IR 05000275/1999010
| ML16342C131 | |
| Person / Time | |
|---|---|
| Site: | Diablo Canyon  |
| Issue date: | 07/30/1999 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML16342A876 | List: |
| References | |
| 50-275-99-10, 50-323-99-10, NUDOCS 9908060053 | |
| Download: ML16342C131 (56) | |
Text
ENCLOSURE U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
Docket Nos.:
License Nos.:
Report No.:
Licensee:
Facility:
Location:
Dates:
Inspectors:
Approved By:
50-275 50-323 DPR-80 DPR-82 50-275/99-10 50-323/99-10 Pacific Gas and Electric Company Diablo Canyon Nuclear Power Plant, Units 1 and 2 7 '/2 miles NW of Avila Beach Avila Beach, California May 29 through July 10, 1999 D. L. Proulx, Senior Resident Inspector D. G. Acker, Resident Inspector J. A. Sloan, Senior Resident Inspector, San Onofre G. A. Pick, Senior Project Engineer L. J. Smith, Chief, Project Branch E ATTACHMENT:
Supplemental Information 9908060053 99'0730 PDR ADOCK 05000275
EXECUTIVE SUMMARY Diablo Canyon Nuclear Power Plant, Units 1 and 2 NRC Inspection Report Nos. 50-275/99-10; 50-323/99-10 This inspection included aspects of licensee operations, maintenance, engineering, and plant support.
The report documents inspection performed during a 6-week period by the resident inspectors.
~Oerations
~
Because of successful licensee efforts to reduce control room deficiencies, both units operated with a "black board" {i.e., no illuminated annunciators) for most of this inspection period (Section 02.1).
Operations, Technical Maintenance, and Engineering personnel misunderstood the actuation logic for the containment high-high pressure trip and incorrectly assumed that, considering the specific hardware failure, bypassing a failed channel was not possible.
Instead, operators placed the channel in trip during corrective maintenance, making the containment spray system more vulnerable to a spurious actuation (Section 04.1).
Action 17 for Technical Specification 3.3.2 was nonconservative because it did not specify a required time for placing a failed containment high-high pressure channel in bypass.
The licensee planned to correct this specification to include a required time frame for completing this action (Section 04.1).
Maintenance
~
An unclear procedure for sy'tem restoration resulted in a risk-significant component (a diesel fuel oil transfer pump) being out of service for approximately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> longer than necessary for routine maintenance.
However, the licensee adequately considered risk in scheduling the activity and performed the maintenance and retest well {Section M1.3).
~
The licensee had adequately evaluated and controlled the risk associated with concurrent on-line maintenance of Diesel Engine Generator 1-3 and the associated 4160 volt Vital Bus F undervoltage relays (Section M1.4).
~En ineerin
~
Two failures to take appropriate actions to identify the cause and preclude repetition of the August 31, 1998, slow start of Diesel Engine Generator 1-1 were identified as examples of a noncited violation of 10 CFR Part 50, Appendix B, Criterion XVI,
"Corrective Action," in accordance with Appendix C of the NRC Enforcement Policy.
Operators did not adequately document the symptoms associated with the slow start.
Similarly, system engineers did not contact the operators who had observed the slow start. Significant information that could have aided Engineering personnel in determining the cause of the slow start of Diesel Engine Generator 1-1 was not obtained from the operators until asked for by the inspectors.
In addition, the licensee failed to test Diesel Engine Generator 1-1 within 1 week, as specified in Action Request A0467444 and, as a result, did not promptly correct the underlying deficiency,
-2-a loose wire.
These issues resulted in Diesel Engine Generator 1-1 being in a degraded condition for 18 days. This violation was placed in the licensee's corrective action program as Action Request A0478728 (Section M8.1).
Prior to 1991, Emergency Operating Procedure E-1.3, "Transfer to Cold Leg Recirculation," was inadequate to ensure initiation of containment spray during cold leg recirculation in violation of Technical Specification 6.8.1.a.
This Severity Level IV violation is being treated as a noncited violation, consistent with Appendix C of the Enforcement Policy. Even though the licensee later demonstrated that core cooling could have been maintained and that containment spray was not needed, the inadequate procedure could have complicated recovery actions.
This violation is documented in the licensee's corrective action program as Nonconformance Report N0002050 (Section E8:1).
r A noncited violation of Technical Specification 6.8.1.a, in accordance with Appendix C of the Enforcement Policy, was identified because the licensee failed to establish an appropriate frequency for preventive maintenance of safety-related expansion joints.
This violation is in the licensee's corrective action program in Action Request A0472447 (Section E8.2).
Plant Su ort Housekeeping was excellent throughout safety-related areas (Section 02.1).
With the exception of a degraded high radiation area boundary, routine radiation protection controls were well performed (Section R1.1).
Because of improper calibr'ation, the control room indication for the plant vent noble gas radiation monitors was nonconservative from 1993 to 1998 in violation of Technical Specification 6.8.4.g program limits for noble gas release rates.
This licensee-identified Severity Level IVviolation is being treated as a noncited violation, consistent with Appendix C of the Enforcement Policy. Actual counts from the associated detectors, which would be used to calculate release information during a declared emergency, were correct. This violation is in the licensee's corrective action program in Nonconformance Report N0002063 (Section R8.1).
Re ort Details Summar of Plant Status Units 1 and 2 operated at essentially 100 percent power throughout this inspection period.
I. ~Oeratione
Conduct of Operations 01.1 General Comments 71707 The inspectors visited the control room and toured the plant on a frequent basis when on site, including periodic backshift inspections.
In general, the performance of plant operators reflected a focus on safety.
Operator performance was generally characterized by self-and peer-checking.
The utilization of three-way communications continued to improve, and operator responses to alarms were observed to be prompt and appropriate to the circumstances.
Operational Status of Facilities and Equipment 02.1 Plant Materiel Condition a.
General Comments 71707 During routine plant tours, the inspectors observed overall plant materiel condition and housekeeping.
Except for minor items such as loose ladders and tools that were reported to the shift supervisor and immediately corrected, housekeeping was excellent throughout safety-related areas.
Because of successful licensee efforts to reduce control room deficiencies, both units operated with a "black board" (i.e., no illuminated annunciators) for most of this inspection period.
Operator Knowledge and Performance 04.1 Res onsetoSolidStateProtection S stem SSPS Failures a.
lns ection Sco e 71707 The inspectors reviewed operator response to failure of a portion of the SSPS.
This inspection included personal observation, interviews, and review of documentatio ~
b.1 Observations and Findin s Licensee Res onse-2-On June 16, 1999, at 7:09 a.m., Annunciator PK-06, "PPS Channel Set Failure,"
alarmed.
Operators entered annunciator response Procedure OP AP-5, "Malfunction of Protection or Control Channel," Revision 14, to identify and correct the failure. Upon examination of the SSPS parameters in the Eagle 21 system, the operators determined that Protection Set 4, Rack 16, was the affected portion of the system that failed. The functions affected were one channel of steam generator level, steam generator pressure, containment high pressure, and containment high-high pressure.
