IR 05000282/1999006

Insp Repts 50-282/99-06 & 50-306/99-06 on 990601-0720.One NCV Occurred.Major Areas Inspected:Activities Related to Reactor Safety,Verification of Performance Indicators,Event Followup & Compliance with Commission Rules & Regulations

ML20210R717
Person / Time
Site:	Prairie Island
Issue date:	08/12/1999
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML20210R706	List: IR 05000282/1999006 ML20210R702
References
50-282-99-06, 50-306-99-06, NUDOCS 9908170197
Download: ML20210R717 (18)

Text

.

'. . .

U.S. NUCLEAR REGULATORY COMMISSION REGION lli l

Docket Nos: 50-282; 50-306 I License Nos: DPR-42; DPR-60 i

Report No: 50-282/99006(DRP); 50-306/99006(DRP)

Licensee: Northern States Power Company Facility: Prairie Island Nuclear Generating Plant Location: 1717 Wakonade Drive East Welch, MN 55089 Dates: June 1 through July 20,1999 Inspectors: S. Ray, Senior Resident inspector

- P. Krohn, Resident inspector S. Thomas, Resident inspector Ap; oved by: Roger Lanksbury, Chief Reactor Proje cts Branch 5 Division of Reactor Projects

.

9908170197 99081222 DR ADOCK 05

,

, , . 1 SUMMARY OF FINDINGS Prairie Island Nuclear Generating Plant, Units 1 & 2 NRC Inspection Report 50-282/99006(DRP); 50-306/99006(DRP) ,

l The report covers a 7-week period of resident inspectio {

i inspection findings were assessed according to potential risk significance, and woro assigned J colors of green, white, yellow, or red. Green findings were indicative of issues that, while not I necessarily desirable, represent little risk to safety. White findings would indicate issues with some increased risk to safety, and which may require additional NRC inspections. Yellow findings would be indicative of more serious issues with higher potential risk to safe j performance and would require the NRC to take additional actions. Red findings represent an unacceptable loss of margin to safety and would result in the NRC taking significant actions that could include ordering the plant shut down. The findings, considered in total with other inspection findings and performance indicators, will be used to determine overall plant performanc Cornerstone: Mitigating Systems e To Be Determined. The licensee identified that a door into the 122 control room chiller room was broken in such a way that it may have opened during a high-energy line break and resulted in an adverse environment in the control room chiller rooms and the control room itself. During an accident such as a steam break on either unit, the control room may have had to be abandoned and equipment operated from the control room may have failed or spuriously actuated. The inspectors performed a preliminary risk estimation in accordance with Phase 2 of the Significance Determination Process and determined that the issue was potentially risk significant and was assigned to both units. The final risk estimation will be conducted in accordance with Phase 3 of the Significance Determination Process and documented in a future inspection repo (Section 40A3)

e Green. During Unit i full power operations, the inspectors identified that two personnel access hatches to sump C, located directly under the reactor vessel, were not properly secured in the partially open position, as described in the Prairie Island Individual Plant Examination, NSPLMI-94001, Revision 1. A risk determination of this finding was performed by region- and headquarters-based l risk analyst specialists. They determined that the small change in the containment early release frequency due to this issue did not impose a <

'

significant increase in risk. The inspectors identified a Non-Cited Violation, assigned to Unit 1, regarding improper procedure implementatio <

(Section 1R04.1)

e Performance Indicator Verification. The inspectors identified that the licensee had failed to cou'nt two reportable safety system failures in its performance indicator report submitted in May 1999. The licensee corrected the error in its

' June 1999 submittal and the additional failures caused that performance indicator for the first quader of 1999 to change from the green band into the ;

white band for Unit 2. The finding was assigned to both units.' (Section 40A2)

"

,

. . .

