IR 05000275/1998008

Insp Repts 50-275/98-08 & 50-323/98-05 on 980202-06,23-27 & 0302-18.No Violations Noted.Major Areas Inspected: Engineering

ML20217A851
Person / Time
Site:	Diablo Canyon
Issue date:	04/17/1998
From:	Stetka T NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV)
To:
Shared Package
ML20217A842	List: IR 05000275/1998005 IR 05000275/1998008
References
50-275-98-05, 50-275-98-5, 50-323-98-05, 50-323-98-5, NUDOCS 9804220346
Download: ML20217A851 (43)

Text

.

l e

ENCLOSURE l

l U.S. NUCLEAR REGULATORY COMMISSION l REGION IV

'

l Docket Nos.: 50-275;50-323 l License Nes.: DPR-80, DPR-82 l \

Report No.: 50-275/98-05;50-323/98-05 l l 1'

Licensee: Pacific Gas and Electric Company l Facility: Diablo Canyon Nuclear Power Plant, Units 1 and 2 l Location: 7 % miles NW of Avila Beach Avila Beach, Califomia Dates: February 2-6 and 23-27, and March 2-18,1998 l

l Inspectors: M. Runyan, Reactor inspector, Engineering Branch l P. Goldberg, Reactor inspector, Engineering Branch D. Pereira, Reactor inspector, Engineering Branch Accompanying D. Prevatte, Consultant Personnel:

l Approved By: T. Stetka, Acting Chief, Engineering Branch ,

Division of Reactor Safety 1 l

l

,  !

'

l l

l l ATTACHMENT: Supplemental Information l .

!  !

9804220346 980417 PDR ADOCK 05000275 G PDR _

.

1

'

I-2- l l

l

\

EXECUTIVE SUMMARY

' W s Canyon Nuclear Power Plant, Units 1 and 2

.

Nh2 Inspection Report 50-275/98-05; 50-323/98-05 l

Enoineerino

. The deletion of procedural steps to separate trains of the auxiliary saltwater and component cooling water systems, when transferring to hot leg injection during a loss of i coolant accident recovery appeared to constitute an unreviewed safety question. This unresolved item was left open pending additional review by the NRC (Section E8.14).

l

- The design of the auxiliary saltwater system appeared vulnerable to common-mode failure from two mechanisms: (1) failure of the intake screen shared by both trains of l auxiliary saltwater could clog both auxiliary saltwater heat exchangers, resulting in a loss I of component cooling water, and (2) because both Units 1 and 2 auxiliary saltwater intake structures are located in close proximity, both screens could be clogged at the same time, preventing the intended design that one unit provide an auxiliary suction source for the other unit. The licensee's current design met the licensing basis (Section E8.17).

. The discovery of a design vulnerability that could result in loss of containment spray during the recirculation phase (of a loss of coolant accident recovery) appeared to constitute an unreviewed safety question. This unresolved item was left open pending additional review by the NRC (Section E8.21).

I

l

r

!

l l s l

l -3-Report Details l

i Summarv of Plant Status ]

l During the first week of the inspection, both Units 1 and 2 were operating at full power. During the second week of the inspection, Unit 1 was operating at full power and Unit 2 was shutdown for a refue!ing outag l Ill. Engineering E8 Miscellaneous Engineering issues (93902)

E8.01 (Closed) Insoection Followuo item 50 275/9517-01: Design of the 4kV to 480V Safetv-Related Transformer Eackground This item involved two issues concerning electrical transformers. The first involved the method used to brace the coils in the unit auxiliary transformers, which appeared to allow for relaxation over time resulting in a reduced capability to withstand faults. The second was to followup on the licensee's design review of the 4kV to 480V transformers to determine if a similar vulnerability existe Insoection Followuo The inspectors discussed these issues with licensee engineers and reviewed an internal report entitled, "Short-Circuit Evaluation of Diablo Canyon Transformers," dated June 21, 1996. The report documented an effort to evaluate the capability of all Diablo Canyon transformers to withstand a short circui The licensee replaced the unit auxiliary transformers with rebuilt transformers of a different type. The original units were manufactured by Wagner. The Wagner transformer on Unit 1 failed catastrophically when subjected to a through fault on October 21,1995. The replacement transformers were rebuilt General Electric transformers. A review by the licensee indicated that the withstand stress for th: * 4 .t

,

transformers was at least two times greater that the calculated stress correspondirg to a l through fault. For the Wagner transformers, the withstand stress was calculated to be only 60 percent of the through-fault stress. Therefore, the replacement transformers provided a substantial increase in fault survivability margin.

!

The 4 kV to 480 V transformers at Diablo Canyon are dry-type transformers for which design records were not available. In lieu of a design study, the licensee performed a sample inspection. Based on historical records, the licensee concluded that these type of transformers rarely fail and when they do fail, a prior inspection would likely detect the

!

r

.

*

l -4-l

!

l incipient failure. The dry-type transformers are routinely inspected and cleaned. The l only defect suggesting an impending fault-stress problem was found in 1991 and l involved a cracked pressure block on top of the coils of one of the dry-type transformer The blocks were replaced. Following this discovery, all other dry-type transformers were inspected for this defect and no additional problems were found. Based on these results and the continuing inspection of these units, the licensee determined that the 4kV to 480V transformers were not subject to the same failure mode experienced by the Unit i l auxiliary transforme Based on review of this information and discussions with licensee engineers, the ,

inspectors concluded that the licensee's response to this issue was adequat I E8.02 (Closed) Deviation 50-275/9612-01: NRC Not Informed of the Licensee Decision to Not Determine the Mean Seat Areas For All 20 Unit 1 Main Steam Safetv Valves Backoround in 1994, the licensee conducted a program to test the main steam safety valves at the Westinghouse Service Center using both live steam and an AVK device. The licensee ,

found that there was good correlation between the set points measured on live steam I and the AVK device. In licensee Letter DCL-95-241, dated November 1,1995, to the l NRC, the licensee committed to perform additional testing during the Refueling Outages 1R7 and 2R7 for Units 1 and 2. This testing was to determine the mean seat area for the AVK device for all 20 of the main steam safety valve Due to equipment problems at the test facility and the licensee's decision to not delay the refueling outage, specific mean seat areas were developed for only 9 of the 20 main steam safety valves. The licensee did not inform the NRC of the failure to fully meet the commitment until after plant restart from the Unit 1 Refueling Outage 1R Insoection Followuo The inspectors reviewed the licensee's corrective actions for the failure to meet their commitment. The licensee stated that they appointed a project manager to specifically manage the main steam safety valve augmented test program. The inspectors ,

interviewed the project manager and found the project manager was very knowledgeable

-

! of the valves and the test program. In addition, the inspectors found that the licensee was no longer using the AVK test equipment and associated mean seat areas for testing the main steam safety valves. The licensee was testing the valves with Trevitest )

equipment. Due to the change in test equipment, the inspectors concluded that the j licensee's commitment was no longer applicabl j

l

! I l A i

t l

.

o i-5-

.

'

E8.03 (Closed) Violation 50-323/9613-01: Failure to Have Adecuate Fire Protection Material Control Backcround The NRC identified approximately 300 feet of 3-inch diameter combustible rubber hose stored in the containment penetration area of Unit 2. The hose was found at the 100-foot elevation in the auxiliary building with no transient combustible permit. Licensee Procedure OM8.lD4, " Control of Combustible Materials," Revision 3, paragraph 5. required that all combustible materials stored in an auxiliary building area, not designated for storage, receive a transient combustible permi Insoection Followuo in 1988, the licensee installed piping, dedicated hose connections, and storage hangers for approximately 300 feet of 3-inch flexible hose to perform steam generator rapid fill and drain down during refueling outages. This design change was not identified to require an impact review by fire protection personnel for changes to the fire protection program combustible loading calculation During 1988, the licensee performed a baseline fire protection area walkdown to identify and quantify insitu and transient combustible material. The licensee believed that the fire area walkdown was performed prior to the installation of the flexible hose, or, if it was installed at that time, that walkdown personnel assumed the hose would be removed upon completion of the refueling outage. Therefore, the 1988 baseline combustible materialinventory did not identify the 300 feet of hose for inclusion in the engineering fire loading calculatio The inspectors reviewed the licensee's completed corrective actions to prevent recurrence of the violation. These specific corrective actions included the removal of some combustible materials, or, where not removed, the issuance of transient combustible permits. In addition, the licensee performed the following actions to support the control of combustible materials: Procedure OM8.lD4, ' Control of Flammable and Combustible Materials,"

Revision 5, was revised on March 18,1997, to require periodic combustible material walkdowns by plant fire protection personnel and documentation of the results.

i

,

'

l l

-

\

-6-ll A licensee assessment to identify any additional insitu combustible materials in I areas governed by Procedure OM8. ID4 was performed during the week of 1 June 18,1996. The additional insitu combustible materials identified during this assessment, which were all temporarily stored materials, were included in a revision of Calculation M-824, " Fire Loading Calculation," Revision 8. Permits ,

were issued to identify this material as transient combustibl ) Procedure CF3.lD13, " Replacement or New Part Evaluation (RPE)," l Revision 4, was changed on December 5,1996, to include a reference to Procedure CF3.lD9, " Design Change Package Development," Revision 6A, to ensure a review by the fire protection grou The inspectors reviewed the corrective actions and concluded that they appeared to be appropriate to prevent recurrence of the violation. The inspectors reviewed revised Procedure OM8.lD4 and the revised Fire Loading calculation (M-824) for both units and determined that the completed corrective actions should prevent a similar occurrenc E8.04 (Closed) Insoection Followuo item 50-275 -323/9613-02: Review of Auxiliarv Saltwater System Pioino Followina Desian Basis Seismic Event l l

Backaround The licensee initiated a corrosion testing program in 1995 to quantify the condition of the auxiliary saltwater system piping. The testing determined that there was a potential for excessive corrosion on the Unit 1 piping located in the tidal zone near the plant's intake structure. The NRC noted that the piping was coated with fiberglass and epoxy, which had a projected life of 20 to 25 years, and the licensee's tests determined that the corrosion rate in the tidal area could be as high as 40 mils per year. The auxiliary saltwater system piping located outside of the tidat zone had a corrosion rate of 2 to 4 mils per year. The pipe was buried in 1971 l and had a nominal pipe-wall thickness was 375 mils. Based on this information, the NRC determined that if the coating failed after 20 years of service (in 1991), that in 1996 (the year this issue was identified) the portion of the pipe exposed to corrosive conditions of 40 mils per year could have a pipe-wall thickness as low as 175 mil The licensee performed an evaluation and determined that 188 mils was the minimum pipe thickness needed to survive a design basis seismic event. The NRC concluded that further information was needed to determine if the auxiliary

{

saltwater system piping would remain functional following a design basis seismic )

even !

l

,

i l

! l I

U___ _

f*

.

