IR 05000298/1998015
| ML20198J375 | |
| Person / Time | |
|---|---|
| Site: | Cooper  |
| Issue date: | 12/17/1998 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML20198J332 | List: |
| References | |
| 50-298-98-15, NUDOCS 9812300159 | |
| Download: ML20198J375 (100) | |
Text
_ . . . _ _ . - _ . ._.. . -.
- . . .. . _ . . _ . _ __ _ _ _ _.._. _ ...._.. __ _ _ _ _ . . _ .
!
ENCLOSURE 2 U.S. NUCLEAR REGULATORY COMMISSION' l
REGION IV
l
.
Docket No.: 50-298 I
i License No.: DPR 46 l
Report No.: 50-298/98-15 l Licensee: Nebraska Public Power District .,
Facility: Cooper Nuclear Station Location: P.O. Box 98 Brownville, Nebraska
,
Dates: May 4-22,1998, and June 8-26,1998 i
'
( .
l ' Inspectors: M. Runyan, Team Leader l R. Nease, Sr. Reactor inspector P. Goldberg, Reactor inspector R. Bywater, Reactor Inspector D. Pereira, Reactor inspector j
~ R. Hall, NRR Project Manager l J. Panchison, Contractor. ;
,
J. Leivo, Contractor
!~
Approved By: T. Stetka, Acting Chief, Engineering Branch Attachment: Supplemental Information L
!-
l l
!
!
i e
- i l-
"612300159 981217
,
_. ,
- - - - . . . . ~ . - - . . . - - - - - - . - . - - - - . - - - - . -
I
!
EXECUTIVE SUMMARY l
Cooper Nuclear Station I NRC Inspection Report 50-298/98-15 During the weeks of May 4-18 and June 8-26,1998, an engineering team inspection was conducted onsite. Additionalinoffice inspection was conducted through August 26,1998.
A safety system engineering inspection was performed for the diesel generators, vital ac electrical distribution system, and the control room emergency filtration system. The team also reviewed the status of various miscellaneous programs, which were planned or in progress.
Based on the feam's findings, the licensee's engineering program was functioning at an j adequate level of performance. The team concluded that, with several exceptions, the '
licensee's control and use of design and licensing input information, calculations, and modifications were satisfactory. The design criteria documents appeared useful for capturing the design basis and providing cross-references to calculations, drawings, modification history, licensing commitments, and other relevant documents.
'
It was noted that the majority of these discrepancies were historical in nature and not indicative of current engineering performance. The team noted that the licensee has developed a plan to address both these discrepancies and the existing old design issues.
However, many discrepancies were identified that indicated a lack of attention to detail. A large number of problems were found with engineering evaluations and calculations, including, for !
example, incorrect design input, improper references, and unsupported assumptions. !
None of the findings of this inspection challenged the operability of any plant components or systems.
Enaineerina
- Six examples of a violation of 10 CFR Part 50, Appendix B, Criterion V, were identified involving five examples of inadequate surveillance procedures and an example of a failure to implement a surveillance procedure (Sections E1.1.1.1, E8.8, E8.17, E8.29, E8.31, E8.39).
- Five examples of violation of 10 CFR Part 50, Appendix B, Criterion ill, were identified involving one example of a failure to control the application of loads on welding receptacles tied to the Class 1E ac electrical buses, three examples of a failure to correctly translate design inputs into calculations, and one example of a failure to verify that a calculation included all required heat loads (Sections E1.1.1.2, E1.3.1, E8.17, E8.31, E8.37).
. The selected design changes were found to be sufficiently detailed, accurate, and complete to support the modification process. The number of existing temporary modifications was considered high, and 14 temporary modifications were observed to have been installed for greater than a year (Section 1.1.4).
ii
- . -. - - . . - , - -
. - - .- - -. .-- .. . -- .
Modification packages were generally of good quality. However, a statement in the Technical Specification bases 'egarding the use of canisters ,in the control room emergency filtration system carbon filter beds, was not updated when a modification was performed (Section E1.3.4).
- A violation of 10 CFR Part 50, Appendix B, Criterion XI, " Test Control," was identified fer the failure to test the No.1 emergency diesel generator lube oil pump relief valve l
'
l following adjustment of its lift set point (Section E1.4).
. A noncited violation of 10 CFR Part 50, Appendix B, Criterion V was identified regarding !
inappropriate implementation of a surveillance procedure. This procedure, which l involved the number of starting air compressors needed for emergency diesel generator operability, was implemented prior to NRC approval of the improved technical speci'ications (Section E1.4).
i I l . The licensee's programs and procedures for conducting safety reviews, screens, and i
'
evaluations for changes to the facility in accordance with 10 CFR 50.59 improved since
! the last assessment. The 10 CFR 50.59 evaluations were of generally good quality.
i Several older evaluations were found to be inadequate. Contemporary evaluations performed for older Updated Safety Analysis Report changes or modifications were not
.
always rigorous in identifying the basis for the determination that an unreviewed safety l question was not involved (Section E2.1).
. The improved technical specification program was found to be using more rigorous methodology than was used in establishing current Technical Specification values and i the nonconservative errors in computed allowable values for the emproved Technical l Specifications had no effect on the current technical specification or its application l- (Section E2.2).
- While there was an overall upward trend in the engineering backlog Of problem l identification reports the overall progress associated with the engineedng document i reduction program was considered to be a strength (Section E2.3).
- Enforcement discretion was exercised, and a violation of 10 CFR 50.59, was not issued concerning the failure of a safety evaluation to identify that a change to the methods used to test the high pressure steam admission valves rendered these valves inoperable during testing, contrary to the Updated Safety Analysis Report. This discretion was l exercised because the issue was an old design issue that was identified and corrected by the licensee (Section E8.7).
- The licensee failed to recognize a significant heat transfer mismatch between the shell l
and tube sides of the residual heat removal system heat exchangers (Section E8.17).
!
!
.
A violation of 10 CFR 50.73(a)(2)(ii)(B) was identified for the failure to submit a !.icensee
event report for a condition involving diverse power to certain motor operated valves that i were outside the plant's design basis (Section E8.19).
. An example of a violation of 10 CFR 50.59 was identified concerning the failure of a safety evaluation to identify that a modification to the reactor equipment cooling system,
'
iii
!
!
- - - ~ . - . - - - - - . - ..-.. . . - . . - . - - - . . . . - . . . ~ . - . - . - _ . . . . . . _
E s
.
-
which established a continuous inventory loss, introduced an unreviewed safety ,
question (Section E8.30).
~
. Enforcemen' discretion was exercised, and a violation of 10 CFR Part 50, Appendix B, !
Criterion Ill, was not issued for a failure to translate the residual heat removal system
'
design basis into drawings, procedures, and instructions to ensure that the residual heat ,
removal system could meet its low-pressure-coolant-injection safety function. The
discretion was exercised because the issue was an old design issue that was identified j and corrected by the licensee (Section E8.40). ;
-
i Plant Suocort ;
t
.
- A noncited violation of Technical Specifications 3.19 and 4.19 was identified regarding . '
several examples of inoperable fire barriers and a failure to include some fire barners in !
the surveillance program (Section F8.2).
= ' A noncited violation of 10 CFR Part 50, Apperidix B, Criterion V, regarding an inadequate surveillance procedure, was identified involving remote operation of Valve
.RHR-MOV-M039B following a control room fire (Section F8.2), 1
!
l I
, iv
.
-
~, - - . ~. - - - - - - - . - . - - - - . - - -
I TABLE OF CONTENTS i i
! EXECUTIVE S U M MARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ii :
i :
,
Re port Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
'
!
l i
111. Engin ee ring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 E1 Conduct of Engineering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 E1.1 Emergency Diesel Generators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 E1.1.1 De sign Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 '
E1.1.1.1 Mechanical Design Review . . . . . . . . . . . . . . . . 1
- E1.1.1.2 Electrical Design Review . . . . . . . . . . . . . . . . . . 3 i
!
E1.1.2 Surveillance Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 E1.1.3 System Walkdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 E1.1.4 Modifications /femporary Modifications . . . . . . . . . . . . . . . . . . . 7 l E1.2 Class 1 E AC Power Distribution System . . . . . . . . . . . . . . . . . . . . . . . . 8 )
E.1.2.1 Design Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 j E1.2.2 Surveillance Testing Review . . . . . . . . . . . . . . . . . . . . . . . . . . 10 l l E1.2.3 System Field Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 l E1.3 Main Control Room Air Conditioning System . . . . . . . . . . . . . . . . . . . 11 l E1.3.1 Mechanical Design Review . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 .
i E1.3.2 Su rveillance Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 l l E1.3.3 System Field inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
- E1.3.4 Modifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . 15 l L E1.4 Problem Identification Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 E.1.5 Operability Evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 E1.6 Improved Technical Specifications Review . . . . . . . . . . . . . . . . . . . . . 19 E2 Engineering Support of Facilities and Equipment . . . . . . . . . . . . . . . . . . . . . 20 E2.1 10 CFR 50.59 Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 E2.2 Interim 10 CFR Part 21 Submitted by Licensee Regarding Errors in General Electric Set Point Calculations . . . . . . . . . . . . . . . . . . . . . . . 27 l E2.3 Engineering Backlog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
'
E2.4 System Engineering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 E2.5 Yea r 2000 Computer lssue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
,
E8 Miscellaneous Engineering issues (92903) . . . . . . . . . . . . . . . . . . . . . . . . . . 31
'
E8.1 (Closed) Unresolved item 50-298/9501-01: Acceptability of Single Check Valve for Containment Isolation of Reactor Building and Torus Vacuum R eli e f Lin e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
, E8.2 (Closed) Unresolved item 50-298/9624-03: Possible 10 CFR 50.59 l Violation Associated With Standby Liquid Control System . . . . . . . . . 32 E8.3 (Closed) Unresolved item 50 298/9624-05: Possible 10 CFR 50.71(e)
Violation Related to a Non Bounding Analysis involving the Radiological L
Consequences for an Anticipated Transient Without Scram . . . . . . . . 33
! E8.4 (Closed) Violation 50-298/9624-06: Failure to Torque Hydraulic Control Unit Scram Valve Capscrews as Required by Maintenance Instruction
.............................. .......................34 E8.5 (Open) Unresolved item 50-298/9624-08: Anticipated Transient Without
'
Scram Emergency Operating Procedure issues . . . . . . . . . . . . . . . . . 35 i
V
- _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - _ _ _ _ _ _ _
i E8.6 (Closed) Violation 50-298/9624-09: Failure to Promptly Identify and Correct Conditions Adverse to Quality Related to a Design Criteria Docu m ent R eview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 E8.7 (Closed) Inspection Followup Item 50-298/9624-10: Review Licensee's Disposition of Six Contractor-Identified Potential Condition Reports . . 40 E8.8 (Closed) Inspection Followup item 50-298/9624-12: Quality Assurance Program Requirements and Programmatic Weaknesses Regarding Standby Liquid Control System . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 E8.9 (Open) Violation 50-298/9624-14: Eight examples of 10 CFR 50.71(e)
failure to update the Updated Safety Analysis Report; and B. three examples of failure to conduct 10 CFR 50.59(b)(1) evaluations . . . . . 48 E8.10 (Closed) Unresolved item 50-298/9625-02: Acceptability of emergency diesel generator Cylinder Differential Temperatures . . . . ......... 54 E8.11 (Closed) Inspection Followup Item 50-298/9707-07: Determine Whether 10 CFR 50.59 Safety Evaluations Were Performed . . . . . . . . . . . . . . 55 E8.12 (Closed) Unresolved item 50-298/97201-01: Review of Licensee's Evaluation of Residual Heat Removal Pumps Flowrate . . . . . . . . . . . 56 E8.13 (Closed) Inspection Followup ltem 97201-02: Residual Heat Removal Pump Suction Strainer Modification . . . . . . . . . . . . . ........... 57 E8.14 (Closed) Inspection Followup item 97201-03: Residual Heat Removal Pump Net-Positive Suction Head for Fire Events . . . . . . . ........ 58 E8.15 (Closed) Unresolved item 97201-04: Residual Heat Removal Pump Minimum Flow Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 E8.16 (Closed) Inspection Followup Item 97201-05: Residual Heat Removal Pump-to-Pump Interaction . . . . . . . . . . . . . . . . . . . . ... ........ 60 E8.17 (Closed) Unresolved item 50-298/97201-06: Residual Heat Removal Heat Exchanger Performance Testing . . . . . . . . . . . . . . . . . . . . . . 61 E8.18 (Closed) Unresolved item 50-298/97201-09: Residual Heat Removal System Suppression Pool Cooling Throttle Valve Stroke Time . . . . . . 63 E8.19 (Closed) Unresolved item 50-298/97201-10: Reportable Condition of Containment isolation Valves Which Did Not Have Diverse Power . . 65 E8.20 (Closed) Unresolved item 50-298/97201-11: Technical Specification Lower Limit for Degraded Voltage Set Point Was Below Analytical Limit
....................................... ... ... ...... 66 E8.21 (Open) Inspection Followup Item 50-298/97201-12: Basis for Instrument Uncertainties for Indicator Channels That Support Technical Specification Compliance and Operator Actions . . . . . . . . . . . . . . . . . . . . . . . . . . 68 E8.22 (Closed) Inspection Followup item 50-298/97201-13: Basis for Technical Specification Set Point for Time Delay Permissive for Residual Heat Removal Heat Exchanger Bypass Valve . . . . . . . . . . . . . . . . . . . . . 70 3 E8.23 (Open) Inspection Followup Item 50-298/97201-14: Technical Specification Bases for Condensate Storage Requirements . . . . . . . 71 E8.24 (Closed) Unresolved item 50-298/97201-16: Weakness in the Design, Evaluation, and Operation of the Radioactive Floor Drain System .. 72
'
E8.25 (Open) Inspection Followup item 50-298/97201-17: Emergency Core Cooling System Pump Seal Failure . . . . . . . . . . . . . . . . . . . . . . . . . . 74 E8.26 (Closed) Inspection Followup item 50-298/97201-19: Hydraulic Analysis for Service Water Backup to Residual Heat Removal . . . . ........ 75 E8.27 (Closed) Unresolved Item 50-298/97201-20: Adequacy of Safety Evaluation Supporting Updated Safety Analysis Report Change, Which vi
_ - - - - - - - - - -
l l
l
!
