
Contrary to the above, on January 13, 1988, maintenance was performed on the rod control system without documented instructions or drawings appropriate to the circumstances.
Fuses were removed from the system by personnel who did not fully understand what the fuses supplied.
Subsequent rod motion resulted in two dropped control rods and necessatated a
manual reactor trip.
This is identified as one of four examples of a violation (250,251/87-54-02).
7.
Engineered Safety Features Walkdown (71710)
The inspectors performed an inspection designed to verify the operability of the Unit 3 and 4 Auxiliary Feedwater System.
This was accomplished by performing a complete walkdown of all accessible equipment.
The following criteria were used, as. appropriate, during this inspection:
a.
Systems lineup procedures match plant drawings and as built configuration.
b.
Housekeeping was adequate and appropriate levels of cleanliness are being maintained.
c.
Valves in the system are correctly installed and do not exhibit signs of gross packing leakage, bent stems, missing handwheels or improper labeling.=-
d.
Hangers and supports are made up properly and aligned correctly.
e
~
Va+ves in the flow'aths" are in correct position as required by the 'applicable procedures with power available and valves were locked/lock wired as required.
Local and remote position indication was compared and remote instrumentation was functional.
g.
Major system components are properly labele The inspectors reviewed the following documents during the course of the inspection:
a.
3/4-0SP-75.5, entitled Auxiliary Feedwater System Flowpath Verification, revision dated October 15, 1987.
b.
Operating Oiagrams:
5610-T-E-4061, sheet 4,
revision 27, entitled Auxiliary Feedwater Pumps Steam Supply System.
5610-T-E-4062, sheet 3,
revision 54, entitled Steam Generator Auxiliary Feedwater Supply Systems.
Conditions that were identified by the inspectors and brought to the attention of the licensee include:
a.
Unit
-
Steam Generator 3C feedwater control valve FCV-498 appears to be leaking oil.
b.
Unit 4 - Hain Steam Isolation Valve (HSIV) SV-2608 has a
small packing leak.
No violations or deviations were identified within the areas inspected.
8.
Operational Safety Verification (71707)
The inspectors observed control room operations, reviewed applicable logs, conducted discussions with control room operators, observed shift turnovers and confirmed operability of instrumentation.
The inspectors verified the operability of selected emergency systems, verified that maintenance work orders had been submitted as required and that followup and prioritization of work was accomplished.
The inspectors reviewed tagout records, verified compliance with TS LCOs and verified the return to service of affected components.'y observation and direct interviews, verification was made that the physical security plan was being implemented.
Plant housekeeping/cleanliness conditions and implementation of radiological controls were observed.
Tours of'he intake structure and diesel, auxiliary, control and turbine buildings were conducted to observe plant equipment conditions including potential fire hazards, fluid leaks and excessive vibrations.
The inspectors walked" down accessible portions of the following safety related systems to verify operability and proper valve/switch alignment:
A and B Emergency Diesel Generators Control Room Vertical Panels and Safeguards Racks Intake Cooling Water Structure 4160 Volt Buses and 480 Volt Load and'Motor Control Centers Unit 3 and 4 Feedwater Platforms Unit 3 and 4 Condensate Storage Tank Area Auxiliary Feedwater Area Unit 3 and 4 Mai'n Steam Platforms a.
Fire Watch Asleep on Duty FP&L Justification for Continued Operation (JCO), JPE-LR-87-020, Loss of HVAC [Heating Ventilating and Air Conditioning] to DC [Direct Current] Equipment and Inverter Rooms, outlined compensatory measures to be taken to ensure adequate ventilation in the inverter room located behind the vertical panel boards of the main control room.
One of the measures was to block open fire door 108A-1 which separates the two inverter rooms.
Blocking open this door impairs function of the fire door and also the inverter room's halon system Administrative Procedure (AP)
15500, entitled Fire Protection Program, Revision dated December 8, 1987, section 9.4. 1 requires that backup suppression be established as compensatory action during fire protection impairment of automatic suppression systems (e.g.
halon system).
Section 9.5.3 specifies that a continuous fire watch is an acceptable compensatory measure when the halon system is impaired.
