IR 05000293/1997012

Insp Rept 50-293/97-12 on 971006-10 & 1119.Violations Noted. Major Areas Inspected:Eq Documents for EQ Equipment That Required Requalification Due to Containment Environ Changes Resulting from CS Flow Rate Reduction in 1988

ML20197K125
Person / Time
Site:	Pilgrim
Issue date:	12/17/1997
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:
Shared Package
ML20197K107	List: IR 05000293/1997012 ML20197K102 ML20197K110
References
50-293-97-12, NUDOCS 9801050221
Download: ML20197K125 (11)

Text

,- .. -- . . - . - - _ - -- .. -. . -.

.. ;

l

,

!

U.S. NUCLEAR REGULATORY COMMISSION

!

REGION I [

!;

Docket No: 50 293

i License No: DPR 35 I

Report No:- 50 293/97 12

'

I

'

Licensee: Boston Edison Company

,

Facility: Pilgrim Nuclear Power Station i

Location: . Plymouth, Massachusetts  ;

i Dates: October 610,1997 and November 19,1997  :

.

inspectors: Leonard Cheung, Senior Reactor Engineer .

Paul Looser, NRR (phrt time)

William H. Rutand, Chiei

'

Approved by: ,

i Electrical Engineering Breach .

Division of Reactor Safety ,

!

!

!

.

(

G PDR &

e

.)

.

EXECtlTIVE SUMMARY Pilgrim Nuclear Power Station NRC SpecialInspection Report 50-293/9712 This special inspection was conducted: (1) to review the environmental qui cation (EO)

documents for those EQ equipment that required requalification due to containment environment changes resulting from the containment spray flow rate reduction in 1988, and to deturmine whether compliance with regulatory requirements was affected for those requalification; 2) to revisit the potential unreviewed safety question (USQ) issue for the replacement and the subsequent modification of two 480/120 volt safeguard control transformers; and 3) to review corrective actions for the requalification of nine General Electric (GE) electrical containment penetrations. This report covered the result of a one-week onsite inspection by one regional based inspector and one and half days inspection by an NRR inspecto Engineerina

• The EQ equipment that required requalification due to containment environment changes resulting from the containment spray flow rate reduction in 1988 (Limitorque limit switches, Marathon terminal blocks, Kerite cable, Rockbestos cable, and the acoustic monitors for the safety relief valves) was qualifiable to the corrected post accident profile without requiring additional tests. (Section E2.1)

• From June 1993 to 1996, because of GE's calculation error, Pilgrim EQ files for the affected Limitorque components and the acoustic monitors did not contain the appropriate post accident containment temperature profile to which these components were required to be qualified to. However, the issue for the GE calculation error was documented in another NRC inspection report as an apparent EQ violation of 10 CFR 50.49(e)(1), which had sufficiently covered these EQ deficiencies. (Section E2.1)

• There were USQs for the replacement and the subsequent modification of two 480/120 volt safeguard control transformers. One apparent violation with two examples of 10 CFR 50.59 pertaining to USQs were identified. (Section E8.1)

• The requalification for nine GE electrical penetrations was acceptable. However, from March 1996 to April 1997, inese nine General Electric electrical containment penetrations, which were electric equipment important to safety, were not qualified in that the qualification methodology (thermogravimetric analysis and linear slope comparison analysis) used by Boston Edison had not been validated by test results to be equivalent to the method specified in the Guidelines for Evaluating Environmental Qualification of Class 1E Electrical Equipment in Operating Reactors, November 1979 (DOR Guidelines). This is a violation. (Section E8.2)

.

.

Renort Details f Symgp tof Plant Statut

;E w a special engineering inspection to review potential unreviewed safety questions j

ios two plant modifications and the environmental qualification (EO) documents for

, selected electrical e7uipment important to safety. Pilgrim was at full power during this inspection.

.

