IR 05000286/1987013

Safety Sys Outage Mod Insp Rept 50-286/87-13 on 870422-0714. Rept Describes Activities & Findings Associated W/First Portion of Team Insp Re Outage Design Insp

ML20238D961
Person / Time
Site:	Indian Point
Issue date:	08/21/1987
From:	Haughney C, Imbro E Office of Nuclear Reactor Regulation
To:
Shared Package
ML100271221	List: IR 05000286/1987013 ML20238D954
References
50-286-87-13, NUDOCS 8709140020
Download: ML20238D961 (25)

Text

.

.

. _ _ _ _ _

.- .-

' .

.

U. S. NUCLEAR REGULATORY COMISSION OFFICE OF NUCLEAR REACTOR REGULATION Division of Reactor Inspection and Safeguards Report No.: 50-286/87-13 Docket No.: 50-286 Licensee: Power Authority of The State of New York 123 Main Street White Plains, NY 10601 Inspection At: Indian Point Station Indian Point, New York Power Authority of The State of New York White Plains, New York Inspection Conducted: April 22-23, May 11-15, May 26-29, July 13-14, 1987 Inspection Team Members:

Team Leader: E. V. Imbro, Chief, Team Inspection Appraisal and Development Section #2, RSIB, DRIS, NRR H. B. Wang, Operations Engineer, NRR

,

<

Mechanical Systems: G. J. Overbeck, Consultant, WESTEC Services Mechanical Components: J. Blackman, Consultant, WESTEC Services Electrical Power: G. W. Morris, Consultant, WESTEC Services Instrumentation & E. T. Dunlap,* Consultant, WESTEC Services Control

.

Y E. 9. Imbro, Chief,

'

$Ofe7 Date Signed Team Inspection Appraisal and Development Section #2, NRR Approved By t harTes/

_ Haughney, M IAActing / Chief M f//h7 Dfte .Vigned j

Special spection Branch, NRR

• Part-time ___

,/- m

%D

'

i -

. .

.-

.

.- INSPECTION REPORT

' INTRODUCTION AND SUMMARY Introduction The Safety System Outage Modification Inspection (SSOMI) Program was initiated by the NRC in 1985. This program generally consists of four team inspection activities (1) an outage design inspection to evaluate planned design changes and modifications against the commit- ;

ted design bases and design margins; (2) an outage vendor inspection to evaluate procurement activities related to the outage; (3) an in-depth outage inspection to review and inspect procurement and installation; and (4) a pre-operations readiness inspection to assure plant readiness for startup through review of licensee controls, inspection of turnover package closeouts, verification walkdowns of installed systems, and witness of selected in process testin This report describes the activities and findings associated with the first portion of this team inspection - the outage design inspectio Some of the items identified by the team may be potential enforcement findings. Any enforcement actions will be identified by Region . Purpose The purpose of this portion of the Safety Systems Outage Modification Inspection Program was to examine, on a sampling basis, the detailed design and engineering required to support plant modifications planned during the current outage. This assessment covered the technical adequacy of modifications to assure that the plant has not

- violated any licensing commitments and regulatory requirements by installation of the modifications and the effectiveness of design controls for modifications planned during the outage.

,

i The major modifications scheduled to be accomplished during this planned outage were: (1) the replacement of the six service water pumps; (2) the replacement of station batteries; (3) the addition of provisions to drain the pressurizer safety / relief valve loop seals; (4) the replacement of certain valve motor operators; (5) the addi-tion of a reactor vessel level indication system (RVLIS); and (6) the addition of instrumentation to follow the course of an accident (RG 1.97). The above six items were the focus of the design team's inspectio . Inspection Effort The inspection was conducted by NRC personnel with contractor assist-ance. Part of the team was at the Indian Point ~3 site on April 22-23, 1987 to gather information regarding the design activities related to plant modifications planned during this outage. The majority of the team inspection activities occurred at the Indian Point 3 site during the weeks of May 11, 1987 and May 25, 198 Some team members also

'

-2-

. .

.

l

.. visited the New York Power Authority (NYPA)* engineering offices at White Plains, New York during the two weeks of inspection. The initial inspection activities concluded on May 29, 1987 with a status briefing. A followup inspection was performed on July 13-14, 198 The primary emphasis of the SSOMI design inspection was placed upon reviewing the adequacy of design details (or products) as a means of ;

measuring how well the design process functioned in the areas

~

sampled. In reviewing the design details, the teams focused on the following items:

(1) Validity of design inputs and assumptions (2) Validity of design specifications

.

(3) Validity of analysis (4) Identification of. systems interface requirements

'

!. (5) Potential indirect effects of changes

.

(6) Proper component classification I

(7) Revision control (8) Application of design information transferred between organizations (9) Design verification methods and contro . Personnel Contacted A large number of NYPA personnel were contacted during the inspection. The following is a brief list of the key personnel involved:

Name Position

,

J. Brons Senior Vice President - Nuclear Generation W. Josiger Resident Manager

~

S. Zu11a Vice President - Nuclear Engineering P. Conroy Assoc. O&M Engineer L. Garofolo Supervisory Engineer J. Brunetti Supervisory Engineer J. Bencivenga Supervisory Engineer M. Cass Assistant to Resident Manager S. Munoz Technical Services Superintendent R. McNany Project Supervising Engineer K. Vanduzer Associate Project Supervisor Engineer R. Burroni Engineer A. Petrenko Engineer C. Caputo Supervisory Engineer S. Ahmad Nuclear Project Engineer C. Sclafani Supervisory Electrical Engineer T. Anderson Design Engineer L. Kelley Supervisory Performance & Reliability Engineer

• The Power Authority of the State of New York (PASNY), the licensee for Indian Point 3, has changed its name to the New York Power Authority (NYPA). The Operating License, however, has not been modifit:d accordingl NYPA has been used throughout this report to refer to the Power Authority of the State of New Yor '

-3-

- _ _ - _ _ _ _ - _ _ _ - _-

.

. .

.-

.

T. Orlando Senior Performance and Reliability Engineer G. Eddleson Lead Electrical Designer J. Walters Design Engineer J. Mui Design Engineer H. Chang Design Engineer L. Epstein Design Engineer J. Gullick Lead Electrical Engineer - Technical Services N. Mathur Supervisory Engineer - Nuclear Engineer G. Mavrikis Director - Project Engineering Nuclear Support J. Sosnowski Supervisory Electrical Engineer - UE&C J. Simon Project Manager - UE&C Summary of Significa_nt Weaknesses 1.2.1 Configuration Control Configuration control is the ability to control changes to the plant design in such a manner that the' plant remains in conformance with its licensing basis over its lifetime. To maintain the plant configuration, careful attention must be given to the plant's licens-ing basis as described in the FSAR, the NRC staff's SERs, plant technical specifications, and commitments made in correspondence to the NR In addition, strict attention must be paid to the details of design modifications to assure that the licensed plant configura-tion is maintaine During this inspection, the team observed certain weaknesses in control of plant configuration. The team noted, for example, the use of uncontrolled design inputs in development of plant modifica-tions. In one instance, the team noted that nominal flow rates specified in the FSAR were used to calculate the NPSH of the service

_ water pumps. This practice is a problem for two reasons: (1) the FSAR generally lags the plant configuration by at least six months, therefore it should not be relied upon as a design input document;

.and; (2) to determine the required pump NPSH the design engineer needs to know the maximum system flow corresponding to pump runout rather than the nominal design flows presented in the FSA .2.2 Design Interface Control

.