Reoort Details During this inspection period, both units operated at or near full power except that Unit 2 was brought to about 40 percent power on June 4,1999, for turbine valve testing and work on the condenser and cooling towers. The unit was retumed to full power on June 6,199 . REACTOR SAFETY Cornerstones: Initiating Events, Mitigating Systems, and Barrier integrity 1R01 Adverse Weather l 1 Insoection Scop The inspectors observed the performance of the licensee's inspection in accordance with Surveillance Procedure (SP) 1039, "Tomado Hazard Monthly Site inspection,"

Revision 5. The inspectors also conducted a document review of Periodic Test Procedure 1636, * Summer Plant Operation," Revision i Observations and Findinas There were no findings identified and documented during this inspectio R03 Emeraent Work Inspection Scope By attending the shift crew briefs, daily plant staff meetings, and weekly work planning meetings, the inspectors reviewed how the following emergent work was evaluated and incorporated into the maintenance schedule:

• Work Order (WO) 9905963, " Stem Collar Clamp Unscrewing on CV-31136, 22 Steam Generator Feedwater Regulating Valve";

e WO 9901678, " Seal Leak and High Vibration on Bearing Housing on 21 Containment Spray Pump';

e WO 9907731, " Perform As-Found Test / Inspection of SA-56-4';

e WO 9907733, " Test and Install New Valve SA-56-4';

e WO 9907740, " Relief Lifting on 22 Diesel Driven Cooling Water Pump Starting Air"; and e SP 1106B, "22 Diesel Driven Cooling Water Pump Test," Revision 5 Observations and Findinas There were no findings identified and documented during this inspectio ,

, . .

1R04 Eauipment Alianment 1- Containment Sumo C Hatches Inspection Scope During an at-power containment entry, the inspectors reviewed the status of selected equipment which would contribute to the mitigation of containment damage following a core damaging even Observations and Findinas The inspectors discovered that the configuration of the Unit 1 containment sump C hatches was not being properly controlled, resulting in a small increase in the risk of containment early release following a postulated core damaging even On June 15,1999, the inspectors observed that the bolts used to partially block open the two personnel access hatches to sump C, the area located directly under the Unit i reactor vessel, were not properly held in place. As described in the Prairie Island Individual Plant Examination (IPE), NSPLMI-94001, Revision 0, Prairie Island operated with these hatches partially blocked open to provide a flowpath from the containment floor to the reactor cavity, through openings in the in-core instrument tunnel. In a post-accident scenario, the flooding of the reactor cavity facilitated direct cooling of the reactor vessel in order to prevent vessel failure after core melt, and also cooled the containment floor and corium debris to prevent basemat failure in case the vessel did fall. Since the bolts were not securely held in place, there was a high probability that under loss of coolant accident conditions the hatches would have closed, potentially impacting the failure of the both the reactor ct.olant system and containment boundaries. The most recent manipulation of the hatch bolts had been near the end of the Unit i refueling outage. Since Unit i started up from that outage on May 29,1999, !

and the discrepancy was corrected on June 15, the exposure time for this finding (the length of time that this condition existed) was approximately 18 day A risk determination of the impact of this issue on the Unit 1 containment was conducted by regional and headquarters-based risk analyst personnel. The effects of a dry reactor cavity or a wet reactor cavity were evaluated with respect to containment failure ,

mechanisms such as high pressure melt ejection, core / concrete interactions, and direct !

containment heating. The assessment concluded that, although there was a change in ;

the Prairie Island early release frequency due to this finding, the change was small and i the configuration with the improperly secured hatch bolts did not impose any significant increase in risk. Therefore, this issue was determined to be within the licensee

- response band (green).

The inspectors determined that a contributing factor to the improperly secured bolts was that the safeguard hold (equipment) tagging process was not implemented properl During the same Unit 1 at-power containment inspection, the inspectors identified that the two sump C access hatch safeguards hold cards (cards 1-197 and 1-198) were not hung in a manner that would have prevented the movement of the hatch blocking bolts for either of the hatches. On one of the hatches, one of the blocking bolts was not even engaged with the access hatch. The inspectors brought these discrepancies to the attention of an operator who, in coordination with the shift supervisor, properly secured

.

-. .