TP-347, entitled DC Equipment and Inverter Rooms Supplemental Cooling Monitoring and Standby Condition, Revision dated June 25, 1987, Section 5. 1. 1 requires tQat anytime door 108A-1 is maintained open, a
continuous fire watch shall be established to close door 108A-1 within 60 seconds of sounding the halon activation alarm.
On January 12, 1988, during a routine tour performed by two NRC inspectors, the fire watch posted in accordance with AP 15500 and TP-347 was found asleep.
The failure of the fire watch to remain awake could have precluded the fire door from being closed in a
timely manner, which would reduce the effectiveness of the halon system.
The failure to maintain an alert fire watch constitutes and inadequate implementation of AP 15500 and TP 347 and is one of four examples of a violation (250,251/87-54-02).
This incident and the previous one (ref. IE Report 250,251/87-35)
are si~lar in that the fire watches were found lying on the floor, with thei'r shoes removed.
This represents a problem with these individuals'ttentiveness and dedication to duty since they had received training identifying the importance of their specific functions.
These individuals consciously deviated from their duty, indicating that the.
root cause of their poor performance is attributable to inappropriate motivation.
The licensee has recognized this as a problem area and
has implemented plans to upgrade the fire watch program.
An evaluation is in progress to determine whether the fire watch function can be better implemented by personnel who are trained to combat, as well as detect, fires.
The use of skilled fire fighters might decrease the potential for inattentiveness.
The licensee is also studying the possibility of installing an automatic door closure system which would eliminate the necessity of posting a continuous fire watch in the inverter room for the remainder of time the JCO is in effect.
Cold Leg Accumulator Discharge into Reactor Coolant System (RCS)
Due to Negative Pressure Transient On January 15, 1988, with Unit 3 in Mode 3, the RCS pressure was inadvertently decreased to approximately 625 psig which resulted in a
small discharge of the cold leg accumulators into the RCS.
The Reactor Control Operators (RCOs) were performing a unit cooldown and depressurization to repair on a Control Rod Drive Mechanism (CROM)
moveable coil circuit and a leak on a
The RQO was performing General Operating Procedure (GOP)
3-GOP-305, entitled Hot Standby to Cold Shutdown.
Due to the impending shift turnover, the operator decided to slow the cooldown rate from 90 degrees F/hr to approximately 20 degrees F/hr.
The RCS at this time was at 400 degrees F and 950 psig and decreasing.
As the cooldown rate was slowed, the RCO noticed pressurizer level increase due to less RCS shrinkage and two charging pumps operating.
This also caused RCS pressure to increase which activated the Overpressure Mitigation System (OMS) alarm.
The RCO then secured a charging pump to stop the level and pressure increase, and also increased the setpoint of the pressurizer spray valve (PCV-455B)
from 12% to 25%.
These actions reduced RCS pressure to approximately 900 psig which cleared the OMS Actuation alarm and the RCO returned PCV-455B setpoint back to 12%.
The RCO thought that the RCS was stable with pressure 900 psig and temperature at approximately 395 degrees F
and slowly decreasing.
The RCO continued with shift turnover and the oncoming RCO was briefed on plant status.
Approximately ten minutes after assuming RCO duties the RCS pressure was noticed to be at 625 psig.
The RCO immediately took manual control of the spray valve and the pressure transient was terminated.
Based on graphs printed out for each accumulator, the operations s~f- -determined that approximately 50 gallons of borated water injected into the RCS.
The accumulator discharge isolation valves were not yet closed.
GOP-305 directs the RCO to isolate the accumulators when RCS pressure is between 700 and 1000 psig.
The RCO was unaware that the pressure had dropped below 700 psig.
The licensee's preliminary investigation determined that the spray valve was stuck open which resulted in excessive spray and the subsequent pressure decrease.
PCV-455B was in use with an outstanding plant work order (PRO)
number C312387, dated January 10, 1988, for
"Excessive Cycling".
The malfunction of the spray valve in conjunction with shift turnover activities contributed to the pressure transient.
The licensee reported this event to the NRC due to an Engineered Safety Features Actuation.