Weaknesses were also noted by the team in the area of design inter- i face control. The procurement specification for the safety-related service water pumps did not include enough information regarding seismic design requirements. Therefore, the seismic qualification -

,

report prepared by the vendor considered only a one dimensional '

earthquake rather than the three dimensional earthquake as committed in the FSAR. In addition, the procurement specification did not specify the committed design code, appropriate allowable stress l 1evels, and minimum modeling requirements necessary to perform a j dynamic analysis. This lack of specificity in the procurement specification contributed, in part, to the pump vendor's failure to produce a seismic qualification report that demonstrated that the pumps were seismically qualifie l

__ \

..'

.

-

1. Design Verification In addition to the lack of specificity in the procurement specifica-tion, several design deficiencies and computational errors were found in the seismic qualification report that were not detected by the NYPA's technical review, indicative of a weakness in design verifica- i tion. For example, the team's review of the dynamic analysis revealed I that the pump operating speed was between the third and fourth l resonant frequencies. The procurement specification required that j the pump fundamental frequency be greater than 110 percent of the j operating speed. Therefore, during pump startup and shutdown the '

pump would pass through the fundamental frequency and pump resonance ;

would not be precluded during pump operation. In addition, the <

licensee failed to verify that the replacement service water pumps would provide design flow to essential components assuming a concur-rent LOCA and guillotine failure of a moderate energy line as cur-rently committed to and analyzed in the FSAR. Furthermore during this inspection, the team found one scenario where this commitment could not be met. If the break is postulated in the essential service water header upstream of the pump discharge check valves, service water flow would be lost to 2 of the 3 emergency diesel generators. Two diesel generators are required in the event of a LOC This FSAR commitment is more conservative than the guidelines set forth in Standard Review Plan 3.6.1 for moderate energy line '

crack This matter should be resolved between NYPA and NRC as soon as possible, since it relates to the original plant desig The team also found that the licensee had failed to verify that the worst case system alignment had been selected to determine service water pump NPS This worst case pump runout condition is likely to exist following a LOCA, during manual transfer to the recirculation mode, assuming the single failure as the inability to start a service

~~

water pump aligned to the non-essential header. In this scenario, only a single service water pump would be operating since the techni-cal specifications permit one of the three non-essential pumps to be inoperable without entering a limiting condition of operation (LCO);

i.e., only two of the three pumps are considered operable at the initiation of the accident. Therefore, in the initial stages of recirculation, prior to isolation of turbine building non-essential heat loads, a single service water pump is runnirg against minimum system resistance and consequently, providing a high (runout) flow rat In addition to the question raised about the operability of the single non-essential service water pump at prolonged runout conditions, the team questioned whether the component cooling water (CCW) heat exchanger, initially aligned to the non-essential header during recirculation receives its design flow rat The CCW heat exchanger is the heat sink for the containment following a LOC Although the licensee has now decided to defer the installation of the new service water pumps, the above systems operability and flow balancing questions are equally valid for the original pumps. The licensee has been requested by the NRC staff to demonstrate service

.

water system operability prior to restart.

!

!

l

-

-5-i .

. _ _ _ _ . _ - - -- - i

I

., ,

!

,

[ 1.3 Conclusions The design inspection team noted significant areas of weakness in the design and design verification process associated with the replacement of the service water pumps. The team also found two instances where NYPA was using relaxed design criteria from that specified in their FSAR and NRC bulletin responses without obtaining prior staff approval and examples where the FSAR and technical specification bases had not been updated to reflect changes made during a previous outage. Based on this inspection, licensee manage-ment should take action to ensure that (1) adequate controls are in place to maintain plant configuration; (2) the plant licensing basis is updated to reflect design changes as required by 10 CFR 50.71(e)

ar,d; (3) the engineering staff and design agents are aware of the plant's licensing basis. Since some of the team's questions were directed towards the original design of the plant and had not been questioned by the utility staff, during any modification, the licen-see should examine carefully the original design and licensing basis to assess all the design considerations that are affected by the change. As a result of the questions raised by the design team, NYPA decided to reinstall the original service water pumps in order to maintain their outage schedule. NYPA plans to install the new pumps during a future outage following their evaluation of the team's concern During the inspection, NYPA explained an ongoing program to j reestablish the design basis of the plan This effort is encouraged by the tea It also shows that licensee management has been aware of this weakness and is taking positive steps to establish configura- '

tion control. Clearly, more work is needed in this are In contrast to the weak practices described above, the team observed that many things had been done correctly and that NYPA has taken an active role in identifying problems and correcting them in a timely

~

manne The proposed replacement of the service water pumps, for example, was initiated to improve system reliability as a result of a poor maintenance history for the original pumps. Also, the flow model testing and improvements made to the service water system intake bays should further enhance pump performance and system reliabilit Throughout the inspection the team noted a positive atLitude by NYPA towards the inspection findings and a willingness to correct any deficienc .4 Corrective Actions Prior to Restart Subsequent to the team's inspection of May 1987, the licensee decided to defer the installation of the new service water pumps and reinstall the original pump The team was informed that installa-tion of the new service water pumps was halted based upon uncertain-ties in successfully addressing the team's concerns in a time period to support the restart schedul Cited as part of that decision was the need for additional modifications to limit flow to certain i service water system components in order to mitigate runout

-

-6-l

_ _ _ _ _ _ - - -_

. .

.-

,

conditions. It was determined by the licensee that completion of these modifications could delay the scheduled restar On July 13 and 14,1987, a reinspection was performee to review engineering activities associated with reinsta11ation of the original pumps and the adequacy of those pumps with regard to the team's i concerns identified in the initial inspection. -To assess the adequacy of the reinstalled pumps to deliver required flow following design basis events, a detailed flow network analysis was performed by the licensee. The analysis has confirmed that certain valves must be throttled and that a modification is required to the air-operated flow control valves associated with the diesel generator coolers (FCV 1196A and B). The inspection team understands that following addi-tional activities are planned to be completed by the licensee prior to restar . Develop a procedure to establish the throttled positions for flow control valves to assure correct flow distribution in the service water syste . Perform system flow tests to benchmark the analytical model developed to represent the service water system. This benchmark testing will verify analytical assumptions on friction factors and head loss coefficient . Set flow control valves to their throttled positions and make .

system modifications necessary to maintain valve pocitions,

'

e.g., adding mechanical stops to valves and disconnecting the air supply from the air-operated diesel generator flow control valve .