.

the blocking bolts for each access hatch and correctly positioned the safeguard hold tag ,

Through further discussions with operations and engineering department personnel, the inspectors determined that there was some confusion conceming the reason the sump C access hatches were required to be partially blocked open and on how to properly hang Safeguard Hold Tags 1-197 and 1-198 to ensure that the hatches were blocked open as requiredc in response to a previous error involving Tag 1-198 (discussed in Inspection Report 50-282/99004(DRP); 50-306/99004(DRP)), the licensee began the engineering work for modification of the hatches to prevent recurrence of this problem. This modification had not yet been installe Technical Specification 6.5.A required that integrated and system procedures for normal reactor startup, operation, and shutdown of the reactor and all systems and components involving nuclear safety of the facility be prepared and followed. Contrary to the requirements of TS 6.5.A, during full power operation of Unit 1, the licensee failed to control the position, status, and logging of Safeguards Hold Tags 1-197 and 1-198, in accordance with procedure SWI O-3, Steps 5.2 and 6.1. This violation is being treated as a Non-Cited Violation (NCV), consistent with Appendix C of the NRC Enforcement Policy (50-282/99006-01(DRP); 50-306/99006-01(DRP)). This issue was in the licensee's corrective action program and was being tracked as issue Number 1999195 There were no findings identified and documented during a similar inspection of the Unit 2 sump C hatches on June 23,199 .2 D1 Emeroency Diesel Generator Inspection Scope On June 28,1999, the licensee removed the D2 emergency diesel generator from service for preplanned on-line maintenance.. During the time that the D2 diesel was out-of-service, the inspectors reviewed all open work orders and performed a train walkdown of the D1 emergency diesel generator,4160-volt bus 15, and the control room G panel, Observations and Findinas There were no findings identified and documented during this inspectio R05 Fire Protection Insoection Scope The inspectors walked down the following risk significant plant areas looking for any fire protection issues:

• auxiliary feedwater pump rooms and-e . Units 1 and 2 emergency diesel generator room F ,

. .

. Observations and Findinas There were no findings identified and documented during this inspectio R09 Inservice Testina Inspection Scooe The inspectors observed the performance of and/or conducted a document review of the following inservice testing activities for pumps and valves:

• SP 2100, "21 Motor Driven AFW [ Auxiliary Feedwater ] Pump Monthly Test,"

Revision 53; e SP 1356, " Thermal Barrier Check Valve Test," Revision 3; and

• SP 1355A,"AFW Pumps Suction Check Valves Quarterly Function Test,"

Revision Observations and Findinas There were no findings identified and documented during these inspection R10 Laroe Containment Valves Insrection Scope The inspectors reviewed the containment venting at power process to determine if large containment isolation valves were cycled at power to accomplish the task. The inspectors also reviewed the control of containment integrity while the operators cycled the Unit 1 containment vacuum breaker valves in accordance with SP 1130,

" Containment Vacuum Breakers Quarterly Tests," Revision 3 Observations and Findinas

. -There were no findings identified and documented during this inspectio R12 Maintenance Rule Imolementation Inspection Scooe The inspectors reviewed the licensee implementation of the maintenance rule I requirements, including a review of scoping, goal setting and performance monitoring, l short-term and long-term corrective actions, and current equipment performance status, for the following components and systems that had experienced recent performance problems:

e instrument air system and e safeguards chilled water syste ;

s

. 1

. . 4 Observations and Findinas There were no findings identified and documented during this inspectio < 1R13 Maintenance Work Prioritization Inspection Scope The inspectors reviewed the licensee's evaluation of plant risk and configuration control associated with removing the 21 containment spray pump from service to facilitate pump bearing and seal replacemen i Observations and Findinas

There were no findings identified and documented during this inspectio R15 Ooerability Evaluations Insoection Scope The inspectors reviewed the following operability evaluations:

e Nonconformance Report 19991466, which discussed the 11 residual heat i removal pump operating in the alert range during the performance of Surveillance Test Procedure 10928, " Safety injection Check Valve Test (Head Off) Part B: RWST [ refueling water storage tank] Flow Path Verification,"

Revision 9; e Nonconformance Report 19991823, which discussed the 11 boric acid storage tank low-low level bistable 1LC-190C being found out-of-tolerance during the performance of SP 1022; e Safety Evaluation 537, which discussed the fact that the as-built configuration of the Units 1 and 2 reactor coolant pump supports differed from that described in the Updated Safety Analysis Report, Section 4.3.3.1.2; and e Safety Evaluation 538, which discussed the operation of the Unit i reactor with a clip spring located in the lower reactor vesse Observations and Finding 1

There were no findings identified and documented during this inspectio R16 OperatorWorkarounds Inspection Scope The inspectors reviewed the following open operator workarounds (OWAs):

.

.. .