Following identification of the failed protection functions, operators reviewed the Technical Specifications {TS) for each of the affected functions. TS 3.3.1, "Reactor Trip System Instrumentation," Actions 6 and 27, were applicable for steam generator level and required the licensee to place the channel in trip within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. 'In addition, TS 3.3.2, "Engineered Safety Features Actuation System Instrumentation," Actions 20 and 29, were applicable for steam generator level, steam generator pressure, and containment pressure high. Actions 20 and 29 of this TS also required placing the channel in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
Action 17 applied for containment high-high pressure {which provided a signal input to the main steam isolation and containment spray logic) and required that the channel be placed in bypass.
TS 3.3.2, Action 17, provided no time limitto perform the action.
Operators then noted that the channels associated with steam generator level, steam generator pressure, and containment high pressure bistables were in the tripped condition because of the card failure in Protection Set 4, Rack 16. However, the bistables associated with the containment high-high pressure were not tripped.
Operators incorrectly believed at this time that a problem existed with the containment high-high pressure channel because this channel did not trip as well.
Operators contacted Technical Maintenance personnel to troubleshoot the failed equipment.
Technical Maintenance isolated the problem to a failed loop calculation processor card in Protection Set 4, Rack 16. This card failure removed the capability of the affected channels to properly process the analog input signals from the transmitters as well as send signals to the SSPS to trip the associated bistables.
Engineering personnel were consulted to provide further direction on repair of the system.
At'12:49 p.m., prior to the expiration of the associated 6-hour TS time limitation, operators authorized taking each of the affected channels to the tripped condition. The channels for steam generator pressure, steam generator level, and containment high pressure were appropriately taken to the tripped condition.
Procedure OP AP-5, Step 8, required that the affected channels be removed from service prior to performing maintenance.
Procedure OP AP-5 referenced Surveillance Test Procedure (STP) l-12-P934, "Containment Pressure Channel PT-934 Calibration,"
Revision 3, for the details for removing the containment high-high pressure channel from service.
Because the containment high-high pressure channel did not automatically go to bypass upon card failure, licensee personnel incorrectly assumed
-3-that the failed loop calculation processor card prevented the software-enabled channel bypass.
However, because STP I-12-P934 contained instructions for how to take the containment high-high pressure channel to either bypass or tripped condition to perform noncalibration activities, licensee personnel considered taking the channel to trip as a procedurally accepted alternative for removing the channel from service.
Procedure OP AP-5, Step 10, required that the inoperable containment high-high pressure channel be place in the TS required condition, which was the bypass position.
However, because of the incorrect assumption that the containment high-high pressure channel could not be bypassed, operators believed that they could not comply with this step, and left the channel in trip during repairs.
Engineering and Regulatory Services personnel approved of this course of action.
At 3:39 p.m., Technical Maintenance personnel completed replacement of the loop calculation processor card for Protection Set 4, Rack 16. Each affected channel of SSPS was returned to normal, and TSs 3.3.1 and 3.3.2 were exited. The licensee initiated Action Request (AR) A0486655 to enter this item into the corrective action program.
b.2 Ins ector Followu At 4 p.m. on June 16, the licensee briefed the inspectors on the actions taken in response to the loss of the four SSPS channels described above.
Operations personnel stated that they had to take the containment high-high pressure system to the tripped condition rather than bypass, because the system design caused the channel to be automatically tripped on loss of power, and that the system could not be physically taken to bypass upon the card failure.
The inspectors disagreed with the licensee's assessment of the system response to the card failure. The inspectors noted that the basis for Improved TS 3.3.2 stated that the containment high-high pressure function bistables required energization to trip.
Therefore, a loss of power would not trip the channel.
The basis for Improved TS 3.3.2 also stated that this channel was designed to require energization of the bistables to trip the channel so that a loss of power to the channel would not result in an inadvertent containment spray during power operations, which could result in the grounding of multiple pieces of equipment and undesirable consequences.
In addition, the basis for Improved TS 3.3.2 stated that the action for loss of a containment high-high pressure channel was to take the channel to bypass rather than trip to preclude an inadvertent containment spray. Although the improved TSs have been approved, implementation is not planned to take place for several months.
The inspectors determined that the containment high-high pressure channel performed as expected upon loss of the loop calculation processor card in Protection Set 4, Rack 16, by not automatically going to trip or bypass upon loss of the channel.
In response to the inspectors'oncern, on June 17 the licensee duplicated the failure of the loop calculation processor card for Protection Set 4, Rack 16, on the simulator. The system responded as required for the containment high-high pressure channel by not going automatically to bypass or trip. The technicians performing the simulation then C
-4-successfully bypassed the failed channel using the man-ntachine interface.
Licensee engineers performed further research of the design of the system and noted that the trip and bypass functions were not affected by the loss of the loop calculation processor card, as previously assumed.
Because TS 3.3.2, Action 17, did not specify a time limitfor placing the containment high-high pressure channel in bypass, failure of the licensee to perform this action per Procedure OP. AP-5, Step 10, was not a violation of the TSs.
However, the inspectors considered the lack of a time limit to be a weakness in the licensee's current TSs. The licensee plans to implement improved TSs in May 2000. The improved TSs have a 6-liour.limitingcondition for operation for placing a failed containment high-high pressure in bypass.
Licensee personnel stated that they planned to implement a TS interpretation for the current TSs within a month that willspecify that the allowed time for putting this channel in bypass is 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
The inspectors considered this action acceptable for addressing a nonconservative TS.
Conclusions Operations, Technical Maintenance, and Engineering personnel misunderstood the actuation logic for the containment high-high pressure trip and incorrectly assumed that, considering the specific hardware failure, bypassing a failed channel was not possible.
TS 3.3.2 required the failed channel be placed in bypass but did not specify a required time for this action. Instead, operators placed the channel in trip during corrective maintenance, making the containment spray system more vulnerable to spurious actuation.
Action 17 for Technical Specification 3.3.2 was nonconservative because it did not specify a required time for placing a failed containment high-high pressure channel in bypass.
The licensee plans to correct this specification to include a required time frame for completing this action.
I II. Maintenance Conduct of Maintenance General Comments on Maintenance Activities Ins ection Sco e 62707 The inspectors observed all or portions of work activities covered by the followingwork orders:
Work Order
~Deecri ttcn C01 60594 R0185495 Revise second level undervoltage relay setpoints Perform Procedure MP E-50.10B, "General Electric Type lAV55C Undervoltage Relay Maintenance," Revision 11
-5-C01 59450 R1 84444-01 Replace radiator on security diesel generator engine Replace filter element and clean strainers for Diesel Fuel Oil Transfer Pump 0-1 b.
Observations and Findin s The inspectors observed that the listed maintenance activities were adequately performed, except as discussed in Section M1.3 for the diesel fuel oil pump work.
M1.2 Surveillance Observations a.
Ins ection Sco e 61726 The inspectors observed performance of all or portions of the following surveillance tests:
Procedure STP I-36-SIR02 STP M-75 STP M-89B STP I-12-P935 STP P-DFO-01 Title Protection Set 1, Rack 2 Channels Operational Test, Revision 3 4KV Vital Bus Undervoltage Relay Calibration, Revision 21 Venting Residual Heat Removal to Safety Injection Pump Piping in Modes 1-4 Containment Pressure Channel PT-935 Calibration, Revision 3 Routine Surveillance Test of Diesel Fuel Oil Transfer Pump 0-1, Revision
b.
Observations and Findin s The inspectors observed that the listed surveillances were adequately performed.
See Section M1.4 for a specific discussion of Procedure STP M-75.