The inspectors will followup on the licensee's investigation and proposed corrective actions by reviewing the Licensee Event Report (LER)
which is required within
days following the event.
c.
Procedure Corrections Not Made Expeditiously to ONOP 0208. 11 On January 9,
1988, the licensee determined that procedure ONOP 0208. 11, entitled Annunciator Test Panel I Station Service, Revision dated September 10, 1987, needed revision to correct a potentially non-conservative statement relative to the time allowed to realign AFW nitrogen bottles subsequent to the receipt of a
system low pressure alarm.
This issue is fully explained in paragraph 11.
On The Spot Change (OTSC)
5676 to ONOP 0208. 11 was approved on January 10, 1988, but was not immediately made available for use by the RCOs.
The OTSC was not expeditiously entered in the three controlled copies of ONOP 0208. 11 maintained in the control room.
Administrative Procedure 0109.3, Revision dated August 6, 1987, entitled On The Spot Changes To Procedures, specifies in section 5.9.2 that:
Licensed Operations personnel are responsible for handwriting the text of approved OTSCs into EOPs I'Emergency Operating Procedures],
[Emergency Procedures],
and ONOPs within eight hours of approval.
Although the OTSC to ONOP 0208. 11 was approved on January 10 it was not entered into the controlled copies of ONOP 0208. 11 used by the RCOs until the NRC inspectors identified the omission on January 13, 1988.
At least
hours had elapsed.
This is a
safety concern because for an extended period of time, the RCOs were not aware that the 80 minute ONOP timeframe had been found to be non-conservative and that a
minute period had been specified as a corrective action.
The failure to proper ly implement the requirements of AP 0109.3 constitutes one of four examples of violation (250,251/87-54-02).
9.
Plant Eve'nts (93702)
The following plant events were reviewed to determine facility status and the need for further followup action.
Plant parameters were evaluated during transient response.
The significance of the event was evaluated along with the performance of the appropriate safety systems and the action's taken by the licensee.
The inspectors verified that required notifications were made to the NRC.
Evaluations were performed relative to the need for additional NRC response to the event.
Additionally, the following issues were examined, as appropriate:
details regarding the cause of the event; event chronology; safety system performance; licensee
compliance with approved procedures; radiolo'gical consequences, if any; and proposed corrective actions.
The licensee plans to issue Licensee Event Report ( LERs)
on each event within 30 days following the date of occurrence.
On December 29, 1987, with Unit 3 at 70% power, the reactor was manually tripped due to an apparent loss of turbine generator electrical load.
Power was being increased from 50% to 70% at 3% per hour when the turbine
'verspeed protection generator anti-motoring trip alarmed.
The indicated megawatts (MWe) was-24 MWe.
The Plant Supervisor Nuclear (PSN) decided to manually trip the reactor.
The licensee's preliminary investigation revealed a stuck/frozen closed contact for the MWe input into the turbine overspeed protection circuitry.
This made up one half of the logic necessary to dump control oil to the control valves to prevent turbine overspeed.
This contact is supposed to open when generator load is greater than 20%.
The other half of the logic was made up when the turbine load was greater than 50%
as indicated by turbine first stage pressure.
When the reactor power reached 70%, this corresponded to 50%
turbine load due to secondary plant inefficiencies.
Therefore, the turbine overspeed
.protection circuitry was actuated and the control oil dumped causing the control valves to close.
The faulty contact was repaired and the unit was returned to service on December 31, 1987.
On January 13, 1988, with Unit 3 at 100% power, the unit experienced a
turbine runback to 70% due to a full length control rod dropping into the core.
This event was reported as a significant event 'to the NRC and is discussed further in paragraph 6.
On January 13, 1988, with Unit 3 in the process of shutting down (10E-9 amps, in the Intermediate Range) to repair a moveable coil for a dropped rod, the reactor was manually tripped.
The RCOs tripped the reactor when two additional full length control rods dropped into the core.
This event is discussed further in paragraph 6.
On January 14, 1988, at 0115, with Unit 3 in Mode
and Unit 4 at 100%
power, the licensee reported a significant event in that the Emergency Notification System (ENS)
phone was out of service.