E2 Engineering Support of Facility and Equipment E Reaustification of EQ Eauloment inside the Containment Scope of inspection in 1988, the licensee reduced the containment sprey flow rate, which resultod in an increase of post accident containment temperature profile. In 1996,the licensee revised the service water design temperature from 65'F to 75'F, and later found that the 1987 General Electric (GE) calculation of the post accident containment temperature profile was incorrect (nonconservative). The inspector reviewed the EQ documents for equipment that required requalification due to the containment environment changes resulting from the containment spray flow rate change in 1988, and to determine whether compliance with regulatory requirements was affected, Observation and Findinas The licensee stated that the components that required requalification, in addition to the GE electrical containment penetrations, included: Limitorque limit switches, Marathon terminal blocks, Kerite cable, Rockbestos cable, and the acoustic monitors for the safety relief valves. These components were used for post accident monitoring (Regulatory Guide (RG) 1.97 items) only, which required the components to be functional for 30-day post accident. These components, except the acoustic monitors, were located inside the Limitorque actuator switch housing. The switch housing also contained other components which were used for valve controls, but were not required for post accident monitoring function. Therefore, those other components did not required requalificatio The licensee provided for the inspector's review a Boston Edison Company (BECo)

!ctter to the NRC (BECo 93 030), dated March 1,1993. This letter indicated that the licensee committed to complete the RG 1.97 program by refueling outage N (March to June,1993).

The licensee stated that all Limitorque components were tested for 30 days with temperature and pressure profiles higher than (enveloping) the required (corrected)

accident profiles. The only parameter that was not enveloped was the 30-day post-accident total radiation dose,2x10' rads tested gamma radiation vs 5x10' rads (gamma + beta) dose. The inspector's review of the Limitorque test results

. _ . _ _ _ _ _ . _ _ . _ . _ _ _ _

• .

confirmed the above statement. The licensee first tested (by Wyle Laboratories) the Limitorque components in May 1993 to the accident profiles, in 1996, when the licensee learned that the 1987 General Electric calculation for the containment temperature profile was incorrect, the licensee retested the affected components using the corrected temperature profile, without changing the already tested radiation dos During this inspection, the licensee conducted an evaluation (justification) and determined that the 1996 retest was not really required to demonstrate the requalification of those components and therefore they considered these components qualifiable to the corrected containment temperature profile according to " Guideline for Evaluating EQ of Class 1E Electrical Equipment in Operating Reactors" (DOR Guidelines), which allowed qualification for radiation by analysi The inspectors reviewed this evaluation and found it acceptabl The inspector also reviewed the EQ Evaluation Sheets (EQES) and the test report for the acoustic monitors, which were supplied by Technology for Energy Corporation

'(TEC), Knoxville, Tennessee. The test report entitled " Addendum to Qualification Test Report 517 TR-03,BWR LOCA/MSLB Qualification of TEC 1414 VFM for-Containment Requirements," Revision 3, dated January 18,1983, was an addendum to the original test report that was used previously to demonstrate the ,

qualification of the acoustic monitors. The temperature profile in the original test report required linear slope analysis (Arrhenius methodology) to cover the post-accident temperature profile. During the NRR review of the qualification of GE electrical penetration (detail discussed in Section 8.2), the NRR reviewer asked the licensee to provide basis for alllinear slope analyses that had been used at Pilgrim to demonstrate equipment qualification. The licensee subsequently obtained the addendum test report from the vendor. The tested temperature profile (400'F for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> + 350'F for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> + 315'F for 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> + 300'F for 32 days) in the addendum test report completely enveloped the Pilgrim post accident temperature profile. The inspector agreed that the acoustic monitors were qualifiable to the corrected post accident profiles without involving additional testin . Conclusion The inspector concluded that the reviewed RG 1.97 equipment (Limitorque limit switches, Marathon terminal blocks, Kerite cable, Rockbestos cable, and the acoustic monitors for the safety relief valves) was qualifiable to the required (corrected) post accident profile without requiring additional tests. The inspector also concluded that from June 1993 to 1996, because of General Electric's calculation error, Pilgrim EQ files for the affected Limitorque components and the acoustic monitors did not contain appropriate post accident containment temperature profile to which these components were required to be qualified t The issue for the GE calculation error was documented in inspection report 97-05, section E1,8 as an apparent EQ violation of 10 CFR 50.49(e)(1)(eel 70005-05),

which had sufficiently covered these EQ deficiencie .. - - ... . - - . - - .