M1.3 Diesel Fuel Oil Transfer Pum Maintenance a.
Ins ection Sco e 61726 62707 The inspectors observed portions of the postmaintenance restoration and surveillance testing for Diesel Fuel Oil Transfer Pump 0-1 and discussed aspects of the maintenance activity with personnel performing the work. The inspectors also reviewed Procedure STP P-DFO-01, "Routine Surveillance Test of Diesel Fuel Oil Transfer Pump 0-1,"
Revision 1, the risk assessment checklists for removing Pump 0-1 from service, and portions of the Independent Plant Examination submitta Observations and Findin s Each of the two fuel oil transfer pumps and associated filters and strainers were located in separate confined spaces that required Security presence to open.
The licensee procedure for fillingand venting the system required operators to align a cross-connect valve to support fillingand venting the system.
However, this procedure also had instructions that appeared to require that Engineering personnel concur with this action.
The licensee decided that this concurrence to a routine procedure was not required and initiated action to have the procedure changed.
Consequently, a delay of approximately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> resulted from having to wait for the procedure change and then arrange for confined space venting, testing, and Security presence to enter the second pump vault to complete system restoration.
TS 3.8.1.1.g allows one diesel fuel oil transfer pump to be out of service for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, and Pump 0-1 was declared operable within approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
However, the Individual Plant Examination report, in Table 3 4.2-6, "Risk Achievement Worth Ranking of Nonguaranteed Failure Event Tree Split Fractions," listed the failure of the diesel generator fuel oil transfer system with loss of offsite power as having the highest risk achievement worth of all plant systems.
Loss of offsite power was also listed in the report as being the largest contributor to the core damage frequency.
Based on this importance, minimizing unnecessary out-of-service time for the fuel oil transfer pumps would contribute to lowering the core damage frequence for both Units 1 and 2. The licensee's work schedule indicated that the filter replacement and postmaintenance test were risk significant, requiring up to two work shifts per day to ensure that the tasks were expeditiously completed.
Additionally, the risk assessment checklists for the activity documented that other scheduled activities were considered in determining that the risk of performing the activity was acceptable.
Operators performing the restoration of the system and the postmaintenance surveillance test closely followed the procedure and carefully performed the task. A control operator supervised the activity locally.
Conclusions An unclear procedure for system restoration resulted in a risk-significant component (a diesel fuel oil transfer pump) being out of service for approximately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> longer than necessary for routine maintenance.
However, the licensee adequately considered risk in scheduling the activity and performed the maintenance and retest well.
Concurrent Performance of Procedure STP M-75 and Diesel En ine Generator DEG 1-3 Maintenance Unit 1 Ins ection Sco e 61726 62707 The inspectors observed the maintenance and surveillance activities and reviewed the licensee's evaluation of the risks associated with concurrent performance of the two activitie ~
b.1 Observations and Findin s
~Back round-7-The inspectors determined that the licensee had scheduled and evaluated the concurrent performance of Procedure STP M-75 along with routine preventive maintenance activities on DEG 1-3. Procedure STP M-75 required removal, calibration, and in-place functional testing of the 4160 volt Vital Bus F undervoltage relays.
'EG 1-3 provided emergency power to 4160 volt Vital Bus F. The bus undervoltage relays had a number of functions, including the transfer of Vital Bus F power from the unit auxiliary to startup power and starting DEG 1-3.
In addition, these relays provided a permissive signal to allow connecting DEG 1-3 to Vital Bus F when unit auxiliary and startup power were not available.
Therefore, the licensee removed DEG 1-3 from service during relay testing to prevent an inadvertent start and loading onto the bus.
The TSs required the periodic testing of the vital bus undervoltage relays. This surveillance test had been performed during the refueling outages (18-month fuel cycle).
However, when the units went to 21-to 24-month fuel cycles, the licensee was unable to demonstrate that the undervoltage relays would remain within their design tolerances during this longer period. The licensee decided to test the undervoltage relays, in power operation, at a frequency of at least once every 18 months. The performance of this surveillance test affected only the selected vital bus and the associated DEG and was performed at different times on the other two vital buses.
In order to prevent an inadvertent start of DEG 1-3, Procedure STP M-75 required DEG 1-3 be placed in manual, making DEG 1-3 inoperable.
In addition, since removal of the undervoltage relays precluded the automatic transfer of Vital Bus F to startup power upon loss of unit auxiliary power, the licensee declared startup power not available. Thus, the licensee was required to enter TS 3.8.1.1.c for having one DEG and one offsite source of safety-related power not available concurrently.
TS 3.8.1.1.c had an allowed outage time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
Licensee personnel decided that, because they had to declare DEG 1-3 inoperable, that they would use this time to perform routine preventive maintenance on the DEG.
b.2 Risk Evaluation The inspectors reviewed the risks associated with concurrent performance of maintenance on DEG 1-3 and Procedure STP M-75 and determined that the licensee had reviewed the risk associated with this planned maintenance and surveillance activities. Overall, the licensee established and maintained an on-line safety monitoring system for Operations personnel to check the risk associated with concurrent maintenance outages of diverse safety equipment.
The licensee's "no maintenance probabilistic risk assessment" model established a core damage frequency of approximately 2.5 E-5/reactor year (ry). The on-line monitor calculated an approximate 3000 percent increase in the instantaneous risk with the DEG and startup power supplies not available.
However, the model assumed that the startup power was not available to any of three vital buses and that startup power was not readily recoverable.
Both of these assumptions over approximated the risk increas The licensee performed informal calculations which indicated that the core damage frequency with only DEG 1-3 being unavailable was approximately 8 E-5/ry. Similarly, the core damage frequency with only the startup power to one of the three 4160 volt vital buses not available was approximately 9 E-5/ry. The overall core damage frequency with both the emergency diesel generator and startup power not available to one vital bus would be approximately 3 E-4/ry. Since the work was scheduled to be complete within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> [(12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />)/(8760 hour0.101 days <br />2.433 hours <br />0.0145 weeks <br />0.00333 months <br />s/ry)], the combined risk in terms of conditional core damage probability was less than 4 E-7 (assumes loss of startup power to one vital bus and no immediate actions to recover startup power). Industry guidance indicated that maintenance activities with risks less than 1 E-6 were not considered risk significant.
In addition, the licensee stated that the actual risk was lower than the calculated risk because operators were prepared to manually restore startup power upon loss of unit auxiliary power.
'he inspectors discussed the concurrent performance of DEG 1-3 preventive maintenance and STP M-75 with the licensee.
Licensee personnel stated that they considered that putting DEG 1-3 in manual (condition required for performance of STP M-75) rendered DEG 1-'3 inoperable and unavailable.
Therefore, the calculated risk associated with performing DEG 1-3 routine maintenance during STP M-75 or placing DEG 1-3 in manual when required by STP 1-3 was the same.
Therefore, deferring DEG 1-3 maintenance to a later date would increase the time DEG 1-3 was not available. Taking DEG 1-3 out of service a second time would also increase the system unavailability time calculated through the licensee's Maintenance Rule program.
Work Performance During the prejob briefing, licensee personnel discussed in detail the method and timing of the restoration of startup power that would be expected in response to a unit trip and loss of auxiliary power during maintenance.
All plant switching evolutions were well controlled, with excellent coordination of work by operators and Maintenance technicians.