-7-l t

l l

Insoection Followuo l The inspectors discussed these issues with the licensee. In March 1997, the licensee installed piping to completely bypass the piping in the tidal zone. The l

licensee planned the same modification for Unit 2 in March 1998. The length of pipe in the tidal zone was only about 5 percent of the totallength of auxiliary saltwater system pipin The inspectors reviewed Design Change Package DCP C-049207, " Auxiliary Saltwater System Bypass Piping Intake to Hillside Vault," Revision 7, which provided the plans to bypass the auxiiicry saltwater system piping within the tidal zone. The inspectors noted that the new bypass piping did not extend through the tidal zon The sections of pipe that were bypassed were abandoned in place. The licensee provided cathodic protection for the buried portions of the bypass piping and the j existing portion of the buried auxiliary saltwater system pipe. The inspectors i determined that the licensee had adequately resolved the corrosion problem and that l l

l the concern of the effects of piping corrosion on the ability of the piping to l withstand a seismic event was no longer an issue.

( E8.05 (Closed) Violation 50-275:-323/9623-07: Plant Staff Review Committee did not Review l

Safetv Evaluations as Reauired by Technical Soecifications Backaround The NRC determined that as of October 23,1996, safety evaluations were performed for l the core reloads for Unit 1, Cycle 8, and Unit 2, Cycles 7 and 8, without plant staff review l

committee (PSRC) evaluation review. In addition, fuel sipping was performed during the l Unit 2 Refueling Outage 2R7 without the PSRC having reviewed the associated safety evaluation.

l l Insoection Followup 1 ,

Westinghouse Electric Corporation (Westinghouse) prepared the 10 CFR 50.59 safety evaluations for Units 1 and 2 core reloads and for the Unit 2 fuel sipping modificatio '

l The Westinghouse safety evaluations concluded that the core reloads and the fuel l sipping modification did not create unreviewed safety questions nor require changes to j

'

the technical specificatio Licensee engineering personnel used the Westinghouse safety evaluations, in part, as a basis for responding to questions contained in the safety evalustion screenings required by their administrative procedures. Because all screening questions had negative responses, the procedures did not require that licensing basis impact evaluations (LBIEs)

be prepared and, as a result, a PSRC review was not required.

I l

l

'

.

-8-The licensee determined that the Westinghouse safety evaluations were not reviewed by )

the PSRC due to a programmatic deficiency in the procedures governing the LBIE I program. Both the procedures and the training program for LBIEs did not contain specific requirements for processing safety evaluations provided by vendors. Licensee personnel were unaware that these safety evaluatir .s were required to be reviewed by the PSR l The licensee took the following actions to prevent recurrence:

1 The PSRC reviewed the Westinghouse core reload and fuel sipping safety evaluations and agreed with the conclusions stated in the plant's safety l evaluation screens. The core reloads and fuel sipping modifications did not result l in any unreviewed safety questions or changes to the technical speci3 cation j The PSRC met on October 24,1996, and December 27,1997, for core reloads and fuel sipping evaluation approvals, respectivel . The engineering staff was questioned as to whether the PSRC had reviewed any vendor safety evaluations that support current operation of the units. As of February 14,1997, no other vendor safety evaluations supporting current operability of the units had been identifie . The applicable safety evaluation procedures were revised to clarify requirements regarding PSRC review of safety evaluations provided by vendors. Revision 3 to Administrative Procedure TS3.lD2, " Licensing Basis impact Evaluations," was reviewed and approved by PSRC on June 6,1997. Paragraph 5.1.11 stated that !

if a vendor develops a 10 CFR 50.59 safety evaluation for a licensee activity or i analysis, then that safety evaluation shall be reviewed by the PSRC and an LBIE i shall be generated to reference the vendor safety evaluation and to document PSRC revie . Licensee personnel were notified of changes to Procedure TS3.lD2. The licensee notified appropriate personnel via an e-mail message on July 29,1997, ]

stating that provisions had been added to help assure that vendor-developed i safety evaluations are reviewed by PSR . The licensee stated that the Procedure TS3.lD2 changes were reviewed by each technical staff supervisor with his/her group in technical staff update session These sessions were completed on August 1,199 l l

The inspectors reviewed the licensee's corrective actions, including revised l I

Procedure TS3.lD2, the e-mail message, and technical staff update session documentation, and concluded that the licensee had taken adequate actions for this proble l l

l

-

\

l l

-

\

-9- l

\

E8.06 (Closed) Violation 50-323/9624-03: Failure to Perform a 50.59 Evaluation Prior to Chanoino Unit 2 Reactor Trio Set Point l Backoround j

The NRC identified that on May 21,1996, the licensee's PSRC approved increasing the Unit 2 reactor coolant low flow trip set point in Technical Specification 2.2.1, Table 2.2-1 without a written safety evaluation to determine whether this change involved an unreviewed safety questio '

Insoection Followup Engineering personnel performed a detailed analysis to provide a technical basis for the change in the reactor coolant system low flow trip set point. A LBIE screen was prepared, rather than a formal safety evaluation, prior to implementing the change. The LBIE screen was reviewed and approved by the PSRC in support of a technical specification interpretation (TSI) to administratively change the set point consistent with supporting analyse At that time, the licensee's procedure for processing TSIs did.not require the performance of a 10 CFR 50.59 safety evaluatio The licensee stated that the nuclear industry now has heightened sensitivity to the need to perform documented 10 CFR 50.59 safety evaluations of potential changes to the plant licensing bases. Based on this heightened sensitivity, the licensee concluded that a formal 10 CFR 50.59 safety evaluation should have been performed to satisfy this requiremen The inspection team reviewed the licensee's completed corrective actions to prevent recurrence of the violation. These specific corrective actions included the following: The method of measuring reactor coolant system flow was changed to require the measurement to be made at the beginning of each operating cycle, reducing instrument uncertainty. Because it was no longer necessary, the TSI was rescinded on November 7,199 . The existing TSis were reviewed to identify which TSI should be: (1) included in the licensee's standardized technical specification submittal, (2) incorporated into the technical specification via a separate license amendrnent request, or (3) deleted. Based on current procedures, TSis fitting Categories (1) or (2) would l require a safety evaluation.

!

I h

!*

-10-l l

l Procedure XI3.lD3, " Technical Specification Interpretations," Revision 3, was i revised to require that when a TSI was submitted to the PSRC, a schedule for ;

'

l performing a confirmatory evaluation was included. The schedule provided for l development and approval of either a technical specification bases change with

! an associated 10 CFR 50.59 safety evaluation, or a license amendment request.

l The inspectors' review of the above completed corrective actions indicated that they l were appropriate to prevent recurrence. For example, the inspectors noted that l

Procedure XI3.lD3 provided guidance stating that when a TSI that does not address a

]

l temporary plant condition is presented to the PSRC for approval, a schedule for I performing a confirmatory unreviewed safety question evaluation shall be presented. In l addit,on, this procedure further stated that for a TSI that is not addressing a temporary I cordition, the schedule shall provide for development and approval of either a technical !

specification bases change or a licensee amendment reques j

Tne inspectors reviewed the list of TSis (39 total) at the time of this inspection. Based upon the revised review process, the inspectors determined that 4 TSis were being deleted,14 TSis were being incorporated into the technical specifications via a license amendment request, and the remaining 21 TSis were being included in the licensee's standardized technical specification submitta j

i Based upon the above completed corrective actions, the inspectors concluded that the

'

licensee's actions should prevent recurrence of the violation.

I E8.07 (Closed) Licensee Event Reoort 50-323/96-007: Technical Soecification 3.7.1.1 Not Met Due to Hioh initial Main Steam Safetv Valve Lift Points Backaround l

l l In August 1996, with Unit 2 in Mode 1 at 100 percent power, Technical Specification i 3.7.1.1 was not met when 7 of the 20 main steam safety valves did not meet the l technical specification tolerance for as-found set points. The licensee analyzed the high

! set points and determined that the set points were outside the technical specification

! tolerance, but not outside the design basis analytical margin. The licensee thought the l cause of the high initiallifts was related to a sticking phenomenon between the main

, steam safety valve disk and nozzle seating surface. The licensee tested the main steam l safety valves in place using the AVK hydraulic lift device. The licensee performed the l testing as part of their augmented test program to identify the reason for the high initial lifts and the set pressure drifts that the plant had experience The licensee performed a root cause analysis that lead the licensee to believe that the sticking phenomenon was caused by micro-bonding of gauled material originating from the relative motion of the disk against the nozzle seat. The licensee stated that laboratory tests indicated that gauling occurred during uncontrolled cooling of the valve i

!

I L

I,

.

! -11-without steam pressure present. In addition, the different coefficients of thermal l expansion between the disk and nozzle material resulted in relative motion between the two components. The licensee concluded that, without steam pressure present, this motion took place under relatively high seat loads and resulted in gauling. Through testing, the licensee also determined that elevated temperatures during normal operation were necessary for the micro bonding to occur. The results of the augmented test program indicated that bonding might occur within 90 days of reinstallation at normal operating temperature and pressur Insoection Followuo The licensee's immediate action was to assure that all main steam safety valves were left within the technical specification tolerance following testing and any required adjustments. The inspectors reviewed Action Requests A0410736, dated August 8, 1996, and A0410736, dated August 7,1996, and verified that the valves were reset to be l

within the technical specification tolerance. The inspectors found that the licensee replaced the Unit 1 disks during the Unit 1 Refueling Outage 1R8 and had scheduled disk replacement for Unit 2 during Refueling Outage 2R8 (which began February 1998).

To minimize micro-bonding between the disk and nozzle seat, the licensee replaced the 422 stainless steel disks with inconel X-750 disks. The licensee stated that the inconel material had a coefficient of thermal expansion closer to that of the seat material which minimized the relative motion between the disk and nozzle seats. The inspectors reviewed licensee Letter DCL-97-073, dated May 2,1997, to the NRC, which addressed the augmented testing of the main steam safety valves. The licensee stated that, as a result of three main steam safety valves lifting low during a dual unit trip on August 10, 1996, they determined that use of the valve specific correlation factors derived from the AVK test equipment bias data resulted in main steam safety valve set points that were outside technical specification limits. The licensee found that the tests using the Trevitest test equipment provided result correlations that were closer to the results recorded by the plant computer than those provided by the AVK test equipment result The licensee discontinued the use of AVK test equipment and valve-specific correlation factors due to the findings from the August 1996 dual unit trip. The licensee further stated that the set points for both units were adjusted using the Trevitest test equipmen The inspectors reviewed Surveillance Test Procedure STP M-778, " Augmented Test Program for Main Steam Safety Valves with inconel X-750 Disks," Revision 0, and noted that the test procedure required the valves to be tested with Trevitest equipment. The l

inspectors reviewed the main steam safety valve test data and noted that, since the

'

Trevitest equipment was being used, none of the .ves tested exceeded the technical l specification set point toleranc Tiie inspectors determined that the licensee's actions in response to this series of events were satisfactory.

I

.

-

-12-I This violation of Technical Specification 3.7.1.1 was previously cited in NRC Inspection Report 50 275;323/96-1 E8.08 (Closed) Licensee Event Reoort 50-275/96-013: Main Steam Safetv Valves Set Outside Technical Soecification 3.7.1.1 Followina Use of inaccurate Mean Seat Areas Due to Personnel Error  !