.

E8 Miscellaneous Engineering issues (92903)

E8.1 (Closed) Unresolved item 97-08 08: Unreviewed safety questions (USO) in the replacement and modification of the safeguard control transformers. In 1992, the licensee replaced, without prior NRC approval, four standard 480/120 volt stepdown transformers (X56, X57, X58 and X59) with microprocessor controlled regulating transformers. The microprocessors were Motorole MC68705R, 2.1 megahertz,8 bit processors. The transformers were manufactured by Rapid Power Technologies, and were purchased commercial grade. The transformers were dedicated for safety related application by a third party (RAM-Q Industries),

that is no longer in busines Two Boston Edison (BECo) safety evaluations (SE 2706 dated September 14,1992, and SE 2750, dated March 31,1993) were used to support the transformer replacement. Two of these transformers (X55 and X56) were used to supply power to redundant safeguard control panels Y3 & Y4, and Y31 & Y41. The inspector's review of the two safety evaluations revealed that the licensee f ailed to address potential failures of the microprocessor and its associated software (or firmware),

and f ailed to check for unintended function On April 1,1997, a weather induced voltage transient on the 500 kV transmission system resulted in shutting down both transformers, and causing a loss of power to redundant instruments and controls (for example, service water pump pressure controls, hydrogen and oxygen monitoring isolation valves). Investigation by the licensee revealed that the redundant transformer shutdown was caused by an unknown and unintended trip function (i20% of specified input voltage) of the microprocessor The inspector reviewed Pilgrim Final Safety Analysis Report (FSAR), section 8.8.3, Safety Design Basis for the 120 Vac safeguard control subsystern, Revision 9, dated July 1988, which was effective during the time when both modifications (replacements of transformers and microprocessors) were implemented. Section 8.8.3.4 of the FSAR stated that the 120 Vac safeguard control subsystem was designed and installed in accordance with IEEE-279 Standard. lEEE 279 Standard cection 4.0, e nel Independence, required that the signals from both channels to be independer accomplish decoupling of the effects of electric transient Section 8.8.3.J of the FSAR stated that the 120 Vac safeguard control subsystem was arranged so that no single component f ailure would prevent the system from providing power to the hydrogen / oxygen analyzer subsyste CFR 50.59(a)(1) states that a licensee may make changes in the f acility as described in the safety analysis report, without prior NRC approval, unless the proposed change involves an unreviewed safety question (USQ). 10 CFR 50.59(a)(2) states that a proposed change !s deemed to involve a USO if a possibility for a malfunction of a different type than any evaluated previously in the safety analysis report may be create *

.

However, as of March 1997, the licensee's replacement (in 1992) of two transformers (X55 and X56), which provided the 120 Vac power to the safeguard control subsystem, without prior NRC approval, involved a USO in that both new transformers contained an unintended trip function (due to voltage transients) which had actually occurred and caused a common-mode rnalfunction (power loss) of both transformers on April 1,1997; this event had caused the loss of the redundant signals for the control of the service water pumps, and for other control function The unintended trip function could also be initiated by a single component failure, such as a failure of the circuit breaker controlling the offsite power supply, causing a loss of power to both channels of the hydrogen / oxygen analyzer subsystem. This condition (malfunction of a different type) was not previously evaluated in Pilgrim FSAR or the licensee's safety evaluations (SE 2706 and SE 2750). This constituted an apparent violation of 10 CFR 50.59 (a)(1), (eel 50 293/9712 01)