There was no other ongoing maintenance, such as work on any of the offsite power lines or safety-related equipment on the other two 4160 volt buses, which would have increased plant risk during performance of Procedure STP M-75 and DEG 1-3 maintenance.
Procedure STP M-75 was completed within the 12-hour TS 3.8.1.1.c limiting condition for operation.
C. 'onclusions The licensee adequately evaluated and controlled the risk associated with concurrent online maintenance of DEG 1-3 and the associated 4160 volt Vital Bus F undervoltage relay Ma M8.1-9-Miscellaneous Maintenance Issues (92700, 92902)
Closed Licensee Event Re ort LER 275/1998-012-00:
TS 3.8.1.1 not met because of loose terminal Iug on relay.
~Back round On August 31, 1998, the monthly surveillance test for DEG 1-1 was performed in accordance with Procedure STP M-9A, "Diesel Engine Generator Routine Surveillance Test," Revision 50. The required voltage of 41 60+240/-375 volts was achieved in 14.7 seconds, which exceeded the 13-second requirement of TS 4.8.1.1.2.a (2).
Operators declared DEG 1-1 inoperable.
Technicians connected diagnostic equipment to DEG 1-1, and operators performed three additional tests, with DEG 1-1 reaching the required voltage within 11 seconds on each test.
Engineering personnel suspected a
problem with operator timing of the DEG starts or a faulty voltage meter.
On September 1 the licensee declared DEG 1-1 operable, without any corrective actions taken. The basis for this operability determination was the three successful starts in which the earlier problem with the DEG start time was not repeated.
On September 18, with diagnostic equipment installed, the licensee performed another start of DEG 1-1 to validate that the DEG remained operable.
DEG 1-1 achieved rated voltage in 19 seconds, in excess of the 13 seconds required by the TSs. The required frequency of 60 Hz was reached in 14.5 seconds, which exceeded the TS limitof 13 seconds.
Review of the diagnostic data revealed that the relay that energized
{Relay K3) to drop out the DEG field flash was delayed.
Technicians removed Relay K3 and found a loose lug on one of its terminals to the coil. Relay K3 was replaced with an equivalent spare.
On September 19 operators performed Procedure STP M-9X, "Diesel Generator Operability Verification," Revision 11, which tested successfully the starting times for DEG 1-1. Consequently, operators, declared DEG,1-1 operable.
On September 22 the licensee concluded that, given the decreased reliability of DEG 1-1 during the period between the failures of August 31 and September 19, DEG 1-1 was conservatively considered inoperable.
This period of inoperability was in excess of the TS allowed outage time of 7 days.
Ins ection Sco e
The inspectors evaluated the response to a failure of DEG 1-1 to achieve rated voltage within TS starting times on August 31, 1998. The, inspectors independently verified the licensee investigation, as documented in LER 275/1 998-012-00 and AR A046744046744l0-Observations and Findin s lns ector Follow u The cover letter to the LER stated that, following the failure of DEG 1-1 to achieve rated
d Engineering attributed the cause for achieving, the rated voltage 1-1 failed the to faulty test equipment.
The system engineer stated that, when DEG
-
ai e e
surveillance on August 31, he assumed that the failure resulted from either an operator error in timing, a problem with the voltage meter in the control room, or an intermittent fault. None of these conclusions were documented in AR A0467444. The initial failure was not explained until the subsequent failure occurred on September 18. The system engineer also stated that he did not question the operators as to the response of DEG 1-1 or the accuracy of the timing and that the meter had not been recalibrated to confirm. the other potential cause of failure.
The failure of the system engineer to implement actions to identify the root cause of the slow DEG 1-1 start on August 31, a significant condition adverse to quality, was identified as Example 1 of a failure to comply with the requirements of 10 CFR Part 50, Appendix B, Criterion XVI,"Corrective Action." However, this Severity Level IVviolation is being treated as a noncited violation, consistent with Appendix C of the Enforcement Policy. This violation is in the corrective action program as AR A0478728 (275/99010-01, Example 1).
On October 30, 1998, the inspectors interviewed the operators who performed the surveillance of DEG 1-1 on August 31, The operators stated that no problem existed with the timing, as noted by independent peer-'checking.
In addition, the operators stated that the voltage meter was calibrated properly. The operators stated that the voltage climbed gradually to an indicated value of 80, decayed slowly back to 55, and then gradually increased to 120. The licensee indicated that the normal response was for the voltage to increase from 0 to 120 smoothly at an approximately constant rate.
The inspectors concluded that, had the Engineering personnel interviewed the operators, the licensee would not have dismissed the surveillance failure on August 31 as incorrect timing by the operators or a voltage meter problem.
V The inspectors reviewed the adequacy of the documentation of the original deficiency.
On August 31, operators documented in AR A0467444 that, "During STP M-9A, DG 1-1 did not meet the timing requirements for voltage during the start. This was an undervoltage start, and with the allowance for relay operation, the voltage was 1.6 seconds slow." The problem description of the response of DEG 1-1 did not discuss the increase-decrease-increase of the starting voltage.
Procedure OM7.IDt, "Problem
.Identification and Resolution - Action Requests," Revision 9, Section 5.1.2.3, specified that the description should provide the appropriate level of detail to allow the reviewer to make an assessment with regard to equipment operability or the ability of the equipment to perform its intended design function. The inspectors concluded that the failure of DEG 1-1 on August 31 was not properly documented in the AR and reflected poor operator implementation of the corrective action procedure.
Additionally, poor documentation by the operators of the failure to meet the acceptance criteria contributed to the incorrect assumptions by the system engineer for the August 31 failur The inspectors questioned the system engineer's actions related to an intermittent failure of DEG 1-1 to start. The system engineer recommended in AR A0467444 on September 1 that DEG 1-1 be tested within 1 week to see if the condition would recur.
The system engineer stated that he requested that the work week manager allow testing of DEG 1-1 within 1 week to ensure that the diesel generator failure was not intermittent. This request was rejected because the work schedule was full. The system engineer then requested that DEG 1-1 be retested within 2 weeks.
The subsequent work week manager also rejected the request for scheduling reasons.
Finally, work control personnel allowed the retest to occur on September 18, approximately 2 ~la weeks after the failure.
The inspectors concluded that the failure to act upon the system engineer's recommendation to retest DEG 1-1 within 1 week of the initial failure was a failure to take prompt corrective actions to resolve a significant condition adverse to quality. This failure was Example 2 of a violation of 10 CFR Part 50, Appendix B, Criterion XVI,
"Corrective Action." However, this Severity Level IVviolation is being treated as a noncited violation, consistent with Appendix C of the Enforcement Policy. This violation is in the corrective action program as AR A0478728 (275/99010-01, Example 2).
The licensee determined that the field flash cutout relay termination was loose and making intermittent contact. Therefore, DEG 1-1 was degraded until the condition was corrected.
However, the licensee indicated that insufficient evidence existed to indicate that DEG 1-1 was inoperable for this time period.
b.2 0 erabili Assessment Procedure OM7.ID12, "Prompt Operability Assessment,"
Revision 1, Section 5.1.5.b, stated that the level of detail provided in addressing operability was up to the shift supervisor.
This procedure direction did not meet the expectation of NRC Generic Letter 98-18, "Resolution of Degraded or Non-conforming Conditions - Operability Assessments."
As a minimum, the generic letter recommended that an operability assessment contain a description of the degraded and nonconforming condition and justification why this degraded condition did not impact operability.