Increased the Maximum Ambient Temperature Value for the Residual i Heat Removal Service Water Booster Pump Room ;
'
......................................................75 E8.28 (Closed) Unresolved item 50-298/97201-21: Update Safety Analysis l Report and Technical Specification Discrepancies . . . . . . . . . . . . . . . 80 )
E8.29 (Closed) Unresolved item 50-298/97201-22: Instrument Uncertainties i Not Taken into Account When Measuring the Maximum Service Water l Te m p e rat u re . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 82 l E8.30 (Closed) Unresolved item 50-298/97201-23: Reactor Equipment Cooling System inventory Loss . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 E8.31 (Closed)1Jnresolved item 50-298/97201-24: Evaluate Effect of Room i Cooler Not Starting When Both residual heat removal Pumps were i R u n ning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 E8.32 (Open) Inspection Followup Item 50-298/97201-25: Reactor Equipment Cooling System Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 E8.33 (Open) ;nspection Followup item 50-298/97201-26: Effect of loss-of- I coolant-accident induced piping failure on reactor equipment cooling system pipin g . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ........... 87 E8.34 (Closed) Unresolved item 50-298/97201-27: Reactor Equipment Cooling l Heat Exchanger Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 l E8.35 (Open) Inspection Followup item 50-298/97201-28: Electrical Separation l C rite ri a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 0 ;
E8.36 (Open) Inspection Followup Item 50-298/97201-29: Design Basis for i reactor equipment cooling Discharge Header Pressure and Time Delay S et point . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 i E8.37 (Closed) Unresolved item 50-298/97201-30: Se:vice Water Interface 1 with Reactor Equipment Cooling System . . . . . . . . . . . . . . . . . . . 93 l E8.38 (Closed) Inspection Followup Item 50-298/97201-31: Instrument Air l Pressure Regulator Failure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 E8.39 (Closed) Inspection Followup item 50-298/97201-32: Adequacy of Corrective Action for Overranged Residual Heat Removal Service Water Booster Pump Suction Pressure Gauges and Leaking Service Water Valv e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 6 E8.40 (Closed) Licensee Event Report 50-298/95-010: Residual Heat Removal ,
Minimum Flow Valve Position vs Design Basis Requirements . . . . . . 97 IV. Plant Support . . . . . . .................................. ............ ... 98 F8 Miscellaneous Fire Protection issues (92904) . . . . . . . . . . . . . . . . . . . .... 98 F8.1 (Closed) Violation 50-298/9625-07: Failure to identify and Correct Transient Combustible Control Problems . . . . . . . . . . . . . . . . . . . , . 98 j F8.2 (Closed) Licensee Event Report 50-298/94-008, Revision 1: Inoperable !
Appendix A Fire Barrier Penetration Seal Resulting from inadequate i Initial Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...... 99 F8.3 (Closed) Licensee Event Report 50-298/96-009, Revisions 0,1, and 2:
Appendix R Safe Shutd.?wn Analysis Vulnerabilities . . . . . . . . . . . . . 100 V. Management Meetings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .... 103 X1 Exit Meeting Summary . ......... ............. . . .. ...... .103 Attachment . . . . . . . . . . . . ....... .... . ..... ........... .. . . . ... 1 vii i
. . . . _ - ._ .
l l
l
'
l Report Details 1
'
I 111. Enaineerino
! E1 Conduct of Engineering ,
l E1.1 Emeraency Diesel Generators l
l E1.1.1 Design Review j l
E1.1.1.1 Mechanical Design Review I a. Insoection Scope (93809)
The team reviewed selected emergency diesel generator support and auxiliary systems, l which consisted of fuul oil and fuel oil transfer, lubricating oil, Jacket water, and that portion of the service water system, which supports the diesel generator heat I exchangers. This was a general review primarily of selected design documer.ts such as l design calculations and drawings. !
l b. Observations and Findinas l
Jacket Water l
' l The diesel engine Jacket water subsystem was a closed recirculating water circuit j treated demineralized water for engine cooling 11 consists of a 385-gallon standpipe, an ;
engine driven pump, a heat exchanger, a bypass pump, a heater, and the associated i piping and instrumentation. The team reviewed various design documents related to the
'
Jacket water system and determined that assumptions and design inputs were reasonable and consistent with design basis requirements.
Fuel Oil The fuel oil subsystem provides for the storage and transfer of clean fuel oil for the emergency diesel generators. This system originates at the two nominal 30,000 gallon underground storage tanks. A fuel oil transfer pump is located in the manhole above each main storage tank and is capable of delivering fuel to either of the two day tanks.
.
The transfer pump discharge piping is buried as is a 4-inch cross-connect pipe between i the two main storage tanks. The transfer piping is cross-connected inside the emergency diesel generator building by a 2-inch line with a single, normally open, manual valve.
The team reviewed calculations related to the fuel oil system and found discrepancies as follows:
!
i * Technical Specification bases, paragraph 4.9, as well as, Surveillance
! Procedure 6.DG.602," Diesel Fuel Oil Availability" stated that 4 inches of water was acceptable in the main diesel fuel oil tanks. The team questioned the origin of the 4-inch water level acceptance criteria. The licensee referred to Calculation 87-052," Emergency Diesel Generator Storage Tank Fuel
i
!
--____-_ - - _ _ _ - _ _ __
!
l l,
Capacities," Revision 1. The result of this licensee review revealed that only 1 1/8 inches existed between the maximum permissible water level and the fuel oil pump suction inlet. The licensee further determined that a water level of 4 inches would result in a water contaminated fuel oil flow to the day tank. The licensee initiated Problem Identification Report 2-28057 to address this concern.
The licensee also stated that the water level in the tank had never approached a level of 4 inches and based upon their regular fuel oil sample results from the day tank, they had no evidence that water carryover had occurred in the past.
- A change to the technical specification bases and Surveillance Procedure 6.DG.602 for the emergency diesel generator fuel oil storage tanks established an acceptable water level of 4 inches in the tank. These changes were implemented in July 1993 in response to NRC concerns that no acceptance criteria existed related to the quantity of water that might be found in the fuel oil tanks.
In response to this finding, the licensee lowered the water level acceptance limit to 2 inches. The licensee stated that while the improved technical specifications will not include an acceptance limit for water in the tank, it will require the removal of water found in the tank.
10 CFR Part 50, Appendix B, Criterion V," Instructions, Procedures, and Drawings,"
states, in part, that activities affecting quality shall be prescribed by procedures appropriate to the circumstances. Procedure 6.DG.602 was inappropriate to the circumstances in the specified acceptance criterion for the maximum water lercl in the day tank would not have prevented water intrusion into the day tank. This fa! ure was identified as an example of a violation of 10 CFR Part 50, Appendix B, Crite. ion V (50-298/9815-01).
Lube Oil The tube oil subsystem circulates oil through the engine to lubricate and cool the moving parts for the diesels under all conditions. This system consists of an engine driven pump, bypass pump, pre-post pump, filters, strainers, oil cooler, heater, external and internal lube oil circuits. In the main lube oil circuit, the engine driven pump takes suction from the engine sump and circulates lube oil through the heat exchanger / cooler, filter, and strainer back to the oil header of the engine. Various design documents related to the lube oil system were reviewed and it was determined that assumptions and design inputs were reasonable and consistent with design basis requirements.
Service Water The service water subsystem is a supply and return loop from the plant service water system. It consists of heat exchangers for jacket water, lube oil, and engine intercoolers. It supplies the heat sink on the tube side of the coolers for turbochargers, jacket water, and lube oil. The two heat exchangers for jacket water cooling and tube oil cooling are connected in series in the main circuit. An NRC safety system functional inspection (NRC Inspection Report 50-298/87-10), performed in 1987, identified concerns that the service water system may not be capable of providing adequate cooling to the emergency diesel generators during worst case accident scenarios i
l l
_ _ _ _ - _ _ - _ _ - _ _ _ _ - _ - _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ . . _ - _ _ _ _ _ _ _ _ _ _ _ _ .
because the actual heat removal capabilities of the service water system were not measured. The inspection team was concerned that a minimal amount of fouling could significantly reduce the heat transfer coefficient of the heat exchanger and prevent it from fulfilling its design function. At the time, the heat transfer coefficient (U) was not determined and trended, nor was any trending of heat exchanger fouling performed.
This was contrary to Section 8.1.5 of the Updated Safety Analysis Report, which stated that, ". . . flow, pressure, and temperature data from the critical heat exchangers was periodically monitored to detect any trends from silt accumulations."
As a result of this inspection finding, Design Modification 87-165 was implemented to provide for the installation of local pressure and temperature instrumentation for the emergency diesel generator essential heat exchangers. Using this instrumentation, Performance Evaluation Procedure 13.18 was used, which documented measured temperatures and flows and calculated the heat transfer coefficient ard compared the calculated U value to the vendor's acceptable range. It is recognized that for any set of system flow rates and fluid temperatures, U will have a specific range of acceptable values. The vendor's required U value range corresponded to design basis service water, jacket water, and tube oil temperatures and flows. Since performance testing was generally performed during the spring or fall when the service water temperature was not at the maximum, calculated U values were, for the most part, not meaningful.
Based on this, performance testing of the diesel heat exchangers was discontinued and reliance was placed on Maintenance Procedure MP 7.2.42, " Heat Exchanger Cleaning,"
Revision 11, which mandated inspection and cleaning of the subject heat exchangers.
This change was in accordance with Generic Letter 8913, which permitted frequent regular maintenance in lieu of testing.
Although regular maintenance in lieu of testing was acceptable, Updated Safety Analysis Report, Section 8.1.5, stated that the flow, pressure, and temperature data was monitored to detect adverse trends. The licensee provided the team with flow and temperature data, which was regularly gathered, analyzed, and trended by the system engineer. The team concluded that this trending met the intent of the Updated Safety Analysis Report.
c. Conclusions The team found the mechanical design of the emergency diesel generators was appropriate to support system operation. However, a violation of 10 CFR Part 50, Appendix B, Criterion V, was identified for a change to a surveillance procedure that introduced the possibility of contaminating fuel oil with water in the diesel generator day tanks.
s E 1.1.1.2 Electrical Design Review a. inspection Scoce (93809)
The team reviewed the electrical design documents associated with the emergency diesel generators, including drawings, calculations, and design basis documents.
_ _ _ _ _
. .- . _._ _ _ _ _ ___ __
b. Observations and Findinas The Cooper Nuclear Station had two Cooper-Bessemer diesel generators with a l 4000-kW continuous rating,4400 kW DEMA standard rating (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for each 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> l of operation),4700 kW overload rating (2000-hour maintenance interval), and 5000 kW maximum overload rating (320-hour maintenance interval). A diesel generator electrical l protection included generator differential, generator voltage restrained overcurrent, l overspeed, reverse power, loss of field, and overvoltage. The design also included an overpower relay, which can isolate the nonsafety portion of the system when the diesel generator is paralleled to the electrical grid for testing.
The team reviewed Design Criterion Document-1," Emergency Diesel Generator,"
Revision 4, against the Updated Final Safety Analysis and electrical calculations. The team also reviewed the governing calculations for the static and transient loading and electrical protection of the diesel generator. The attributes reviewed for the calculations included completeness of scope; completeness, reasonableness, and verifiability of assumptions; completeness, appropriateness, and referenceability of design inputs; validity of the design / licensing basis and methodology; consistency of selected interface requirements (for example, with other calculations or with drawings, modifications, and procedures); and for identification of design margins.
Based on this review of the emergency diesel generator design, the team found the calculations, drawings, and interfacing documents acceptable. However, the following issues were identified:
- inadeauate procedural control of the use of weldina receptacles and other short-term loads served by safetv-related ac electrical distribution systems in reviewing the one-line diagrams, the team identified several welding receptacles served directly from safety related 460 Vac motor control centers.
These welding receptacles were served directly from the motor control center bus via a fused disconnect switch that could only be operated manually at the motor control centers. Therefore, there were no means for shedding welding receptacle loads either automatically or manually from the control room, without shedding the critical motor control center loads. For example, motor control centers Diesel Generators 1 and 2 serve critical diesel generator auxiliary loads, such as starting air compressors and exhaust fans in addition to welding receptacles. The team also identified that Calculation NEDC 87-104A, paragraph II.E, assumed that, " Motor operated valves, hoists, cranes, welding receptacles, emergency equipment, and startup equipment are not considered running for normal operation." In addition, discussions with the licensee revealed that the effects of applying a nonlinear impedance load, such as an arc welder, had not been evaluated with respect to introducing unacceptable levels of harmonic distor1 ion that might adversely affect other safety-related circuits (for example, sensitive protective relays or control circuits).
The team discussed this finding with the licensee to determine how the licensee was controlling welding loads. The team found that Emergency Procedure 5.2.5,
" Loss of Normal AC Power - Usc of Emergency AC Power," Revision 32, C2, Attachment 1, stated that the load tables provided in the procedure for operator
. _ ._
use ". . . do not include short term loads such as motor operated valves, hoists, cranes, welding receptacles, or sump pumps which only operate for a short time j and are accounted for in plant load study NEDC 87-104A." ;
in addition, the licensee indicated that except for the weld receptacles supporting )
the "Z pump" modification, thers were no physical controls or special postings on I the receptacles. Moreover, Administrative Procedure 0.31," Equipment Status ;
Control," Revision 4, C1, Section 8.6.1.6, stated that, "Use of 460V/480V l
'
receptacles not located in the Weld Shop shall require prior authorization from the Control Room." On that basis, the team concluded that the licensee's controls for use of these receptacles were inadequate and this condition could -
potentially threaten the integrity of the safety-related ac distribution system. i l
The licensee's subsequent investigation of this finding revealed that a chemistry I lab air conditioner and unused transformer had bet c found connected to welding i receptacles, and that no evaluation of this departure from the calculation design basis had been performed. The addition of these loads had not been evaluated, nor accounted for in Calculation NEDC-87-104A. )
i in response to the team's finding, the licensee prepared Plant improvement l Request 2-24257 dated May 6,1998, which identified immediate and longer-term l corrective actions. This included the following licensee actions: ;
i 1. Issued night order May 6,1998, to restrict use of all welding-type i receptacles supplied from Critical Buses 1F and 1G. ,
2. Removed any loads attached to receptacles and re-analyzed the loads.
3. Began investigating the extent of condition (for other components, systems, programs, departments, etc., potential for cumulative effect).
4. Assessed (by walkdown) whether any loads were attached that had not been authorized or analyzed. The walkdown identified 18 breakers on buses supplied from Critical Buses 1F and 1G that supplied welding receptacles or attachable loads; the licensee found that the chemistry lab air conditioner had been connected and an unused transformer was attached to a receptacle marked for laundry use. Some receptacles were unlabeled and their source could not be identified, but the licensee verified that all unlabeled receptacles had no loads attached.
5. Initiated procedure change to Procedure 2.2.19A,"480 Vac Auxiliary Power Checklist," Revision 0, to indicate a normally open feeder breaker position for buses supplied from Critical Buses 1F and 1G that supply welding receptacles.
6. Initiated procedure change to Procedure 0.31, " Equipment Status Control," Revision 4 C1, to require a plant temporary modification if a load was added to a welding receptacle from a breaker served from a source supplied from Critical Buses 1F and 1G.
=. .--. _-. . . _ - . - _ . - _- - . - -
,
l
!