Following the April 1,1997, event, the licensee replaced the microprocessors, also without NRC prior approval, on April 12,1997, with units that had been modified to remove tbn 120% input voltage trip function. The microprocessors were commercial grade items. A BECo safety evaluation (SE 3001 dated April 10,1997)

was used to support this microprocessor replacement. The inspector's review of this safety evaluation indicated that the licensee again failed to investigate into the hardware and software of the microprocessors, such as vendor configuration management, coding standards, and life cycle issues. Although one unintended trip function (input voltage transient) was eliminated, the remainder of the software was unknown, and other voltage transients such as harmonic distortion or noise were not addressed. There was no validation and verification for the sof tware that was available for the ;nspector's review. The inspector determined that the safety evaluation was inadequate to reach the conclusion that no USO existe The testing performed by the licensee during the commercial grade item dedication was limited to intended functions only. No tests were performed to demonstrate that no unintended functions existed in the microprocessor. The inspector's review of vendor manual for the regulating transformers, V 1184, Revision 1, indicated that the microprocessor would shutdown the transformer for three other conditions:

high temperature, overcurrent, and silicon controlled rectifier (SCR) firing error There were no tests or surveillance to confirm the accuracy of the high temperature and overcurrent shutdown values. These were additional modes of f ailures that could result in the loss of safeguard control power supplies that had previously not existed with the original distribution type transformers. The inspectors concluded that the testing was insufficient for commercial grade item dedication. The inspectors concluded that the inadequato testing program was a result of the root causes of the apparent 10 CFR 60,59 violatio On April 26,1995, the NRC issued Generic Letter (GL) 95-02, Use of NUMARC/EPRIReport TR 102348, " Guideline on Licensing Digital Upgrades,"in Determining the Acceptability of Pe forming Analog to-DigitalReplacements under 10 CFR 50.59. This document provided guidance on the staff position that the system level f ailures to be evaluated for failures of a different type than previously reviewed "should be the digital system being installed." Further, GL 95-02 also

-

l l

stated: "If during the 10 CFR 50.59 determination there is uncertainty about....whether the probability of a different type of malfunction may be created, j the uncertainty should lead the licensee to conclude that a new type of malfunction may be created....lf the uncertainty involves whether or not this modification is more or less safe than the previous analog system, or if no degree of safety had been determined, a USO is involved."  ;

The inspector concluded that the above condition constituted a second example of apparent violation of 10 CFR 50.59 (a)(1). (eel 50 293/9712 01)

Af ter being notified of the USO concern, the licensee completed an operability determination (Justification for continued operation (JCO)) on October 9,1997, and concluded that the transformers were operable. The conclusion was based on operating and industrial experience, and that in case both transformers were ;

shutdown, the shutdown function could be easily bypassed manually, because those transformers were r; ear the main control room, and the operators were trained for this task. The inspector reviewed this JCO and found it acceptable. The licensee stated, on a telephone conversation with the inspectors on December 3, 1997, that their JCO and the station procedures dealing with degraded and nonconforming conditions was based on the pre Revision 1 (dated October 8,1997)

version of Generic Letter (GL) 91 18,Information to Licensees Regarding NRC Inspection Manual Section on Resolution of Degraded and Nonconforming Condition On November 21,1997, an enforcement conference was held to discuss multiple apparent violations identified during inspection 97 05, in that conference, these two apparent violations (USO discussed above) were also discussed. The licensee also presented the corrective and preventive actions (both completed and planned)

for this USO issue. Only one planned testing (electro-magnetic interference (EMI))

was discussed in the conference. On Decernber 3,1997, the inspector referred the licensee (Mr. D. Ellis) to inspection Report 97 07 and whether additional tests (for examples, high temperature, overcurrent, total harmonic distortion) should be included in their planned testing.