Note: The team was informed that the licensee intends to provide

~

mechanical stops on the various butterfly valves that need to be throttled and to provide a positive locking devic Valves that appear to require some throttling based upon analytical results are SWS 44-1 through 4, SWS 62-1 and 2, FCV 1196A, SWS 57, and SWS 16- The team was also {

informed that the control scheme for the flow control valves at the discharge of the diesel generator coolers ;

)

will be modified. In the short term, all of the automatic controls will be eliminated and these valves will become

-

essentially manual valve . Perform a system flow distribution test to simulate system .

alignment during the injection phase of LOCA with concurrent a failure of the nonsafety-related air suppl This test will confirm valves have been set to their proper throttled position . Develop procedures to prevent runout of the service water i system pumps aligned to the nonessential header during the recirculation phase of LOCA and to assure sufficient service water flow to the component cooling . vater (CCW) heat exchange _- b

- - - - - - -

_ _ _ . _ . . _ .

t . .

..-

..

'

Note: The team was concerned that procedure ES-1.3, Rev. 1,

" Transfer to Cold Leg Recirculation" does not isolate essential nonsafety-related heat loads (e.g. , turbine oil coolers) from the nonessential service water header prior to starting a nonessential service water pump. This lineup could result in flow degradation to the CCW heat exchanger and possible damage to the nonessential service water pumps as a result of pump runout. The CCW heat exchanger is the heat sink for the containment following a LOC . Revise Station 0perating Procedure RW-6 to indicate 1500 gpm flow is required for the containment fan coolers instead of the 1250 gpm flow currently indicate . Revise the alarm setpoint of containment vent fan cooling water low flow for safeguards panel SBF-2 and correct alarm response procedure ARP- l

.

_ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _

. .

_

. .

.-

..

.- INSPECTION FINDINGS INDICATIVE OF LICENSEE WEAKNESSES Control of Design Input Design activities should be accomplished to (1) assure that design inputs are correct and used appropriately, (2) that the design be traceable from design input through to design output (i.e., sources of design input identified), and (3) that assumptions be documente The quality of design inputs and assumptions was evaluated during the review of safety evaluations and calculations associated with modifi-cations. Weaknessess were identified which included (1) use of the FSAR as a source of design input instead of appropriate design documents, (2) failure to identify the source of design input, (3)

failure to identify assumptions and justify their use, and-(4) the use of preliminary information without confirmation that the infor-

- mation is adequate for final design. The following subsections describe examples of inappropriate use of design input and assump-tion . Incorrect design inputs and inappropriate assumptions were used in Calculation 6604-266-2-SW-003 to confirm adequate net positive suction head (NPSH) for the service water pumps being replaced by modification MOD 86-03-096 SW Calculation 6604-266-2-SW-003, Pump Performance Requirements, Rev. O, 8/25/86 used flow rates to various heat loads from the-FSAR which were not conservative with respect to the calculation's objectiv First, a summation of required design flows to essential heat loads was used instead of a higher flow corresponding to the actual pump /

system operating point. Higher flows require more service water pump NPSH to prevent cavitation and potential pump degradation or failur Second, a value of 1400 gpm per containment fan cooler

_

was used even though post-modification test suggested that the flow varied between 1450 gpm and 1500 gpm. Third, a value of 1350 gpm was used for. the total flow through the diesel generator service water )

flow control valves even though these valves (FCV 1176 and FCV 1176A)

received a full open signal on safety injection actuation and were sized to pass 1500 gp Fourth, the calculation implicitly assumed that nonsafety-related devices were used to limit service water flow to essential nonsafety-related heat loads such as the turbine lube oil coolers. Although nonsafety-related temperature and pressure control valves and their associated controllers will attempt to limit service water flow to minimum required levels, it is not conservative to assume that these nonsafety-related devices will function as i expected. Their incorrect operation such as failing open will 1 increase service water flow and thereby require greater NPSH for the i pumps. Fifth, the calculation used data for required NPSH versus flow from a vendor's proposal and did not confirm the adequacy of that information for final design purpose . Misleading references and inappropriate assumptions were used in a battery vc1tage sensitivity calculation to support the replacement of original safety-related inverters 31 and 3 _ _ . _ _ _ _ _ _ .

.

.- During a previous outage, modification MOD 85-03-075 replaced the l original 7.5 kVA safety-related inverters 31 and 32 with larger 25 l kVA inverters. Calculation 6604-0221-3-BR-02, 125 Volt DC Load i Study, Rev. O, 8/30/85, was prepared to support this modification.

! This calculation was initially presented by NYPA as being the

! calculation which determined the adequacy of the batteries to supply i the 25 kVA inverter. From this perspective the team considered the l battery to be inadequate. It was later learned that this calculation was not a battery sizing calculation but, its purpose was to deter-mine the maximum output of 25 kVA inverters based on the current battery capacity. It was determined that the batteries could not sustain a 25 kVA inverter output and that the vital ac loads sustain-able was approximately 9 kVA, i.e. , the inverter is oversized. NYPA

>

subsequently determined that the vital loads supplied by the 25 kVA inverter were less than the maximum sustainable battery load (9 kVA)

and therefore, the battery capacity was adequate. Calculation 6604-0221-3-BR-02 contained the following incorrect references and inappropriate assumption The battery voltage sensitivity analysis contained implicit assumptions concerning battery age, minimum electrolyte tempera- '

ture and maintenance margin which were not conservative with respect to the calculation's objective and inconsistent with surveillance procedures. First, the battery capacity was implicitly assumed to be at 100 percent of the manufacturer's rating even though a capacity as low as 80 percent is acceptable per the refueling outage Battery Load Test procedure. Second, the minimum electrolyte temperature was implicitly assumed to be 77 degrees F even though monthly and quarterly battery surveil-lance procedures specify an alert point at 65 degrees F and define the battery inoperable at 60 degrees F. Third, the average specific gravity was implicitly assumed to be that of a

~ fully charged battery at 1.215 even though the quarterly battery surveillance procedure specifies an alert point of 1.205 and defines the battery inoperable at less than 1.195 specific gravity, The sources of bus data and load profile data were identified as references attached to the calculation. However, the data used in the calculation for the loads could not be deduced from the

-

attached reference During the followup inspection of July 13-14, 1987, the licensee provided the team with a battery sizing calculation which was ,

prepared in 1981. This calculation included correction factors for '

minimum design temperature and aging. However, no specific design margin was included for maintenance (such as low electrolyte specific gravity) which could amount to approximately 5 percent loss of capacity. The licensee also noted that the 1981 calculation had hidden margin in the form of future de and inverter capacity that l

could also be used to account for this loss of capacit The team concluded that, in spite of the misleading 1985 calculation, the existing batteries have sufficient capacity for the identified l load However, NYPA should develop suitable controls to assure that additional loads added to the vital ac bus do not exceed the ,

, )

-10- '

- - - _ . i

_ _ _ _ _ _ _ _

_

. .