.

e OWA 19950907, " Unit 1 and Unit 2 Reactor Coolant System Vent System Solenoid Valves Leak By Causing Alarm and Pressure Indications in the Control Room";

e OWA 19991958, "12 Battery Charger May Require Manual Restarting Following Safety injection Actuation";

l L e OWA 19990774, " Unit 2 Nuclear Steam Supply System Annunciator System Routinely Generates Trouble Alarms Requiring the Operator to Exit the Control Room"; and e OWA 19950902," Unit 1 and Unit 2 Component Cooling System Has Continuous Cross-leakage due to Small Leakage Through Motor Valves."

l

'

In addition to the evaluations performed for these OWAs, the inspectors discussed routine plant evolutions with operators and observed common plant operations to l

determine if there were any undocumented OWAs.

! Observations and Findinas There were no findings identified and documented during this inspectio R19 Post-Maintenance Testina j Insoection Scooe The inspectors' observed and reviewed the following post-maintenance tests:

e testing under Work Order 9901542 of newly installed control room ventilation high-energy line break (HELB) isolation dampers CD-34146 and CD-34147;

e testing in accordance with SP 1307, "D2 Diesel Generator Fast Start Test,"

l Revision 16 of the D2 emergency diesel generator following installation of two l new fuel oilinjectors; and -

e testing of control room ventilation darnper CD-34145, per Work Order 9905605, following "B" train electrical power cable separation of its actuating solenoid valve SV-3370 Observations and Findinas l . There were no findings identified and documented during this inspection.

l'

l 1R22 Surveillance Testing l Inspection Scope

.

The inspectors observed the performance of the following surveillance testing:

e SP 1218, " Monthly 4KV (4 kilovolt) Bus 15 Undervoltage Relay Test,"

Revision 22;

l L

m,

,

. .

.

.. e ' SP 1130, " Containment Vacuum Breakers Quarterly Tests," Revision 30; and e' SP 1024, " Refueling Water Storage Tank Level Functional Test," Revision 1 Observations and Findinas

!

There were no findings identified and documented during this inspectio I 1R23 Temoorary Plant Modification Insoection Scooe The inspectors reviewed Temporary Modification 98T059. This temporary modification removed the operating air to the temperature control valves for the residual heat ;

removal unit coolers 11,12, 21, and 22, allowing continuous full flow of chilled water to the unit cooler Observations and Findinas There were no findings identified and documented during this inspectio i OTHER ACTMTIES I 40A2 PlVenfication Inspection Scope The inspectors reviewed the performance indicator data covering the time period from the second quarter of 1997 through the first quarter of 1999 for safety system functional

. failures reported by the licensee as part of its initial data submittal in May 199 j Observations and Findings The inspectors noted that the licensee reported in the performance indicator data for the !

third quarter of 1998 two safety system functional failures for each unit. However, the licensee had issv9d four Licensee Event Reports (LERs) during the same quarter that indicated potential safety system functional failures for both units in accordance with 10 CFR 50.73(a)(2)(v). The inspectors discussed the discrepancy with the licensee engineer responsible for developing the performance ind!cator data and were told that LERs 1-98-12 " Fire Areas 58/73 Appendix R Safe Shutdown Analysis issues," and 1-98-14, " Fire Area 32 Appendix R Safe Shutdown Analysis lasues," were not included in the performance indicator data. The reason given was that the LERs indicated that only one of two trains of safety systems were affected by the conditions described in the I

LER ~

The inspectors questioned whether the opposite train was protected or whether it could be affected by the same fire. The licensee reviewed the LERs and determined that both LERs should have been included in the performance indicator data for safety system functional failures for both unit j

u

< ..

The licensee corrected the error in its June 1999 performance indicator data submitta The correction affected the threshold for the first quarter of 1999 for Unit 2. The originally reported riumber of safety system functional failures in the previous four quarters was four (within the green licensee response band), but the corrected value was six (within the white increased regulatory response band). This issue was considered a finding assigned to both unit The issues associated with LERs 1-98-12 and 1-98-14 had previously been assessed by the NRC during its Fire Protection Functional inspection as discussed in inspection Report 50-282/98016(DRS); 50-306/98016(DRS). Enforcement aspects of the issues were resolved as discussed in a letter to the licensee from the Regional Administrator, NRC Region Ill, dated March 30,1999 (EA 98-526). The issues were assessed during the NRC's Plant Performance Review as reported in a letter to the licensee from the Director of Reactor Projects, NRC Region lil, dated March 26,1999. Thus, the failure to properly report the performance indicator data did not adversely affect the NRC's ability to assess licensee performance. Pending a final decision on how to resolve the failure to properly report the performance indicator data this issue will be tracked as an unresolved item (50-282/99006-02(DRP); 50-306/99006-02(DRP)).