The licensee contacted the telephone company to effect repairs and the ENS phone was placed back in service on January 14, 1988, at 0155.
On January 16, 1988, with Unit 3 in mode 5, cold shutdown, the cold leg accumu~ors-injected approximately 50 gallons of borated water into the reactor
'coolant system (RCS)
due to an inadvertent decrease in RCS pressure.
This significant event was reported to the NRC in accordance with
CFR 50.72 (b) (2) (ii).
This event is discussed further in paragraph.
Component Cooling Water (CCW) Heat Exchanger Operability Summary of Concern Previously Identified as URI 250,251/87-27-02 In Inspection Report 250,251/87-27, issued on July 17, 1987, the NRC identified potential deficiencies in Revision 2 of licensee safety evaluation JPE-L-85-38.
The concern, which was designated.
as URI 250,251/87-27-02, is summarized below.
The effectiveness of the CCW heat exchangers is heavily 'dependent on precipitation of calcium carbonate from the canal water on the heat exchanger tubes.
The high levels of calcium carbonate in the canal system rapidly degrade the heat transfer capability of the heat exchangers.
Consequently, the licensee periodically cleans them.
e In June 1986, the plant staff postulated that, with one heat exchanger out of service for cleaning, canal temperatures might rise to a point where the remaining two heat exchangers could not handle the Maximum Hypothetical Accident '(MHA) heat load.
Revision 2 to JPE-L-85-38 was issued on August 5,
1986, to address this po s s i bi l ity.
Revision 2 states that should, during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Limiting Condition for Operation (LCO) period for the cleaning of a CCW heat exchanger, the performance of the remaining two heat exchangers degrade to the point where the flow from two ICW pumps is necessary to remove the accident heat load, the plant may continue to operate for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> during any three month period.
Ouring May 1987, NRC inspectors reviewed evaluation JPE-L-85-38 including all revisions.
It was noted that the decision to operate the Units for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in a degraded condition such that the flow of two ICW pumps was required to provide accident protection conflicted with system capability discussions found in the Final Safety Analysis Report (FSAR) and the TS Basest NRC evaluation An NRC evaluation of this issue has been completed.
The following clarifications address the specific issues which were documented in the URI.
The 'NRC staff disagrees with the licensee's conclusion in safety evaluation JPE-L-85-38, Revision 2 with respect to continued Unit operation for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in any three month period while CCW heat exchangers are degraded beyond the efficiencies discussed in the FSAR and the TS bases.
It is the staff's position that TS Limiting Conditions for Operation (LCOs)
are meant to apply to single unplanned events and are not meant to.be convenience tools to keep the plant operating under adverse conditions.
When the performance of the remaining two heat exchangers degrades to the point where two ICW pumps are required for accident mitigation, the provisions of TS 3.0. 1 (plant shutdown)
should apply.
Continued operation in this circumstance would require a safety evaluation approved by the NRC staff since such operation is outside the scope of the TSs and the FSAR design basis.
If the licensee has performed an analysis demonstrating that plant operation may continue at reduced power levels, then operation may continue provided the analysis shows that the design basis accident decay heat loads can be handled by two CCW heat exchangers utilizing the flow from one ICW pump.
This analysis must be provided to the NRC for review and (assuming acceptability)
approval.
A temporary TS waiver of compliance could, with appropriate justification, be authorized until a licensing amendment is issued.
An appropriate amendment would include requirements for reduced maximum power levels and trip setpoints when the degraded conditions are encountered.
Since the licensee's evaluation was not sent to the'RC for review and since no license amendment was requested, the CCW system should have been declared inoperable when the CCW heat exchangers were sufficiently fouled such that more than one ICW pump was required for the system to perform its design safety function.
Any time a
CCW heat exchanger is known to be fouled to the the point where it cannot remove its individual share of the design basis heat load, it should be declared inoperable, and the appropriate CCW system TS LCO followed.
The flow received from only a single ICW pump must be assumed in making this determination.