.-

.

. load capacity of the batteries since, with the 25 kVA inverter's excess capacity, the inverter will not be self limitin .2 Design Interface Control Design activities should be such that (1) design information between external design organizations is documented in specifications, l drawings or other controlled documents, (2) design information I

between internal design organizational units identify incomplete items which require further evaluation or review, and (3) interface information is reviewed and approved consistent with its intended use

, by a responsible design organization. The team reviewed design l details of modification packages in order to examine the effective-i ness of the interfe'e control mechanisms and found weaknesses in the l implementation of controls associated with external organization Weaknesses were found in the procurement specification for the replacement service water pumps associated with modification package 86-03-096 SWS. These weaknesses resulted, in part, in a technically deficient seismic qualification report for the pumps. In addition, errors contained in the vendor's qualification report were not detected by the licensee's review process as indicated in subsections 2.2.1 and 2.2.2. Based upon the limited sample size, it is not

'

possible to conclude that a pervasive weakness exists; however, the type of errors observed in this major procurement activity suggests that similar weaknesses may exist in other procurement activitie .2.1 The procurement specification for the safety-related service water pumps did not include sufficient technical information or require-ments to ensure that seismic requirements would be satisfie Procurement specification MDA-SWP-84-0148-A was developed to specify

.. the design, fabrication, testing, preparation, shipping and delivery requirements for seven service water pumps, six of which were planned to be installed as part of modification MOD 86-03-096 SWS. Several design related licensing commitments were not specified in the procurement specification and were apparently not transmitted to the pump vendor in a controlled manner. These commitments included (1) a reference to the design code of record; (2) the basic seismic analysis method to be followed including the three-dimensional earthquakes (OBE and SSE), percent critical damping, method of modal j combination, and pump operability requirements; (3) appropriate allowable stress levels and; (4) minimum modeling requirement The seismic qualification report prepared by the vendor, (" Structural Integrity of the 26APK-1 Service Water Pump, New York Power )

Authority, Indian Point - Unit 3", TR-8605, Rev. O, 7/31/86) did not demonstrate that the licensee's FSAR commitinents were being considered and was technically deficient in a number of basic areas as described in section 2.2.2 of this report. The lack of documented l technical requirements contributed, in part, to the vendor's failure i to prepare a seismic qualification report to verify that the SWS pumps met the licensee's FSAR commitment '

1

_ _ _ _ _ _ _ _ . .

.-

. During the inspection, preliminary analyses were performed by the pump vendor as a first step to revising the seismic qualification report. The capability of the support structure to withstand pump operability loads combined with the seismic loads is presently unresolved pending completion of the final design analysi .2.2 The service water pump vendor's qualification report prepared to demonstrate conformance with the design requirements of the procure-ment specification contained incorrect analytical modeling techniques and computational errors that were not detected during the licensee's interface revie Ingersoll-Rand (I-R) qualification report No. TR-8605, " Structural Integrity of the 26APK-1 Service Water Pump", Rev. O, 7/31/86, was prepared as required by the procurement specification M0A-SWP-84-0148-1 for modification MOD 86-03-96 SWS. Several signi-ficant design deficiencies and computational errors.were found in the vendor's report that should have been detected during the licensee's technical review:

'

The NYPA procurement specification required that the fundamental frequency of the pump arrangement should be at least 110 percent of the pump operating speed. An initial pump design was found to have an operating speed between the fourth and fifth resonant frequencies. The pump design was then changed to raise the end bell 10 feet, add lateral support, and change material. from bronze to carbon steel. The intent of these changes was to develop a stiffer arrangement and thereby increase the natural frequencies. However, the team's review of the finite element analysis results revealed that the operating speed was still

"

between the third and fourth resonant frequencies. Hence the design problem was not solved, and pump resonances were not

,

precluded during pump operatio The NYPA procurement specification requires the vendor to develop a design which considered the emergency mode of behavior (i.e., normal operating conditions plus seismic). However, the qualification report does not address the combination of normal operating and seismically induced loads. The only stress evaluation shown was for anchor bolt stresses subject to seismic load The NYPA procurement specification requires that the vendor consider static seismic loads of 1.1 g in the three orthogonal directions. However, the vendor performed a modal analysis using an approximation of the SSE response spectra curve assuming 5 percent damping. The percent critical damping used was inconsistent with the FSAR commitments. In addition, the approximation of the response spectra curve is not consistent with accepted industry practic Pump operability during a seismic event (i.e., allowable shaft lateral deflection) was not considered in the design, i

l

-

-12-l

_ _ _ _ _ . - _ - .

- ,- . . __ - _

o . . .

m

• - Although all three response spectra (i.e., x, y, and z .

directions) were' input into the analysis, only the modal-response in the x direction for the first mode of behavior was considered when the results were evaluate '

Significantly reduced number of dynamic degrees-of-freedoms were used such that the dynamic motion of the pump could not be adequately characterize )

• - The analysis contained modeling errors which indicated that the-symetric pump had an asymmetric mass distribution. As a ,

consequence, only approximately.one-third of the actual mass was I included in the mode It appears that the design deficiencies and analysis errors would have gone undetected due to a weak review of the vendor qualification report. Therefore, the ability of the pumps-to resist seismic and '

.

operating' loads and meet FSAR commitments has not been adequately

-

demonstrated.'.

On July 13 and 14, 1987, a reinspection was perfomed, at which . time Rev. 1 of the qualification report was reviewed by the team. This revision was prepared in response to the team's findings discussed above as well as additional _ design guidance prepared by the license The team found two significant errors in the revised report, namely (1) inadequate treatment of seismic operability and (2) incorrect summation of seismic result .- Seismic operability, as'a minimum, is normally evaluated by comparing the available clearance between the rotating component and the pump casing to the lateral deflection of the rotating component. While

-

I-R did discuss pump operation as it affects wear and as a conse-quence service life, the net clearance between the rotating impeller and the pump casing was not evaluate The team reviewed the seismic analysis results to assess if they appeared to be reasonable and consistent with expected behavio While the mathematical modeling and natural frequency responses appeared to be reasonable, the square root of the sum of the square

. (SRSS) results were inconsistent with expected behavior. Upon further review by the team, it was noted that the element data (forces and stresses) appeared to be incorrectly summed. The strain in the two perpendicular springs that modeled the spiders ,

varied by an unrealistically large amount when, in fact, the strain '

values should have been essentially the sam l An additional inconsistency noted was the magnitude of the vertical force located at the mounting plate which supports the entire column assembly, pump casing, and end bell. The value detemined from the analysis was 20,471 pounds. The entire weight of the pump (including water) weighs approximately 12,200 pounds. Therefore, a net verti-cal acceleration of approximately 2.68 g was developed. However, since the pump is assumed to be rigid in the vertical direction and ,

the applied acceleration is 0.4 g, the magnitude of the force is inconsistent with expected result .