Backaround On April 11,1996, for Unit 1, and August 7 and 8,1996, for Unit 2, with each unit in Mode 1 at 100 percent power, Technical Specification 3.7.1.1 was not met when the main steam safety valves were set outside of the maximum tolerance of +/- 1 percent of the nominallift pressure. The licensee stated that the main steam safety valves were set using AVK test equipment that used inaccurate mean seat areas. The licensee discovered this condition August 10,1996, when both units tripped. Two Unit 1 and two Unit 2 valves lifted at a pressure lower than the set point during the trip. The licensee performed post-trip set point verifications with Trevitest equipment. The licensee stated that, after the Trevitest testing, all of the main steam safety valves were left within technical specification tolerance Insoection Followuo The licensse's corrective actions for using an incorrect mean seat area was to change the test equipment from the AVK to the Trevitest equipment and to use the Trevitest mean seat area. The licensee's corrective actions, discussed in Section E8.07 of this report, were sufficient to resolve this ite This violation of Technical Specification 3.7.1.1 was previously cited as a noncited l violation in NRC Inspection Report 50-275;323/96-2 E8.09 (Closed) Violation 50-275/9703-03: Failure to Take Adeauate Corrective Actions Resultina in Water in the Auxiliarv Feedwater Pumo Turbine.

l Backoround

!

! In August 1996, the licensee identified an abnormally high concentration of water in the

!- oil within the governor of the turbine-driven Auxiliary Feedwater (AFW) Pump 1-1, but

! failed to take adequate corrective action to preclude repetition. An action request was not written and additional review of the root cause and followup investigation of the e potentialimpact on pump operability was not initiated. This led to a second discovery of water in the governor oil system in April 199 I

. 1 I

.

-13-I

,

latoection Followuo in August 1996, the system engineer chose not to write an action request for the discovery of water in the oil because it was determined that the water did not affect the operabnity of the governor. Although the 500 ppm of water found in the oil sample was higher than expected, the system engineer concluded that there was no operability impact became the water content was only 25 percent of the general rule-of-thurnb maximum li- for proper lubrication of 2,000 ppm. Later examination of the control guide for the .orbine showed that the actual water content upper limit was 5,000 ppm for proper lubrication. Although at the time it was thought that the sample could be flawed or contaminated, there was insufficient oil left in the system to take a cecond sample. The system engineer decided to change the governor oil to establish a new baseline. The l new oil was sampled to assure that it was free of water, in April 1997, when the next sample indicated water intrusion similar to that indicated in the previous sample, an action request was written. The licensee agreed that an action request should have been written after the first sample disclosed a higher than expected moisture content and that the sample frequency should have been increase Licensee corrective actions included the following: l The lube oil heat exchanger for turbine-driven AFW Pump 1-1 was replaced during Unit 1 Refueling Outage 1R . Applicable procedures were revised to include threshold limits for tube oil sample results in order to determine when action requests are writte . An oil sample taken 3 months after Refueling Outage 1R8 ensured that the water l intrusion problem was corrected by replacement of the lube oil heat exchange j Maintenance Procedure MA1.DC52, " Maintenance Services Predictive Maintenance Program," Revision 1 A, was revised with an on-the-spot-change on !

August 19,1997. The on-the-spot-change revised paragraph 4.3 to require l initiation of an action request if abnormal data was received, frequency of data j collection needed to be changed, or if greater than 2000 ppm water was 4 l

measured in the oi The inspectors reviewed the licensee's corrective actions and concluded that the 1 corrective actions appeared sufficient to preclude recurrence of the violation. The )'

l inspectors reviewed the revised Maintenance Procedure MA1.DCS2, and verified that l

,

I I l

t

.

.

-14-

- Revision 1 A required an action request be generated if it was determined there was over 2000 ppm water in the oil. Although the 2000 ppm water limit would not require the issuance of an action request if the same event were to occur again, i.e.,500 ppm of water, the inspectors were assured by the licensee that, in this event, a second confirmatory sample (and, if necessary, additional, more frequent, samples) would be taken to assure that the lubrication limit of 5000 ppm would not be exceede The inspectors reviewed Action Request A0428421 and the work order, which replaced the lube oil heat exchanger for the turbine-driven AFW Pump'1-1. The inspectors noted that Action Request A0428421 indicated that the root cause of the water intrusion was believed to have been a defect in the lube oil cooler and/or 0-ring seals. Both of these components were replaced during Unit 1 Refueling Outage 1R E8.10 (Closed) Violation 50-275:323/9717-01: Failure to Correct Smoke Detector Sensitivity Backaround The NRC identified that the licensee, between 1988 and 1993, initiated approximately 21 action requests documenting problems associated with inaccessibility and sensitivity testing of the various smoke detectors. The corrective actions associated with these action requests failed to promptly correct a nonconformance regarding the failure to test smoke detector sensitivity. Specifically, three detectors in Unit 1 and one detector in Unit 2 had not been tested within the established 5-year frequenc Insoection Followuo l

A small number of smoke detectors were not sensitivity tested due to inaccessibility. The l licensee stated that smoke detector sensitivity testing was a licensing commitment, incorporated into the Final Safety Analysis Report by reference to the National Fire Protection Association code. This code stipulated following the manufacturer's 3 instructions for maintenance activitics, which included sensitivity testing of the smoke I detector The licensee's surveillance test procedures established operability for the fire and smoke I detectors through the performance of functional tests. However, licensee personnel did l

'

not recognize that sensitivity testing, while implemented in the test procedures, was a licensing commitment. In addition, licensee personnel believed, incorrectly, that detectors became more sensitive with time due to dirt accumulocon and that detectors would fail safe. Engineering personnel inappropriately used this justitication in lieu of providing a method for performing sensitivity testing. As a result, corrective actions to resolve inaccessibility for sensitivity testing were not timely. This issue was identified in ,

May 1997 during a licensee fire protection audit. The licensee agreed that more timely l corrective actions should have been implemente i l

!

J

i

.

-15-l The corrective actions taken to prevent recurrence and future actions were as follows:

]

! The licensee inspected the detectors identified in the 21 action requests and i concluded that a total of eight detectors were inaccessible for sensitivity testin )

These eight detectors were to be modified to allow future sensitivity testing by the end of Unit 2 Refueling Outage 2R8 for both Units 1 and . The detectors originally were classified as inaccessible, but were later determined to be accessible, were sensitivity tested by the end of Refueling Outage 2R8 for both Units 1 and 2. At the time of this report, all testing was completed on Unit 2 and only two detectors in Unit 1, both located over the main steam lines, ]

i remained to be tested. Refueling Outage 2R8 began in February 199 I I Some detectors could only be tested during a ' unit outage due to personnel safety {

concerns or physical locations near equipment which has the potential to trip the i plant if tested during plant operations. These detectors were to be sensitivity 1 tested by tne end of the Unit 1 Refueling Outage 1R9 for Unit 1 and by the end of l Refueling Outage 2R8 for Unit 2. The Refueling Outage 1R9 was scheduled to begin in February 199 The inspectors determined that the licensee's completed and planned actions in response to this issue were satisfactory for resolution of this issu I 8.11 (Closed) Violation 50-275:-323/9717-02: Failure to Control Transient Combustible Materials Hag.karound The NRC identified that an r.cca in the intake structure containing safety-related equipment included the fo!iowing materials: (1) five aerosol cans and a one gallon plastic container of flammable liquids, not in use and not stored in a flammable liquid cabinet; (2)

several untreated wooden pallets; (3) combustible packaging material consisting of j several cardboard boxes used for storing materials; and (4) an unattended chair and j ventilation ductwork, composed of combustible materials in red-painted no-comhustible storage area Insoection Followup The licensee believed that these fire protection housekeeping issues were not representative of the other areas of the plant. While the exact cause for each of the conditions listed in the violation could not be determined, it appeared that, in general, the intake personnel did not have a clear understanding of the requirements of Procedure IDAP OM8.lD4, " Control of Flammable and Combustible Materials,"

Revision ;

__

i .

.

-16-l

)

l The corrective actions taken to prevent recurrenco were as follows:

,

l The licensee conducted walkdowns of the intake area by an intake team to

! correct any conditions that did not conform to the requirements of Procedure IDAP OM8.lD4. Afterward, nuclear quality services and fire protection personnel verified compliance with Procedure OM8.lD4. These walkdowns were i

completed on December 18,1997.

!

l The licensee conducted a meeting durin; the week of October 1,1997, of all l intake personnel regarding expectations for the control of combustibles in l

'

accordance with Procedure OM8.lD I l The licensee assigned the maintenance foreman responsibility and accountability for contrni of combustibles and flammables in the intake structure. The licensee i

'

instrucke the organizations performing support functions at the intake structure concerning their responsibility and part in assuring procedure compliance. This i action was completed on October 1,199 l Procedure IDAP OMB.lD4, Section 4.8, was revised to clarify that no unanalyzed transient combustibles were permitted in the red-painted, no-combustible storage areas from the floor to the ceiling. This revision was completed ,

on February 15,199 I A flammable liquid storage locker was installed in the intake structure to facilitate compliance with Procedure OM8.lD4. This action was completed on February 5,

,

1998.

l A maintenance self assessment was to be performed within 6 months to verify l that the corrective actions have been effective. This self assessment was

! planned to be completed and documented by June 26,1998.

l l The inspectors reviewed the completed and planned corrective actions, and concluded

'

that they appeared sufficient to prevent recurrence of the violation. The inspectors walked down the intake structure with fire protection personnel, and identified no transient combustibles in the red-painted, no-combustible storage areas. The

'

inspectors examined the flammable liquid storage locker detailed in Corrective Action 5 above. The inspectors determined that the intake structure was in compliance with Procedure IDAP OM8.lD4 at the time of this inspection.

f t

1

'

.

-17-E8.12 (Closed)Insoection Followuo item 50-275/97202-01: Review of Ultimate Heat Sink Calculation Backoround During normal plant operation, auxiliary saltwater (ASW) was provided to one of the two component cooling water (CCW) heat exchangers for each unit. Technical Specification 3.7.12 required that whenever the ultimate heat sink (UHS) saltwater temperature exceeded 64*F, the second CCW heat exchanger was to be placed in service within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or the plant was to be placed in at least hot standby within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in at least hot shutdown within the following 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Considering the "El Nino" effects on Pacific Ocean temperatures, the NRC questioned what maximum UHS temperature (above 64*F) would allow safe operation with the plant in the two-CCW heat exchanger lineup. The licensee had no analysis addressing this plant operating conditio Insoection Followuo In response to this concem, the licensee issued three calculations, which together established the limits of operation with elevated UHS temperatures as follows: Calculation M-1027," Determine the Maximum Allowable ASW Temperature When Two CCW HXs Are Aligned," Revision 0, December 30,1997, assessed the limits on plant operation in Modes 1 through 3. It determined that UHS temperatures as high as 75*F were acceptable with two CCW heat exchangers in servic . Calculation WCAP-14282," Evaluation of Peak CCW Temperature Scenarios for Diablo Canyon Units 1 and 2," Revision 1, December 1997, assessed the CCW temperature responses to various accident and failure scenarios to determine the maximum CCW temperature. Case 9 was a sensitivity study case for a loss-of-coolant accident (LOCA) with two ASW pumps supplying two CCW heat exchangers that had not been previously addressed in other calculation . Calculation M-1020," Evaluate the CCW System for Mode 4 Operation with Elevated UHS Temperatures," Revision 0, November 21,1997, determined the maximum UHS temperature for which a single CCW heat exchanger could l

support Mode 4 operation. This was to determine the maximum UHS

temperature for which a safe shutdown could be accomplished if a second CCW j heat exchanger could not be placed in service within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> as required by the technical specifications. This temperature was 70*F, and this was established as the UHS upper temperature limit.

l

-.