The licensee had previously recognized that the proper classification of LERs had become more important with the initiation of the performance indicator system. The licensee had entered activities into its corrective action system to ensure that future LERs were more specific in indicating whether the issue was a safety system functional failure in the context of the performance indicators and whether the issue affected both units. The inspectors verified that these action recommendations were in the licensee's corrective action system, as lasue Numbers 19991278,19991299, and 1999195 A3 Event Follow-uo

. Inspection Scope On June 25,1999, the licensee discovered that the door into the 122 control room chiller

. room was inoperable. The inspectors reviewed the licensee's response to this finding and completed a preliminary review of its risk significance, Observations and Findinas The licensee discovered that a high energy line break barrier door was inoperable. The inspectors determined that the issue was potentially risk significant for both units. The NRC will conduct a Phase 3 Significance Determination Process (SDP) after evaluating the licensee's risk estimation. The final risk significance determination will be reported at the completion of the Phase 3 SD Event Description The 122 control room chiller room door consisted of a double door set with one side being pinned closed to the door frame at the to'p and bottom to prevent it from inadvertently opening. The other side was used for normal ingress and egress and was latched to the pinned side. While responding to a door alarm, operators discovered that the pins on the pinned side were broken. This would have allowed the door to swing

l

_ - _ _ _ -- _ - _ _ ----

- - _ . - - - - - - - - _ - - - - - _ _ ,

.

-

.

!

open into the chiller room with a small differential pressure on the outside such as would

- be expected after a HELB in the auxiliary buildin Since the wall between the 122 and 121 chiller rooms and the control room ducting in the chiller rooms were not qualified for the harsh environment of a HELB, the licensee declared both trains of control room special ventilation inoperable and implemented the requirements of Technical Specification 3.13.A.1 which stated that, within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, the licensee must initiate the actions necessary to place both units in hot shutdown within

- the next 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> The licensee conducted emergency repairs and was able to install the top pin, and test and close the door in 58 minutes. The inspectors reviewed Updated Safety Analysis Report Appendix 1," Postulated Pipe Failure Analysis Outside of Containment,"

Revision 4, Section 1.11.1. The analysis showed that the highest pressure in the area of the chiller room doors after a HELB would be 0.75 pounds per square inch (psi). The inspectors reviewed Calculation ENG-CS-146," Pressure Capacity Evaluation For Auxiliary Building Special Vent Zone Double Doors," Revision 0. The calculation showed that doors pinned with both pins should withstand a differential pressure of 6.53 psi. The calculated response was linear with respect to the number of pins, so a door with one operational pin should withstand over 3 psi. Thus, the door was considered operable with only one pin installe The licensee conducted an investigation to try to determine the length of time the door had been inoperable. The investigation showed that the door had been operable about a week before the event, but no evidence could be found regarding exactly when it became inoperable. Technical Specifications did not contain an allowed outage time for inoperability of both trains of control room special ventilation. The 1-hour action time given was considered a reasonable time to prepare for a controlled shutdown similar to that allowed by Technical Specification 3.0.C. Thus, the inoperable door was considered a condition prohibited by Technical Specifications. However, since the situation was corrected within the allowed time limit after discovery, and there was no conclusive evidence that the system had been inoperable for longer than the time allowed to reach hot shutdown conditions, the issue was not considered a violation of NRC requirement Sionificance Determination The inspectors used the NRC's SDP in accordance with draft NRC Inspection Manual Chapter 06XX dated May 5,1999. One of the design functions of the chiller room wall was to serve as a steam exclusion boundary between the auxiliary building and the chiller room / control room ventilation envelope. Since the finding represented an actual loss of the safety function of a mitigation system (steam exclusion boundary), the Phase 1 Screening Process of the SDP called for a Phase 2 Risk Estimatio The inspectors determined that the inoperable chiller room door would have had the most significant effect on the risk from a main steamline break (MSLB) initiating event if the break was outside of the shield building but upstream of the main steam isolation valves (MSIVs). There was a open grate in the control room ductwork located in the 122 chiller room that would have allowed steam to enter the control room if the chiller room door opened during an MSLB. There were fire dampers located in the ducts that

i r - - . . .. . . . . . . . . . .