-13-

_ _ _ _ _

,.

. .

..

. Desian Verification

! Design verification is the process of reviewing, confirming, or

! substantiating the design by one or more methods. When design i reviews are used as the method of verification, the following attri-

butes are examined

(1) the inputs are correctly selected and incor-i porated in the design; (2) applicable codes, standards, and regulatory l requirements are satisfied; (3) an appropriate design method is used, and;'(4) the design is suitable for the applicatio The quality of design verifications was assessed through the review of modification package details. A weakness was found in the implementation of the design verification process which suggest a need for greater atten-tion to detai Errors included: (1) failure to meet licensing

, commitments; (2) failure to ensure that an appropriate design method '

was used; (3) computational errors and; (4) failure to ensure speci-fied parts and equipment are suitable for the required applicatio The following subsections describe examples of weak implementation of the design verification proces .3.1 The service water system pumps were planned to be replaced without assessing the performance of the pumps following initiating events other than loss of coolant accident (LOCA).

Modification MOD 86-03-096 SWS was reviewed and approved without ensuring that the new pumps would perform their safety function following all initiating events. Analyses were not performed to confirm that the new pumps could deliver required flows for plant shutdown following a safe shutdown earthquake or a moderate energy line break. The FSAR presents an extensive analysis to demonstrate that the service water pumps can deliver design flow rates to essen-tial loads for the duration of a LOCA coincident with a passive pipe failure (i.e., complete loss of a service water header). However, 1

~

the analysis was not revised to account for the different performance I characteristics of the new pumps. The team was informed that the occurrence of a LOCA coincident with a major service water system header rupture was beyond the current licensing requirements; there-

' fore, the analysis was not performed. Irrespective of what current licensing requirements are, the Indian Point 3 FSAR committed that the plant can sustain a LOCA and a passive failure of a single service water header. Therefore, NYPA must either demonstrate that this commitment is met or they must modify their FSAR accordingl During the inspection of July 13-14, 1987, the team found one scena-rio where this commitment could not be met. If the break is postu-lated in the essential service water header upstream of the pump discharge check valves, service water flow would be lost to 2 of the 3 emergency diesel generators. Two diesel generators are required in j the event of a LOC NYPA must assess the performance of the new service water pumps following other initiating event Since the replacement new pumps 1 have 10 feet less available NPSH than the original pumps, they are

'

potentially more susceptible to cavitation during runout condition l Therefore, the capability of these pumps to perform following other initiating events plus a single active failure may not be assure (See Section 2.3.2 below)

-

-14-i

_

-

.

..

.

-

2.3.2 The service water pumps were intended to be replaced with pumps of a different design without assessing the NPSH and potential runout conditions which may exist following a LOCA during the manual transfer to long term recirculation concurrent with a single active failur Design activities associated with the service water pump modifica-tion, MOD 86-03-096 SWS, implicitly assumed that the highest flows for a pump will be upon initiation following a LOCA and a single active failure (i.e., one pump fails to start). Although this is a condition that the essential service water pumps must satisfy, conditions upon shifting to recirculation also must be satisfie The service water system is normally separated into essential and nonessential headers. Six service water pumps supply water to the two discharge headers. By manual valve operation, the essential

-

loads can be transferred to the nonessential header and vice vers The essential loads are those which must be supplied with cooling water immediately in the event of a LOCA. The essential loads include safety-related loads as well as critical balance of plant (BOP) loads. The nonessential loads are those which are needed to support power operation but not immediately needed at the time of a LOC The nonessential loads include the component cooling water (CCW) heat exchanger which removes heat from the residual heat removal (RHR) system and is the containment heat sink during the recirculation phase of safety injection following a LOCA. At the beginning of the recirculation phase of safety injection, at least one cor.ponent cooling water heat exchanger is placed in service by the startup of one of the service water pumps on the nonessential header. Since the Technical Specifications only require two nonessential pumps to be operable and emergency procedure ES- (Transfer To Cold Leg Recirculation) does not isolate nonessential heat loads from the service water header prior to starting a

_ nonessential service water pump, the single pump may experience runout flows. Should the second pump fail to start (the assumed single active failure) the single nonessential pump would experience

. runout for 4 prolonged period resulting in the loss or degradation of flow to the CCW heat exchanger. Furthermore, considering all the parallel flow paths and the fact that nonessential loads are not isolated from the service water header prior to starting a service water pump in the nonessential header, it is unlikely that a single service water pump could provide the design flow to the CCW heat exchanger, thereby reducing post-accident containment heat remova This concern, that safety-related nonessential pumps may experience runout flows and potential damage prior to operator action to limit nonessential loads, should have been assessed in view of the fact that the available NPSH of the new pumps is 10 feet less than that of the replaced pumps. Although NYPA decided to reinstall the original pumps, these questions are equally valid for the original service water system design. This item is currently being reviewed by the licensee's engineering organization and should be resolved prior to restar .3.3 A verified calculation had errors which should have been detected during the checking and verification proces '

-15-

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

_ _ _ _ .

. .

[.

~.

I: Calculation 6604-0221-3-BR-02,-125 Volt DC Load Study, Rev. O, l 8/30/85 was prepared to support modification 85-03-075, which replaced original design 7.5 kVA safety-related inverters of battery l 31 and 32 with larger 25 kVA inverters. This calculation had been !

l checked, but it contained the following error !

'

)

The calculation listed the total emergency loads on the dif-ferent buses fed from the battery; however, it appeared that the load profile developed in this calculation may have left out 3 l of 4 buses amounting to a potential error of about 25 percent of the I load. Specifically, the calculation includes a tabulation of j loads connected to battery 31 in section A.1 of the calculatio '

However, the team could not correlate the load profile developed in section A.2 of the calculation with the load data in section J In response to the team's concern, the licensee was able to 1 generate additional supporting data that they used to clarify the tabular data and convert that into the load profile included in the calculatio *

To demonstrate that the battery chargers have sufficient capacity to carry de loads and recharge the battery within 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> per an FSAR commitment, a calculation was prepared to determine the available output of the inverters to the ac vital instrument buses. However, the results for the maximum output available in kVA of the new inverters is overstated because values used in calculating the output were not conservative with respect to the calculation objective (i.e., to determine inver-ter output at a reduced de bus voltage and at an inverter efficiency corresponding to that output). An equation presented as Note 1 in the Summary / Conclusion section of the calculation

.. uses a value for available de bus voltage of 125 volts when the voltage will be much lower (approximately 10 percent) due to the battery discharge condition. In addition, the equation uses an inverter efficiency corresponding to a fully loaded inverte Since the inverter will not be fully loaded, the efficiency will drop by 10 percent to 15 percent corresponding to approximately its half loaded condition. Therefore, the maximum output at the inverter must be initially limited to approximately 8.8 kVA

. instead of 11.5 kVA as stated in the calculation to permit charging of depleted battery within 15 hour1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> Voltage assessments at intermediate steps on the load profile incorrectly used a value of available Ampere-hours per positive -

. plate based upon a permissible cell voltage of 1.75 volts. This cell voltage corresponds to the original 60 cell battery and not the existing 58 cell battery which has a permissible cell voltage of 1.81 volts. The final step in the load profile used a slightly different method which avoided this erro .3.4 Motors on two valve operators were going to be replaced with new motors without assessing the effects on motor overload protection even though nameplate data differe '

-16-

_ _ _ _ - . _ _ _ _ _ _

_ __ _ _ _ - _ _ - _ _

-

-

.