!-
7. Began determining whether receptacles were needed by any emergency procedure or abnormal opert' ting procedure to support plant operation j and verifying that the loading and voltage calculations included all loads l added during emergency procedure or abnormal operating procedure actions, i 8. Determined that a Priority 2 root-cause evaluation would be performed.
!
The team found these planned and implemented corrective actions acceptable and agreed with the licensee's Engineering Evaluation IEE98-119, " Welding Receptacle Loading," prepared to address this finding. The evaluation addressed various loading l scenarios and concluded that use of welding receptacles energized from 480 Vac l Critical Buses 1F or 1G should be restricted. i i
10 CFR Part 50, Appendix B, Criterion Ill, " Design Control," requires, in part, that design changes, including field changes shall be subject to design control measures commensurate with those applied to the original design."
The licensee's failure to control the design configuration of the safety-related ac distribution system loads was idant;fied as an example of a violation of 10 CFR Part 50, Appendix B, Criterion til (50-298/9815-02).
c. Conclusions i i
i The team concluded that the electrical design documents associated with the )
l emergency diesel generators were appropriate. However, one example of a violation of I
!
10 CFR Part 50, Appendix B, was identified, involving a failure to properly control the j l use of welding receptacles on safety-related buses. '
!
,
E1.1.2 Surveillance Test a. Inspection Scope (93809)
The team reviewed surveillance procedures and documents related to testing the i emergency diesel generators, associated equipment, and the emergency loading i sequencing. In addition, the team verified that the surveillance testing was conducted in accordance with the licensee's current technical specification surveillance requirements. ;
This review included 22 surveillance procedures.
l b. Observations and Findinas l The team determined that each of the applicable surveillance test procedures were
'
acceptable, approved by their cognizant authority, and current with the latest changes.
Data recording, documentation requirements, prerequisites, and acceptance criteria l were considered to be clear and easy to understand. The purpose for conducting
'
particular portions of the testing was well explained. The team determined that the technical specifications surveillances were conducted in accordance with their
.
scheduled frequency, and recorded properly in the listing of completed test l surveillances.
.
I
!
_ , .-
- _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ - _ _
l
!
c. Conclusions The team concluded that the emergency diesel generators' surveillance procedures were being conducted properly and in accordance with their current Technical Specifications requirements.
E1.1.3 System Walkdown a. Irispection Scoce (93809)
The team performed a walkdown of the emergency diesel generator auxiliary and support systems to observe the status of all major mechanical system components.
b. Observations and Findinas During the walkdown, the team noted that the B emergency diesel generator room was significantly warmer than the A emergency diesel generator room. This finding was discussed with the licensee. The licensee stated that the temperature difference was normal and consistent with the heating, ventilating, and air-conditioning system cycling.
The team also noted that housekeeping was good. In addition, the team made a random check of component tagging and matched the tagging against the design drawings. No discrepancies were identified.
c. Conclusions The material condition and housekeeping associated with the diesel generators were observed to be good.
E1.1.4 Modifications / Temporary Modifications a. Insoection Scope 93809 The team reviewed a sample of electrical and mechanical design modifications involving the emergency diesel generator. The review scope included the modification scope and description, the safety evaluation, and the list of affected documents.
In E.ddition, the team reviewed plant temporary modifications currently in effect to determine the manner in which they were being controlled, their total number, and age.
b. Observations and Findinas With the exception of Design Change 95-036," Service Water Start Timer Setting Change," the team found the selected design modifications to be complete, accurate, and sufficiently detailed. The exception, Design Change 95-036, involved the failure to include Safety Guide 9 in Calculation NEDC 91-157, " Diesel Generator Transient Analysis." This failure was discussed in Section 1.1.1.2 of this report.
The team reviewed Operations Procedure 2.0.7, " Plant Temporary Modification Control,"
Revision 25. The purpose of this procedure was to control temporary modifications to ensure operator awareness and conformance with design intent and operability
l
,
--
requirements. The plant temporary modification index indicated that there was a total of 26 open plant temporary modifications with 14 of them older than 1 year. Of those temporary modifications older than 1 year,2 were opened in 1994,1 in 1995,7 in 1996, and 4 in 1997. The number of temporary modifications for a one-unit plant appeared high. In addition, there were a number of modifications that were older than 1 year.
c. Conclusions The selected design changes were found to be sufficiently detailed, accurate and complete to support the modification process. The number of existing temporary modifications was considered high and 14 temporary modifications were observed to have been installed for greater than a year.
E1.2 Class 1E AC Power Distribution System l
E.1.2.1 Design Review a. Insoection Scoce (93809)
The team reviewed the station ac power distribution system. Offsite power to the station included 345 kV,161 kV, and 69 kV lines. Offsite ac power for plant startup and shutdown is obtained via a 345 kV/161 kV autotransformer to the 161 kV substation and through the startup transformer to the station auxiliary power distribution system. During normal operation, plant auxiliary loads are supplied from the main generator via the i normal station service transformer. An emergency station service transformer served by l the 69 kV line provides an alternate source of power to redundant safety-related 4.16 kV l Critical Buses 1F and 1G. Critical Buses 1F and 1G are also served by their two I respective emergency diesel generators and provide power to 480 Vac switchgear buses and 480 Vac motor control centers within their respective divisions.
The team reviewed Design Change Document-4, "AC Electrical Distribution System,"
Revision 2, against the Updated Safety Analysis Report and electrical calculations. The team also reviewed the governing calculations for the safety-related ac system capacity, voltage, short-circuit currents, and protective device application and coordination. The attributes reviewed for the calculations included completeness of scope; completeness, reasonableness, and verifiability of assumptions; completoness, appropriateness, and referenceability of design inputs; validity of the design / licensing basis and methodology; consistency of selected interface requilements (for example, with other calculations or with drawings, modifications, and procedures); and for identification of design margins.
The team also reviewed selected portions of electrical drawings to confirm that they were consistent with the calculations.
b. Observations and Findinas Based on selective review of these documents, the team noted that Design Change Document-04 was consistent with the Updated Safety Analysis F port; the calculations adequately supponed the design change document; and the documents were readily available. However, there were also some calculations that were historical in nature (for example, Calculations 2.05.01,2.05.02,2.05.03, and NEDC 94-110), which had been
. .. . - _
superseded but were not explicitly identified e such on the document. The licensee began a comprehensive calculation indexing pream intended, in part, to remedy this condition. The team identified several discrepancies in the following calculations and drawings:
- Calculation NEDC 87-104A, " Plant AC Load Study," Revision 13, Sheet 6, identified Attachment 9 as the source of the design inputs to the calculation for unsaturated direct axis synchronous reactance (xo), generator open circuit transient time constant (T.), quadrature axis synchronous reactance (xq), and generator direct axis transient reactance (xo,); the reference should have been to Attachment 4. To address the team's concern, the licensee issued Problem Identification Report 2-20676, which confirmed that the calculation used the correct values and recommended the error be corrected during the next revision of the calculation. The team found this acceptable.
l
. Calculation NEDC 87-104A load tables and corresponding Updated Safety 1 Analysis Report, Table Vlli-5-1, " Diesel-Generator Loading Table, Standby AC '
Power System," Sheet Vill-5-5, used 0 amperes for the O to 15 second loading interval for service water pump Motor A(B). This was noted to be contrary to Note 5 of the tables and the correct 13-second start time for the first service water pump in that the pump start would result in a current increase prior to 15 seconds. However, this finding did not negate the results of the calculation. In response to the team's finding, the licensee issued Problem Identification Report 2-20677 to correct the calculation at its next scheduled revision. The team also noted that the licensee's Updated Safety Analysis Report rebaselining program was considering the elimination o,' Updated Safety Analysis Report, Table Vill 5-1, because the level of detail in the table was difficult to maintain and may not be required or justified.
l
. Connection Diagram E508, Sheet 50, Revision 5, which showed the alternate l 480 Vac service to control room emergency filter booster Fan 1-BF-C-1B and l exhaust booster Fan 1-BF-C-1B, had protective 2 and 8 ampere fuses on the l high and low side of Transformer HV XFMR CRFD (this transformer serves the control room fire and smoke dampers). However, these fuses were not shown ;
on one-line diagram 3006 Sheet 5, Revision N62. The team noted that since the one-line diagram is a control room drawing, it should reflect the actual electrical protection configuration for the transformer primary and secondary circuits. In response to the team's finding, the licensee issued Design Change Notice 98-0687 to correct the one-line diagram.
. Connection Diagram E508, Sheet 50, Revision N05, did not show any thermal overload protection for Starter HV-STR-BF-C-1 A, which serves the control room emergency filter booster Fan 1-BF-C-18. Elementary Diagram 3036 showed three thermal overload contacts in series with the contactor coil (presumably one per phase); Calculation NEDC 91-184, " Motor Thermal Overload Heater Sizing,"
Revision 1, identified a T33 heater size, whereas, the One-Line Diagram 3006, Sheet 5, indicated that a thermal overload was provided. In response to the team's finding, the licensee confirmed that three overload contacts were provided and issued DCN 98-0693 to correct the connection diagram.
_ ._ _ _ -
. Connection Diagram E503, Sheet 50A, Revision N01, showed two thermal overload contacts in se-les with the contactor for control room exhaust booster Fan 1-BF-C-18, but Elementary Diagram 3036 showed three contacts in series.
Calculation NEDC 91-184 sized the thermal overloads assuming three thermal overload devices, if there were two thermal overloads, the calculation would result in a T43 heater size rather than a T44 as established by the calculation.- I In response to the team's concern, the licensee determined that the protection I was correct as shown in the calculation and elementary diagram, and issued !
DCN 98-0694 to correct the connection diagram.
10 CFR Part 50, Appendix B, Criterion Ill, requires, in part, that," Measures shall be established to assure that applicable regulatory requirements and the design basis, as defined in 10 CFR 50.2 and as specified in the license application, for those structures, systems, and components to which t!- appendix applies are correctly translated into specifications, drawings, procedures, and instructions." The failure to correctly translate design bases into one-line diagrams, connection diagrams, and calculations was considered to be a violation of 10 CFR Part 50, Appendix B, Criterion Ill. These failures .
represent historicalissues and were not representative of current design controls. I Therefore, these failures were considered to constitute violations of minor significance and were not subject to formal enforcement action.
c. Conclusion ,
l The team concluded that Design Change Document-04 was consistent with the Updated ,
Safety Analysis Report, that the calculations supported the design change document l and that the documents were readily available.
E1.2.2 Surveillance Testing Review a. Inspection Scoce (93809) j l
The team reviewed selected surveillance procedures to confirm that permissives for l manual loading of the emergency diesel generator were tested for loading the computer l room heating, ventilation, and air conditioning, the plant management information l system uninterruptible power supply emergency feeder, the alternate shutdown panel feeder, the technical support center emergency power feeder, and the emergency diesel generator exhaust fans.
b. Observations and Findinas 1 The team reviewed the following surveillance procedures:
. Surveillance Procedure 6.1DG.302, "Undervoltage Logic Functional, Load Shedding, and Sequential Loading Test (Division 1)," Revision 2C2
. Surveillance Procedure 6.2DG.302, "Undervoltage Logic Functional, Load Shedding, and Sequential Loading Test (Division 2)," Revision 1 The team confirmed that permissives were tested as a part of the surveillances.
- . .
.
.
. _ _ _ _ _ . . _. _ _ ._.
l l
c. Conclusion The team concluded that emergency diesel generator permissiva testing was addressed by the surveillance procedures.
E1.2.3 System Field 'nspection a. Inspection Scope (93809)
The team performed a walkdown of the safety-related ac switchgear and motor control centers.
b. Observations and Findinas The walkdown included an observation of the internal wiring of manual transfer Switch HV-SW-(BF-C-1 A/1B) used to orovide a backup source to control room heating,
, ventilation, and air-conditioning loads, and a verification of the locked configuration of the disconnect switcher serving the trarssfer device. The team noted that three loads can be served from either Motor Control Center LX (normal) or TX (alternate).
c. Conclusion No problems were identified in the system field inspection.
E1.3 Main Control Room Air Conditionina System E1.3.1 Mechanical Design Review a. Inspection Scoce (93809)
The team reviewed tne main control room air-conditioning system. This system distributed conditioned air to the main control room, rest rooms, pantry, instrument repair room, and the cable spreading room. This was a general review primarily of selected design documents, such as design calculations and drawings. The documents were reviewed for completeness of scope, reasonableness and verifiability of assumptions, appropriateness of design inputs, validity of methodology, and reasonableness of results.
b. Observations and Findinas The team noted that the control room air-conditioning system consisted of a single, package type, self-contained air-conditioning unit complete with filters, cooling coils, heating coils, and two redundant supply fans (one operating and one spare). A humidifying unit was provided in the duct to the control room to assure humidity control.
As part of the control room air-conditioning system, a control room emergency filtration system was provided in order to positively pressurize the control room to ensure that any leakage was out of the control room and into adjoining areas and to filter outside air brought in through the outside air intake in the event of radioactive or chemical gas air contamination near the intake. The control room emergency filtration system consisted of (in series) a shutoff valve, profiler, HEPA filter, carbon filter, and a single emergenc/
.
. . .
. . .
_ - _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ .
i supply fan. The design of the control room emergency filtration system was such that on a high radiation signal, all outside air is channeled through the bypass system before entering the control room through the air-conditioning duct. All return air from the control room was recircu'ated. Tne team noted that to direct the outside air through the filter system and to isolate exhaust flows, intake Damper HV-A.V.-270AV must close, exhaust Damper HV-A.V.-272AV must close, and Damper HV-A.V.-271 AV must open on a high radiation signal. These dampers were all single nonredundant components.
Updated Safety Analysis Report, Section I-5-5, paragraph 5.1.6.4, states, " . . . required safety actions shall be carried out by equipment of sufficient redundance and independence that no single failure of active components can prevent the required actions." The licensee initiated Problem identification Report 2-24258 to address this issue as a result of the team's finding. The team reviewed Condition Report 94-0735 dated September 12,1994, which addressed the potential for failure of the emergency supply fan to start on a high radiation signal, and Problem Identification Report 1-15363 dated December 1,1995, which documented an app, rent inconsistency in Updated Safety Analysis Report, Appendix G," Accident Anah a Protection Sequences, Figures G-6-21,22,23, and 24," which indicated that the conts 01 room heating, ventilation, and air-conditioning system must be single failure proof. The licensee noted that the design of the system was consistent with their licensing basis and provided information to document the control room emergency filtration system licensing basis. The licensee stated that although contradictory statements existed in Chapter I and Appendix G, the system was licensed as not meeting single failure criteria. In 1996 the Upaated Safety Analysis Report, Appendix G, was rewritten and the single failure requirements for the control room emergency filtration system were deleted. The team determined that the 50.59 evaluation for this change, License Change Request 95-087, provided a weak justification for the deletion of the single failure requirement for the control room emergency filtration system in Appendix G (See Section E2.1b of this report for further information regarding this 50.59 safety evaluation). The team agreed that the control room emergency filtration system and control room air-conditioning system were not designed to meet single failure and that the single failure criterion was not a part of the licensing basis.