.

-18- )

I i l

I l

l The licensee committed to incorporate this limit into the design basis with Design ,

Change Package (DCP) M-49386 by June 1,1998, and into the ITS as part of the response to an NRC request for additional information associated with ITS Section '

The inspectors reviewed the above calculations and the licensee's responses to this item. No discrepancies were identified in these documents. However, the team did question the increased CCW temperature limit, from 120'F to 140*F, that was incorporated in Calculation WCAP-14282 with respect to the ability of the equipment !

cooled by CCW to remain functional at this elevated temperature. Sample re-qualification documents for the residual heat removal pump mechanical seal, the safety injection pump mechanical seal and tube oil system, and the centrifugal charging pump mechanical seal and lube oil system were reviewed by the inspectors and found to acceptably demonstrate the capability of this equipment to properly functio '

E8.13 (Closed) Insoectig.a Followuo item 50-275/97202-02: Review of Revision to WCAP-14282 and incorooration into Desian Basis Documentation Backaround The NRC observed that in the original revision of Calculation WCAP-14282, " Evaluation of Peak CCW Temperature Scenarios for Diablo Canyon Units 1 and 2," high fouling I

factors had been used for the various heat exchangers, consistent with conservatively oemonstrating the capacity to meet the design basis heat transfer requirements for the various system heat loads. However, this assumption was not conservative with respect to the CCW temperature. For very low fouling factors, which was consistent with actual

,

plant experience, the heat transfer rate into CCW could be much higher, resulting in l higher than calculated CCW temperatures. At the time of the inspection, this WCAP was l being revised to address this concern, and the licensee had issued Action

Request A0439116 to track the changes necessary to incorporate the revised WCAP l

results into design basis documentation as presented in design criteria memoranda I

(DCM) documents and the Final Safety Analysis Repor This NRC also identified that there were no procedural controls to limit CCW heat l exchanger tube plugging to the 2 percent allowed by the manufacturer. Action l Request A0443543 was initiated to generate procedural controls to limit tube plugging l without reanalysis.

!

'

Insoection Followuo The inspectors reviewed the revised WCAP-14282 (Revision 1) and identified no discrepancies. The affected DCMs were in various stages of revision, Design Change Package (DCP) M-49386, to change the Final Safety Analysis Report, was targeted for a

0-19-June 1,1998, completion, and the other affected calculations had been identified, with several having been changed but not yet checked. However, none of the documents affected by this calculation had gone through the complete revision process at the time of this inspectio The inspectors concluded that the revised WCAP and the related calculations discussed in the preceding item (Section E3.12) adequately addressed the previously identified design concerns. Although revisions to the other affected design and licensing do::uments were incomplete, the inspectors verified that these actions were being tracked satisfactorit E8.14 (Ocen) Unresolved item 50 275/97202-03: Determine if Current Acoroach to Sinale Failure Design Reoresents a USQ Background The original design intent for the ASW and CCW systems was that they be separated into two redundant trains for long-term post-LOCA cooling as described in Final Safety Analysis Report Section 9.2.7.2, thus, assuring their ability to withstand a single passive failure. This was reflected in Emergency Operating Procedure E-1.4, " Transfer to Hot !

Leg injection," Revision 12,which required train separation at approximately 10% hours !

after a LOCA. However, the licensee discovered that when the trains were separated, the accident heat removal capabbities of these systems, in conjunction with the residual ,

'

heat removal system, were vulnerable to single active failure in two scenarios. First, for the postulated loss-of-electrical Bus F, CCW cooling flow in Loop B and ASW cooling i flow in loop A would be lost, and second, for the postulated loss-of-electrical Bus G, ASW i cooling flow in Loop B and residual heat removal flow in Loop A would be los With this discovery, on March 3,1997, the licensee initiated Licensee Event Report (LER) 1-97-001, "The Component Cooling Water System Has Operated With Procedural Guidance That Permitted Operation in a Condition Outside the Design Basis of the Plant." Corrective action was to change Emergency Operating Procedure E-1.4 to no longer require train separation, but to make separation optional, and to transfer the train separation decision to the Technical Support Center (TSC), where the decision would be made after an evaluation of plant conditions. The NRC determined that since this mode of operation was not consistent with the original design or licensing basis, it potentially constituted an unreviewed safety question (USQ).

Insoection Followuo The inepectors' review focused in two areas: (1) the licensee's actions following identification of this vulnerability and (2) determination of an unreviewed safety questio The following observations were made:

f.

Io e

{ -20-

! Licensee's Responses to Single Faliure Vulnerability l

! The licensee's responses to the discovery of these single failure vulnerabilities included the following:

l Revision of the emergency operating procedure, as described above, to make

!

separation of the ASW/CCW trains optional and tc 'qsfer this decision to the l TSC.

I Revision of TSC Procedure PEP EN-1, " Plant Accident Mitigation Diagnostic l Aids and Guidelines," Revision 6, to incorporate guidance on train separatio j l

e Revision of the UFSAR to reflect these procedural changes.

i o Upgrade of the operators for ASW Train Cross-Connect Valves FCV-495 l

and FCV-496 to allow remote manual operation from the control roo l o issuance of Non-Conformance Report (NCR) N002010, " Separation of ASW and CCW Systems in Post-LOCA Operation," Revision The team reviewed these responses and found that they satisfactorily addressed the technical concerns with the single failure vulnerabilities identified. With these changes, during the injection phase of an accident, when only an active failure was required to be considered, the ASW/CCW systems would be operated in the cross-connected mod An active failure in this phase could reduce flows, but not to the extent where the ;

systems could not perform their safety functions. In the long-term, when both an active and passive failure were required to be considered, the decision to separate the systems would be deferred to the TSC, where the plant status would be evaluated. if the decision were made to leave the systems split, they would still be protected from active failur For passive failure as defined in the UFSAR (a 50 gpm leak for 30 minutes), the licensee was able to show that, for the CCW system, operator action could be taken in that time to detect and isolate the leak, and the water loss from the system would not be sufficient to incapacitate either train; for the ASW system, a loss of this volume could be tolerated j indefinitely without affecting the system's ability to perform its safety functio l Additionally, the upgrade of cross-connect valves FCV-495 and FCV-496 assured the )

ability to quickly split the trains remotely from the control room if so desire l The USQ Question The licensee's position regarding whether this concern constituted a USO remained unchanged from the time of the previous inspection and was essentially contained within the 10 CFR 50.59 safety evaluations that had been produced as a part of the Final

,

..

.

-21-I Safety Analysis Report and emergency operating procedure change processes. The primary elements of these safety evaluations, as contained in the licensee's response letter to the NRC, Letter DCL-98-007, dated January 12,1998, were that:

, The changes did not affect the design of any system or the ability of the systems i to perform their safety function . The changes did not affect assumptions made in the Final Safety Analysis Report !

accident analyses, nor the results of these analyse . Indications of a single failure and system conditions were available, procedures were in place to perform the necessary/ appropriate actions, and responses could be made in an acceptable time fram The inspectors agreed, generally, with the licensee's position with one exception. The emergency operating procedure change did result in a change in the system response to a passive failure during the long-term recirculation phase. Prior to the change, with the trains separated, no operator action was necessary to prevent a passive failure from debiliteting both trains. After the change, operator action was a necessary element in the ,

response to a passive failure. This change in the accident scenario potentially l

'

constituted a USQ. This item was left open pending additional review by the NR During this review, the inspectors observed that the CCW system was normally pressurized with nitrogen supplied to a common surge tank for both divisions. This ,

feature was described in NRC Generic Letter 96-06, " Assurance of Equipment Operability and Containment Integrity During Design Basis Accident Conditions," that i involved the potential for water hammer in containment fan cooler units during accidents due to voiding following loss of power. This design incorporated a single pressure l control valve intended to vent nitrogen pressure from the tank at the upper end of the ;

normal operating pressure band. Such venting could be expected for events that would add significant new heat loads to the system, such as a LOCA, thereby causing an increase in the system's bulk temperature and the resultant expansion of the water in the system and raising of the system pressure. The team noted that for such an event, if the pressure control valve were to fail to close, all nitrogen pressure could be vented, thereby defeating this waterhamer protection feature. If such an event were to be accompanied by a loss-of-offsite-power (LOOP), the potential would exist for voiding and subsequent water hammer in the containment fan coolers when the CCW pumps were restarted after the emergency busses were re-energized by the emergency diesel generators. It appeared that the potential would be greater if the LOOP occurred after the LOCA, because more time would have been available for CCW system heatup and l

releasing of the nitrogen pressure from the system.

l

I i .

l l -22-l i

The licensee responded that this was not a credible concern if the LOCA and the LOOP were considered to occur simultaneously, since there would be insufficient time for system heatup and pressure relief berore the CCW pumps would be restarted; therefore, i there would be no waterhammer. Furthermore, the licensee considered this scenario to l be outside the plant's licensing basis, i.e., the licensing basis only required consideration of LOOP coincident with LOC Based on this review, the inspectors considered that a potential existed that made the CCW system vulnerable to a failure of the CCW surge tank back pressure regulator valve to close coincident with a non-simultaneous LOCA and LOOP. The inspectors concluded that this scenario was beyond the licensing basis of the plant and of very low probabilit Conclusion The deletion of procedural steps to separate trains of the auxiliary saltwater and component cooling water systems, when transferring to hot leg injection during a loss of l coolant accident recovery appeared to constitute an unreviewed safety question. This !

unresolved item was left open pending additional review by the NR ]

l E8.15 (Ocen) Insoection Followuo item 50-275/97202-04: Modification to ASW Pumo Testina l Method Backaround The NRC discovered that the method used by the licensee for performing ASME )

Section XI testing of the ASW pumps was with the system cross-connected, with each I pump supplying the opposite train's CCW heat exchanger. This configuration was used to provide the maximum system resistance and hence the most conservative lineup. For this test, the CCW heat exchanger outlet valve, a sealed, throttled valve, was unsealed l and adjusted to regulate the flow to the test reference value. This adjustment was i different for each test, depending on the ocean tide level at the time of the test. If this was a pump post-maintenance test, the pump's division would be considered inoperable l until the test was successfully completed. Likewise, while the opposite train's CCW heat l

exchanger outlet valve was unsealed, that division could also officially be considered inoperable, making both divisions technically inoperable at the same time. However, with this configuration, both trains were capable of supplying sufficient flow to satisfy design basis flow requirements. Therefore, no safety concern existe Insoection Followuo in response to this finding, the licensee submitted a relief request letter to the NRC (DCL-97-210, dated December 12,1997, " Inservice Testing Relief Request P-RR5 - Auxiliary Saltwater Pump (ASWP) Performance Using Evaluation of

- __ _

.