, . .

.

"

. A material substitution evaluation, MSE 87-3-060 RHR, was performed to demonstrate that replacement of existing Limitorque motor operators for RHR valves 730 and 731 with new qualified operators did i not degrade the existing installation and operation of the subject '

valve A material substitution (i.e., the installation of components equal to or better than those of the original item) is not considered a modification at Indian Point Unit 3 but rather a replacement. Although nameplate data for the new motors differed from the motors being replaced, MSE 87-3-060 RHR was reviewed and approved without assessing the adequacy of motor overload protection and without detecting information errors in the evaluation. A thorough review would have determined that the original overload protection was oversized. It appears to the team that the original protection may have been selected based upon a continuous duty motor, not on a short-time duty motor consistent with a valve operator applicatio Preliminary analysis conducted by the team using actual motor name-plate data and the time-current curve supplied by the licensee indicates that the existing thermal overload relay heaters for RHR valves 730 and 731 would permit the motor to draw 110 percent locked rotor current for approximately 21 seconds. The motor manufacturer recommends that the locked rotor current be limited to 10 second It is estimated that the overload relay protection for the replace-ment motors is at least 5 sizes too large (i.e., approximately 60 percent higher than required) to adequately protect the motors from locked rotor current and still allow sufficient margin over the required operating time for valve strokin To assess the generic implications, the team reviewed the overload heater sizes existing on valve circuits associated with modification 84-03-037 MUL This completed modification replaced the motors on

_ RHR valve 744 and CCW valves 769 and 79 Like the previous example, the motor manufacturer recommends that the locked rotor current be limited to 10 seconds. The thermal overload relay heaters for RHR valve 744 are sized to permit the motor to draw 110 percent of locked rotor current for approximately 17 seconds. For CCW valves 769 and 797, the thermal overload heaters are sized to permit the motor to draw 110 percent of locked rotor current for approximately 140 second !

I Based upon these findings, it appears that inadequate motor operated j valve electrical protection is a generic problem at Indian Point Unit 3 and could result in undetected damage to safety related valve motor .3.5 Technical approaches to assess the adequacy of the pipe support I system from the pressurizer to the surge tank following safety and relief valve transients were inconsistent with licensing commitment Modification package 86-03-009 RCS relocates, modifies, and elimi-nates piping supports from the pressurizer safety and relief valve discharge line to the surge tank originally required to support the line during safety and relief valve transient Two deviations from licensing commitments were found, namely: (1) the use of a less

-

- _ _ _ _ - _____

_ _ . __

, ,_ _

-

.

..

.

"

conservative base plate qualification approach in response to IE Bulletin 79-02 as described in a letter from P.J. Early (NYPA) to B. H. Grier, OIE, Region I, USNRC dated July 6, 1979 (PIN-79-45) as I well as a letter from J. R. Schnieder (NYPA) to B. H. Grier OIE, l Region I, USNRC dated December 7, 1979 (IPN-79-P9) and (2) the use of l

ASME Code case N-411 for pipe dampin Calculation No. 840223-CA is a pipe support calculation for modifica-tion MOD 86-03-009 RC Several of the support base plates were evaluated consistent with the methodology presribed in the licensee's commitment to IE Bulletion 79-02. However, the base plate evaluation for 8 supports (RC-R-343-4A-H, RC-R-343-4B-H, RC-R-343-105-H, RC-R-343-106-H, RC-R-342-106-H, RC-R-70-204-R, RC-R-70-205-R and i RC-R-70-206-R) were performed with a less conservative approac If the methodology of IE Bulletin 79-02 is applied to the supports in question, then some of the anchor bolts are inadequate. Although the use of the alternate approach may be technically acceptable, relaxa-tion of a licensing commitment should have been obtained from NRC prior to performing the modificatio The differences in the two methodologies are summarized belo IE Bulletin 79-02 Alternate Response Criteria Plate Flexibility b/t 5 2 b/t i 6 Prying Factor (Note 1) Not Used (Note 2)

1.67 Shear-Tension Inter-action Relationship

[fh+/s ) ~< 1 [ f g.67

\ Fa/

+ s -<y

-

( Fa / ( Sa / Sa (Note 3)

where b = distance from edge of rigid attachment to edge of plate t = plate thickness f = actual tension stress of bolt Fa = allowable tension stress of bolt

'

s = actual shear stress of bolt Sa = allowable shear stress of bol Note 1 The prying factor is used to account for anchor bolt load secondary effect Note 2 Where a prying factor was not used, anchor bolt loads were conservatively predicted by considering the resisting moment arm to be the distance from the anchor bolt to the far edge of the rigid attachmen _ _ _ _ - _ _

_-- _ ___ _

_;;_ _ _ _ _ _ .

"

Note 3 The shear-tension interaction relationship is used to evaluate anchor bolt adequacy.-

The use of Code' case N-411 was generically endorsed by the ASME for plants confonning to the 1984 edition of the code. 'However, the code of record is ANSI B31.1,(1967 for.the piping in question at Indian Point Unit 3. The piping was originally l

designed for 1/2 percent critical damping. Code case N-411 l' specifies a variable damping; varying from 5 percent damping for frequencies less than or equal to .10 Hertz, then linearly decreasing to 2 percent dar. ping for 20 Hertz and 2 percent damping above 20 Hertz. .The use of Code case N-411 results. in L substantially higher damping than the original plant licensee and.as a result the piping system is designed to withstand lower

, seismic accelerations. Prior permission for relaxation of this L licensing connitment should have been obtaine The licensee responded by requalifying the piping system to its {

original design commitment of 1/2 percent critical damping. The '

higher acceleration levels results in the addition of snubbers and strengthening of some pipe support During the team's reinspection of July 13 and 14,1987, the licensee indicated his intention to seek NRC acceptance of the {

'

1ess conservative base plate evaluation method on the basis that it is consistent with current industry practic . Heat tracing was planned to be installed for freeze protection on the new service water screen wash water supply line without a design ,

,- calculation to confirm its adequac J f

~

Modification package 86-03-096 SKS added a new service water travel- )

ing screen and a new screen wash system. The new wash water supply line was designed to be protected from freezing by heat tracin However, the licensee could not define the basis for the selection or a'dequacy of the freeze protection proposed on the new wash water lines. The installation drawing (860726-FE-531, Rev. 2 Intake Structure Conduit and Equipment Installation Section and Details)

contained conflicting infonnation regarding the position of the heat tracing cable and failed to identify how much heat tracing tape was

-

required per foot of pipe. Analysis performed by the licensee during the inspection confirmed that the proposed heat tracing would provide sufficient heat to protect the line from freezin , Design Document Control During the inspection, the team requested and reviewed numerous controlled documents. The team found no instances were obsolete i revisions of documents were being used by design personne Therefore based upon the team's observations, the design document controls imposed appear to be adequat !