Procedure OM7.ID12, Section 2.6, stated, in part, "the length of documentation and level of detail associated with determination of operability willvary depending on the complexity of the technical basis for the conclusion. The amount of detail must be sufficient to present a logical basis for the conclusion.
It must contain sufficient detail such that an independent reviewer, who is qualified in the particular technical discipline, is able to arrive at the same conclusion, without relying on additional guidance or explanation from the author." However, the licensee believed that AR A0467444 did not meet the criterion for a formal operability determination and concluded that Section 2.6 of Procedure OM7.ID12 did not apply.
Procedure OP1.DC17, "Control of Equipment Required by the Technical Specifications,."
Revision 4, provided guidance to address situations when safety-related equipment was degraded.
Procedure OP1.DC17, Section 5.4.3, stated that, if no definite root cause for an initial problem could be determined following troubleshooting, the following actions were required:
(a) the department responsible for the troubleshooting shall document
4
-12-the logic behind returning the equipment to service; (b) the shift supervisor or shift foreman shall review this justification and consider the effect of the failure on the ability of the equipment to meet its safety function, the type of failure experienced, the maintenance history, and system status; (c) the shift foreman may justify operability based on information documented in an AR that described the equipment problem, actions taken to resolve the problem, and logic behind the decision; and (d) either the Operations Dayshift Supervisor, Director, Operations, or Manager, Operations Services should document concurrence.
Licensee management stated that, while the documentation of operability for DEG 1-1 on August 31 did not meet management expectation, Procedure OP1.DC17 was not violated.
On September 1, the licensee justified operability of DEG 1-1 by stating (in AR A0467444) that it subsequently passed the required surveillance and the previous problem was not repeated.
No explanation as to the cause of the original failure was offered. The inspectors concluded that the licensee did not adequately address operability of DEG 1-1 following failure on August 31, because no explanation of the apparent failure was provided.
Further, the inspectors found that operators declared DEG 1-1 operable without formally documenting a suspected cause of failure.
b.3 Safe Assessment The Class 1E electrical distribution system consisted of a two-train/three-bus design.
The distribution included a Train A vital bus (Bus F), a Train B vital bus (Bus G), and a Train A/B bus (Bus H). Bus H contained vital equipment for both Trains A and B that could not have been placed on Bus F or Bus G because of loading limitations.
The design basis for the starting time of DEG 1-1 allows the diesel generator'to achieve rated voltage and frequency in a time period sufficient to successfully mitigate the consequences of a large break loss-of-coolant accident coincident with a loss of offsite power. The starting time for DEG 1-1 was not considered crucial to the successful mitigation of intermediate or small break loss-of-coolant accidents.
For most of the time period that DEG 1-1 was considered inoperable, the licensee had a full complement of redundant features on the other trains.
Both DEGs 1-2 and 1-3 were operable during this entire time period. The only safety-significant configuration that existed was DEG 1-1 being inoperable coincident with the SSPS being inoperable, which is discussed below.
b.4 Licensee Safe Assessment The licensee assessment of safety significance documented in LER 275/1 998-012-00 focused on the time period in which DEG 1-1 was inoperable coincident with another train of the SSPS being inoperable (causing the opposite safety injection train to be inoperable) on September At the time this configuration occurred, reactor power was at 73 percent while the licensee repaired Heater Drip Pump 1-2.
If DEG 1-1 had achieved rated voltage and frequency 7 seconds slower than required during a large break loss-of-coolant accident, NRC limits on peak cladding temperature would not have been exceeded, given the plant conditions. The fact that reactor power was at 73 percent was the most dominant mitigation factor.
b.5 Probabilistic Risk Assessment The licensee performed an informal risk assessment of this event.
The licensee noted that, although DEG 1-1 was considered inoperable as defined in the TS for the time period of August 31 to September 18, DEG 1-1 could be considered available for small to intermediate size breaks of the reactor coolant system.
During small to intermediate size break accidents, the starting time of a diesel generator was not time critical.
Therefore, DEG 1-1 was only unavailable for a large break loss-of-coolant accident, which in itself is a low probability event. The licensee calculated that the change in core damage frequency for the event would be considered insignificant. The inspectors and an NRC Senior Reactor Analyst reviewed the evaluation and concluded that the risk assessment was reasonable.
b.6 Corrective Actions Corrective actions were documented in LER 275/1 998-012-00 and included:
(1) replacing the failed relay, (2) revising the preventive maintenance work order to include more specifics on termination inspections of the diesel generator panels, and (3) inspecting the other five diesel generators on site for similar problems.
The licensee suspected that, because all six DEGs were similarly inspected during routine preventive maintenance on the cabinets, there existed a potential for common mode failure However, the licensee did not inspect the field flash cutout relays on the unaffected DEGs until 6 weeks later, when questioned by the inspectors.
Upon inspecting those DEGs, the licensee found all terminations to be tight.
The licensee initiated AR A0478728 to document the failure of the system engineer to validate his engineering judgement and the failure to take prompt action to identify if an indeterminate failure existed.
C.
Conclusions Two failures to take appropriate actions to identify the cause and preclude repetition of the August 31, 1998, slow start of DEG 1-1 were identified as examples of a noncited violation of 10 CFR Part 50, Appendix B, Criterion XVI,"Corrective Action," in accordance with Appendix C of the NRC Enforcement Policy. Operators did not adequately document the symptoms associated with the slow start.
Similarly, system engineers did not contact the operators who had who observed the slow start.
Significant information that could have aided Engineering personnel in determining the cause of the slow start of DEG 1-1 was not obtained from the operators until asked for by the inspectors.
In addition, the licensee failed to test DEG 1-1 within 1 week, as specified in AR A0467444 and, as a result, did not promptly correct the underlying deficiency, a loose wire. These issues resulted in DEG 1-1 being in a degraded
-14-condition for 18 days.
This violation was placed in the licensee's corrective action program as AR A0478728.
Although DEG.1-1 had reduced reliability for a time period in excess of the TS allowable ou age ime, t
t'
the eveht was not risk significant in that the licensee determined that I
t DEG 1-1 was available for small and intermediate size breaks in the reactor coo an system.
For large break loss-of-coolant-accidents, for most of the time, backup systems were available that could have mitigated the consequences of any potential accident.
E2 Engineering Support of Facilities and Equipment E.2.1 Year 2000 Y2K Review The staff conducted an abbreviated review of Y2Kactivities and documentation using Temporary Instruction 2515/141, "Review of Year 2000 (Y2K) Readiness of Computer Systems at Nuclear Power Plants." The review addressed aspects of Y2K management planning, documentation, implementation planning, initial assessment, detailed assessment, remediation activities, Y2Ktesting and validation, notification activities, and contingency planning. The reviewers used NEI/NUSMG 97-07, "Nuclear UtilityYear 2000 Readiness,
" and NEI/NUSMG 98-07, "Nuclear UtilityYear 2000 Readiness Contingency Planning," as the primary references for this review.
The results of this review willbe combined with the results of other reviews in a summary report to be issued by July 31, 1999.
ES E8.1 Miscellaneous Engineering issues (92700, 92903)
Closed LER 275 323/1 998-003-00:
TS 3.6.2.1 for containment spray system may not have been met prior to 1991 due to an inadequate procedure.