[*

!

23-

,

!

l i

L

'

Pump Curves," to allow ASW pump testing using an evaluation of pump performance compared to pump curves in lieu of single reference points, as allowed by Operation and j Maintenance Part 6 (OM-6), " Inservice Testing of Pumps in Light-Water Reactor Power

'

Plants," paragraph 5.2(b). This would eliminate the need to adjust the CCW heat exchanger outlet valve and the resultant declaring of the affected ASW/CCW train inoperabl ]

The inspectors reviewed the relief request letter and the NRC's recommendations for use

of the pump curves in lieu of reference points contained in NUREG-1482,4/95, i l " Guidelines for Inservice Testing at Nuclear Power Plants," Section 5.2, "Use of Variable

'

Reference Values for Flow Rate and Differential Pressure During Pump Twting." The NUREG described the general requirements for allowing such relief as well as seven specific requirements for preparing the pump curves to be used. The licensee had -

commit *ed to all of these general and specific requirements in the relief request and had l provideo clear arguments that demonstrated the impracticality of the current method of l testing and the need for this relie The inspectors concluded that the licensee's actions regarding this item were appropriate and timely, and that they committed to fulfill all of the regulatory and ASME Code guidance for cases such as this, including assuring that the pump performance would ,

meet not only the Code required acceptance criteria, but also that they would also meet l l the minimum accident analyses performance requirements, as addressed in NRC l Information Notice 97-90,"Use of Non-conservative Acceptance Criteria in Safety- I Related Pump surveillance Tests." Pending this approvcl and implementation of the i proposed changes, this item remained ope E8.16 (Closed) Unresolved Item 50-275:-323/97202-05: Discrenancies in Desion Documentation i

Backaround I

;

l The NRC identified four examples where the licensee's documentation of design bases I i information was inconsistent with actual plant desig In the first example, the NRC found that the piping temperature classification for the l auxiliary saltwater system (ASW) in design criteria memorandum (DCM) S-17, " Auxiliary Saltwater System," Revision 4, did not reflect the correct values specified in Calculation M-784, " Auxiliary Saltwater System," Revision 1, which determined the maximum system pressures and temperatures for various modes of operation. The NRC reviewed Calculation M-784 and determined that the pressure and temperature classification in the calculation was acceptable and that, therefore, no safety concern existe \.

)

-24-In the second example, the NRC identified that Technical Specification Basis 83/4.3-1 for the ASW system did not describe the start of the ASW pumps in response to the engineered safety features actuation signal. The NRC noted that the Final Safety Analysis Report stated that the ASW pumps were started from the engineered safety features actuation signal. Since this was consistent with the actual design, the issue did <

not constitute a safety concer l In the third example, the NRC identified that Technical Specification Bases B3/4.5.5 did not describe verification of the refueling water storage tank temperature as a necessary parameter to establish operability of this tank. The NRC noted that Technical Specification Section 3/4.3.2 for the refueling water storage tank described verifying the storage tank temperature to establish operability during low outside ambient temperature conditions. The technical specification bases only mentioned the refueling water storage l tank volume and boron concentration as a requirement for operabilit l l

In the fourth example, the NRC identified that Design Criteria Memorandum S-12, !

" Containment Spray System," Revision 6, did not correctly identify that a coincident high- !

high containment pressure signal was necessary to start the containment spray pumps when a safety injection signal was received. The team found that the design criteria memorandum only described the high-high containment pressure signal as being necessary for automatic actuation of the containment spray system. The NRC found that the Final Safety Analysis Report stated that receipt of the high-high containment pressure signal was required in combination with the safety injection signal to l automatically initiate containment spra The NRC also identified two examples (identified as the fifth and sixth examples below)

where the licensee failed to update the Final Safety Analysis Report to reflect plant conditions. In both cases, these conditions existed for greater than six months prior to the previous update of the Final Safety Analysis Report .

In the fifth example, the NRC identified that Section 9.2.2.1 of the Final Safety Analysis Report stated that " based on design basis accident heat load, one of the following four conditions must be satisfied as a minimum to maintain the auxiliary saltwater system design basis." The NRC identified that " auxiliary saltwater system" should have read

" component cooling water system."

in the sixth example, the NRC identified that Section 6.2.3.5.3 of the Final Safety Analysis Report stated that two alarms were provided to announce that the spray additive tank solution had been exhausted. Based on control room annunciator layout l

i Drawing 500808 and the as-installed condition, only one alarm existed. Also, this alarm announced that the technical specification level of 60 percent in the spray additive tank had been reached,instead of being exhausted as stated in the Final Safety Analysis Report .

!

.

.

-25-I l

-

Insoection Followuo l

For the first example, the inspectors reviewed Action Request A0438253, dated August 8,1997, and determined that the licensee initiated this document to revise DCM S-17B to reflect the correct temperature classification described in Calculation M-784. In addition, the inspectors reviewed Action Request A0449058, dated December 1! 097, and found that this document was initiated to correct the temperature and pre sure classification in DCM S-178 for the auxiliary saltwater syste The licensee stated that the completion date for this task (Action Request A0449058)

was June 1,1998. In licensee Letter DCL-98-007 dated January 12,1998, the licensee stated that this condition was considered to be an isolated problem with no generic implications since the correct information regarding pressure and temperature classification was provided in DCM M-46, " Piping Pressures, Temperatures, and Operating Modes-Unit 1." After the inspection the licensee submitted supplemental information concerning this item. The licensee stated that the design criteria memoranda were developed to be used by personnel that understood their use and limitations. In addition, the licensee stated that their personnel understood that they needed to use the most specific information available, which might be !n the design criteria memorandum or in some other design basis document. In the case of pressure and temperature information, the licensee personnel were trained to use two generic design criteria memoranda which provided piping pressure and temperature. The inspectors agreed with the licensee's positio For the second example, the licensee determined that the addition of the auxiliary saltwater system pumps to the bases was not required. The licensee stated that when the technical specification bases listed the safety injection functions, it referred to them as examples of safety injection equipment that would actuate in response to a loss of coolant accident or main steam line break. The licensee stated that since the list was a list of examples, it *.vas not required to be all inclusive. The inspectors reviewed Final Safety Analysis Report Section 7.1.2.1.2.2 which discussed the requirements imposed on the safety injection signal by the design basis. The inspectors found that the ASW system pumps were included in the discussion in the Final Safety Analysis Report and noted that the technical specification bases and the Final Safety Analysis Report were identical with the exception of the exclusion of the ASW system pumps. The inspectors reviewed NUREG-1431, ' Standard Technical Specifications Westinghouse Plants," and determined that the bases for Technical Specification 3.3.2 included an example list of equipment started on a safety injection signal. The inspectors noted that the list in NUREG-1431 did not contain all of the equipment started by a safety injection signa Based on this information, the inspectors concluded that the licensee's technical specification bases was acceptable.

,

Concerning the third example, the inspectors reviewed Surveillance Test Procedure (STP) R-20, " Boric Acid Inventory," Revision 18, for the refueling water storage tank, and l

l found that the tank temperature measurement was included in the procedure. The l

I

.

E

,. , ]

l a

,

-26-

,

I inspectors reviewed License Amendment Request 94-06, dated August 17,1994, which j the licensee initiated to delete the minimum refueling water storage tank solution

! temperature and increase the allowed outage time of the refueling water storage tank for I

adjustment of boron concentration from 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. At this time, the licensee deleted reference to the tank temperature measurement from the technical specification bases. However, the NRC did not approve the deletion of the refueling water storage l tank temperature and in the NRC response letter to the amendment request, dated l April 14,1995, the NRC required the licensee to revise the bases submitted with the

,

amendment to retain reference to the temperature measurement. The licensee did not

'

revise the bases as stipulated in the NRC response letter, such that the refueling water

. storage tank temperature remained in the technical specification surveillance section, but not in the bases section in response to this issue, the licensee stated that information regarding the refueling water storage tank temperature was added to the technical specification bases of the improved technical specifications, which was f submitted to the NRC on June 2,1997. The inspectors determined that this action by the l licensee was sufficient to resolve this concer Regarding the fourth example, the inspectors reviewed Action Request A0441273, dated j

' August 7,1997, which was initiated by the licensee to revise the DCM S-12 to correctly 1

'

identify when containment spray would be initiated. The inspectors determined that the licensee had identified this discrepancy in advance of the NRC identification. The inspectors reviewed DCM S-12, and determined that the licensee appropriately revised this document to clarify that the containment spray system was initiated by a safety injection signal coincident with a high-high containment pressure signal. The inspectors determined that the licensee took adequate corrective actions to clarify the discrepanc The licensee's response letter stated that both the DCM and the Final Safety Analysis Report were revised to clearly identify the requirement of coincidental signals for the automatic actuation of the containment spray system. The inspectors reviewed Action l Request A0441540, dated August 12,1997, which was initiated to correct the Final Safety Analysis Report descriptions of containment spray initiation. The inspectors reviewed a Final Safety Analysis Report update change request dated August 25,1997, which revised Sections 6.2.2.2.2.1, and 6.2.3.2.1 and found that the licensee added that containment spray required both a high-high containment pressure signal and a safety injection signal in order to actuate. The inspectors noted that the licensee identified this

, discrepancy in the Final Safety Analysis Report while they were performing a design

! bases review of the Final Safety Analysis Report. The change to the Final Safety I

And /sis Report was needed only for clarification purposes; it did not represent an actual i

error in ti % document.

Concerning the F,fth example , the inspectors reviewed Action Request A0441163, dated August 6,1997, which the licensee initiated to correct Section 9.2.2.1 of the Final Safety Analysis Report. The licensee determined that the change was an editorial correction i

l L

F

.

.