It is not appropriate, contrary to the inference in analysis JPE-L-85-38, for the CCW system to be operable with no LCO when three heat exchanger s are required to be operable because of fouling.
Safety evaluation JPE-L-85-38 was not performed to the required specifications of
CFR 50.59.
This was an error since the evaluation specifically authorized a
change in facility operation from that described in the FSAR.
Had the required evaluation been performed an unreviewed safety question would have been found to exist because, without a reduction in the flux level trip setpoints, the safety margins are reduced.
The NRC staff considers the operability of a
system to be defined in terms of the maximum power level authorized by the license, and any degradation of the system which would render it incapable of performing its function at the fully licensed power level would cause the system to be inoperable.
Enforcement Action As a result of evaluation JPE-L-85-38, the licensee operated outside the design basis of the CCW and ICW systems with reduced safety margins for a short period of time in January 1987.
This resulted in violations of the requirements of
CFR 50.59 and the Technical Specifications.
Previously, the NRC has issued violations, resulting in escalated enforcement action, because a safety evaluation was not adequately performed (EA 87-97)
and the CCW system was operated
outside its design basis (EA 87-85).
Consequently, the identifi-cation of an inadequate safety evaluation that led to the operation of the CCW heat exchangers outside the system design basis is a
repeat of previously identified concerns, for which the licensee has already begun to implement corrective action.
In summary, the violation is a further example of a safety concern that is similar to issues previously addressed by both the NRC and the licensee.
Therefore, no Notice of Violation will be issued.,
However, the licensee should perform a thorough evaluation to ensure that the root causes of this occurrence have, been fully identified and corrected.
URI 250,251/87-27-02 i s closed.
ll.
Design Control On January 6,
1988, a
NPO discovered that Train 2 of the Unit 4 AFW Backup Nitrogen System was not properly aligned.
One of the 3 bottles required to be in service was Tound to be isolated.
This issue is discussed in detail in paragraph 7.
The misalignment reduced the volume of nitrogen available for valve control.
This created a concern that system operatiop could fall short of the durations specified in design basis documents.
e NRC inspectors reviewed the AFW Nitrogen Backup System to verify that it was being operated in accordance with applicable design bases.
Several Operations Surveillance Procedures (OSPs)
were identified which allowed nitrogen consumption rates so large that nitrogen supplies could be consumed in less time than specified in design basis documents.
This constituted an AFW operability concern since the system might cease to function sooner than expected during accident conditions.
The design basis for the AFW system is specified in Document 5610-075-DB-001, Revision F (issued for trial use),
which states in section 3.1
~ 13 that:
It shall be possible to control AFW flow automatically upon loss of instrument air for a
period of two hours without any required operator action of the AFW [system] outside of the control room.
AFW component level design basis requirements are specified in Document 5610-075-DB-002, Revision A (issued for trial use),
which states:
The nitrogen backup to the FCV's [Flow Control Valves] instrument air supyly-shall have sufficient capacity valved in to allow 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> operation before operator action is required [section 5.2. 1].
When the low pressure alarm annunciates, local operator action will b'e required to valve in the spare bottle(s)
and replace the empty bottles if continued automatic flow control is desired
[section 5.2.13].
The AFW system and its Nitrogen Backup system have been modified several times to improve performance and reliability.
Plant Change Modification (PCM)85-176 was installed during the Unit 4 refueling outage which ended
on September 1,
1986.
PCM 85-175 was installed in the Spring of 1987 during a Unit 3 refueling outage.
The PCMs expanded the capacity of each Unit's AFW nitrogen system to a
10 bottle system consisting of 5 bottles per train.
Three bottles per, train were to be kept continuously aligned for service.
1he two remaining bottles would be aligned subsequent to receiving each train's low pressure alarm.
While the 2 bottles are consumed, sufficient time exists to replace the depleted inventory and restore 3 bottle operation.
This alternating cycle would continue until either the instrument air system is restored, precluding the need for backup nitrogen, or the AFW system is no longer needed.
Calculations had been performed to ensure that PCMs85-175 and 85-176 implemented the AFW Nitrogen Backup system design bases.