E8.2 [Clojied) Unresolved item 96-07 02: Environmental qualification (EO) of nine General Electric (GE) electrical containment penetrations (0100E, Q101B, Q102A&B, Q103A&B, Q105A&B, Q106B). During a July 1996 inspection (IR 96-07), the inspector noticed that the licensee had used the thermogravimetric analysis (TGA) to qualify the accident peak temperature in the containment. The basis for using TGA for this application was not addressed in detail in the licensee's analysis, such as the mechanical strength of the epoxy sealant and the containment pressure condition which could cause stress in the epoxy sealant. Since this was a new methodology for justifying the peak temperature for environmental qualification, the inspector requested NRR to determine its acceptability for this application,

.

.

The result of the NRR review indicated that TGA (weight loss methodology) for containment peak temperature together with a linear slope comparison analysis for the remaining temperature profile was not an acceptable method to demonstrate the EO of the electrical penetrations, because this method of qualification had not been validated by operating experience or test resuh Following the July 1996 inspection, the licensee informed the NRC that they had found another GE test report, entitled " Low Voltage Powar and Control Nuclear Containment Loss of Coolant Accident Qualification Test for 100 Series Electrical Penetration F02 Program," dated September 13,1973, that could be used to demonstrate, by similarity, the EQ of those electrical penetration l During this inspection, the inspector reviewed the EQ file for the electrical penetrations, which contained the 1973 GE test report. The licensee determined that both the tested penetration; and the installed penetrations used the same type of epoxy sealant, and therefore, determined that qualification by similarity was appropriat The inspector noted that the penetrations was tested to 340'F for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />,325'F for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, and 260*F for 10 days. The associated cables of the tested penetrations were energized at rated current during the first 30 minutes during the tes The inspector compared the Pilgrim accident temperature profile with the tested temperature profile to determine the acceptability of the qualification. For the first 30 minutes, where the tested penetration circuit was energized, Pilgrim's peak accident temperature of 334*F was enveloped. For the remaining duration where the tested circuit was not energized, the licensee completed a calculation (EODF DEF #98D, entitled " Penetration Conductor Heat Rise Evaluation," dated March 3, 1997) to determine the temperature rise of the energized conductors. The inspector superimposed this self heating temperature rise to the post accident containment .

temperature profile, and found substantial portion of this profile was not enveloped, as discussed below:

From the seventh hour to the fourteenth hour, the tested temperature (260'F) was about 34*F below the accident temperature profile (about 294*Fincluding heat rise). There was an additional portiori of about 19 hours2.199074e-4 days <br />0.00528 hours <br />3.141534e-5 weeks <br />7.2295e-6 months <br /> where the tested temperature profile was below the accident profil In response to the inspector's questions, the licensee provided a material analysis report performed by Attran Corporation, Boston, Massachusetts, entitled, " Oxidation degradation of polymeric materials," dated April 11,1997. This analysis provided a reasonable basis that the function of the penetrations' epoxy sealant would not be affected by the temperature difference discussed above, in addition, the licensee's

" linear slope analysis" (Arrhenius methodology, not for demonstrating total qualification) results showed that substantial margins existed in other time periods where the tested temperature profile enveloped the accident temperature profil _ . _

- . _ _ - . _ - . . -- - .-- = - - - - - - . - - - . - _

'

.

l

$

7  ;

The inspector's review of the equipment qualification evaluation sheets for those electrical penetrations indicated that sufficient evaluations had been provided for !

other parameters, such as radiation (including beta and gamma), chemical spray, >

and that the licenses had selected DDR Guidelines for the qualification for these ,

electrical penetrations. The inspector considered the qualification for those electrical penetrations acceptable. However, during the period from March 1996 to  ;

April 1997,the qualification of the nine affected electrical penetrations was not established in that the qualification methcdology (TGA and linear slope comparison  !

analysis) used by the licensee had not been validated by test results to be i equivalent to the method (type testing) in the DOR Guidelines. This constitutes a

,

violation of 10 CFR F20.49(f), which requires electrical equipment important to  !

safety to be qualified by one or more of_the methods specified in that sectio !