Subsequent to the inspection, the licensee prepared an evaluation entitled,
"CREFS/CRAC Single Failure Scenarios, System Failure Modes and Consequences Evaluation, Draft Revision B," dated May 20,1998, which deveioped and documented a dose consequence analysis for four case scenarios following a design basis loss of coolant accident. Since all other accidents were bounded by the loss of coolant accident in terms of dose consequences to the control room personnel, only the loss of coolant accident was considered. These four case scenarios addressed the control room emergency filtration system and control room air-conditioning system status.
Scenario 1 involved a fully operational control room emergency filtration system and control room air-conditioning system; Scenario 2 involved an operable control room emergency filtration system and an inoperable control room air-conditioning system; Scenario 3 involved an inoperable control room emergency filtration system and an operable control room air-conditioning system; and Scenario 4 involved a completely inoperable control room emergency filtration system and control room air conditioning system. Only one of the four scenarios was included in the loss of coolant accident dose calculation of reced. In each scenario reviewed, a system single failure was considered that resulted in the General Design Criteria 19 criterion of 30 Rem thyroid
_ _ _ _ _ _ _ _ _ _
l l
l dose being exceeded. In all cases a compensatory measure to repair or recover failures was identified, which could reduce the estimated dose consequences to below or very near the General Design Criteria 19 criterion; however, it was noted that even with compensatory measures, the estimated dose to the operators may exceed General Design Criteria 19 criterion by one REM. The licensee acknowledged the dosage concern t/tt stated that because the control room emergency filtration system and control room air-cenditioning system were never licensed to be single failure proof, its commitment to the control room dose requirements of General Design Criteria 19 did not require a single failure consideration for this system.
On January 27,1995, the NRC issued Amendment 167 to the operating license.
Amendment 167 provided a technical specification change that increased the flow in the control room emergency filtration system to improve the ability to pressurize the control room. The amendment also addressed the potential to exceed the General Design Criteria 19 criterion. The amendment stated that exceeding the General Design Criteda 19 limit was acceptable as long as interim compensatory measures (availability of potassium iodide (KI) thyroid-blocking tablets in the control room) were in effect. The l team verified that the interim compensatory measures were in effect by reviewing Procedures 2.4.1.2, " Fuel Element Failure," Revision 12 and 5.7.14 " Stable lodine Thyroid Blocking (Kl)," Revision 10. The use of the interim compensatory measures is under continuing review by the NRC program office.
Two calculations reviewed were found to have the following apparent discrepancies:
.
Calculation 86-155, " Control Room HVAC - System Balancing," Revision 0, was not updated to reflect Design Modification 93-257," Replacement of The Control Room Booster Fan BF-C-1 A With A Higher Capacity Fan." This modification replaced a fan with a capacity of approximately 350 cfm with one of 1000 cfm capacity. The team reviewed the test results from Procedure 6.HV.105," Control Envelope Pressurization Test," and determined that the 1000 cfm fan was adequate to pressurize the control room envelope to 1/8 inch differential pressure. However, the team determined that Calculation 86-155 indicated that a flowrate of 3000 cfm was necessary to pressurize the control room envelope to 1/8 inch differential pressure. As a result of the team's inquiry, the licensee initiated Problem Identification Report 2-24255 to address the inaccurate calculation.
.
Calculation 94-134, " Verification of Control Room Emergency Filter System Capability," Revision 1, calculated the face velocity over the carbon filter beds but neglected the reduction of face area due to the geometric influence of the angle frame structure. The calculation stated that even though the exposed area of each tray was 3.9063 square feet, the effective area was considered to be the area based on the dimensions of the actual trays disregarding' the angle frame flange width. This larger area equated to 4.41667 square feet. The team considered that the actual flow area should not include that portion of the carbon, which is blocked by the angle frame structure. The team considered the calculation assumption using the larger area to be non-conservative. Since the emergency fan is located downstream of the carbon filters and pulls the airstream through the carbon bed, the carbon under the angle frame will not be fully utilized. Using the unobstructed (reduced) flow area, which equates to a
- -- - .- _... - - . . . - -- - - _ - - = _ -
,
higher face velocity, could result in less than the 99 percent required filter l efficiency at a flow rate of 10 percent greater than the design flowrate of 900 cfm l
"
as currently specified by the technical specification. The team did not consider l this to be an operability issue because they noted that the dose calculations assume 90 percent efficient filters and sctual measured flowrates were less than l 900 cfm.
10 CFR Part 50, Appendix B, Criterion 111, requires, in part, that, " Measures shall be i established to assure that applicable regulatory requirements and the design basis, as l
- defined in 10 CFR 50.2 cnd as specified in the license application, for those structures,
, systems, and ccmponents to which this appendix applies are correctly translated into i specifications, drawings, procedures, and instructions."
! The failure to properly translata the design basis to Calculation 86-155 and to properly evaluate the geometric implications of the carbon filter beds within Calculation 94-134 1 were identified as an example of a violation of 10 CFR Part 50, Appendix B, Criterion til I (50-298/9815-02).
c. Conclusions The licensee's failure to properly translate the design basis flowrate for the control room heating, ventilation, and air conditioning into Calculation 86-155 and to properly evaluate the geometric implications of the carbon filter beds within Calculation 94-134 were identified as a violation of 10 CFR Part 50, Appendix B, Criterion Ill.
E1.3.2 Surveillance Test a. Inspection Scope (93809)
l The team reviewed the surveillance procedures and documents related to testing the control room emergency filter system, and associated equipment,in part, to verify that the control room emergency filter system surveillance testing was conducted in accordance with the current technical specification surveillance requirements. This review included eight surveillance procedures.
b. Observations and Findinos The team determined that the applicable control room emergency filter surveillance test procedures were acceptable, approved by their cognizant authority, and current with the latest changes. Data recording, documentation requirements, prerequisites, and acceptance criteria were clearly stated. The team determined that the technical specification surveillances were conducted in accordanco with their scheduled frequency, and recorded properly in the listing of completed test surveillances.
c. Conclusions The team determined that the control room emergency filter surveillances were conducted in accordance with the technical specifications and were of satisfactory quality.
I E1.3.3 Sys'em Field Inspection a. Inspection Scope (93809)
The team performed a walkdown of the control room ventilction system. This included a visual survey of all major system components.
b. Oaservations and Findinas No obvious problems were identified during the walkdown. It was noted, however, that there was no local control room area temperature indication other than the temperature reading on the room thermostat. Calculation 93-54," Control Room Heatup During 24 Hour Period After Failure of Control Room HVAC," Revision 1, determined the tu, required for the temperature in the control room to reach 105 degrees F. In accordanc- !
with Alarm Procedure 2.3.2.18," Panel R-Annunciator R-1, PanelM/ indow !
Location R1/A-6," Revision 14, plant shutdown is to be initiated if the control room temperature exceeds 105 degrees F. The team observed that the thermostat indication l was not, in accordance with human factors, a good means for monitoring control room I temperature.
c. Conclusions No problems were noted during a walkdown of the control room ventilation system.
E1.3.4 Modifications a. Insoection Scope (93809)
The team reviewed selected design modification packages pertaining to the control room ventilation system. The review scope included the modification scope and description, safety evaluation, and the list of affected documents.
b. Observations and Findinas The team found the contents of the modification packages to be acceptable with one exception. As noted in Section 1.3.1 of this report, Modification Design Change 93-257 ,
failed to update Calculation 86-155, " Control Room HVAC - System Balancing,"
Revision O. Additionally, since Modification Design Change 93-257 installed a higher capacity fan, a NUCON test tray assembly was added to the emergency filter assembly to complement the two charcoal trays already present. To make room for the third tray, the sample canister tray was removed. Carbon samples are now taken from the test tray assembly to satisfy surveillance requirements. The modification package failed to update the technical specification bases, which still referred to the removal of test canisters that are installed with the adsorber trays, in response to the team's finding, j the licensee issued Problem Identification Report 2-24256. This was identified as a l
weakness that will be addressed as a part of the licensee's technical specification upgrade program.
,
l
- _ .- . . _-.
I c. Conclusions The modification packages reviewed were generally of good quality. However a statement in the Technical Specification bases regarding the use of canisters in the l control room emergency filtration system carbon filter beds, was not updated when a l modifier. tion was performed.
I E1.4 Problem identification Reports l a. inspection Scoce (93809)
The team reviewed Procedure AP 0.5," Problem Identification and Resolution,"
Revision 15, and 27 problem identification reports associated with the emergency diesel ,
generators,14 problem identification reports associated with the Class 1E ac power distribution system, and 7 problem identification reports for the control room ventilation system.
b. Observations and Findinas The problem identification report process provided a single point-of-entry method for documenting the evaluation and resolution of problems, concerns, or recommendations.
As the result of the team's review of the selected problem identification reports, the following discrepancies were identified:
Problem identification Report 2-28063 The team reviewed Problem identification Report 2-28063, dated May 19,1998. This document was initiated in response to correspondence from the emergency diesel generator manufacturer, dated April 29,1998, which stated that there was inadequate spring preloading in the oil pressure relief valve on the engine-driven lube oil pump on Emergency Diesel Generator 1. This condition could cause low engine lube oil pressure during operation. The relief valve, which required two sprin; 3 to obtain the set point of 75 psig, was faulty, in that only one of the springs was instaud. The licensee determined that no action was necessary since there was normal lube oil pressure during operation of the emergency diesel generator. in addition, the licensee determined that, since the lube oil pressure of the emergency diesel generator was within design requirements, operability was not impacted.
The team reviewed Design Criteria Document-1, " Diesel Generator Design Criteria Document," Revision 4, which was prepared to identify the nuclear safety design basis for the emergency diesel generator system. This document described the significant components for the emergency diesel generator and its support systems and described the engine-driven lube oil pump as having an integral relief valve (DGLO-RV-10RV (11RV)), with a set point of 75 psig, which protected the pump and engine from overpressurization. The document stated that with a set point of 75 psig, the relief valve was adequately sized to prevent overpressurization of the lube oil system, which had a design pressure of 125 psig. In addition, the team noted that the lube oil pump was of positive displacement design and was capable of pumping to a pressure of 300 psig.
. _ _ . _ . . _ _ . _
The team reviewed the events regarding the inadequate spring loading and found that the licensee had installed a new lube oil pump on the Emergency Diesel Generator 1 in November 1997 following the failure of the installed lutn oil pump. After instaliation of the new lube oil pump, the licensee determined that the set point for the new relief valve was lower than the 50 psig minimum normal tube oil operating pressure of the emergency diesel generator. This condition existed only during slow starts of the diesel and did not exist during fast starts that occur during emergency operation. The licensee discussed this low set point with the diesel manufacturer. As the result of these discussions, the licensee concluded that proper engine lube oil pressure could be obtained by turning the relief valve adjusting screw to further compress the spring and increase the set point. After the normal tube oil operating pressure for the diesel I
generator was obtained, the licensee did not perform a post-maintenance test to determine the final as-left lift set point of the relief valve. The team considered that by turning the adjusting screw to compress the relief valve spring and not checking the resultant set peint of the relief valve, the relief valve could be effectively gagged, thus, l
'
removing overpressure protection.
in responst to the NRC concern, the licensee measured the set point of the lube oil relief valve under minor Maintenance Work Order 98-1538. The as-found set point was found to be 90 psig, which was in excess of the 75 psig set point specified by the vendor. The licensee concluded that even though the as-found set point was greater than that specified by the vendor, the initial adjustment made in November 1997 did not cause a loss of overpressure protection for the lube oil system. The inspectors noted that the licensee reset the valve's set point.
10 CFR Part 50, Appendix B, Criterion XI, " Test Control," states, in part, that a test program shall be established to assure that all testing required to demonstrate that i structures, systems, and components will perform satisfactorily in service is identified j and performed in accordance with written test procedures, which incorporate the I requirements and acceptance limits contained in applicable design documents.
The licensee's failure to perform a test of the diesel generator lube oil pump relief valve following adjustment of its relief set point to ensure that this set point was still consistent with design limits was identified as a violation of 10 CFR Part 50, Appendix B, Criterion XI (50-298/9815-03).
Problem identification ReDort CR 98-0245 The team reviewed Problem Identification Report CR-98-0245, dated March 24,1998, which was initiated following the discovery that the Emergency Diesel Generator 2 starting air compressor was blowing mist out of the vent, causing a decrease in receiver air pressure. The air compressor was secured and the shift supervisor declared the emergency diesel generator inoperable. Technical Specification 4.9.A.2.a.1 required that the emergency diesel generator starting air compressor must be capable of recharging the air receivers during the monthly test. Technical Specification Bases 4.9 clarified the technical specification, stating that during the monthly test, it was expeded that each receiver in each set of receivers would be drawn down below the point at which the corresponding compressor automatically started, thereby checking the ability of the compressors to recharge the receivers. The team noted that although the technical specification referred to a single compressor, the bases referred to both
.m.L t - - - .h * w e---'
l I
compressors. However, in response to the problem identification report and subsequent ;
to the initial declaration of inoperability, the licensee determined that the emergency 9 diesel generator was operable with only one compressor operable, consistent with the requirement of Technical Specification 4.9.A.2.a.1.
l The team reviewed the licensee's draft improved technical specifications for the emergency diesel generator starting air system and noted that the current surveillance requirements (Surveillance Procedure 6.2DG.105, " Diesel Generator Starting Air Compressor Operability," Revision 7 ) had been revised to delete the requirement for the compressors to be operable and instead required each emergency diesel generator ;
to have at least one air start receiver pressurized to at least 200 psig. While, the team considered this revision to be appropriate, they noted that the procedure had been )
implemented prior to implementation of the improved technical specifications. The improved technical specifications were implemented on July 31,1998.
10 CFR Part 50, Appendix B, Criterion V," Instructions, Procedures, and Drawings," I states, in part, that activities affecting quality shall be prescribed by procedures appropriate to the circumstances. Procedure 6.2DG.105 was not appropriate to the circumstances in that the implemented procedure was inconsistent with the requirements of the current technical specifications. This non-repetitive, licensee identified and corrected violation is being treated as a noncited violation consistent with Section Vll.B.1 of the NRC Enforcement Policy (50-298/9815-04).