,

._

L .

s . .

may have closed when exposed to hot steam, but they were not rated for a steam environment and the inspectors did not credit them as a mitigation syste The inspectors assumed that an MSLB would have required the control room to be evacuated. The control room evacuation procedure required a manual trip of both unit Thus, an automatic safety injection was assumed to occur on the affected unit due to low steamline pressure and a manual reactor trip transient was also assumed to occur on the unaffected unit. The inspectors credited the fire dampers in the ventilation ducts with slowing down the rate of steam entry to a rate that would allow this evacuatio The following documents were reviewed as part of this SDP:

e Individual Plant Examination (IPE) NSPLMI-94001, Revision 0; e Plant Safety Procedure F5, Appendix B," Control Room Evacuation (Fire),"

Revision 20; e Abnormal Operating Procedure 1C1.3 AOP1, " Shutdown From Outside the Control Room - Unit 1," Revision 3; and e Abnormal Operating Procedure 2C1.3 AOP1, " Shutdown From Outside the

' Control Room - Unit 2," Revision MSLB (Outside Containment) on the Affected Unit-The exposure time of the broken door pins (the length of time that the pins were broken)

was unknown. Maintenance workers normally responsible for door repairs stated that they had verified that the door was operable on June 18,1999, while they were performing other work in the room. A Category 1 door alarm was received for an 11-second period on June 21,1999, but it was not known if the alarm was from the 122 chiller room door. With no other information available, the inspectors used an estimated exposure time of one half the time since the door was know to be operable, or 3 % days. This technique was the same as the licensee used for estimating fault

'

exposure time for safety system unavailability as described in NEl [ Nuclear Energy .

Institute] 99-02 [ Draft Revision B], " Regulatory Assessment Performance indicator j Guidance," dated May 1999.- )

!

i x The licensee's IPE, ( in Figure 3.1-8), indicated that the following functions were needed to prevent possible core damage in a MSLB:

,

e suberiticality - using the reactor protection system;  ;

J e break isolation to prevent blowdown of the unaffected steam generator - using automatic or manual closure of either steam generator's air-operated MSIV or the non-retum check valve on the affected steam generator; l e prevention of a reactor coolant pump (RCP) seal failure - using at least one charging pump supplying RCP seal injection or at least one component cooling water pump supplying RCP thermal barriers;

.

.. ,

e ' secondary cooling - using at least one auxiliary feedwater pump or at least one main feedwater pump supplying the unaffected steam generator; e short-term reactor coolant system inventory control - using at least one safety injection pump supplied from the refueling water storage tank and at least one pressurizer power-operated relief valve (PORV);

e long-term reactor coolant system inventory control - using at least one safety injection pump on containment sump recirculation and at least one residual heat removal system heat exchanger; and e containment cooling - using at least two fan coil units or at least one containment spray pump on containment sump recirculation.

,

The licensee IPE, Figure 3.1-8, documented some functions would not be needed, depending on the success of other functions. For instance, if the first four functions were successfully accomplished, the last three functions would not be necessary for succes The inspectors made the following assumptions: l e The break would cause the 122 control room chiller door to open and allow an adverse steam environment into the roo e The fire dampers in the control room ductwork would not be effective in isolating steam. This would allow and result in an environment adverse to control room operators, making it uninhabitable into the control roo o The operators would have enough time to perform the immediate actions and safely evacuate the control room using their abnormal procedures for control room evacuation and shutdown from outside the control room. This would include scramming the unaffected unit and closing the pressurizer PORV block valves on both unit o Equipment that could be operated from the hot shutdown panels or other accessible areas would be available except in cases where actions were needed in the harsh environment areas of the auxiliary building to prevent failure or spurious operatio e The operators would implement Plant Safety Procedure F5, Appendix B, even though there was no fire in the control room, because they would understand that the effect of condensing steam in the control panels could be similar to the effects of a fire. That procedure was the only one available for isolating equipment from the control room circuits to prevent spurious operatio e Actions in F5, Appendix B, to isolate control room circuits would be completed before the associated components were damaged by spurious operatio e- All other equipment which had controls in the control room would be subject to either failure or spurious operation to the undesirable position due to the harsh