.(VIO 50 293/9712 02)

59 FSAR Reviews I A recent discovery of a licensee operating their facility in a manner contrary to the .

updated final safety analysis (UFSAR) description highlighted the need for a special, focused review that compares plant practices, procedures and/or parameters to the ,

UFSAR description ,

While performing the inspections discussed in this report, the inspector reviewed the applicable portions of the UFSAR that related to the areas inspected, including i FSAR section 8.8.3, that pertained to the safety design basis for the 120 Vac -

safeguard control subsystem. The inspector verified that other reviewed sections of the FSAR wording were consistent with the observed plant practices, procedures and/or parameter .

- XI Exit Meeting The inspector met with the licensee personnel at the conclusion of the site inspection on October 10,1997, and summarized the scope of the inspection and the inspection result No proprietary information was knowingly included in this report from those document ,

The licensee acknowledged the inspection findings e.t that meeting, ,

This inspector amended the exit meeting in a November 19,1997, telephone call to Mr. D. Ellis of BECo. The inspector stated that the potential EQ document violation for certain RG 1.97 items was deleted as discussed in Section E2.1c of this report, i

_ - - _ ,_ _ ._ __ __ _

-

.

O PARTIAL UST OF PERSONC CONTACTED H211on Edison Company J. Alexander, QA Manager E. Almerda, I & C Department Manager T, Boulette, Sr. Vice President - Nuclear B. Chenard, Electrical Engineering Manager S. Das, Senior Electrical Engineer N. Desmond, Manager Regulatory Relation Group W. DiClore, Maintenence and Project Manager N. Eisenmann, Senior I & C Engineer D. Ellis, Principal Engineer, Regulatory Affair J. Geroty, NESE Manager C. Gossard, Plant Manager C. Hickey, QA Engineer J. Keene, Department Manager Regulatory Affairs F. Mogolesko, Project Manager NESG H. Ohelm, General Manager, Tech. Section B. Rancourt, Senior i & C Engineer W. Riggs, NSG Manager D. Sitkowski, Senior Electrical Engineer T. Sullivan, Plant Manager J. laorming, I & C Department Manager L. Wetherell, Deputy Engineering Manager HBS R. Arrighi, Resident inspector R. Laura, Sr. Resident inspector INSPECTION PROCEDURE USED IP 92903 Followup - Engineering ITEMS OPENED, CLOSED, AND DISCUSSED Oooned 50 293/97-12 01 eel USO for safeguard control transformer replacement 50 293/97 12-02 VIO ' EQ of GE electrical penetrations C195td 50 293/96 07-02 URI EQ of GE electrical penetrations 50-293/97 08 08 URI USO for safeguard control transformer replacement

. .

.

LIST OF ACRONYMS USED BWR Boiling water teactor CFR _

Code of Federal Regulations DOR Guidelines Guidelines for Evaluating Environmental Qualification of Class 1E Electrical Equipment in Operating Reactors E Environmental qualification EOES- Environmental qualification evaluation sheet FSAR Final Safety Analysis Report GE General Electric IEEE Institute of Electrical and Electronics Engineers kV Kilovolt LOCA Loss of coolant accident MSLB Main steam line break NRR: Office of Nuclear Reactor Regulation

- UFSAR Updated Final Safety Analysis Report USO Unreviewed safety question Vac: Volt, alternating current

.

I

!

,

?

i

!

'

+

a

'

-

.

'

t

k y=,- g- .,- ,w.--,,.o y,---es w-- g wi 4.-g -+r g w.y-oy y y y ..,. W ,,4p.igw,<na-.ess.,g _ g e. --q sf y- % ,,~-y%w,y -gme.-9-9,w4 i. c-,w-g 9,g_, y. gA.'