Problem Identification Report 1-24279 The tearn reviewed Problem Identification Report 1-24279, dated April 18,1997, which identified that a valve was located on top of the intercooler on both emergency diesel generators that was not labeled and was not included on the service water component check list. i he licensee contacted the emergency diesel generator manufacturer to discuss the purpose of the valves and learned that the valves were designed to vent trapped air at the top section of the intercoolers. The purpose of this venting was to assure a water solid system and, as a result, a maximum heat transfer rate. The licensee's disposition stated that while the valves should be left open,if the valves were closed, there would be a minor loss of heat transfer, which would not inhibit the operation of the emergency diesel generators. These valves were found in the closed position on both emergency diesel generators and had presumably been in this position for an extended period, possibly since initial operations. These closed valves had no effect on emergency diesel generator operation as evidenced by successful emergency diesel generator operation during periodic surveillance testing. Licensee corrective actions included revising the drawings to include the valves and adding the valves to the i emergency diesel generator valve checklists.
c. Conclusions A violation of 10 CFR Part 50, Appendix B, Criterion XI," Test Control," was identified regarding the failure to test the Emergency Diesel Generator 1 lube oil pump relief valve following adjustment to compensate for a f aulty spring assembly supplied by the vendor.
The licensee's use of the improved technical specifications prior to NRC approval and misleading statements in the technical specification bases concerning the number of air
,
l l
!
compressors needed for diesel generator operability was considered to be a noncited violation.
E.1.5 Operability Evaluations a. Inspection Scope (93809J The team reviewed a sample of operability determinations and evaluations having the potential for impact on engineering. Operability determinations were evaluated for the emergency diesel generators and the control room ventilation system.
b. Observations and Findinos As the result of this review, the team noted that the licensee's operability determination in Problem Identification Report 2-24077, " incorrect installation of diesel generator overpower relay," indicated that there was no effect on operability due to an incorrectly wired overpower relay. However, the licensee conservatively decided that they would declare the emergency diese! generator inoperable when tested in parallel mode with the defective wiring (rather than considering it operable within the prescribed allowable outage time for test). The team determined the overpower trip was only in effect for testing and that the emergency diesel generator operation for accident mitigation was not affected.
c. Conclusions Operability determinations associated with the emergency diesel generators and the control room ventilation system were acceptable.
E1.6 Imoroved Technical Specifications Review a. Inspection Scops The team reviewed the licensee's improved technical specifications submittal versus their current technical specifications. The team reviewed the three systems selected for this inspection, i.e., the emergency diesel generators, the Class 1E ac power distribution system, and the control room ventilation system. This review was conducted to assure that the submittal accurately addressed the selected systems.
b. Observations and Findinos The team's review determined that the improved technical specification submittal was free of inconsistencies and errors. The team determined that the improved technical specifications were consistent with the safety requirements of the current technicai specifications. The team noted that the improved technical specification submittals were in three-column format and considered the format to be an improvement over the present two-column format in the existing technical specifications.
, 19
_ _ _ - _ _ _ _
l l
c. Conclusions I l
The team concluded taat the improved technical specification submittal was free of :
inconsistencies and errors.
]
E2 Engineering Support of Facilities and Equipment E2.1 10 CFR 50.59 Proaram a. Inspection Scope (37001)
The team reviewed program documents, including procedures, a quality assurance audit, a self-assessment, training lesson plans and records related to the licensee's 10 CFR 50.59 program. The team also reviewed a representative sample of safety
, evaluations performed in support of mcdification packages, engineering evaluations, l
plant temporary modifications, license change requests, procedure change notices, and Updated Safety Analysis Report changes to assess the licensee's compliance with !
10 CFR 50.59. In addition, the team reviewed several problem identification reports, l interviewed plant personnel, and observed a station operations review committee meeting to gain further insights into the implemer, ation of the 10 CFR 50.59 program.
b. Observations and Findinas l Procedures and Controls Administrative Procedure 0.8," Safety Assessments and Unreviewed Safety Question Determinations," Revision 2, dated March 5,1998, was the licensee's governing procedure for the performance of 10 CFR 50.59 evaluations. The procedure was generally consistent with the industry guidance of NSAC-125," Guidelines for 10 CFR 50.59 Safety Evaluations,"in directing the user to first perform a safety analysis to determine whether a proposed change, test, or experiment was safe to perform; then directing the user to conduct an applicability screening ano, if needed, an unreviewed safety question evaluation in accordance with 10 CFR 50.59.
The team noted a number of strengths in the procedure. The initial safety review section provided an extensive list of components, analyses, design criteria, failure modes, and programs for consideration by the user of potentialimpacts resulting from the proposed change, test, or experiment. The applicability screen was similarly thorough and was designed to identify impacts in addition to those that would require a 10 CFR 50.59 evaluation, such as necessary changes to the offsite dose assessment manual or the emergency plan. Each safety review was required to be prepared and independently reviewed by certified individuals. Procedure 0.8 required the user to provide a detailed description of the proposed change, test, or experiment, to identify all disciplines or departments required to review the change, test, or experiment, and to list all references relied upon in conducting the safety review. The procedure also designated management responsibilities for further review and action by the nuclear licensing and safety manager, the station operations review committee, or the safety review and audit board, as appropriate, based on the results of the safety review.
l
- - - . ~ . . - - . . . . . - . .--- - - - . -. - ... . - - . - - .
l l
l l l
Procedure 0.8 also provided detailed guidance and examples that generally wported a j broad interpretation of the language of 10 CFR 50.59. For example, the procedure l defined the " Safety Analysis Report (SAR)" to include the Cooper Station Updated
'
Safety Analysis Report and other licensing basis information, such as NRC safety evaluations and licensee commitments in support of license amendments; analyses and commitments in response to NRC generic communications; and other analyses and I calculations used to establish the bases of any technical specification, whether docketed or not. The procedure also stated that changes to structures, systems and components that were not explicitly described in the safety analysis report can affect the function of structures, systems, and components that are explicitly described in the safety analysis report (and therefore must be considered in performing a 10 CFR 50.59 screening and unreviewed safety question evaluation).
The team reviewed related procedures and verified that they directed the user to Administrative Procedure 0.8 to perform a safety review,10 CFR 50.59 screening, aad a unrevie<ved safety question evaluation, as appropriate.
i The teara reviewed a self-assessment of the 10 CFR 50.59 program (NLS-97-001), I dated December 12,1997. The self-assessment was conducted from
- September 22-25,1997, by a team consisting of four licensee personnel and two members from other utilities. The licensee's team concluded that the 10 CFR 50.59 '
program was sound, but also identified several opportunities for improvement.
Recommended actions included revising Procedure 0.8 to distinguish the 10 CFR 50.59 screens from screens for other regulatory requirements; revising the procedure and forms used for the screens and unreviewed safety question evaluations to be more consistent with industry guidance; assigning unreviewed safety question evaluations (and the associated written summaries) their own identifying number for tracking.
purposes; and developing additional guidance for requalification training.
The team also reviewed Cooper Nuclear Station Qua!ity Assurance Audit Report 98-04,
"Special Programs," dated Apri! 1,1998. Regarding the 10 CFR 50.59 program, the report found that the program was adequate, but that deficiencies were evident based on a large number of problem identification requests and station operations review committee rejections. Performance monitoring and feedback were considered a weakness in the program. Recommendations included devoting sufficient resources to allow the program owner to affect improvements; promptly revising the 10 CFR 50.59 procedure to reflect industry guidance; develop a process for immediate feedback from current industry and Cooper Nuclear Station experience on 10 CFR 50.59 evaluations;
,
and developing a proactive performance monitoring program. ;
- 1
'
The team found the licensee's self assessment to be an effective toolin identifying potential program improvements. Some additional recommendations of the self l assessment included the need to develop performance indicators to measure progress, and the need to provide better guidance on the use of licensing basis information and i how to access it. The team concluded that the quality assurance audit findings were j valid and focused on performance. :
- The team found that the 10 CFR 50.59 program owner was actively engaged in program improvements and that several actions were in progress, in response to the self-assessment and audit findings. The " Strategy for Achieving Engineering Excellence,"
'
_ , . - , _ _ _ .
Revision 1, dated April 9,1998, included Action 3.4.g, " Streamline and Enhance the 50.59 Process," with a completion schedule of December 1998. A revision to Procedure 0.8 had been drafted, consistent with the current industry guidance provided in NEl 96-07, " Guidelines for 10 CFR 50.59 Safety Evaluations," Revision 0, which included a flowchart and forms to make the procedure easier to follow. Recent station operations review committee-approved revisions to Procedures 0.4 and 0.4A, when implemented, will require that all procedure changes, including non-intent changes, receive 10 CFR 50.59 screening reviews. The licensee's definition of intent change was also being revised to be consistent with the description in NRC Inspection Procedure 42700," Plant Procedures." The fact that non-intent procedure changes have not received 10 CFR 50.59 screens was identified as a potential program weakness in NRC inspection Report 50-298/97-07.
The team questioned the usefulness of the current performance indicator for 10 CFR 50.59 evaluations, the station operations review committee rejection rate, noting that evaluations could be rejected for a variety of reasons that may or may not reflect the technical or regulatory adequacy of the evaluations. Changes in the membership of station operations review committee, whether alternates attend specific meetings or new members replace old ones, could introduce variation in the rejection rate. Also, the tearn questioned whether prior review of evaluations by station operations review committee subcommittees could bias the data (e.g., if a subcommittee recommended further work on an evaluation before it was presented to station operations review committee, would it be counted as a rejection?). Finally, the team noted the large volume of items routinely presented for station operations review committee review and approval, and questioned whether uniform standards for the quality of evaluations could be consistently applied. The station operations review committee administrator indicated that these concerns would be reviewed. The 10 CFR 50.59 program owner indicated that the ongoing action plan included efforts to identify improved performance indicators.
Trainino and Qualifications The team reviewed lesson plans and records and interviewed the engineering support l personnel training coordinator in order to assess the effectiveness of the licensee's training program for 10 CFR 50.59.
Training Program Description 901, Revision 2, dated October 7,1996, is a collection of lesson plans that form the basis for qualification as a certified 10 CFR 50.59 preparer / reviewer. The current Training Program Description 901 training requirements ,
were established in May 1996. The five lesson plans comprising Training Program i Description 901 include lessons on 10 CFR 50.59 safety evaluations; codes, standards, and classifications; licensing basis; Updated Safety Analysis Report, Chapter 14, accident analyses, and Appendix G; and trusient and overpressure protection. In addition to the series of individual lessons that must be completed, personnel must also prepare two 10 CFR 50.59 evaluations that are judged acceptable by a certified l individual before th:r aan be certified.
l The team revie, mon Plan ADM003-01-01,"10 CFR 50.59," Revision 4, dated September 3,19 , . This classroom training required successful completion of a written exam in order to receive credit toward certification. The inson plan was detailed and
. __
generally consistent with Administrative Procedure 0.8; however, the team noted several minor incorrect references to the previous procedure for 10 CFR 50.59 evaluations in the lesson plan that did not reduce the effectiveness of the plan.
Lesson Plan ADM003-01-01 highlighted areas where industry guidance (NSAC-125)
was not consistent with NRC positions, including the issue regarding the margin of safety. Similar to the discussion in Administrative Procedure 0.8, the lesson plan described a broad interpretation of the subjects of 10 CFR 50.59. The les. son plan on codes, standards and classifications also consisted of classroom training and a written exam; the other three lessons of Training Program Description 901 were self-study, requiring an oral review with an instructor for successful comple. tion. Overall, the team considered the lesson plans to be satisfactory to meet the goals of the training program.
lmolementation of the 10 CFR 50.59 Proaram The team selected a representative sample of documents to assess the effectiveness of the implementation of the 10 CFR 50.59 program. These documents included 10 CFR 50.59 evaluations associated with modification packages, license change requests, procedure change requests, engineering evaluations, plant temporary modifications and Updated Safety Analysis Report changes.
. License Change Request 95-087, dated December 18,1995, revised Appendix G of the Updated Safety Analysis Report to make it consistent with current plant design. Specifically, Updated Safety Analysis Report, Sections ill, IV, VI, and XIV, and Appendices A, C, D(1), and G were revised to ensure that the entire spectrum of transients, accidents, and special events analyzed for Cooper Nuclear Station were appropriately included in the Updated Safety Analysis Report. Appendix G was revised in its entirety, with Figures G-6-21 through -24 modified to remove a single failure proof designation for the control room heating and ventilation system. The replacement figures, G-5-36 through-41, were changed to no longer indicate that the control room ventilation system was required to meet the single failure criteria. However, tne 10 CFR 50.59 evaluation associated with this license change request did not address the removal of the single failure requirement from these figures. Condition Report 1-15363, dated December 1,1995, identified the desired changes, but also failed to provide a justification for them. During the course of this inspection (see Section E1.3.1 of this report), inspectors discussed the design basis for the control room ventilation system t.vith the licensee. Although the licensee presented information to support the position that the licensing basis for the Cooper Nuclear Station control room ventilation system did not require the system to be single-failure proof, such information was not included in the 10 CFR 50.59 evaluation supporting the Updated Safety Analysis Report charges.
-
The team reviewed several recent Updated Safety Analysis Report Change Requests and their associated 10 CFR 50.59 evaluations. Change Request 97-166, approved December 1,1997, revised the wording on Updated Safety Analysis Report, page Vill-4-2, to read, "In case the emergency source is not available then the standby ac power source re-energizes buses 1F and 1G within s 14 seconds." The previous revision had indicated "within 10 seconds."
. -
\
i Item 1.g of the 10 CFR 50.59 applicability screen attached to Change Request 97-166 indicated that all of the specific changes associated with this item were evaluated by a still valid unreviewed safety question evaluation. This unreviewed safety question evaluation was documented in License Change Request 95 0015, dated February 28,1995, as the 10 CFR 50.59 evaluation done in support of Design Change 95-036.
The description of the change for License Change Request 95-0015 and Design 1 Change 95-036 and the referenced 10 CFR 50.59 safety evaluation reflected changing the starting time for the emergency diesel generators from 16 to 14 seconds, and changing the service water pump starting time (after emergency diesel ger rator start) from 15 to 13 seconds. The marked up Updated Safety Analysis Report pages provided with License Change Request 95-0015 indicated l the change in diesel start time from 16 to 14 seconds.
The team considered a reduction in the maximum analyzed emergency diesel generator start time from 16 to 14 seconds as a conservative change. However, neither License Change Request 95-0015, Design Change 95-036, nor the supporting 10 CFR 50.59 evaluation discussed the revision of the emergency diesel generator starting and loading time in the less conservative direction from within 10 seconds to 14 seconds, and the resulting impacts of that change.
Therefore, the team questioned the adequacy of the referenced 10 CFR 50.59 safety evaluation to justify the Updated Safety Analysis Report change.