The
hour design basis was assumed to consist of 3 minutes of automatic operation during system initiation (90 psig per minute consumption rate) followed by 117 minutes of either steady state automatic or remote manual operation (35 psig per minute tonsumption rate).
These consumption rates were specified in the PCM packages as the maximum acceptable values for use in post installation acceptance tests.
They were also incorporated in some, but not all, periodic nitrogen surveillance tests.
Additionally, calculations were performed to justify the selection of a nitrogen header low pressure alarm.
The PCM descriptions specified that the low pressure alarm alerts the operators that approximately 80 minutes of nitrogen supply remain and that bottle realignments must be made within that period to maintain operation of the Flow Control Valves.
An alarm selection calculation was performed and a 650 psig setpoint was incorporated as Revision 1 to the PCM packages.
The
minutes of operation after receipt of the alarm was based on a consumption rate of 17.5 psig per minute.
This reduced nitrogen usage level was selected subsequent to correcting a flow control valve oscillation problem that had previously caused increased nitrogen consumption.
However, the post installation acceptance test values were not revised to reflect this reduced maximum allowable value.
a 0 PCM Inadequacies Two inadequacies were identified with respect to PCMs85-175 and 85"176.
(1+-=The two sets of calculations performed to support PCM design
'ssumptions (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> total duration, 80 minutes post-alarm)
used different maximum allowable consumption rates.
Only the consumption rates supporting 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of total system operation (90 and 35 psig per minute)
were mentioned in the Acceptance Test section of the PCMs.
No mention of the '17.5 psig per minute criterion was made in the PCMs
~
Consequently, when flow control testing verified only that consumption was less than
psig per minute, the plant staff did not realize that the
minute timeframe was not being confirme (2)
The context in which the term "automatic operation" should be used was not clearly specified in the PCM descriptions.
The plant staff did not understand that the 90 psig per minute consumption rate applied only for 3 minutes during automatic initiation.
This time limit was recorded in the calculation record but was not mentioned in the PCM package.
Consequently, plant personnel used the 90 psig per minute consumption limit as if no restrictions applied.
These deficiencies resulted in important design information being incorrectly translated into procedural surveillance requirements.
b.
Noncompliance With Applicable Requirements
CFR 50, Appendix B, Criterion III, as implemented by the licensee's Topical Quality Assurance Report (TQAR),
Revision 10, Topical Quality Requirement 3.0, Revision 5, requires that design changes be subject to design control measures commensurate with thow applied to the, original design and that these design control measures assure that applicable regulatory requirements and the design basis are correctly translated into specifications, drawings, procedures and instructions'he TQAR, Appendix C,
Revision 7, specifically commits to ANSI N45.2. 11-1974, QA Requirements for the Design of Nuclear Power Plants, which specifies that design activities be prescribed and accomplished in accordance with procedures of a type sufficient to assure that design inputs are correctly translated into procedures.
Design changes must be justified and subjected to control measures commensurate with those applied to the original design.
Contrary to the above, between January 8-10, 1988, inspections identified that design inputs contained in PCMs85-175 and 85-176, had not been correctly translated into operating procedures and the system description, as demonstrated by the examples below.
(1)
Units 3 and 4 procedures 3/4-0SP-075.3, entitled AFW Nitrogen Backup System Low Pressure Alarm Setpoint and Leakrate Verification, revisions dated November 5,
1987, were not updated to reflect the 35 psig per minute maximum allowable consumption-rMe assumed in PCM 85-175 and 85-176.
The 50 psig per minute acceptance criteria specified in the procedures for manual system operation exceeded the 35 psig per minute maximum value supporting
hours of total system operation.
If actual consumption had approached the 50 psig per minute criterion then the nitrogen system would have lasted approximately 90 minutes
.rather than the 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> specified in the design basis documents.
Additionally, the 50 psig per minute consumption rate criterion would have allowed only 30 minutes. of continued operation after receipt of the low pressure alarm, instead of the 80 minutes specified in the PCM (2)
Unit 3 and 4 procedures 3/4-0SP-075.6, both entitled AFW Train
Backup Nitrogen Test, and procedures 3/4-0SP-075.7, both entitled AFW Train 2 Backup Nitrogen Test, all revisions dated December 17, 1987, did not utilize the PCM specified consumption rate acceptance criterion in the proper context.