,

environment and moisture from the MSL {

,

. .

e The motor-operated valve and check valve for the steam supply to the turbine-

.'

driven auxiliary feedwater pump from the affected steam generator would be rendered inoperable due to the assumed MSLB in the near vicinity. This would also allow the steam supply to the AFW pump from the other steam generator to be lost out the break, resulting in the turbine-driven AFW pump not being availabl * Equipment in the harsh areas of the auxiliary building that was not environmentally qualified for the post-MSLB conditions would not be availabl e At least one operator would be available on the inhabitable 695-foot level of the auxiliary building, either because the operator was already there at the start of the event or by someone getting into the area through the locked access doors from the turbine buildin With those assumptions, the remaining mitigation systems for ecch required function were evaluated as follows:

• Subcriticality: Although not discussed in the IPE, the licensee recently installed a diverse scram system which tripped the reactor by a means other than the normal reactor trip breakers. Thus, the automatic reactor protection system consisting of two different systems; a normal scram system and a diverse scram system, each with two trains, was credited. The inspectors were concemed that the reactor coolant system cooldown due to the MSLB might lead to recriticality, especially since it was assumed that the safety injection pumps would not be available for boron injection. The licensee performed a preliminary calculation, using best estimates and the reactor conditions existing at the time of the finding, and determined that either unit could be cooled down to below 200 degrees without recriticality. Thus, suocriticality, if successfully achieved, should not be lost late * Break Isolation From the Unaffected Steam Generator: Two MSIVs and a diverse, automatic, non-retum check valve were credited. The MSIVs, once closed, could be prevented from spuriously reopening because the direct current solenoids would be manually disabled from the battery rooms in the turbine building in accordance with F5, Appendix B. Since manual action under time constraints would be needed to ensure the MSIVs did not reopen, this situation was best described as one train plus one multi-train system with manual actuation under time constraint e Prevention of RCP Seal Failure: Two charging pumps and one component cooling water pump, all operated locally or at the hot shutdown panel, were credited. Loss of electrical power to buses 16 and 26 was assumed due to shorting of switches in the control room. There were no immediately available procedures to restore those buses. Manual procedure actions in accordance with FS, Appendix B, were credited with preventing the loss of buses 15 and 25 or restoring the buses once they were lost. This situation was best described as one multi-train system with manual actuation under time constraints plus one train with manual actuation under time constraint i

.

.

e Secondary Cooling: The motor-driven AFW pump, operated locally, was credited. Again, manual action to prevent failure or restore buses 15 and 25 would be needed to assure pump availability. The turbine-driven AFW pump was not credited as discussed previously in the assumptions. The unaffected unit's motor-driven AFW pump would also be available to be manually cross-connecting to the affected unit. The two motor-driven pumps were identical and thus were not considered diverse systems. The main feedwater pumps were not credited because they were assumed to be lost due to shorting of their control switches in the control room or to the loss of electrical power. This situation was best described as one multi-train system with manual actuation under time constraints, e If secondary cooling was not available, all remaining success paths depenM on the availability of short-term inventory control. That function was assumed to be q unavailable due to failure of both safety injection pumps because of shorting of their control switches and/or loss of electrical power. In addition, the pressurizer PORVs were assumed not to be available due to closing of the block valves during the control room evacuation, and removal of direct current control power in accordance with F5, Appendix j l

e Long-term inventory control, as well as containment cooling, could be credited by j eventual recovery of at least one train through actions developed by the !

licensee's emergency response organization. However, without short-term I inventory control, those last two functions were not relevant to the outcom '