-27-since it was a clarification only and was not considered to be a quality problem. This example of failure to maintain the accuracy of the Final Safety Analysis Report will be added to other examples of Final Safety Analysis Report discrepancies currently under NRC review as part of open Unresolved item 50-275;-323/9606-0 In the sixth example, the licensee stated in their response letter that they would revise Design Criteria Memorandum S-12 and the Final Safety Analysis Report to clarify the description of the spray additive tank alarms. The inspectors reviewed Action Request A0442941, dated September 3,1997, which was initiated by the licensee to revise Section 6.2.3.5.3 of the Final Safety Analysis Report to correct the statement that there were two alarms to announce that the spray additive tank was exhausted. In +'- .

action request, the licensee committed to a completion date February 27,1998. h l inspectors reviewed the Final Safety Analysis Report update change request, dated 1 December 3,1997, and found that Section 6.2.3.5.3 was revised to state that one alarm ?

was provided to announce when the solution in the tank dropped below a level approaching the Technical Specification minimum requirements. In addition, the l inspectors reviewed Action Request A0449235, dated December 15,1997, which the licensee initiated to correct the DCM S-12, " Containment Spray System." The DCM <

contained the same error as the Final Safety Analysis Report regarding the number of l alarms. The inspectors reviewed DCM S-12, Revision 7 and found that it was revised l

'

on February 2,1998, to include the corrections. This example of failure to maintain the accuracy of the Final Safety Analysis Report will be added to other examples of Final Safety Analysis Report discrepancies currently under NRC review as part of open Unresolved item 50-275;-323/9606-0 E8.17 (Closed) Unresolved item 50-275/97202-06: Availability of an Alternate Flowoath for the ASW System Suction Backaround The auxiliary saltwater (ASW) system was designed to draw water from the Pacific Ocean (the plant's ultimate heat sink (UHS)) through a common intake screen. This was described in Final Safety Analysis Report Section 9.2.7.2.3 as follows, "Each unit's pair of ASW pumps share a common traveling screen to remove floating debris from the incoming seawater. If the common screen for a unit becomes clogged with debris, seawater may be valved to the ASW pump bays from the unit's circulating water pump bays." This alternate flowpath from the circulating water pump bays was a 24-inch

"demusseling"line in each unit containing air-operated, fail as-is, butterfly valves. The NRC observed that the screens were not seismically qualified; therefore, if a screen failed as a result of a seismic event, flow could be restricted to the ASW pumps. They also observed that, although the valves in the alternate flowpath were being routinely exercised, contrary to the recommendations of Generic Letter (GL) 89-13, " Service Water

,

System Problems Affecting Safety-Related Equipment,"this alternate flow path was not i being tested or maintained to demonstrate its availability,

I.

i l"

} -28-l l

Insoection Follovtyp in their response letter to the NRC, DCL-98-007, dated January 12,1998, the licensee i

,

stated that the "demusseling" lines were r.ot a required redundant ASW flowpath, and therefore, they were not considered as required to be maintained or tested in accordance with their Generic Letter 98-13 Program. The licensee based their statement on the following: In a rc.Ww of the design basis of the demusseling flow paths, the licensee determined that the air-operated demusseling valves were Design Class ll, with no provisions in the design to ensure that the flow path could be placed in service under all plant conditions, including a seismic event. Therefore, since they were not fully qualified, this was not intendec as a licensing basis alternate flow pat l 1 Operators could take actions in case of loss of ASW pump suction to start the nonoperating pump or to utilize the opposite unit's standby pump through the unit i cross-tie valve. Specifically, Final Safety Analysis Report Section 9.2.7.3, under '

the subtopic " Safety Evaluation," stated, "The unit crosstie provides operating l flexibility in that it is possible to have the Unit 2 standby pump provide water to i Unit 1 in the event the Unit 1 standby pump is inoperable and vice versa." The licensee pointed out that while the above reference is in the " safety evaluation" section of the report, the reference to the circulating water pump bays in Section 9.2.7.2.3 is in a " system description" section of the report. This, according to the licensee, signified that the actual alternate flowpath was from unit crossties. Further, the licensee indicated that since the circulating water bays did not contain any Design Class 1 features, it was not intended as a redundant ASW system flowpat . The demusseling line was not considered a " cooling loop" as the term was used in Enclosure 1 of the Generic Letter 89-13, and as such was not required to be tested or maintaine The licensee further stated that it recognized the value of ensuring viability of the alternate flow path as demonstrated by the current performance of the periodic demusseling valve stroke tests. In addition, the licensee committed in letter DCL 98-007 to the NRC, dated January 20,1998, to inspect one of Unit 2's demusseling lines in Refueling Outage 2R8, to be completed by April 1998, and based on the results of this inspection, to further evaluate the need for periodic maintenance and testing by June 20, 1998. Following the onsite portion of this inspection, the licensee completed this inspection and found no fouling in this line. The licensee further stated that, since the water contained in this line was isolated from the external environment, no biofouling was expected to occur under any conditions.

l

C

\.

-29-l The inspectors determined that the licensee's position that the circulating water bays were not intended as the design basis alternate suction path for ASW was acceptabl However, several points of concern with the existing design of this system were identified, as discussed below.

l The licensee made the statement that operator actions could be taken in case of loss of ASW pump suction such as starting the second pump or opening the cross-tie valve to the opposite unit. However, it was evident from this statement that the fullimpact of a screen failure due to plugging or a seismic failure was not understood by the license The most significant impact would likely be the immediate release of the material plugging the screen into the flow path of both ASW divisions in that unit, causing an almost immediate plugging of the on-line CCW heat exchanger (s), causing a heat transfer function failure, even if no damage was caused to the pumps. Starting a second pump, if it was not already running, would only serve to plug the second heat exchanger if the screen had already collapsed or increase the differential pressure across the screen if it had not, further increasing the potential for collapse. Opening the cross-tie valve to the opposite unit, as suggested by the licensee, would only serve to exacerbate the plugging likely to be occurring on that screen (the two units' ASW screens are only a few feet apart). The only operator action that would likely reduce the potential for screen collapse due to plugging would be opening the alternate flow path from the circulating water bay. This would increase the screen flow area by a factor of seven, thereby potentially reducing the loading rate and the differential pressure by a factor of up to 49 (loading rate and differential pressure are functions of the flow velocity squared).

The ASW primary flow path was through a nonseismically qualified, nonsafety-related, nonClass 1E powered, traveling screen served by a similarly nonqualified screen wash system. Therefore, this segment of the ASW system did not meet the GDC requirements applicable to all other safety-related systems, including the balance of the ASW syste Though not an acceptable design by today's standards, this was typical of emergency service water systems licensed in many other plants of the same vintage. However, the single common intake screen design in this plant was not typical; most other plants had 1 separate intake screens for each train, which were verified clear as a result of their normal operation. The single screen design of this plant made it more vulnerable to screen failure than was typical and increased the probable consequences of such a failure, further indicating the specialimportance of maintaining and testing the alternate flow path in this plant. Additionally, the ultimate heat sink at Diablo Canyon is the Pacific Ocean, which cannot be maintained clear of debris to the same extent that 8 moting i

'

pond or other similar holding area can at many nuclear plants. Therefore, the probability of clogging both the primary and alternate intake flowpath screens was greate l

'

The inspectors noted that service water intake screen failures due to high differential pressure have been experienced at several plants. Additionally, plugging and screen failure had been experienced at this plant with the circulating water screens due to kelp buildup, although severe ASW screen plugging had not been experienced due to the l

i

. l

.

-30-l relatively low ASW flow velocities. However, this observation for normal operating conditions was not a valid basis for judging accident conditions, which could be significantly more severe as follows: The circulating water screen failures were experienced in spite of the screens and screen wash system being fully operational, providing an indication of the severity of the kelp presence at times. Under accident conditions, the ASW screens and screen wash system may not be operational due to loss of offsite power or their assumed failure, since they were non-safety-related, even if offsite power were available. Under these conditions, the buildup rate would be significantly highe l The relatively low debris buildup rate and differential pressure on the ASW l screens versus the circulating water screens postulated by the licensee was under nonaccident conditions when only one ASW pump was normally operatin ,

For accident conditions, with two ASW pumps running, the flow rate would I double, which could increase the debris buildup rate and differential pressure by j a factor of fou . The licensee stated that operator actions taken would be based on the operators'

observations of screen differential pressure, intake bay level, etc. However, for accident conditions, none of these indications would be available due to loss of instrument air to the bubbler tubes for these instruments, or could be providing false indication of low differential pressur . The licensee provided the various measures the operators could take to rotate the screens if power were lost to the drive motors. However, without coincident power restoration to the screen wash pumps, this would tend to bring the debris over the top of the screens, risking plugging of the CCW heat exchanger Additionally, the licensee did not recognize that after a certain level of debris buildup, the screens can no longer be rotated either by hand, by their normal motors, or by outside machinery without risk of damage due to the very high friction caused by the differential pressur The inspectors concluded that the design of the auxiliary saltwater system appeared to be vulnerable to common mode failure scenarios of more than negligible safety significance. The significance of these vulnerabilities may not have been fully appreciated during original design and licensing. This issue will be further reviewed by the NRC and was identified as an inspection followup item (50-275;-323/9805-01).

Because the licensee had met the licensing basis of the plant with regard to the alternate ASW suction path, this unresolved item was closed.

I

!

.

.

! -31-l l

l l

l E8.18 {Glosed) Unresolved item 50-275/97202-07: EDG Transient Analvsis Comouter Simulation Study l

Backaround

! Design Criterion Manual (DCM) S-21, " Diesel Engine System," Revision 6, stated that each diesel generator was designed such that at no time during a loading sequence will the frequency decrease to less than 95 percent of nominal frequency. This procedure also stated that the diesel generators were designed to ensure that frequency is restored

'

within 2 percent of nominal (60 hz) in less time than 40 percent of each load sequence lnterval. Regulatory Guide 1.9, " Selection, Design, and Qualification of Diesel-Generator Units Used as Standard Onsite Electrical Power Systems at Nuclear Power Plants,"

Revision 1, revised this time criteria to 60 percent, but the DCM did not reflect this new allowanc The NRC reviewed Calculation 215-DC, "EDG Loading Capability Study without KWS Relay," Revision 1, in which the diesel generator transient responses were analyze This analysis indicated that four of the licensee's six diesel generators could drop to 5 Hz during design basis loading, which was slightly under the 95 percent of nominal criteria (57 Hz). Also, one diesel generator was calculated to require 2.54 seconds at one point in the design basis load sequence to be restored to within 2 percent of nominal frequency, which was greater than the Regulatory Guide 1.9,60 percent criteria, for the 4-second loading interval (2.4 seconds). Despite the analytical anomalies, the integrated test of engineered safeguards and diesel generators, conducted on the diesels to monitor their performance, did not show any frequency dips below 57 hz or recovery times greater than 2.4 seconds. The disparity between test and analysis appeared to be the result of a slower than actual modelbg of the diesel generator governor response tim me licensee initiated Action Request A0444243 to evaluate current system capabilities, to resolve discrepancies in their commitment to emergency diesel generator response transient loading, and to revise Calculation 215-DC and DCM S-2 '

Insoection Followuo The licensee was in the process of revising DCM S-21 and Calculation 215-DC with 1 ,

i completion date of February 28,1998. The revision to DCM S-21 WFlincorporate the revised guidance in Regulatory Guide 1.9, Revision 1, allowing a frequency recovery time of 60 instead of 40 percent of the load sequence interval. The revision to Calculation 215-DC will not include a revision to the computer model or make any l

l,

e e

,

,

-32-I t

attempt to reduce the apparent over conservatism in the governor response times in the calculation. Instead, the calculation will include a discussion that will base compliance with Regulatory Guide 1.9 on a combination of the computer simulation and the