The 35 and
psig per minute maximum criteria were incorporated in the surveillances.
However, 90 psig per minute was used as the maximum allowable consumption rate in stead state automatic operation.
The PCM calculations supported this consumption rate for only the first 3 minutes of automatic initiation.
The AFW system can be operated in the steady state automatic mode for extended periods at the discretion of the Control Room Operators.
Consequently, if the actual consumption rate had approached 90 psig per minute during steady state automatic operation, the nitrogen system would have lasted much less time than specified in the design basis documents.
(3)
ONOP 0208. 11, Annunciator Test Panel I,
Station Service, Revision dated September 10, 1987, specified that upon receipi of a
low pressure alarm, each of 5 nitrogen bottle outlet pressure gauges should be placed in service by opening their root valves.
This was contrary to statements in PCMs85-175 and 85-176, which specified that the local pressure indicators are not seismically qualified and will be normally isolated from the system.
This discrepancy created the potential that a seismic event occurring after receipt of header low pressure alarms could cause a
common mode nitrogen system loss due to multiple pressur'e gauge failures.
(4)
The AFW System Description (SD) 117, Revision dated December 10, 1987, and the plant Precautions, Limitations and Setpoints Document, Revision 29, dated December 15, 1987, indicated that the low nitrogen alarm setpoint pressure was 1350 psig.
However, changes made during the implementation of PCMs85-175 and PCMs85-176 modified the setpoint to '50 psig.
Additionally, SD 117 was not updated to reflect extended AFW operation without required operator action outside the control room subsequent to receipt of the low nitrogen pressure alarm.
The SD 117 specified that only 10 minutes existed during which to provide additional nitrogen, a condition that existed before, but not after, the implementation of the PCMs.
The failure to meet the requirements of
CFR
Appendix B,
Criterion 3 is a violation (250,251/87-54-01.)
These discrepancies caused otherwise acceptable statements in additional procedures to be of suspect validity.
ONOP 0208. 11, entitled Annunciator List Panel I Station Service, Revision dated September 10, 1987, contained potentially inaccurate information.
Additionally, Unit 3 and 4 procedures 3/4-0P-065.2, entitled AFW and MSIV Backup N
[Nitrogen]
Gas Supply System, Revisions dated
November 8, 1987, contained similar potentially inaccurate information.
Both procedures correctly specified the PCM criterion, that 80 minutes existed for operators to realign nitrogen bottles after receipt of the low pressure alarm.
However, surveillance testing had verified only that consumption remained less than 35 psig per minute.
The maximum consumption rate allowing
minutes of post-alarm operation had been determined, by PCM calculation, to be 17.5 psig per minute.
Since no surveillance existed verifying that actual nitrogen usage remained less than the maximum allowable by design, the procedural timeframe was potentially incorrect.
Previous Similar AFW Nitrogen Consumption Rate Deficiencies, 1985 In Safety System Functional Inspection (SSFI)
Report 250,251/85-32, issued on October',
1985, an NRC inspection team identified safety concerns regarding inaccurate nitrogen system operability timeframes specified in licensee training documents and procedures.
Prior to-September 1985, Operating Procedure 7300.2, AFW System Flow Control Valves Instrument Air/Nitrogen Backup System Operation, stated that operators had 15 minutes to establish additional nitrogen capacity upon receipt of a
low pressure alarm.
Training Brief ¹9 specified that 20 minutes existed.
The AFW System Description (SD 117) stated that approximately 10 minutes were available.
However, during system testing performed during the NRC inspection, it was determined that only 6 to 7 minutes were available in the most limiting case.
Because of the incorrect procedural information available, the inspection team expressed a concern that appropriate operator action would not have been taken in response to a
low nitrogen pressure annunciator alarm.
The failure to take timely action would result in the a loss of AFW flow.
This discrepancy was one example of many weaknesses which were identified in the licensee's design control program during the SSFI.