In response to the concern, the licensee provided earlier documentation (License Change Request 87-0054, dated Oc%ber 15,1987), which justified a change in the emergency diesel generator stsrt times from within 10 seconds to within 16 seconds, based on a 1988 ant. lysis by General Electric, which concluded that although the emergency diesel generators were designed to start and attain rated voltage and frequency within 10 seconds, a maximum emergency diesel generator start time of 16 seconds assured consistency with the Cooper Nuclear Station licensing basis. This analysis was accepted by the NRC staff as documented in NRC Inspection Report 50-298/88-20, dated July 21,1988.
However, the team noted that this earlier analysis was not referenced in Change Request 97-166, License Change Request 95-0015, nor in Design Change 95-036; thus, it was not clear that the preparer of the 10 CFR 50.59 screen for License Change Request 97-166 was aware that the earlier analysis existed.
The inspectors concluded that this example demonstrated a lack of rigor in performing and documenting a 10 CFR 50.59 screening.
. Change Request 97-096, dated May 14,1997, related to changes to the Updated Safety Analysis Report resulting from the abandonment of the steam condensing mode of residual heat removal as an operating option. This change request removed in its entirety the previous discussion of this mode of residual heat removal operation from Section 8.5.5. The 10 CFR 50.59 evaluation for this change referenced a September 1995 report by General Electric, which
,
concluded that removal of this mode of operation was acceptable. The General i Electric report evaluated the radiological consequences of the change and l determined them to be "relatively insignificant." The team noted that the steam condensing mode of residual heat removal was not credited in any accident i
!
_ _ _ _ . .
,
'
analysis or transient response, and therefore its removal would not impact the analyzed dose consequences. The 10 CFR 50.59 evaluation identified this fact, and the team found it acceptable on that basis.
.
Change Request 96-098, approved November 5,1996, reflected a modification that provided alternate emergency power to the control room emergency filtration system exhaust booster Fan 1-BF-C-1B. The team determined that the 10 CFR 50.59 evaluation associated with the modification package (Modification Package 94 324) was thorough and adequately supported the Updated Safety Analysis Report change.
The team also reviewed several other 10 CFR 50.59 evaluations, including those associated with Engineering Evaluation 009, dated March 4,1997; Modification Packages 94-194A and 97-070 approved November 12,1997; Modification Package 96-107, dated August 9,1996; and Modification Package 96-113, dated August 27,1996. In general, these evaluations were thorough, were performed in accordance with station procedures, and acceptably addressed the criteria of 10 CFR 50.59.
The team reviewed two problem identification reparts that documented the licensee's failure to perform required 10 CFR 50.59 evaluations. Problem Identification Report 2-01693, dated December 2,1996, identified 41 license change requests associated with Updated Safety Analysis Report changes made in 1994 and 1995 never
. received 10 CFR 50.59 safety evaluations; 8 other license change requests had been screened as not requiring evaluations, but the determinations were questioned. The problem identification report indicated that in response to previous problems with the license change request process, a new procedure was adopted in March 1996 for the processing of Updated Safety Analysis Report changes, which added a requirement that all such changes need to be accompanied by a station operations review committee-approved 10 CFR 50.59 evaluation when submitted to licensing. However, the 1994 and 1995 license change requests had been submitted prior to the implementation of the new procedure. The licensee's planned corrective action for Problem identification Report 2-01693 was to assign Training Program Description 901 trainees to perform the required 10 CFR 50.59 evaluations for the 49 license change requests as part of their required training.
Problem Identification Report 2-21502, dated December 3,1997, cited inadequate corrective action in response to Problem identification Report 2-01693, as 37 of 49 evaluations still had not been completed one year later. The licensee initiated a Condition Adverse to Quality Action item CAO 97-1513, as a result of this second problem identification report. In January 1998, the licensee reviewed and prioritized the remaining 37 Updated Safety Analysis Report changes and concluded that two did not require 10 CFR 50.59 evaluations, while several changes were considered to be very significant. A contractor was retained to complete the required evaluations, with independent review by Cooper Nuclear Station Training Program Description 901 certified personnel. At the close of the inspection, the majority of the evaluations had been approved, and most of the remainder were complete and awaiting station
!
operations review committee review. The team noted that no unreviewed safety j questions had been identified.
l
l i
- The team reviewed Administrative Procedure 0.29.2,"USAR Change Requests,"
Revision 5, and confirmed that all Updated Safety Analysis Report changes were currently required to include a safety review and screening for 10 CFR 50.59 applicabikty in accordance with Administrative Procedure 0.8. The team agreed that adherence to this procedure should preclude the recurrence of Updated Safety Analysis Report changes being processed without receiving proper review in accordance with 10 CFR 50.59. However, the team considered the licensee's corrective actions in response to Problem Identification Report 2-01693 to be inadequate because several Updated Safety Analysis Report changes still had not received the required review more than 17 months after the problem was identified. However, the team determined that l while this was a violation of 10 CFR Part 50, Appendix B, Criterion XVI," Corrective Action," the ramifications of this corrective action problem constitutes an additional example of Violation 50-298/9712-02 and is not being cited individually. No additional !
response to Violation 50-298/9712-02 is required. l The team reviewed Prob!cm identification Report 2-24440, dated May 20,1998, and interviewed the originator. This problem identification report documented the disco rery of a potential unreviewed safety question identified through a routine review of the Updated Safety Analysis Report by a licensing engineer. The Updated Safety Analysis Report description of the reactor building heating, ventilation, and air-conditioning exhaust in Sections X-10.3 and V-3.2 conflicted with other Updated Safety Analysis 1 Report sections. The sections cited indicated that the design function of the reactor building heating, ventilation, and air-conditioning exhaust duct was to isolate the reactor building to prevent a fission product release to the environment following a fuel handling accident (i.e., zero unfiltered release). The problem identification report further stated ,
that in 1990 and 1993, the licensee identified that the isolation dampers in the system I were motor-operated instead of air-operated and revised other sections of the Updated i Safety Analysis Report to reflect a change in the system's design criteria to allow a limited unfiltered release through that pathway. The licensee performed 10 CFR 50.59 evaluations for the defacto changes, which concluded that an unreviewed safety I
question did not exist, even though the offsite doses resulting from a fuel handling accident would be increased. Notwithstanding, the NRC staff's current position that any I increase in consequences would constitute an unreviewed safety question, the problem l identification report acknowledged that the recalculated doses would exceed the values for a refueling accident specified in the NRC safety evaluation report for initbl plant licensing. Problem identification Repo't 2-24440 concluded that this issue did not impact current operability, as the accident of concern was a refueling accident.
Subsequent to the onsite inspection period, the licensee identified this issue as a l significant condition adverse to quality and was in the process of reviewing the l 10 CFR 50.59 evaluation to determine whether an unreviewed safety question existed. l Pending the completion of the licensee's evaluation, this issue will be tracked as an l inspection followup item (50-298/9815-05).
c. Conclusions l
,
The licensee's programs and procedures for conducting safety reviews, screens and l evaluations for changes to the facility in accordance with 10 CFR 50.59 improved since j the last assessment. The 10 CFR 50.59 evaluations were of generally good quality, i Several older evaluations were found to be inadequate. Contemporary evaluations I
pedormed for older Updated Safety Analysis Report changes or modifications were not
.._ -
always rigorous in identifying the basis for the determination that an unreviewed safety question was not involved.
l E2.2 Interim 10 CFR Part 21 Submitted by Licensee Reaardina Errors in General Electric Set Point Calculations a. Inspection Scoce (93809)
! The team reviewed recent set point errors that wore made in calculations developed to l support the improved technical specifications.
b. Observations and Findinas A total of about 54 calculations generated by General Electric Nuclear Energy in support of the improved technical specification had been reviewed by General Electric Nuclear Energy, the licensee, and a third party independent reviewer. The General Electric Nuclear Energy and licensee review ioentified three calculations, which were found to have nonconservative allowable values and set points, but would not cause a potential substantial safety hazard. Procedure ISA RP67.04 Part II, " Methodologies for the Determination of Set Points for Nuclear Safety-Related Instrumentation," defined allowable value as,"A limiting value that the trip set point may have when tested periodically, beyond which appropriate action shall be taken."
The improved technical specification had not been implemented at the time of this inspection. The team selectively reviewed the scope and nature of the errors to confirm the licensee's conclusion that even if there were a potential significant impact on the improved technical specifications, there would be no impact on the current technical specifications and plant operation.
Discussions with the licensee indicated that General Electric Nuclear Energy and the licensee had idantified several errors in the calculations. General Electric Nuclear Energy subsequently performed an internal review, and revised their calculations accordingly. The licensee subsequently contracted a third party revieNer to review the calculations. According to the licensee, the third party review examined all of the calculations and generated about 3600 comments. Approximately 2600 of the comments were editorial, approximately 800 were the result of not using current information, and approximately 200 were technical in nature. According to the licensee, the outcome of all the reviews to date identified three erroneous calculations that l resulted in nonconservative allowable values. In discussions with the licensee, the team reviewed the scope and nature of these three nonconservative calculations by l
'
comparing relevant portions of the original calculation (Revision 0) to the corrected calculation (Revision 1). The errors were in the accuracy calculations for flow biased scram, core spray bypass low flow, and residual heat removal minimum flow. The team also performed a cursory review of the comment resolution forms developed by the third party reviewer for Revision 1 of these calculations.
For computing the ailowable value for the flow biased scram (General Electric Nuclear Energy Calculation GE-NE-A41-00065-01-02-04-05-06-07," Average Power Range Monitor (APRM), et al . . . set point Calculations," Revisions 0 and 1, January and November 1997, respectively), General Electric Nuclear Energy omitted flow unit error
l
i
! terms for two channel elements (a square root extractor and summer). This resulted in 1 a slightly nonconservative allowable value of 0.58w + 61.5 percent versus 0 58w I
+ 61.0 percent. The value in the current technical specification was 0.58w + 62 percent
- 0.58dw with a maximum of 120 percent of rated power. The latter term is an offset for one pump operation. Even postulating that the same error had been made in l
'
determining the original (historical) technical specification values, the actual analytical limit established by the General Electric Nuclear Energy calculation for the high neutron flux scram was 122.4 percent rated power, which would provide additional margin to accommodate the effects of the postulated error. On that basis, the team concluded there would be no impact relative to the current technical specification from this error.
For computing the allowable value for the core spray bypass low flow valve closure (General Electric Nuclear Energy Calculation GE-NE-A41-00065-24, " Set Point Calculations for NPPD Cooper Nuclear Station Core Spray Pump Bypass Low Flow Transmitter," Revisions 0 and 1, January and October 1997, respectively), Gencrc!
Electric Nuclear Energy made a computational error in carrying through a numerical value and used an unsupportable 3 sigma accuracy value for calibration toci accuracy.
This resulted in a nonconservative allowable value of 1183 gpm rather than 1318 gpm.
There was no reference to a flow value in the current technical specification. On that basis, the team concluded there would be no impact relative to the current technical specification from this error.
For computing the allowable value for the residual heat removal minimum flow control set point, Calculation GE-NE-A41-00065-28, " Set Point Calculations for NPPD Cooper Nuclear Station RHR Minimum Flow Control Set Point," Revisions 0 and 1, January and October 1997, respectively), General Electric Nucicar Energy made a computational error in calculating the radiation effect (factor of 10 nonconservative). This resulted in a nonconservative allowable value of 1966 gpm rather than 2108 gpm. The current technical specificat;on value was 2500 gpm. On that basis, the team concluded there would be no impact relative to the current technical specification from this error.
c. Conclusions The team concluded that the improved technical specification program was using more rigorous methodology than was used in establishing current technical specification values, and that the nonconservative errors in computed allowable values for the improved technical specifications had no effect on the current technical specification or its application.
E2.3 Enaineerina Backloa a. Inspection Scope (37550)
The team reviewed the licensee's engineering backlog and the manner in which it was being controlled, in addition, the team discussed the backlog with appropriate licensee personnel.
!
i
!
I b. Observations and Findinas !
The team determined that the open problem identification reports and other licensing documents had an upward trend over the past 1-year period. In January 1997, there were approximately 520 open problem identification reports, and in March 1998 there J were approximately 720 open problem identification reports.
The licensee had an engineering document reduction program that reduced engineering backlogs from approximately 2100 open items in January 1997 to approximately 1300 open items in March of 1998. The licensee's open items (not including problem identification reports) consisted of drawing change notices (both modification and nonmodification), change evaluation packages, engineering work requests, engineering project requests, and completion reports. The team noted that the largest decrease occurred in the drawing change notice backlog. The backlog of drawing change notices decreased from approximately 1300 in January 1997 to approximately 480 workable drawing change notices on April 25,1998. The licensee attributed this decrease to the drawing change notice reduction program, which was initiated in January 1997. In February 1998, the licensee sent approximately 300 drawing change notices to a contractor .
In addition, the licensee had a backlog reduction program for the engineering work requests and the engineering project requests. The licensee reduced the backlog of these documents from 431 in January 1997 to 95 in April 1998. The licensee intended to eventually reduce these documents to zero since a new program was to be implemented in June 1998, which would include all of the change documents under one procedure; the change evaluation document.
c. Conclusion The team determined that there was an overall upward trend in the engineering backlog of problem identification reports. However, the overall progress associated with the engineering document reduction program was considered a strength.
E2.4 System Enaineerina a. Inspection Scoce (37550)
The team interviewed the system engineering manager concerning the current system engineering department and future improvement plans. The team also reviewed engineering work management.
b. Observations and Findinas l The licensee stated that there were currently 16 systems engineers at the site and that
!
there were plans to increase the number to 37. The licensee stated that the turnover i rate for engineers was 25 to 30 percent, which they considered to be an undesiretly high rate. The licensee stated that they had already hired 21 engineers with past experience and that 14 of them were in the current senior operator certification class.
The certification class was a full time 6-month training program. The class consists, in
, part, of 12 weeks of studying plant systems and 5 weeks of simulator exercises. The
l l
!
l
!
l
I
1 licensee stated that they planned eventually to send 80 percent of tha site engineers through the certification class. In addition, the licensee stated that all of the engineers in the current certification class and all but one of :ne current 16 systert, engineerc have engineering degrees. ;
The licensee stated that the site started a program in late 1997 to prioritize the schedule l of work for each entfneer for a 1-year period. The engineers' work schedule was !
reviewed once per 't.eek with the appropriate superyisor and a weekly report was generated to indicate what was accomplished. The supervisor prioritized the work with l the engineer and emergent work was also included on the schedule. The licensee j stated that the schedule was a tool that would enable the responsible engineer to forecast milestone objectives of work and then monitor progress in achieving the objectives. l l
In addition to the work schedule, the systems engineering manager was developing a systems engineering expectations list. The licensee stated that one of the expectations to be inc!udod on the list was a trending program with a set of parameters for each system engineer to aid in measuring and trending system performance. The licensee stated that there were no required trending programs currently in place for the system engineers. I c. Conclusion The team determined that plans to reconstitute the system engineering department were in the very early stages of implementation and that no conclusion could be drawn l currently on the effectiveness of the plans. j E2.5 Year 2000 Computer Issue a. Inspection Scope (37550)
The team reviewed efforts by the licensee to ensure that digital equipment will function properly after January 1,2000.
b. Observations and Findinas In discussions concerning the year 2000 computer problem, the licensee informed the team that it did not anticipate any difficulties in meeting the deadline for ensuring a smooth transition for the operability of digital components at the beginning of year 2000.