Prior to 1991 the licensee had steps in an emergency operating procedure for initiating containment spray during cold leg recirculation.
In 1991 the licensee determined that containment spray was not needed in the recirculation mode and deleted the procedure steps.
However, the licensee did not make a change to TS 3.6.2.1.
In 1997, NRC inspectors noted the difference between the procedure and the TS. The NRC determined that the 1991 change was an unreviewed safety question in violation of 10 CFR 50.59, as discussed in NRC Inspection Report 50-275; 323/98-09.
The licensee submitted a TS change.
For containment spray during recirculation, the licensee had to manually align residual heat removal (RHR) pumps to the containment spray headers, as the containment spray pumps could only be supplied from the refueling water storage tanks.
During review of this issue in 1998, the licensee determined that Emergency Operating Procedure E-1.3 "Transfer to Cold Leg Recirculation," Revisions 0-8 were not adequate
-15-to ensure that containment spray could be initiated during cold leg recirculation.
Specifically, with a loss of coolant accident, loss of offsite power, and failure of an RHR pump, the remaining RHR pump could not develop sufficient head to ensure spray.
The licensee determined that the single RHR pump always had sufficient capability to maintain core cooling. Because the 1991 analysis demonstrated that containment spray was not needed during recirculation, the licensee concluded that the inadequate procedure, which existed prior to 1991, did not affect plant safety.
The inspectors concluded that the licensee analysis demonstrated that core cooling would have been maintained.
Even though the licensee later demonstrated that core cooling could have been maintained and containment spray was not needed, the inadequate procedure could have complicated recovery actions.
TS 6.8.1.a requires that the licensee have procedures that meet the requirements of Regulatory Guide 1.33, Appendix A. Item 6 specifies that the licensee have procedures for combating emergencies.
Prior to 1991, Emergency Operating Procedure E-1.3 was inadequate to ensure initiation of containment spray during cold leg recirculation, in violation of TS 6.8.1.a.
This Severity Level IVviolation is being treated as a noncited, violation, consistent with Appendix C of the Enforcement Policy. This violation is documented in the licensee's corrective action program as Nonconformance Report N0002050 (275; 323/99010-02).
E8.2 aO Closed Unresolved Item 275 323/98020-01:
evaluate adequacy of Maintenance Rule program for expansion joints.
Ins ection Sco e
As documented in NRC Inspection Report 50-275; 323/98-20, the facility had two separate failures of nonsafety-related expansion joints during a forced shutdown of Unit 2 in December 1998. The failed expansion joints were both 26 years old and included: a 24-inch inside diameter by 12-inch long screen wash auxiliary header expansion joint and a 6-inch inside diameter by 6-inch long circulating water pump inlet cooler line.
During this inspection, the inspectors evaluated the corrective actions, the root cause assessment, the operability evaluation, and the applicability of the Maintenance Rule.
The inspectors interviewed system engineers and Maintenance personnel and reviewed plant corrective action documents and procedures.
b.
Observations and Findin s Following the expansion joint failures, the licensee evaluated the physical condition of all safety-and nonsafety-related expansion joints in both units. The licensee initiated Nonconformance Report N0002079 to document this deficiency and to ensure that appropriate corrective actions were implemented.
The inspectors assessed the adequacy of the following intermediate and long-term corrective actions listed in Nonconformance Report N0002079:
(1) evaluate maintenance history and preventive maintenance requirements for expansion joints, including applicability of the
-16-Maintenance Rule; (2) review the past corrective actions for Nonconformance Report N0001814; (3) determine the appropriate service and shelf life criteria for the expansion joints; (4) perform a root cause evaluation and a failure analysis on the failed expansion joints, including an assessment of past operability; (5) establish preventive maintenance tasks for replacing the expansion joints based upon the service life; and (6) develop inspection criteria and frequency for the safety-related and designated nonsafety-related expansion joints.
0 erabilit of Safet -Related Ex ansion Joints SW-2-EJ1-EJ3 -EJ4 and-EJ6 and Assessment of Failures The licensee completed a prompt operability assessment for the safety-related expansion joints in accordance with Procedure OM7.ID12. The licensee documented the prompt operability assessment in AR A0472506. The licensee performed an additional assessment for the following safety-related expansion joints, which had exceeded the vendor recommended service life of 10 years:
SW-0-EJ1 Valve FCV-601, auxiliary saltwater unit cross-connect (26 years)
~
SW-2-EJ3 auxiliary saltwater inlet to Component Cooling Water Heat Exchanger (CCWHX) 2-1 (26 years)
~
SW-2-EJ4 auxiliary saltwater outlet from CCWHX 2-1 (15 years)
~
SW-2-EJ6 auxiliary saltwater outlet from CCWHX 2-2 (15 years)
The licensee determined that Expansion Joints SW-2-EJ3, -4, and -6 remained operable because:
(1) of the low pressures at the inlet and outlet of the CCWHXs (7 and 3 psi actual compared to a pressure rating of 100 psi); (2) no physical degradation was evident externally; (3) no internal degradation was identified from inspections performed during the last outage; and (4) only a small chance existed of exceeding the pressure rating of these expansion joints. Since Expansion Joint SW-0-EJ1 was near the discharge of the auxiliary saltwater pumps and was subject to higher system pressures (50-60 psi), the licensee had replaced the expansion joint prior to the startup of Unit 2 from the forced outage.
The licensee had initiated AR A0472447 to have Expansion Joint SW-2-EJ3 replaced during Refueling Outage 2R9 in October 1999. On January 26, 1999, the system engineer received field inspection results indicating that Expansion Joint SW-2-EJ3 was old and brittle. Subsequently, the system engineer contacted the vendor supplying the replacement expansion joints and asked whether or not this expansion joint could withstand the 0.875 inches lateral displacement caused by thermal expansion and/or seismic forces. The vendor indicated that, given the age of the expansion joint, there was concern that the expansion joint would tear with that amount of lateral displacement.
Since the lateral displacement would occur during an accident, which was the time that could least be tolerated, the system engineer informed the shift supervisor, who declared CCWHX 2-1 inoperabl The licensee installed an expansion joint that had only 2 years left on its service life and restored CCWHX 2-1 to service on January 28. The system engineer noted that the internal liner of the removed expansion joint had no tears and that some flexibility
'emained.
Following questions from the inspectors in March 1999, the licensee contracted with a testing laboratory to perform design basis testing on Expansion Joint SW-2-EJ3, which had been removed from the inlet to CCWHX 2-1.
In May 1999, upon receipt of the test results, the licensee found that the expansion joint would have functioned in a design basis accident.
The inspectors verified that the test plan ensured that Expansion Joint SW-2-EJ3 had been tested under design basis conditions. The inspectors determined that the test used conservative test conditions that exceeded the expected accident movement and pressure.
If Expansion Joints SW-2-EJ4 and -EJ6 were to tear, the CCWHX design function would still be fulfilledbecause the cooling would occur and the resultant flooding would not impact equipment operation.
From discussion with licensee engineers, the inspectors determined that motor-operated valves in the area would not become submerged and that the pressure transmitters were qualified for submergence.