One minor weakness was observed in the drawings issued for construc- !

tion of one modification. Modification 86-03-018-SWS replaces existing nonsafety-related service water outlet flow indication loop

-

-19- l

- _ _ _ _ _ _ - _ _ _ _

___ _ ___ _ _ _ _ _ _ - - _ _ _ _ _ - _ - _ ,

a

.

..

!

-

with a loop consisting of environmentally qualified components, including interconnecting cable. Included as part of the drawings issued for construction were Bill-of Material drawings that itemized the specific components which were required to complete the modifica-tion. For some components, the detailed material requirements were missing and nothing on the drawing indicated that the missing infor-mation would be supplied later. In addition, the drawing was incor-rectly identified as nonnuclear safety-relate Document control procedures apparently do not provide for " HOLD" or

"LATER" notations on documents which would permit the design process to continue on schedule while other information is being finalize The consequences are that drawings can be released for construction

- with missing information and no tracking mechanism exists to ensure that the work is completed correctl In the instance identified

,

above, the procured material was appropriate for its application and the lack of detail material requirements did not result in an inadequate installatio .5 Design Change Control and Modification Closecut Procedures for design changes to an approved design must be docu- l mented and information concerning the change transmitted to all  !

'

affected persons and organizations. Engineering change notices (ECN) were used at Indian Point Unit 3 to accomplish design changes to active modifications. After the modification is installed, tested, and the system returned to operations, the modification i'

package is closed out and affected documents revised to reflect the as-built condition. A weakness was found in the closeout of modifi-cations in that not all affected documents, procedures or the controlled list were being revise It appears that the root cause is a less than thorough assessment of affected documents and proce-

,,

dures from modification inception to completion. The failure to revise affected documents and procedures could cause incorrect operator action, introduce design errors and limit the ability to

.obtain a clear understanding of the design base The following examples demonstrate the team's concer . Following completion of a modification in 1982 to the containment fan coolers, not all affected documents, procedures, or setpoints were revise Modification 31-03-055 FCU replaced the cooling coils in the containment fan coolers with coils having an improved heat transfer characteristics. As a result the throttled flow through each cooler was reduced to 1450 gpm to 1500 gpm from the original throttled flow ,

of 2000 gpm. The following documents, procedures, and setpoints were  !

not revised:  !

The setpoints for fan cooler low flow alarms (bistables .

FC-1121-5 th"ough FC-1125-5) were not revised and remained set  !

at 2015 gpm (i.e., 36 mA input) in accordance with Loop Instrument Calibration Document, F-1124, dated May 7, 197 This error, if left undetected, could have confused or misled the operator during a design basis event requiring safety injectio The flow alarm was not armed to announce unless a low

-

-20-

_ - _ _ _ _ - _ _ -

- ----- - - - - -

_ , _ _ .._

..

..

...

-

flow condition existed simultaneously with an Engineered i Safeguards system initiation signal. Therefore following a

'

LOCA, the alarm would have sounded in the control room indicat- i ing insufficient containment fan cooler flow even though

'

adequate cooling water flow may have been present. Post-modifi-cation testing did not detect this omission, because testing was not performed during simulated Engineered Safeguard system operation. However, interviews with plant personnel indicate that a low flow alarm has not been observed during any plant surveillance test or during the course of transients involving Engineered Safeguards system operatio *

The alarm response procedures (ARP-5, Rev. 7, November 7, 1985)

for safeguards panel SBF-2 indicates that the containment vent

.

fan cooling water low flow occurs at 2200 gp Standard operating procedure, SOP-RW-6, establishes the method for balancing flow through the containment fan coolers by throttling the discharge valves. Revision 0, in effect when the modification was installed throttled the valves to obtain 2000 gpm per cooler. It was revised to obtain 1950 gpm. This procedure was again revised on March 20, 1985 to a flow of 1200 gpm (plus 50 minus 0) based upon an incomplete engineering evaluation. Inspection of the valves indicated that the valves are throttled approximately 75 percent open. Post-modification results seem to indicate that a 75 percent open throttle posi-tion corresponds to 1450 to 1500 gpm per cooler. During the inspection the licensee was unable to determine if the procedure had ever been used since being revised in March of 1985. This procedure error is further discussed in Section 2.7 of this repor *

_ FSAR Section 9.6 was not revised to reflect the reduced fan cooler flow. The FSAR discussion states that containment fan coolers require 2000 gpm per cooler during the recirculation phase of a loss of coolant acciden FSAR Table 9.6-1 (Sheet 1 of 2) states that the five fan coolers require 10,000 gpm (5 fan coolers at 2000 gpm) during the injection phas . Following completion of modification 80-3-055, the de single-line diagram 9321-F-30083-27 was not revised to reflect the removal of the SkW Rod Position Control Rack primary inverter. This load was still indicated on the latest de single-line diagram. This oversight did not result in a design error in calculations and modifications reviewed by the tea In fact, this load had not been included in the 1981 battery sizing calculation. However, incorrect key design drawings may lead to personnel confusion or erro .6 Safety Evaluations and Deportability Analyses 10 CFR 50.59 requires that safety evaluations be accomplished for design and procedure changes to determine whether an unreviewed safety question exists or whether a change to the Technical Specifi-cation is involved. The licensee's requirements for performing safety evaluations and the specified technical content appear to be ,

'

-21-L___ - _ _

__

-

l

. *

. :- ,

"

adequate; however, weaknesses were found in the implementation of those requirements as discussed in the following subsection . The nuclear safety evaluation (NSE) 86-03-096 SWS for the service water system upgrade states that the new service water pump perform-

)

ance parameters under the worst case conditions (i.e., injection phase) were evaluated to assure that the service water system design )j requirements were met. However, the calculation used as the basis for ;

the NSE statement was incorrect and did not confirm that the pumps were adequate for other initiating events or operating conditions potentially more severe than that analyzed (See 2.1.2, 2.3.1, and 2.3.2 of this report).