The team reviewed a licensee report," Year 2000 Project Plan," Revision 1, dated April 1,1998, which presented an overview of the issue and a general schedule of tasks to be completed. The team observed that the licensee's approach appeared comprehensive. The team also acknowledged the licensee's statement that Cooper Nuclear Station was less vulnerable than most nuclear plants to this issue because of the preponderance of analog, in lieu of digital, components installed in the plant.
c. Conclusions The licensee had developed a plan to ensure the continued operability of digital components after January 1,2000.
.. . - - .
E8 Miscellaneous Engineering issues (92903)
E8.1 (Closed) Unresolved item 50-298/9501-01: Acceptability of Single Check Valve for Containment isolation of Reactor Building and Torus Vacuum Relief Lines i
a. Backaround l
In reviewing the licensee's disposition of Generic Letter 88-14," Instrument Air Supply I Problems Affecting Safety-Related Equipment," as a part of the assessment of the operational experience review, the NRC identified an issue regarding the effects of this loss of nonessentialinstrument air to the reactor building-to-suppression chamber ;
(torus) vacuum breakers. This containment system provided for one air-operated l breaker in series with a swing check valve that was used for containment isolations.
However, the air-operated vacuum breaker did not have a reliable air source for i accident scenarios, in that it would fail to the open position and be ineffective for the l containment isolation function. The NRC inspection identified that this configuration was I not in accordance with the containment design as described in Updated Safety Analysis .
Report, Section 2.3.5.1, which stated that two valves were required to provide the I containment isolation function for penetrations that were open to the containment l atmosphere, but that did not directly communicate with the reactor vessel (generally defined as Class B valves in the Updated Safety Analysis Report). The licensee determined in Operability Evaluation 94-000-032 that the configuration was acceptable based on a boiling water reactor owners group's position that the check valve could be considered a passive component and could singly perform the containment isolation function. At the time of the inspection, the NRC had not completed its review of the boiling water reactor owners group's position.
b. Inspection Followup
The NRC reviewed the boiling water reactor owners group's position regarding the use of a single check valve for containment isolation and found this configuration to be acceptable. In addition, the NRC concluded that the design configuration was l consistent with the licensing basis as described in the Updated Safety Analysis Report. i Updated Safety Analysis Report, Section 1.7.1," Single Failure Criteria," Item 1, states,
"All air-operated valves in the primary containment isolation systems will fail closed upon loss of instrument air supply, with the exception of the reactor building to torus vacuum breaker, which will fail open upon loss of instrument air." The team reviewed Operability Evaluation 95-000-013 and found it to be acceptable.
In addressing reliability of the check valves in Operability Evaluation 95-000-013, the licensee stated that the check valves were leak tested as a part of the licensee's Appendix J program once per cycle in the as-found condition. The valves had never failed the acceptance criteria and maintenance had ever been necessary to enable the valves to pass the leakage test. In addition, the check valves were stroke-tested once per cycle to ensure that they would open with a 0.5 psid differential pressure and reclose when the force was removed. To substantiate their assertion that if the check valve opened early in the accident it would reclose and maintain containment integrity if the containment were to repressurize, the licensee described the results of an event August 5,1994. In this event the torus was inadvertently subjected to a subatmospheric pressure as a result of a planned torus drain down. The negative pressure was relieved
as a result of Valves PC-244AV and PC-CV-14 opening. The licensee then performed a local leak rate test, and the valve successfully met the acceptance criteria without any preconditioning work being performed on the valve. On the basis of the periodic testing i and maintenance history reported by the licensee, the team agreed with the licensee's conclusion that the reliability of the check valves was acceptable.
To address the reliability / availability of the air-operated vacuum breakecs, the team reviewed:
- CFM 950002, " Torus to Reactor Building Vacuum Breaker Equipment Classification," dated February 7,1995
- Maintenance Work Request 95-0382," Perform STP 95-038, PC-243AV/244AV Accumulator Hold Time Test." dated January 31 and completed February 4, 1995
- Surveillance Test Procedure 95-038,"PC-243AV/244AV Accumulator Hold Time Test" The team also reviewed Calculations86-117, " Seismic Qualification for Air Supply to Vacuum Relief Valve PC-243AV and 244AV," Revision 1, and 86-50," Seismic Analysis of Accumulator for the RB-to-Torus Vacuum Relief Lines," Revision 1, which supported the seismic qualification of the accumulator air supply system for the vacuum relief valves. The team found that the accumulator air supply system for the vacuum relief valves was seismically qualified, the accumulators and air tubing were upgraded to
" essential" status, a leak check on the air tubing and fittings was performed with acceptable results, a 1-hour hold time test on the accumulators was performed with acceptable results, and future hold time tests on the accumulators were scheduled for each refueling outage.
E8.2 (Closed) Unresolved item 50-298/9624-03: Possible 10 CFR 50.59 Violation Associated With Standby Liquid Control System a. Backaround l
The NRC identified that a modification to the standby liquid control system created the l
'
potential for a common single failure to de-energize both trains of the standby liquid control system pump contactor circuits and squib valve firing circuits, rendering them all inoperable until the fault was located and repaired. The report further discussed the licensee's position that the standby liquid control system was a nonessential system and that a single failure proof system design was not required. The licensee indicated that j since the system was not required to be single-failure proof, it was not necessary for the i electrical support to the system to be single-failure proof. The licensee also interpreted that the single-failure procf commitment from Updated Safety Analysis Report, Section 111-9.4, " Standby Liquid Control System Safety Evaluation," only referred to the electricalindependence of the upstream power supplies.
l
b. Inspection Followuo This issue was referred to the NRC program office. The staff reached the following conclusions:
1. The inspection team was correct in their determination that with the modified configuration, a cornmon single failure could be postulated (i.e., a short and/or ground of the redundant 120 Vac control power circuits) that would de-energize the standby liquid control system pump contactor circuits and squib valve firing circuits, rendering the components inoperable until the fault was located and repaired. Specifically, the plant monitoring information system inputs from the power and control circuits for both pairs of standby liquid control pumps and squib valves, are wired to adjacent terminals. This configuration could allow a single electrical short to disable the redundant standby liquid control pumps and squib valves, thereby preventing the system from performing its function.
Therefore, electrical separation has not been maintained throughout the entire system. If this short circuit occurs while the pumps are running, the 10 ampere fuse at the secondary site of the 480/120 volt transformer will blow, and open the secondary circuit. If the shor' occurs while the pump is de-energized, the fault may remain undetected until the pump and transformer are energized.
2. The NRC reviewed Section 9.4 of the Cooper Nuclear Station's Updated Safety Analysis Report and determined that the standby liquid control system is designed to provide redundancy in the power supply to ensure that the system will operate in the event of a single power supply failure. There is no requirement in the Updated Safety Analysis Report for the system itself to be single-failure proof. In addition, there is no requirement in 10 CFR 50.62 that the standby liquid control system be considered as a safety system. The requirement in 10 CFR 50.62, paragraph (c)(4), the anticipated transients without scram rule, states that, "The SLCS and its injection location must be designed to perform its function in a reliable manner. The SLCS initiation must be automatic and must be designed to perform its function in a reliable manner. . . ."
Based on this review, the NRC found that thero was no requirement for the standby liquid control system to be single-failure proof in either the regulations (specifically 10 CFR 50.62), or the licensing basis. Since the as-found configuration was consistent with the licensing basis, the team considered that no change was made to the standby liquid control system.
E8.3 (Closed) Unresolved item 50-298/9624-05: Possible 10 CFR 50.71(e) Violation Related to a Non Bounding Analysis involving the Radiological Consequences for an Anticipated Transient Without Scram a. Backaround
, The NRC identified that General Electric had performed the anticipated transient without
! scram event analysis using a nominal value of four seconds for main steam isolation valve closure time, rather than the minimum allowable value of three secois. Both Updated Safety Analysis Report,Section IV.6.3, " Main Steam Isolation Valve (MSIV)
Description," and Technical Specification 3.7.D.1, " Primary Containment isolation
!
l Valves," allowed a 3-second minimum closure time. The NRC believed that the analysis l was sensitive to changes in main steam isolation valve closure time. Specifically, the ;
NRC team believed that using a three-second main steam isolation valve closure time in l the analysis would likely result in significantly higher peak cladding temperature and increased oxidation. ,
b. Inspection Followuj
The NRC program office evaluated this issue and performed a detailed analysis of main steam isolation valve closure events for BWR/4 plants. The results indicated that the overall response of the fuelis essentially unaffected by changing the main steam isolation valve closure time from 4 to 3 seconds.
Based on this analysis, the team concluded that this issue was resolved. I E8.4 (Closed) Violation 50-298/9624-06: Failure to Torque Hydraulic Control Unit Scram Valve Capscrews as Required by Maintenance Instruction a. Backaround The NRC identified that licensee personnel did not fully implement Maintenance Procedure 7.2.55.2, " Hydraulic Control Unit (HCU) Scram Valve Operator Diaphragm Replacement," Revision 2, in that, on or about November 21,1996, capscrews on each of the mounting brackets for inlet Scram Valve CRD-AO-CV126, and Outlet Scram Valve CRD-AO-CV127 on Hydraulic Control Unit 38-23 were not torqued to 240 in-lbs. '
Specifically, the diaphragm case for each valve is attached to the actuator assembly by 24 capscrews, of which 2 were longer to facilitate mounting to the bracket. These 24 capscrews (which included the 2 longer mounting capscrews) were secured with nuts that were torqued to 240 in-lbs, prior to mounting the valve assembly to the bracket.
(Steps 8.18.10 through 8.1.8.12 of Procedure 7.2.55.2, Revision 2, detailed the above described assembly and torquing actions following diaphragm replacement.) Once the diaphragm case is reassembled, the 2 longer capscrews were placed through the bracket and secured with a flat washer, locking washer, and nut. In accordance with the vendor's manual, the bracket nuts were to be torqued to 225 in-Ibs. However, Procedure 7.2.55.2, Revision 2, was silent on torquing or tightening the bracket nuts.
Since the nuts found to be loose were the bracket nuts (i.e., those not detailed by Procedure 7.2.55.2), the cited violation was in error by stating that licensee personnel did not fully implement Maintenance Procedure 7.2.55.2. As documented in Maintenance Work Request 95-2241, the 24 diaphragm nuts were torqued to the required 240 in-lbs. However, the licensee acknowledged that Procedure 7.2.55.2, Revision 2, did not provide for the irstallation of the bracket nuts b. Inspection Followuo The licensee admitted the violation with clarification. The licensee investigated the causes of this violation and determined that due to misalignment in some cases, the
' bolting faces of the valve diaphragm case / actuator assembly and mounting bracket were not parallel. Consequently, if the capscrew having the least amount of gap is
.
__. . _ . . _ . . . _ _ _ _ _ _ _. _ _ _ - _ . _ . _ _ . _ _ _ . _ _
torqued or tightened first, the prekad achieved is diminished when the capscrew having the larger gap is torqued or tightened. For example, if the misalignment is of sufficient magnitude, the torque applied to the capscrew having the smaller gap will not produce enough force to draw the bolting faces parallel and a gap of smaller proportion will still exist. When the second capscrew is tightened and the bolting faces are drawn parallel, the gap remaining from the first capscrew will be closed, thus reducing the preload originally applied. Depending upon the magnitude of misalignment, this reduction in preload will result in one nut being tight and one being loose as obsented and documented in the cited violation.
The team reviewed the licensee's corrective actions for this violation. These corrective actions were as follows:
.
The licensee verified and/or torqued the bracket nuts on all hydraulic scram valves as required to meet the vendor specified 225 in-lb torque value. These actions were completed on March 31,1997 via Minor Maintenance 97-00894.
.
Maintenance Procedure 7.2.55.2 was revised with Revision 3, to require that the horizontal mounting bracket capscrews be loosened prior to torquing the bracket nuts. This action would ensure any misalignment that may exist was eliminated prior to torquing the bracket nuts. Revision 3 to Modification Package 7.2.55.2 was issued on March 27,1997.
The team reviewed the completed corrective actions and determined that they were appropriate to prevent recurrence of this violation.
E8.5 (Open) Unresolved item 50-298/9624-08: Anticipated Transient Without Scram Emergency Operating Procedure issues a. Backaround ;
The team identified three concerns with Procedure 5.8, " Emergency Operating ;
Procedures," Revision 8, as described in the following paragraphs, and presented in 1 approximately the order they would occur during and accident condition.
1. Inadeauate Mixina Not Considered When Determinino Hot and Cold Boron Shutdown Worth The two decision points in the failure to scram portion of Procedure 5.8 were based on the amount of boron that had been injected into the core. During an
.
anticipated transient without scram event, emergency operating procedures direct that reactor water level be lowered to control power. The procedure allowed operators to raise reactor water level once hot shutdown boron worth was achieved. Since cooling the reactor increases reactivity, the procedure instructed the operators to ensure cold shutdown boron worth was achieved
- before cooling the reactor, l
The NRC found that the licensee used an informal calculation (one which was
- not named, numbered, signed, checked or approved) to determine the hot and cold shutdown boron worth values for use in the emergency operating
_ _ _ _ _ __ _ ____- _ __-_ _ __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
l i
procedures. The calculation was prepared in accordance with the boiling water reactor user's group guidelines, however, this informal calculation assumed that the solution was mixed uniformly with the water in the reactor vessel and appurtenances. No margin was provided to account for nonuniform mixing. The team was concerned that these two variables (i.e., hot shutdown boron worth and cold shutdown boron worth) had been calculated without allowing for the safety margins, which were included in the original design. The design basis and the technical specification included 25 percent additional boron to allow, in peut, for nonuniform mixing. The values for these emergency operating procedure decision points did not include the 25 percent additional boron.
The NRC was also concerned that nonuniform mixing was likely and, as a result, the reactor may not remain shutdown when water level was raised, because insufficient boron had been injected to actually achieve hot shutdown boron worth. The team was similarly concerned that the reactor would not remain shutdown. The licensee stated that they were not required to use the more conservative design volumes, which included margins for inadequate mixing, in the emergency operating procedures.
This issue of possible nonuniform mixing and whether the licensee should include margins for inadequate mixing in calculating values used in emergency operating procedures was referred to the NRC program office for review.