The contribution to core damage associated with the failure of these expansion joints was demonstrated to be low. Also, the engineers concluded that the outlet expansion joints would not likelyfail because the joints would be subject to minimal displacement in a seismic event, pressure at the outlets is essentially 0 psig or negative, and no pressure transients would be likely. Final Safety Analysis Report, Section 9.2.7.3, specified in part that no systems required for safe shutdown are rendered inoperable because of flooding caused by a break in the auxiliary saltwater piping.
b.2 Review of Corrective Actions from Nonconformance Re ort N0001814 Nonconformance Report N0001814 documented the inability of the expansion joint on the discharge of AuxiliarySaltwater Pump 2-1 to fit up following changeout of the pump in April 1994. The long-term corrective actions specified in Nonconformance Report N0001814 included:
(1) procuring expansion joints that accommodated mismatch on the discharge of the auxiliary saltwater pumps; (2) revising appropriate plant procedures to address fit up of expansion joints; (3) inspecting the condition of all safety-related and nonsafety-related expansion joints; (4) developing component identifiers for all safety-and nonsafety-related expansion joints; and (5) identifying inspection criteria for all safety-and nonsafety-related expansion joints.
The inspectors determined that the licensee had implemented all of the corrective actions for Nonconformance Report N0001814, with the exception of developing recurring tasks and inspection criteria for nonsafety-related expansion joints. During this same time frame (April 1994), the licensee initiated AR A0336216 because the expansion joint near auxiliary saltwater unit Cross-connect Valve FCV-601 was omitted from the scope of the inspections committed to in response to Generic Letter 89-13,
"Service Water System Problems Affecting Safety-Related Equipment."
In response to this deficiency, the licensee added Expansion Joint SW-0-EJ1 to the scope of the repetitive task and separated the inspection of safety-and nonsafety-related expansion joints. Specific nonsafety-related expansion joints had been part of Repetitive Task 40010 until resolution of AR A0336216.
From discussions with system engineers,
-18-the inspectors found that the licensee decided to not perform preventive mairitenance on the nonsafety-related expansion joints to save on costs related to parts and labor.
b.3 Corrective Action Verifications In response to the issues identified in Nonconformance Report N0002079, the licensee implemented the following long-term corrective actions:
(1) determined the service life for elastomeric expansion joints to be 10 years with an additional 5 years allowed related to shelf life, (2) assigned a Priority 2 preventive maintenance classification and established a 10-year requirement for replacement of expansion joints, (3) revised the applicable procedures to include guidance for inspection of expansion joints, (4) established that all expansion joints willbe replaced by November 2000 on an expedited basis related to their age, and (5) initiated ARs for all expansion joints to ensure that they were evaluated and replaced if needed.
The failure of nonsafety-related Expansion Joints SW-1-EJ21, Circulating Water Pump 1-2 motor cooling inlet-outside housing, and SW-O-EJ2, auxiliary cooling water header to common saltwater cooling water heat exchanger header, were documented in ARs A0472288 and A0472252, respectively.
The licensee determined that the failure of Expansion Joint SW-1-EJ21 was a functional failure because it resulted in a Unit 1 downpower to 50 percent.
The failure of Expansion Joint SW-0-EJ2 increased the length of the Unit 2 forced outage by more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The licensee concluded in both instances that proper maintenance could have prevented the failures; therefore, the engineers classified the failures as maintenance preventable.
The inspectors verified that the licensee had established satisfactory performance goals and an appropriate monitoring period.
As previously described in NRC Inspection Report 50-275; 323/98-20, available vendor manual data indicated that the service life for these expansion joints was 5 years.
TS 6.8.1.a requires that the licensee have procedures that meet the requirements of Regulatory Guide 1.33, Appendix A. Item 9 specifies that the licensee have procedures and establish a frequency for performing preventive maintenance on safety-related equipment.
The licensee failed to implement preventive maintenance activities to effectively maintain the expansion joints. This NRC-identified Severity Level IVviolation is being treated as a noncited violation, consistent with Appendix C of the Enforcement Policy. This violation is documented in the licensee's corrective action program as AR A0472447 (275; 323/99010-03).
c.
Conclusions A noncited violation of TS 6.8.1.a, in accordance with Appendix C of the NRC Enforcement Policy, was identified because the licensee failed to establish an appropriate frequency for preventive maintenance for the safety-related expansion joints.
System engineers demonstrated a conservative attitude by questioning the capability of an old expansion joint to withstand the expected thermal and seismic movements combined with the age of the expansion join 'E8.3 The licensee effectively implemented the Maintenance Rule program following the expansion joint failures in that engineers determined that the failures were maintenance preventable functional failures.
In general, the inspectors found that the licensee effectively implemented the corrective action program during resolution of this issue.
Closed LER 275/1995-016-01:
TS 3.4.2.2 not met during pressurizer safety valve surveillance testing because of random setpoint spread.
The issues identified in this LER were appropriately addressed, and NRC had previously issued a noncited violation, as documented in NRC inspection Report 50-275; 323/97-07, Section E8.2.
R1 Radiological Protection and Chemistry Controls R1.1 General Comments 71750 The inspectors evaluated radiation protection practices during plant tours and work observation.
The inspectors determined that personnel donned protective clothing and dosimetry properly and that radiological barriers were properly posted, with one exception.
On June 21, 1999, during a tour of the facility, the inspectors identified a degraded high radiation area boundary.
In the entrance to the RHR Pump 1-2 room, one of the redundant high radiation area signs and boundaries was face down on the floor.
~Adjacent to the degraded boundary, the area was properly posted.
The inspectors notified Radiation Protection personnel, who corrected the degraded high radiation area boundary.
The licensee initiated an event trending record to trend this occurrence of 'a degraded radiological posting. The inspectors concluded that the corrective actions were appropriate.
RS II/Iiscellaneous Radiation Protection and Chemistry Issues (92700)
R8.1 Closed LER 275 323/1 998-004-00:
TS 6.8.4.g not met because of inadequate control of vendor information for Plant Vent Noble Gas Radiation Monitors RM-14 and RM-14R.
In May 1998, the licensee identified that Plant Vent Noble Gas Radiation Monitors RM-14 and RM-14R had been improperly calibrated by a factor of two since installation in 1993.
Radiation Monitors RM-14 and RM-14R were installed in 1993 as part of a radiation monitor upgrade.
These monitors used a beta scintillation detector with a pressurized gas sampling chamber.
The standard operating pressure was 14.7 psia.
However, to meet the contract requirement for increased sensitivity, the vendor increased the pressure to 27 psia. Although information on the new pressure was available at the site, personnel assigned to prepare surveillance and scaling documentation were not informed of the change in pressure and used the standard operating pressure.
This error resulted in the monitor readouts in units of microcuries per cubic centimeter in the control room being nonconservative by a factor of
-20-approximately two. Radiation Monitors RM-14 and RM-14R also provided uncompensated counts per minute to the Technical Support Center, which were correct for determining release rates and computing actual releases.
In May 1998, an engineer observed that the control room monitor readings for Radiation Monitors RM-14 and RM-14R did not match the associated uncompensated counts in the Technical Support Center and identified the error. Since plant procedures specified that an Unusual Event be declared for a valid plant vent noble gas radiation monitor alarm, the licensee determined that the nonconservative control room monitor error could have caused Operations personnel to fail to declare an Unusual Event for a slowly developing small release.
The licensee reviewed the capability of associated radiation monitors and required samples and considered that backup information would have been available to assist the operators in properly classifying vent stack releases.