Likewise the NSE concluded that the service water pump and its I mounting were evaluated for integrity during a seismic event so that the structural integrity of the service water pumps and motors is maintained. HoWEver, the seismic qualification report used as the basis for the NSE conclusion contained significant errors and did not confirm that the service water pumps could withstand a seismic event and remain operable (See sections 2.2.1 and 2.2.2).

2.6.2 A power level inconsistent with that stated in the FSAR was used in a I nuclear safety evaluation (NSE 81-03-055 FCU) for the fan cooler j units. This power level appears to have been used as the basis for i reducing the required service water flow rate through the fan coolers thereby reducing the heat removal capability of the fan coolers. The NSE cites information from a vendor parametric study and post- i modification testing results confirming that at a minimum flow of 1400 gpm/ cooler the new fan coolers was equal to or better than the original unit However, the parametric study was based on the licensed power level of 3025 MWt rather than the value previously j

~

assumed in the FSAR accident analysis of 3216 MW !

{

The NSE indicates that if the power level used in the analysis were j reduced from 3216 MWt to the current licensed value of 3025 MWt, then I a lower post-LOCA heat removal rate of 49.0 E06 BTU /hr/FCU could be justifie The plant heat removal systems were designed for the turbine guaranteed rating of 3083 MWt and the portions of the safety analysis dependent on heat removal capacity of plant and safeguards ,

~ systems assumed the higher, maximum calculated power of 3216 MWt, as l did the evaluations of activity release and radiation exposure for the design basis accident. The FSAR design basis value for the heat removal rate of a fan cooler is 76.32 E06 8TU/hr/FCU based on an l assumed power level of 3216 MW This heat removal rate is also d identified in section 5 of the Technical Specifications concerning the design features of the Containment System. While the inspection team did not review containment analysis used to validate the heat removal capacity of 49.0 E06 BTU /hr/FCU, as a mimimum, the NSE should have recongnized and addressed the discrepancy between the current analysis, the FSAR, and the Technical Specification .6.3 The team noted a failure to perform a NSE for changing the setpoint of the turbine generator lube oil temperature control valve from 115 degrees F to 105 degrees l

-22-

_ _ _ _ - - . _ _ _ _ _ _ _ _ _ - _ _ -

_

-

,

..

.

..

This change occurred a number of years ago and was apparently unknown to engineering. The setpoint appears to have been changed by operations or maintenance without determining the consequences of i increased flow to critical BOP loads and the potential for reduced flows to the safety-related load The team is concerned that setpoints at IP-3 may not be controlled adequately. Although controls appear to be in place, it does not appear that they were used in this instance. This oversight also reflects a weakness in determining when a safety evaluation is require .7 Post-Modification Testing The adequacy of test and test control for modifications installed during this outage will be assessed as part of the testing inspec-tion. However, post-modification test results for some completed modifications were reviewed during this inspection to determine whether values used as inputs into design calculations accurately reflect the as-installed system Post-modification test results for MOD 81-03-055 FCU were reviewed to determine the throttled service water flow through the containment fan coolers. It was found that the acceptance criterion for that test was incorrectly determined. However, the throttled flow was set acceptably to meet the revised containment fan cooler design basis. Results of test ENG-84, Rev. O, indicated that the fan cooler  !

discharge valves were throttled to maintain between 1450 and 1500 gp The reults were reviewed by the licensee in 1982 and found to be acceptable as long as the flows exceed a minimum value of 1300 gp Preliminary analysis performed by the licensee during the inspection indicates that the calculated containment peak pressure increases to 43.34 psig from 40.6 psig for the accident conditions of lower fan cooler heat removal rate in combination with the higher power rating i (i.e., 3216 MWt). Although the peak calculated containment pressure does not exceed the containment design pressure of 47.0 psig, the margin of safety as described in the FSAR had been inadvertently 1 reduce .8 Incorrect FSAR Analysis '

During the reinspection of July 13 and 14, 1987, the team examined i

'

the capability of the reinstalled original service water pumps to 0 provide the flows described in the FSAR Section The FSAR provides an analysis which indicates that the original service water pumps (being reinstalled during this portion of the inspection) have

,

!

sufficient capacity to provide cooling water loads during a LOCA ,

concurrent with a service water system header rupture. The team i determined that, the model used in FSAR analysis does not reflect the  !

installed plant condition For example, the FSAR analysis takes  ;

credit for backflow through the diesel generator coolers even though j installed check valves will prevent this backflow. For an essential >

header rupture between the check valve SWN-100 and the pumps, all

-

'

-23-I

. _ _ _ _ _ _ _ _ _

_. _ . _ _ _ _ _ _ _ _ _ _ _ . .___ _ _ ___ _ _ .

.,

'::.

"

essential service water will.be lost. Nonessential service water will flow through diesel generator cooler 31; however, backflow will not occur.through the other diesel generator coolers.because of the closed check valve between the coolers and the break locatio In addition, the team determined that the FSAR analysis also used extrapolated pump performance characteristics which may not be conservative. The FSAR analysis predicts flows from the pumps as high as 7830 gpm. Review of the vendor's pump head curve (Curve N revised in August 29, 1974 to add NPSHR & upthrust curves)

indicates that the last test point was at 6500 gpm. In performing the LOCA/ break evaluation, the NPSHR curve was extended to obtain extrapolated information. The team is concerned that the extrapola-tion of the NPSHR curve well beyond the tested condition may under-estimate the NPSH require In summary, the analytical model used in the FSAR analysis does not reflect the as-installed plant conditio e Y-24-

_ _ _ _ _ _ - _ _ _ _ _ _ - . _ -

__

,

.

.

':; .

o INSPECTION FINDINGS INDICATIVE OF LICENSEE STRENGTHS During the inspection, the team observed many engineering and design activities in process or completed that were performed in a correct and consistent manner. The following observations are listed to identi fy positive area .1 The licensee's current effort to modify and upgrade the service water system during this outage and through future activities should significantly improve that system's performance and reliabilit These activities demonstrate a willingness to correct known inade-quacies and to iniprove performance. This same positive attitude was also observed in the attitudes of the licensee's staff when presented with design errors described in other sections of this repor .2 The detailed engineering, including flow model testing of the service water pump intake bays, should greatly improve the perform-ance of the intake system and structure. This engineering activity appears to be thorough and well execute .3 A program had been initiated prior to the inspection to reestablish the design basis of plant systems. This activity demonstrates a recognition by the licensee that design basis information is often difficult to determine when performing a modification. The observations of this inspection report reinforces the need for such a progra .4 The team reviewed the overall development of the methodology used to

-

solve the transient dynamic problem associated with the piping from the pressurizer to the surge tank MOD 86-03-009 RCS. The sophistica-

tion of the approach used and overall manner in which it was executed is indicative of a technically capable staf .

e

.

-25-

- _ _ _ _ _ _ _ - _ - _ i