! integrated test results. Using this approach, the licensee was confident that they could l' adequately demonstrate that the criteria of Regulatory Guide 1.9 were me The licensee intended to submit a letter to the NRC by May 30,1998, documenting the basis for compliance with Regulatory Guide 1.9, Revision The inspectors reviewed diesel generator test data and observed that the frequency response of the diesel generators for design basis loading sequences was well within the guidelines of Regulatory Guide 1.9, Revision 1. Therefore a safety concern did not exist. The remaining questions involving conformance to the guidelines of Regulatory Guide 1.9 will be resolved as part of the NRC review of the May 30,1998 letter submitted to the NR E8.19 (Closed) Insoection Followuo 50-275/97202-08: Control of Calculations i

Backaround in review of Calculation 195C-DC," Evaluate Adequacy of the Existing Thermal Overload Setting for 460 V Continuous Duty Motors," Revision 4, the NRC identified a discrepancy in an exception note explaining why larger size thermal overload heaters had been selected. The note indicated that the lower size heate." were not selected because they did not meet design requirements. This statement was i.1 correct. The actual reason for selecting the larger size thermal overload heaters was to preclude spurious trips on motor starts when the associated pump or fan was rotating in the reverse direction. The licensee initiated Action Request AR A0443258 to correct the exception note in Calculation 195A-D The NRC noted that several design change notices (DCNs) providing as-built thermal overload settings were not updated in Calculation 195A-DC. The licensee initiated Action Request A0444411 to incorporate this information into the calculation.

l

,

The NRC identified a concern related to Procedure CF3.lD4, " Design Calculations,"

l Revision 2, in that calculations that are made obsolete by a change are not required to l be archived or made historical. This placed dependence on engineers to remember the calculational history. The NRC had difficulty determining the most current calculations l that supported the system design.

!

!

I'

i-

l*

[ -33-

!

i

'

The NRC identified that there was no periodic updating of large calculations to

! incorporate changes to limited scope calculations that affected the larger calculations.

! Also, the NRC identified that the revision dates of referenced industry standards were l inconsistent within lists provided in the Final Safety Analysis Report , technical l specifications, DCMs, calculations, and procedures. The licensee initiated AR A0444408 l- to address these concern .

, insoectior. Followuo l

'

The inspectors observed that the thermal overload heater sizing described in l

l {

l Calculation 195C-DC was correct from a functional point of view and that the only l concern involved the inaccurate explanation for the larger-than-typical sizinti of the heaters. This was being tracked for inclusion during the next revision of the calculation.

i '

l On January 28,1998, the licensee issued Revision 3 to Calculation 195C-DC, !n which

[ the noted DCNs and others were incorporated into the calculation. At the time of the

! aspection, the inspectors observed that the licensee did not have a procedural restriction

,

. on the amount of time to incorporate changes to a calculation. The changes were listed l

'

on a tracking action request that accompanied the calculation. Therefore, information l regarding the change was always available to a calculation user, although not in the I optimal ease-of-use presentation. In response to the inspectors observations, the l licensee agreed to modify procedures to require affected master calculations to be updated with changes no later than 120 days following each refueling outage. The

.

Inspectors considered this procedural change to adequately address the original issue.

L The inspectors reviewed the system used to identify superseded or outdated calculations and to prevent their use in quality activities. During the previous inspection, the design calculation index did not provide this information. However, if access were made to a superseded calculation, the copy obtained would be physically stamped as being superseded. Therefore, the system in place, though cumbersome, would have l

prevented the improper use of superseded design information. As a matter of l enhancement, the licensee decided to revise Procedure CF3.lD4 to require the design i calculation index to be revised on a point-of-use basis to show the status of calculations, l' including when they are placed in a superseded status. A second enhancement to Procedure CF3.lD4 was to include the tracking action request for master calculation updates in the design calculation index " remarks" field so that the user is alerted to the existence of a recently approved calculation not yet updated in the master calculatio Previous to this enhancement, this information was still available to the user in the

'

tracking action request that accompanied the master calculation. The inspectors considered that the placement of this information in the design calculation index made the system more user-friendly. The licensee planned to incorporate changes to j Procedure CF3.lD4 by May 31,199 j

.

I I

.

.

-34-I l

The inspectors reviewed the licensee's response to the NRC's identification of five industry standards that were inconsistently referenced in various plant documents with respect to their revision dates. The licensee was addressing this issue generically as part of a comprehensive review of electrical standards referenced in the DCMs and the Final Safety Analysis Report. Within this review, the licensee determined that the standards listed in the electrical DCMs were consistent. Electrical standards referenced by nonelectrical DCMs were sometimes inconsistent, but some of these discrepancies were explainable because they focused on what was applicable for the particular system or component and therefore were not intended to be comprehensive or to supersede references noted in the electrical DCMs . The licensee recognized a need to resolve any apparent inconsistencies in the references in the nonelectrical DCMs, and, at the time of this inspection, was preparing to begin this effort. The licensee's stated that by ensuring that the electrical DCMs referenced the correct versions of IEEE Standards, there was a I high degree of confidence that the basis for the application of any lEEE standard could be traced to its source. The types of discrepancies that existed generally involved various references to revisions from the 1970's, such as a 1974 revision versus a 1977 revision. The differences in the information presented within these revisions was expected to be negligible and to not cause a material concern with any previous design work. To date, in its review, the licensee had not identified any examples where an inaccurately referenced IEEE standard would have caused a quality concern, and, as a result, no action items had been written relative to this issue. The inspectors concluded I that the licensee's corrective actions were appropriat I The inspectors determined that the findings discussed above did not result in a safety .

related concern involving the licensee's calculation program. That is, the findings did not suggest that previous design changes or evaluations had been adversely affected by or based on inaccurate information. The licensee's' responses, resolutions, and proposed <

enhancements appeared to be a positive step in making improvements in the calculation i control proces l E8.20 (Closed) Insoection Followuo item 50-275:-323/97202-09: Review of Licensee's .

'

Evaluation of Batterv Charoer Settinas Backaround l l

The vital battery chargers were sized by Calculation 236-A-DC, " Unit 1 Battery Charger j Sizing Calculation for Battery Charger 11,12,121,131,and 132," Revision 1, which took credit for a maximum charger capability of 110 percent of the fullload rating of 400 amps (440 amps). In the Final Safety Analysis Report sections for the battery chargers, the chargers were set at sufficient capacity to carry loads up to 110 percent of its 400 ampere rating and were set to a current limit of 110 percent of rated output curren However, the NRC noted that Maintenance Procedure MP E-67.3A," Routine Preventive Maintenance of Batteries," set the current limit to 430 amps (107.5 percent of full load amps). The NRC determined that at the setting of 107.5 percent, the battery charger had

,

.

l

'

I e-35-I adequate capability to supply the DC loads for analyzed accident scenarios. However, the NRC found that the 107.5 percent battery charger setting was not in agreement with calculation assumption The NRC determined that the battery float voltage setting was 135 volts plus control tolerances which would sllow it to be as high as 135.9 volts. The battery vendor manual specified a nominal float voltage of 2.20 to 2.25 volts per cell, which was 132 to 135 volts for the 60-cell vital batteries. The NRC identified that the use of a potentially higher battery float voltage (135.9 volts) than that specified by the vendor (135 volts maximum) l could result in the baking of normally energized de coils. This could shorten the usable life of the equipmen The NRC found that the licensee selected a nominal equalize voltage of 138 volts. The vendor recommended an equalizing charge range of 139.8 to 142.8 volts for 60 cell j The NRC noted that setting the equalize level at 138 volts had no serious consequences I

'

except to reduce the effectiveness of the eque.lizatio insoection Followuo The inspectors reviewed the licensee's response to the inspection findings transmitted in i

'

Letter DCL-98-007 to the NRC, dated January 12,1998. The licensee stated that the purpose of Calculation 236A-DC, Revision 1, was to establish that the sizing of the battery chargers was adequate to supply the existing DC connected loads and recharge the battery within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The licensee stated that the conclusions of the calculation, which specified the maximum battery charger load as 316 amps, meant that the nominal setting of 430 amps in Maintenance Procedure E-67.3A was acceptable by a large i margin. In addition, the licensee stated that the Final Safety Analysis Report statements l were meant to describe battery charger capacity ratings, but noted that these statements could be inferred to be specified settings. The licensee stated that they would review and clarify these statements in the Final Safety Analysis Report by April 1,199 The inspectors reviewed Calculation 236A-DC and verified that the maximum charger load was 316 amps. The inspectors determined that the battery chargers were operable since the maximum charger load of 316 amps was less than the nominal setting of 430 amps specified in the maintenance procedur The licensee agreed that if the battery float voltage was too high it could tend to bake normally energized de coils. However, the licensee stated that the advantage of reducing the number of equalization cycles outweighed the negligible effect of the small 0.9 V difference between the maximum set voltage and the maximum value of the manufacturers range. The licensee stated that operating experience showed that neither battery life nor capacity was affected by operation with the existing float voltage. In i j addition, the licensee had not noted an excessive number of de coils failing. The

! inspectors reviewed Action Request A0444410, dated September 25,1997, which was

I.

i o-36- I

,

initiated in response to this inspection finding. As part of the corrective actions, the

'

licensee revised the weekly surveillance test procedure to tighten the float voltage tolerance from 135 +/- 0.9 V to 135 +/- 0.5 V. The inspectors reviewed Surveillance Test Procedure STP M-11 A, " Measurement of Station Battery Pilot Cell Voltage and Specific Gravity," Revision 12, and verified that the tolerance band of the float voltage was revised to 135 +/- 0.5 V. The inspectors determined that the voltage setting was acceptabl ;

The licensee stated in their response letter that operating experience had shown that the charger equalizing voltage field setting of 138 V was adequate to restore the battery to normal parameters, despite being below the recommended range. The inspectors l reviewed Surveillance Test Procedure Basis Document B-STP M 11B, " Basis Document for STP M-11B Measurement of Station Battery Voltage and Specific Gravity,

" Revision 0, which contained the basis for the field setting, and concurred with the licensees conclusions. The licensee stated that the normal equalizing field setting of 138 Vdc would not be revised. The inspectors considered the licensee's decision to be acceptabl l E8.21 (Ocen) Unresolved item 50-275/97202-10: Potential USQ and Technical Soecification Adherence Associated With Containment Sorav Durino Containment Recirculation Backoround in 1991, the licensee discovered that, in an accident, the maximum heat load, and hence the maximum temperature, in the CCW system would occur during the recirculation phase rather than the injection phase. Titis was due primarily to the higher combination of heat loads from the residual heat removal system and the containment fan coolers during this phase as opposed to just the containment fan coolers heat load during the injection phase. This had the potential to cause CCW temperature to exceed its design limits of 120'F for continuous operation and 132*F for up to 20 minutes. On January 17, 1992, Licensee Event Report (LER) 1-91-018 was issued to document this discover Corrective actions included revising Emergency Operating Procedure E-1.3, " Transfer to Cold Leg Recirculation," Revision 13, to include steps to assure maximum heat transfer to the UHS (two ASW pump /two CCW heat exchangers), and if this configuration could not be established by the time of realignment for cold-leg recirculation to assure that only one residual heat removal system pump was left in service providing reactor coolant system (RCS) injection. Containment spray from residural'ieat removal was to be j terminated during this phase for this condition. Corrective actions also included changing the Final Safety Analysis Report to reclassify recirculation spray as nonsafety relate . l l