The licensee corrected the inaccurate procedures and reviewed critical parameters regarding radionuclide efficiencies and processing for other new radiation monitors. The licensee determined that there were no other similar errors associated with other new radiation monitors. The licensee also noted that the program for incorporating vendor technical information had been improved since 1993. The inspectors reviewed the new surveillance and scaling procedures and the records of the licensee's reviews of other radiation monitors and determined that they were adequate.
Actual counts from the associated detectors, which would be used to calculate release information during a declared emergency, were correct.
Because of improper calibration, the control room indication for the plant vent noble gas radiation monitors was nonconservative from 1993 to 1998 in violation of TS 6.8.4.g program limits for noble gas release rates.
This licensee-identified Severity Level IV violation is being treated as a noncited violation, consistent with Appendix C of the Enforcement Policy. This violation is in the licensee's corrective action program in Nonconformance Report N0002063 (275; 323/99010-04).
S1 S1.1 Conduct of Security and Safeguards Activities General Comments 71750 During routine tours, the inspectors noted that the security officers were alert at their posts, security boundaries were being maintained properly, and screening processes at the Primary Access Point were performed well. During backshift inspections, the inspectors noted that the protected area was properly illuminated, especially in areas where temporary equipment was brought i FR F8.1-21-Miscellaneous Fire Protection Issues (92700)
Closed LER 323/1997-004-00:
auxiliary saltwater system outside design basis because 10 CFR Part 50, Appendix R, requirements were not met.
Back<around On October 17, 1997, the licensee discovered that, on Unit 2, two independent auxiliary saltwater system safe shutdown circuits were routed through pull boxes that,did not have adequate fire protection separation, as required in 10 CFR Part 50, Appendix R.
This placed the plant outside its design basis.
Since each pull box contained redundant control circuits associated with the auxiliary saltwater system, a fire in either pull box could have resulted in ihe loss of both trains of auxiliary saltwater.
Investigation by the licensee found that this issue did not affect Unit 1 since Unit 1 had qualified barriers.
License Condition 2.C.(5) specifies that the licensee shall implement and maintain in effect all provisions of the approved fire protection program.
The Updated Final Safety Analysis Report, Section 9.5.1, indicates that the fire protection plan complies with the requirements of 10 CFR Part 50, Appendix R. Appen'dix R,Section III.G.2, requires that one train of redundant systems, necessary to achieve and maintain hot shutdown conditions and located within the same fire area, is free from fire damage.
This can be accomplished with an approved 3-hour fire barrier separating the trains, separation by more than 20 feet with fire detection and spray equipment, or having a 1-hour fire barrier with fire detectors and fire suppression equipment.
Assessment During a review of design drawings for tornado missile protection, the licensee identified a potential 10 CFR Part 50, Appendix R, concern.
The licensee found that the cables for the auxiliary saltwater pumps were not imbedded but were separated by a 2-inch transite barrier (unqualified asbestos barrier). Therefore, a single fire in either pull box could result in loss of both trains of auxiliary saltwater.
The licensee initiated a continuous fire watch as an interim compensatory measure.
Within 2 weeks, the licensee had installed temporary fire and smoke detection equipment and implemented a roving firewatch in place of the continuous firewatch.
The licensee analyzed for a hypothetical fire in these pull boxes.
The only combustible material contained in the pull boxes was the cable jacketing.
Ignition of the cable jacketing from high current should be prevented by fuses and breakers.
If a fire started on the cable jacketing, the fire duration would be less than 15 minutes because of the limited amount of combustible material.
Given that the cable insulation is generally very slow burning, the radiant heat emitted from a fire would be inconsequential.
Therefore, the transite panel would have adequately pr'evented the spread of fire from one compartment to the other.
In the unlikely event that both Unit 2 trains of auxiliary saltwater pump power supplies were damaged by fire, Unit 2 auxiliary saltwater could be supplied from a Unit 1 auxiliary saltwater pump via a crosstie connection.
In summary, the auxiliary saltwater cables had operable overcurrent circuit fault protection; the combustible loading in the pull boxes would not support a large fire; and,
-22-although the transite panels are not fire rated, there was reasonable assurance that the panels would have provided acceptable fire protection.
Finally, the Unit 2 auxiliary saltwater could be supplied from Unit 1 auxiliary saltwater.
The failure to maintain adequate electrical train separation in the Unit 2 auxiliary saltwater pullbox fire barriers constitutes a violation of minor significance and is not subject to formal enforcement action.
V. Mana ement Meetin s-X1 Exit Meeting Summary The inspectors presented the inspection results to members of licensee management at the conclusion of the inspection on July 13, 1999. The licensee acknowledged the findings presented.
The inspectors. asked the licensee whether any'materials examined during the inspection should be considered proprietary.
No proprietary information was identifie Licensee ATTACHMENT SUPPLEMENTAL INFORMATION PARTIALLIST OF PERSONS CONTACTED J. R. Becker, Manager, Operations Services W. G. Crockett, Manager, Nuclear Quality Services R. D. Gray, Director, Radiation Protection D. B. Miklush, Manager, Engineering Services D. H. Oatley, Vice President and Plant Manager G. M. Rueger, Senior Vice President and General Manager R. A. Waltos, Manager, Maintenance Services L. F. Womack, Vice President, Nuclear Technical Services INSPECTION PROCEDURES USED IP 37551 IP 61726 IP 62707 IP 71707 IP 71750 IP 92700 IP 92901 IP 92903 TI 2515/141 Onsite Engineering Surveillance Observations Maintenance Observation Plant Opeiations Plant Support Activities Onsite Followup of Written Reports of Nonroutine Events at Power Reactor Facilities Followup - Operations Followup - Engineering Review of Year 2000 (Y2K) Readiness of Computer Systems at Nuclear Power Plants
ITEMS OPENED AND CLOSED
~Oened None.
Closed 275/1998-012-00 LER 275; 323/98020-01 URI 275/1 995-016-01 LER 275; 323/1 998-004-00 LER 323/1997-004-00 LER 275; 323/1 998-003-00 LER TS 3.8.1.1 not met for DEG 1-1 because of loose wire (Section M8.1)
TS 3.6.2.1 not met for containment spray prior to 1991 because of inadequate procedure (Section E8.1)
Evaluate adequacy of Maintenance Rule program for expansion joints (Section E8.2)
TS 3.4.2.2 not met during pressurizer safety valve testing (Section E8.3)
TS 6.8.4.g not met for vent noble gas monitors to improper calibration (Section R8.1)
Appendix R not met because of inadequate auxiliary saltwater electrical train separation in a pullbox (Section F8.1)
0 ened and Closed 275/99010-01 275/99010-02 NCV NCV Two examples of failure to identify the cause and correct a slow DEG 1-1 start (Section M8.1)
Failure to provide adequate emergency procedures for containment spray (Section E8.1)
275; 323/99010-03 275; 323/99010-04 NCV
.Failure to establish an appropriate preventive maintenance program for safety-related expansion joints (Section E8.2)
NCV Failure to maintain TS 6.8.4.g program limits for vent noble gas monitors (Section R8.1)
'C AR CCWHX DEG LER NCV NRC RHR SSPS STP TS Y2K LIST OF ACRONYMS USED action request component cooling water heat exchanger diesel engine generator licensee event report noncited violation Nuclear Regulatory Commission residual heat removal reactor year solid state protection system surveillance test procedure Technical Specification Year 2000