Based on the preceding analysis of all credited success paths, the most restrictive mitigation function for the MSLB was secondary cooling with one multi-train system with manual actuation under time constraints credite Reactor Trio on Unaffected Unit The control room evacuation process would require a reactor trip of the unaffected unit, initiating a transient event. However, in this case, the initiating event would actually be the MSLB (outside containment), so its initiating frequency was used. Again, an estimated exposure time of 31/2 days was use Even though the MSLB initiating frequency was used, the mitigating systems for a reactor trip (anticipated transient) were evaluated. For that event, the licensee's IPE required the same mitigation functions as the MSLB, with the exception of break isolation, according to the licensee's IPE. Most of the same assumptions regarding l equipment availability were applicable to the unaffected unit since the units shared a common control room and auxiliary building. The only difference was that both the motor-driven and diverse turbine-driven AFW pumps were credited. Both AFW pumps would have needed to be operated locally and, for the motor-driven pump manual actions under time constraints would be needed to protect or restore bus 15 and/or 2 The motor-driven AFW pump from the affected unit was not assumed to be available for cross-connection to the unaffected unit, because it would be needed for the affected unit if operabl Secondary cooling was again found to be the most restrictive mitigation function on the only viable success paths. Two diverse trains were credited with manual actions under

y ,

.- .,

,

'

time constraints. , Short term inventory control was assumed to be unavailable and i would have prevented any success path not involving secondary coolin Overall Risk Sionificance Estimation of the Findino The most significant risk scenario for the finding associated with the 122 control room chiller room door was determined to be an MSLB (outside containment) for the affected unit and was evaluated as being potentially risk significant. The finding was assigned to i

=

the mitigation system comerstone for both units. The licensee intended to submit its

evaluation of the risk in its LER (1-99-07) due on or before July 26,1999. The NRC will

' conduct a Phase 3 SDP after evaluating the licensee's risk estimation. The final risk

' significance determination will be reported at the completion of the Phase 3 SD A4 Other 1 (Closed) LER 282/99006 (1-99-061- Manual Si Actuation Switch Not Tested On Staggered Basis During integrated SI Test. This event was previously discussed in

,

inspection Report 50-282/99004(DRP); 50-306/99004(DRP), Section M1.3. It was

'

considered NCV 50-282/99004-02. The LER had not been written at the time of that i report.- The inspectors reviewed the LER and verified that the corrective actions 3 commitments had been entered into the licensee's corrective action system as item i L Numbers 19991974 and 1999197 A5 Management Meetings

,1 Exit Meeting Summary The inspectors presented the inspection results to Mr. D. Schuelke and other members

- of licensee management at the conclusion of the inspection on July 20,1999. The licensee acknowledged the findings presented. The inspectors asked the licensee -

l whether any materials examined during the inspection should be considered proprietary.

l No proprietary information was identifie l l

I

j

!

'

,

16 _

'

L

-

-,

.- . .

l l

PARTIAL LIST OF PERSONS CONTACTED Licensee T. Amundson, General Superintendent Engineering i J. Goldsmith, General Superintendent Engineering, Nuclear Generation Services R. Hanson, Risk Assessor J. Hin, Nuclear Performance Assessment Manager A. Johnson, General Superintendent Radiation Protection and Chemistry G. Lenertz, General Superintendent Plant Maintenance J. Maki, Outage Manager  !

J. Schcefer, Risk Assessor D. Schuelke, Plant Manager T. Silverberg, General Superintendent Plant Operations M. Sleigh, Superintendent Security J. Sorensen, Site General Manager NRC S. Burget.s, Senior Reactor Analyst D. O'Neal, Reliability and Risk Analyst ITEMS OPENED, CLOSED, AND DISCUSSED Ooened 50-282/99006-02(DRP); URI improperly reported performance indicator data

- 50-306/99006-02(DRP)

i Opened and Closed ,

50-282/99006-01(DRP) NCV failure to follow procedure for safeguards hold tags ;

Closed 50-282/99006 (1-09-06) LER manual Si actuation switch not tested on staggered basis during integrated Sl test

Discussed 50-282/99004-02(DRP) NCV manual Sl actuation switch not tested on staggered basis during integrated Si test

.

E ,

.

• , .

l l

LIST OF ACRONYMS USED

1 AFW Auxiliary Feedwater CFR Code of Federal Regulations ,

DRP Division of Reactor Projects '

HELB High-Energy Line Break IPE Individual Plant Evaluation LER Licensee Event Report 1- MSIV Main Steam isolation Valve MSLB Main Steamline Break ,

NCV Non-Cited Violation OWA Operator Workaround PORV Power-Operated Relief Valve - ;

psi Pounds per Square Inch - 1 RCP Reactor Coolant Pump SDP Significance Determination Process SP Surveillance Procedure WO - Work Order I

i e

i

.

\

l 18 f.