!-

l l In reviewing this issue, the licensee also discovered that, for a single failure that would l incapacitate one of the residual heat removal pumps, the same condition of not having l recirculation spray through residual heat removal would exist. However, this discovery I

was not included in LER 1-91-018, and it was never formally reported to the NRC in any other manne The licensee's review determined that operation without residual heat removal recirculation spray was technically acceptable because: There were no increases in offsite or control room doses since iodine was j completely removed from the containment atmosphere by the containment spray I system during the injection phas {

) Peak containment pressure was reached during the injection phase, and long- j term pressure was maintained by the containment fan coolers without the use of recirculation spra . Although the long-term temperature / pressure profiles were altered without recirculation spray, they were stiil enveloped by the profiles used for environmental qualification of equipment in the containmen . Containment sump pH was not affected since all of the NaOH in the spray additive tank was injected into the containment by the containment spray system during the injection phas . Long-term hydrogen mixing was completely accomplished by the containment fan coolers, and therefore there was no dependence on recirculation spray to achieve this mixin However, this mode of post accident operation was contrary to the Final Safety Analysis Report at that time. Final Safety Analysis Report, Section 6.2.3.2.1, stated, "During the recirculation phase following a postulated LOCA, containment spray water is provided by recirculation of water from the containment sump through the residual heat removal pumps and piping that connects the residual heat removal pump discharge to the containment spray header . . . This mode of operation will be continued for a period of at least 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following the accident to continue iodine removal from the containment atmosphere." In their corrective actions, the licensee intended to eliminate this Final l Safety Analysis Report requirement for recirculation spray for 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> ]

I In issuing Revision 9 of Emergency Operating Procedure E-1.3 to address this discovery, the licensee's screening process incorrectly determined that a 10 CFR 50.59 safety evaluation was not required. However, a subsequent safety evaluation performed by I Westinghouse determined that the emergency operating procedure revision did not j L <

involve an unreviewed safety question (USQ).

i l

!

l

. )

l-  !

-38-1 (

l l

l 1

'

l At the time of discovery, the licensee considered one residual heat removal pump

!

insufficient to provide both the RCS injection and recirculation spray functions, although there was no calculation to support that conclusion. However, during the previous

,

inspection (the inspection during which this item was identified), the licensee performed l Calculation STA-075, " Minimum ECCS Flow and Minimum Recirculation Spray Header Flow," Revision 0, which demonstrated that one residual heat removal pump could perform both functions if RCS injection flow was reduced. This would require operator action to throttle the residual heat removal injection valves. This reduced R.C.S. Injection flow had been demonstrated as acceptable by Westinghouse analysis NSAL 95-001, dated January 20,1995, " Minimum Cold Leg Recirculation Flow - ECCS Analysis."

Additionally, during the previous inspection, because of NRC concems, the licensee !

prepared a new consolidated safety evaluation. This safety evaluation again concluded that none of the changes that had been made constituted a US {

At the conclusion of the previous inspection, the NRC team concluded the following: j l The licensee incorrectly performed the 10 CFR 50.59 safety evaluation screening l of Revision 9 to Emergency Operating Procedure E-1.3, and as a result, had not f performed a safety evaluation as required by 10 CFR 50.5 . Although a safety evaluation had subsequently been performed by Westinghouse, it incorrectly concluded that this change and the Final Safety Analysis Report change to eliminate the 2-hour recirculation spray requirement were not a US . The new safety evaluation also incorrectly concluded that the changes did not involve a US Insoection Followuo i

The licensee responded to the NRC's concerns in a letter to the NRC, DCL-98-007, dated January 12,1998. In this letter they stated again that they considered their actions appropriate, and that the emergency operating procedure and Final Safety Analysis Report changes that were made as a result of this discovery had not involved a US The following reasons were given for their conclusion: The containment spray (CS) function during the recirculation phase was not required for CS operability by either the licensing or design base . The technical specification requirement to demonstrate the capability to spray containment using the residual heat removal system involved only demonstrating that the valves connecting the residual heat removal system to the containment spray rings could be opene I

i

?,

l h

!

-39- The 10 CFR 50.59 safety evaluation screening on the emergency operating procedure change was performed with the knowledge that the outcome of the operability evaluation performed found the affected systems to be operabl However, it was acknowledged that recent NRC guidance would lead a reviewer j to conclude that a safety evaluation would have been require l The licensee also prepared a " white paper" entitled, " Containment Spray in Post-LOCA l

Recirculation - Licensing and Design Basis History at the Diablo Canyon Nuclear Power 1 Plant," Revision 1, October 7,1997, and the above-described new 10 CFR 50.59 safety l evaluation in which they documented the bases for their conclusions that the changes did not involve a US l The licensee conceded that several errors and omissions occurred during the revision l and review processes for the emergency operating procedures, Final Safety Analysis l Report, and other documents. While these documents were being corrected, the l licensee still concluded that their original evaluation, that these changes involved no ,

USQ, was still vali The licensee also maintained that the limitations on the use of recirculation spray with only one residual heat removal pump available were not addressed in the Final Safety l Analysis Report because the accident analysis in Section 6.2C.4.2 of the Final Safety Analysis Report stated that no credit was taken for recirculation spra The inspectors reviewed all of these documents, as well as the specific requirements of 10 CFR 50.59 in light of current NRC practice and interpretations. The inspectors found that the original 10 CFR 50.59 safety evaluation screening for the emergency operating procedure change erroneously concluded that a safety evaluation was not require However, in view of the relatively early date of that screening, the fact that a safety evaluation was performed by Westinghouse shortly after the procedure was issued, and the licensee's acknowledgment of that error and recognition that in today's environment a safety evaluation would be required, the inspectors did not consider this to be a significant concer The inspectors considered that one provision of 10 CFR 50.59 had apparently not been correctly evaluated. This provision stated that "A proposed change...shall be deemed to involve an unreviewed safety question . . . (ii)if a possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created. . . " For certain single failures, with the procedural guidance that then existed, residual heat removal recirculation spray would not have functioned as described in Final Safety Analysis Report Section 6.2.3.2.1. This discovery constituted a l

" defacto " change to the facility as described in the safety analysis report. This change t

also created, and, in fact, was, a malfunction (failure of the residual heat removal system i

to provide recirculation spray) of a different type than any evaluated previously in the Final Safety Analysis Report. That is, the Final Safety Analysis Report had not .

-40-previously evaluated the possibility of malfunction of recirculation spray through the residual heat removal system. Although calculations existed that showed that recirculation spray was not required, the inspectors concluded that this was not relevant to the USQ questio This issue will remain open pending further review by the NR l

Conclusions The discovery of a design vulnerability that could result in loss of containment spray during the recirculation phase (of a loss of coolant accident recovery) appeared to constitute an unreviewed safety question. This unresolved item was left open pending 1 additional review by the NRC .

,

I

V. Manaaement Meetinas XI Exit Meeting Summary The inspectors presented the inspection results to members of licensee management by telephone on March 18,1998. The licensee acknowledged the findings presente The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary. The licensee stated that some information reviewed by the inspectors was proprietary. This information was not discussed in the repor :e 1 l

'*

l ATTACHMENT l

'

SUPPLEMENTAL INFORMATION PARTIAL LIST OF PERSONS CONTACTED l Licensee S. Ketelsen, Supervisor, Licensing l D. Brosnan, Supervisor, Licensing l B. Waltos, Assistant Manager, Engineering J. Kelly, Engineer B. McCoy, Senior Engineer B. Powers, Vice President and Plant Manager R. Klimczak, Supervisor, Nuclear Technical Services J. Shoulders, Director, Nuclear Technical Services T. Fetterman, Director, Instrumentation and Control / Electrical, Nuclear Technical Services D. Vosburg, Director, Nuclear Safety Systems / Structures, Nuclear Technical Services MB_G D. Allen, Resident inspector D. Proulx, Senior Resident Inspector INSPECTION PROCEDURES USED 92903 Followup-Engineering ITEMS OPENED, CLOSED, AND DISCUSSED Ooened 50-275;323/9805-01 IFl ASW System Suction Vulnerability to Single Failure Closed 50-275/9517-01 IFl Design of the 4kV to 480V Safety Related Transformer 50-323/9613-01 VIO Failure to Have Adequate Fire Protection Material Control 50-275/9613-02 IFl Adequacy of the Operability-ASW Buried Piping 50-275;-323/9623-07 VIO PSRC did not Review Safety Evaluations as Rec,uired by TS 50-323/9624-03 VIO Failure to Perform 50.59 Evaluation Prior to Changing U2

,

Trip Set Point l

r e

.

.

.

l -2-l 50-275/9703-03 VIO Failure to Take Adequate Corrective Actions Water in the l

Turbine 50-275;323/9717-01 VIO Failure of FP- Correct the Lack of Smoke Detector Sensitivity Testing 50 275;-323/9717-02 VIO Failure to Control Transient Combustible Materials 50-275/96-013-01 LER MSSV Set Outside TS 3.7. /96-007-01 LER TS 3.7.1.1 Not Met- High MSSV Lift Points l 50 275/9612-01 DEV History of Diablo MSSVS i 50 275/97202-01 IFl Review UHS Calc for Max UHS Temp Plant Operating j Without Exceeding ASW DSN 1 50-275/97202-02 IFl Review Rev to WCAP 14282 50-275/97202-05 URI Discrepancy in Design Documentation 50-275/97202-06 URI Availability of Alternate Flowpath for the ASW System Suction 50-275/97202-07 URI EDG Transient Analysis Computer Simulation Study 50-275/97202-08 IFl Control of Calculations 50-275/97202-09 IFl Review of Battery Charger Settings Discussed 50-275/97202-03 URI Determine if Long-Term Post-LOCA Operation of ASW with Trains Tied is USQ 50 275/97202-04 IFl ASME Section XI Testing of ASW Pumps 50-275/97202-10 URI Potential USQ and TS Adherence Associated With Containment Spray l

l l

l

L

.' a fa I -3-l LIST OF ACRONYMS USED AFW Auxiliary Feedwater System DCN Design Change Notice LBIE Licensing Basis impact Evaluation LER Licensee Event Report NFPA National Fire Protection Association PSRC Plant Staff Review Committee SER Safety Evaluation Report TSI Technical Specification Interpretation USQ Unreviewed Safety Question CS Containment Spray ASW Auxiliary Saltwater LOCA Loss of Coolant Accident LOOP Loss of Offsite Power RCS Reactor Coolant System LDBAP Licensing and Design Basis Alignment Program ITS Improved Technical Specifications CCW Component Cooling Water l