EA 86-20 was issued on August 12, 1986, specifying violations of regulatory requirements.
PCMs85-175 and 85-176 were implemented subsequent to the AFW SSFI to expand the available nitrogen capacity and allow a longer operability period subsequent to receipt of the low pressure alarm.
However, the available procedural guidance of ONOP 0208. 11 and 3/4-0P-065.2 still greatly-over stated the available time to respond to the low pressure alarm, assuming worst case acceptable surveillance results.
This created a repeat of the system, operability concern identified in the 1985 SSFI.
Inspector Concerns and Safety Significance These discrepancies are a concern because the potential existed for the AFW nitrogen system to be successfully surveillance tested even though the system design basis was not met.
This was possible because proceduralized surveillance acceptance criteria exceeded the
maximum consumption rate values necessary to meet design basis requirements.
Consequently, the AFW system might not have operated for the required timeframes.
Rapid consumption of the nitrogen would not have precluded receipt of either header low pressure alarm.
However, procedures existed specifying that system realignment would not be necessary until
minutes after receipt of the alarm.
A rapid consumption rate which could cause an earlier than expected low'ressure alarm would also shorten the post-alarm response time.
Reviews were conducted of historical surveillance test results.
It was determined that the design basis consumption rates were not exc'ceded.
Measured consumption rates were typically 12 13 psig per minute.
This low rate supported 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of system operation prior to bottle realignment.
It also provided more than
minutes of continued system operation after the receipt of a low pressure alarm.
Additionally, although the inadvertent isolation of one nitrogen bottle on January 6,
1988 reduced the available nitrogen volume, sufficient capacity remained such that, for the measured consumption rate, the train could have fulfilled all design functions.
The AFM flow control valves would use the nitrogen backup system only if the instrument air system failed.
The instrument air system is very reliable.
At no time during plant operation, other than during testing, has the nitrogen system been called upon to function.
Low header alarms have not actuated and the non-seismic gauges have not been placed in service.
Consequently, the health and safety of the public was not adversely affected by either the nitrogen bottle isolation ot the above mentioned discrepancies.
e.
Licensee Corrective Actions The licensee's response to these NRC identified discrepancies was immediate.
Evaluations
'were promptly performed confirming the discrepancies.
Reviews and corrective actions were, with the exception noted in item 5 below, both timely and comprehensive.
The licensee demonstrated a desire to resolve the issues in a manner that precludes recurrence.
Actions taken and/or proposed include:
(1)
The maximum manual mode consumption
'rate specified in the PCMs was revised from 35 to 31 psig per minute.
This change was
~ necessary to support
hours of system operation prior to
'epletion of the initial 3 nitrogen bottles and
hours of operation on 2 bottles subsequent to depleting the first
bottles.
(2)
A single consumption rate (31 psig per minute)
was established as the basis for both design requirements; 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of system operation; and response time after receipt of a
low pressure alarm.
Based on this rate the time to respond to the low pressure alarm was reduced from 80 minutes to 45 minutes.
The
I I
bottle realignment task can easily be performed within this timeframe.
(3)
The maximum permissible steady state consumption rate was reduced to 32 psig. per minute to suppor't continuous AFW system operation for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> in the automatic flow control mode.
(4)
Change request notices were implemented for both PCMs to correct erroneous statements, assumptions, and calculations and to provide acceptance criteria in keeping with the requirements of the design basis.
(5)
Procedure change requests were initiated to incorporate the-revised criteria
,in existing plant procedures.
However, one procedure change was not promptly implemented, contrary to the requirements of site administrative procedures.
This discrep-ancy is discussed in paragraph 10.
(6)
The licensee's guality Assurance Department began a review of the discrepancies.
(7)
At the request of the licensee, engineers from the Bechtel Eastern Power Company initiated a detailed investigation of the discrepancies, to include:
a review of all calculations and supporting documentation for the PCMs; reviews of the original PCMs and all Change Request Notices; independent review of any new Change Request Notices to clarify the PCM descriptions by senior engineering personnel in the Design Review Group; identification of root cause and corrective actions to prevent recurrence; and issuance of a written final repor l 1