2. Limitino Standby Liauid Control System Tank Concentration Assumptions Not Used to Determine Hot and Cold Boron Shutdown Worth The NRC found that the calculation for determining the amount of injected boron necessary to achieve hot and cold boron shutdown worth also contained a non-conservative tank concentration assumption. The licensee assumed that the tank concentration was 15 percent. The licensee stated that this was their lower administrative limit, however, the team noted that the technical specification limit on standby liquid control system was lower ($ 1.5 percent).
The team was concerned that the licensee could operate within the technical specifications limits and the emergency operating procedures would not be effective. The licensee stated that it was the boiling water reactor owner's group policy to use a nominal value rather than a limiting value. This issue of whether it was proper to use a nominal value rather than a limiting value in calculating values in emergency operating procedures was referred to the NRC program office for review.
3. Standby Liouid Control System Boron Disolacement Durina initiation of Shutdown Coolina Following use of the standby liquid control system to achieve cold shutdown boron worth and depressurization of the reactor, the emergency operating procedure required the use of the shutdown cooling mode of the residual heat
'
removal system to bring the reactor to the cold shutdown condition. The initial boron concentration in the reactor pressure vessel when shutdown cooling was initiated was to be higher than necessary to allow for dilution as the shutdown cooling loop was placed in service. However, the team was concerned that the
, _ _ _ _ _ _ _ _ _ - -
licensee had not adequately accounted for the mixing process, which would occur when the residual heat removal system was placed in service in the shutdown cooling mode. Initially the residual heat removal system would pull borated water from the reactor pressure vessel and return unborated water.
Because of the vesselinternal design and the jet pumps, the internal recirculation flow stream would act to displace the borated water in the core area with diluted water.
The volume of the piping in the residual heat removal system, which was used in the shutdown cooling mode was comparable to that of the reactor pressure vessel. The NRC was concerned because the volume of the residual heat removal system was so large with respect to the volume of the borated water, that a period of time could exist, prior to complete mixing, where a significant portion of the boron would be in the shutdown cooling loops of the residual heat removal system. This boron would not be in the core and, therefore, would not be available to control reactivity. The reactivity insertion due to the initial effects of replacing concentrated highly borated water in the core with diluted borated water from the mixed jet pump flow stream combined with the reactivity reinsertion of the cold water from the residual heat removal system loop, could potentially allow a significant reactivity excursion.
Discussion with Genecal Electric representatives indicated that the effects of the boron displacement during initial operation in the shutdown cooling mode had not been comprehensively considered during the development of the emergency operating procedures. The issue of a potential reactivity excursion due to the failure to address the effects of mixing related to boron dilution during initial operation in the shutdown cooling mode was referred to the NRC program office for review.
b. Inspection Followup 1. Inadeauate Mixina Not Considered When Determinina Hot and Cold Boron Shutdown Worth Calculations NEDC 891893,1895, and 1896 currently provided inputs to Procedure 5.8 with regard to hot and cold boron worth values. During NHC Inspection 50-298/96-24, it was documented that Revision 1 to these calculations had been initiated as a result of design modifications. Since these modifications were in the licensee's approval process, Revision 1 documentation could not be immediately located. The team concluded that approved calculations existed and that they provided the necessary inputs to the emergency procedure.
Regarding the issue of whether the licensee should include the 25 percent margin for inadequate mixing in calculated values used in emergency operating procedures, the team reviewed Appendix A to Revisioa 4 of the boiling water
, reactor owners group emergency procedure guidelina. This appendix described
! how the boron weights were to be evaluated, however, there was no requirement
! to assume 25 percent margin. Based on the review of this appendix, the team concluded that not including a 25 percent margin was acceptable. However, i
'
. . .- . - . - - - _ - - - _ _ - . _ . -. . . _ - - . . _ - . .
i l
since this issue was fotwarded to the NRC program office for review, this part of l the unresolved item remains open pending completion of this review.
l 2. Limitino Standby Liould Control System Tank Concentration Assumotions Not ,
Used to Determine Hot and Cold Boron Shutdown Worth l
l The NRC program office reviewed Appendix A to Revision 4 of the boiling water l j reactor owners group emergency procedure guideline, which describes how the !
boron weights were to be evaluated and found that there was no requirement to use the limiting tank concentration. Based on this review, the team concluded that the licensee's use of nominal standby liquid control system tank l
-
concentration instead of the limiting tank concentration referenced in the j technical specifications was acceptable. This part of the unresolved item is - !
'
!
closed.
3. , Standby Liauid Control System Boron Displacement Durina Initiation of Shutdown Cooli.ngn i This issut wa s referred to the boiling water reactor owners group by the NRC
- program office for review. This part of the unresolved item remains open l- pending the results of that review.
- E8.6 (Closed) Violation 50-298/9624-09: Failure to Promptly identify and Correct Conditions Adverse to Quality Related to a Design Criteria Document Review I a. Backaround
.
The following two conditions adverse to quality identified by a contractor's review of the l licensee's design criteria documents were not promptly identified and corrected by the licensee:
L 1
. Technical Specification 3.9.A.1.b and the associated surveillance requirement for !
ensuring an adequate supply of emergency diesel generator fuel oil did not ensure a sufficient fuel oil supply to meet the safety design basis specified in
.
Updated Safety Analysis Report, Section Vill-5.2.7," Standby AC Power Source,
Safety Design Basis." l
= The sizing calculation for the automatic depressurization system accumulators included non-conservative assumptions that did not assure that the accumulators would support the safety function of the main steam relief valves, b. Insoection Followuo
. The reason for the violation as documented in Problem Identification Report 2-06128, written October 8,1996, was 87 design criteria document open items identified in 1495
- during a contractor's verification and validation effort were " lost" due to a lack of process j. control by the vendor and the licensee.
l The " lost" open items were as a result of a breakdown in the administration of the design criteria document project during the mid-1995 time frame. Some of the subject
! 38
l i
open items were never formally transmitted to the licensee; others were transmitted but were not recognized as such because an undefined numbering scheme had been adopted by the vendor without licensee approval. Once identified, the delay from November 6 to December 19,1996, was a result of weaknesses in Procedure 3.32.10,
" Design Criteria Document (DCD) Open Items," Revision 1. Specifically, the procedure did not establish expectations for the timely completion of the evaluation to validate the classification of iss~ues proposed by a vendor.
The team reviewed the licensee's corrective actions, which were as follows:
.
As a result of the initial discovery, an extensive search of the vendor's design criteria document working files was done to bound the scope of this condition.
An additional 30 open items were discovered. The licensee processed those open items in accordance with Procedure 3.32.10 and operability issues were addressed, as required. All 117 open items were closed by July 7,1997.
.
The organizational weaknesses discussed above were corrected by the engineering reorganization, which was initiated in 1995. As a result of the reorganization, the temporary design criteria document project team was replaced by permanent staff within the configuration management engineering group. In addition, the licensee's design criteria document project guidelines were replaced with formally approved and controlled station procedures.
.
Procedure 3.32.10, " Design Criteria Document Open items," was revised with Revision 2, dated March 27,1997, to delineate the timeliness requirements for f licensee review of the classification of design criteria document open items proposed by a vendor.
The team reviewed the completed corrective actions and determined that they were appropriate to prevent recurrence of this violation.
For the two conditions adverse to quality that were mentioned in the violation, two problem identification reports were initiated. Problem Identification Report 2-07827 concluded that the existing fuel oil storage in the main fuel oil storage tanks, given worse-case instrument inaccuracies, exceeded the calculated fuel consumption rate for 7 days of emergency diesel generator operation. Based on this fact, the licensee concluded that the emergency diesel generators were operable. Problem identification Report 2-07309 concluded that the present configuration and testing of the automatic depressurization system valve accumulators assured that the design requirements and safety design basis requirements for the automatic depressurization system valve accumulators were fulfilled. The licensee concluded that the automatic depressurization system was operable. The inspection team reviewed both problem identification reports and concluded that the corrective actions were appropriate.
.
. .
. .
_ - _ _ _ _ _ _ _
- _ _ - _ _ _ _ _____ _ __-___-__ _-________ . _____.
I E8.7 [Olosed) Inspection Followuo item 50-298/9624-10: Review Licensee's Disposition of Fax Contractor-identified Potential Condition Reports a. Backaround The licensee's contractor identified the following six issues, which the NRC regarded as potential condition reports. This item was opened to review the licensee's responses to these issues.
The six issues are described below:
1. During the review of the high pressure coolant injection Updated Safety Analysis Report description for the high reactor vessel level high pressure coolant ir.jection turbine trip, an error sas discovered in the limiting condition for operation instrumentation table. The error was that the limiting condition for operation table for minimum number of operable channels, was listed as two, whereas, for logic systems using the two-out-of-three channels to trip, the minimum number of operable channels was three.
2. Updated Safety Analysis Report, Section 3.0," Primary Containment and Reactor Vessel isolation Control System," Subsection 3.5, " Safety Evaluation," discussed isolations und associated response to essential variables. In summary, the safety evaluation stated that no single failure, maintenance operation, calibration operation, or tests could prevent the system from achieving isolation. However, the contractor determined that existing testing methodology was not in accordance with the Updated Safety Analysis Report safety evaluation.
Specifically, the high pressure coolant injection steam supply isolation valves were prevented from actuating durin0 testing by racking out the power supply breakers while the valves were open. This was contrary to the design basis for high pressure coolant injection steam supply isolation valves, which were required to be operable during all periods of reactor operation. The procedures, however, did station an operator at the valves so that the valves could be closed if a containment isolation occurred.
3. During the review of the residual heat removal operating procedures and the applicable esctions of the Updated Safety Analysis Report, a discrepancy was identified between the operating procedures and the Updated Safety Analysis Report. Operating Procedure 2.2.70,"RHR Service Water Booster Pump (SWBP) System, " Revision 35.1, Section 6.0, step 6.2 stated, " Simultaneous operation of both SWBPs in a subsystem for a period of greater than one minute is prohibited at all times except when required by emergency operating procedures."
The Updated Safety Analysis Report stated that both service water booster pumps were required for each loop. In addition, Updated Safety Analysis Report,Section X, Description 8.2.6, page X-8-7, stated in part, " . . . during shutdown cooling mode two SWB pumps are required per loop."
4. The Updated Safety Analysis Report did not describe discharging reactor water to radwaste or the main condenser with the residual heat removal system when
secondary containment was required. The Updated Safety Analysis Report also did not describe suppression pool water discharge to the main condenser with the residual heat removal system during refueling operations when secondary containment was the primary containment or during power operations. The licensee installed a removable spool piece that connected the residual heat removal system to the main condenser. This spool piece should not have been installed any time that secondary or primary containment was in effect.
5. Updated Safety Analysis Report tables were incorrect with respect to high pressure coolant injection isolation valve testing in accordance with the technical specifications and 10 CFR 50.59, Appendix J. The Updated Safety Analysis Report tables classified these valves as Class B. Updated Safety Analysis Report, page Vll-3-15, states, " Class B automatic isolation valves are considered essential for protection against the gross release of radioactive material." Since these valves did not meet this condition, they did not fit the Class B description, and the Updated Safety Analysis Report table designation was incorrect.
.
6. The current residual heat removal minimum flow requirement of 8400 gpm in the technical specifications was incorrect and should have been 8100 gpm.
b. Insoection Followuo The licensee evaluated all six issues. Four of the six issues were resolved and closed within the corrective action process. The other two issues were evaluated and closed by other administrative means. The licensee evaluations of the six issues are presented below:
1. The licensee recommendation was to develop a technical specification interpretation of the procedure change until the error could be corrected.
Additionally, the licensee ensured that the improved technical specification corrected this error. The licensee initiated Plant Improvement Request 96-0348 to address this issue. This plant improvement request was closed on May 2, 1996. The closure documentation in the plant improvement request concluded that there was no safety issue with this concern and deferred the issue to the improved technical specification project. The improved technical specification will require that three reactor pressure vessel overfill protection channels shall be operable when >= 25 percent reactor thermal power, in order to meet single failure criteria.
Although the table indicated otherwise, at all times the circuitry and licensee procedures implemented the three channellogic. Therefore, the team agreed with the licensee that a safety issue did not exist and that the current controls and planned improved technical specification would correct this discrepancy.
2. The licensee identified this issue as a deficient 50.59 safety evaluation. The
! licensee revised the procedures to meet the Updated Safety Analysis Report requirements. The licensee issued Problem identification Report 96-0373, performed Modification MMP 96-079, and issued Revision 1 to Surveillance Procedure 6.HPCI.301,"HPCI Steam Line Space Temperature Switch Functional Test," to allow divisional testing of high pressure coolant injection
l
,
l l steam valves (15 and 16) without defeating the reactor vessel isolation control function of these valves. During the review of the actions documented in Problem Identification Report 96-0373, the licensee identified additional l instances where testing defeated a component's operability. The licensee l determined that during performance of Surveillance Procedure 6.OG.304,
" Augmented Off Gas (AOG) Steam Line Temperature Switches Functional Test,"
Revision 1, both augmented off gas steam supply valves were deenergized in the open position during performance of the test. The licensee issued Condition Report 97-1474 and modified Surveillance Procedure 6.OG.304 so that the test i
'
could be performed while the valve's steam line isolation function remained operable.
Following the onsite inspection, the team was informed that the subject l surveillance procedures were revised on February 5,1996, to correct the testing l discrepancy and to delete the previous practice of stationing an operator at the va ve during testing.
l The team considered this violation of 10 CFR Part 50.59 to be an example of an old design issue. Therefore, the NRC is exercising enforcement discretion in accordance with Section Vll.B.3, namely (1) it was licensee-identified as a result of a voluntary initiative (an Updated Safety Analysis Report discrepancy review),
(2) it was corrected within a reasonable time following identification, (3) the violation would not be categorized at Severity Level I, and (4) the violation would not likely to be identified by routine licensee efforts such as normal surveillance activities. After consultation with the Office of Enforcement, pursuant to Section
, Vll.B.3 of the Enforcement Policy, discretion is being exercised and a violation is l not being issued.
3. The licensee performed a 10 CFR 50.59 review of Operating Procedure 2.2.70 and the Updated Safety Analysis Report to correct the conflicts. The licensee issued Problem Identification Report 96-0372, which had two action items addressing this issue. Action item 1 evaluated the issue and concluded that the procedural guidance was correct and that Updated Safety Anaiysis Report revisions were required. The 50.59 review was completed on December 11, 1996. Action item 2, which addressed the Updated Safety Analysis Report revisions, was scheduled to be completed with the improved technical specification implementation.
4. The licensee verified the current status of the residual heat removal and j condenser spool piece and removed it if it was installed. In addition, licensee '
operations would perform a residual heat removal, fuel pool cooling , primary and secondary containment review including interties between the systems. All appropriate procedure and Updated Safety Analysis Report changes were to be processed. The licensee issued Problem Identification Report 96-0394, which concluded that installation of the spool piece was acceptable and an Updated Safety Analysis Report revision was not required. Condition Report 96-0394 was closed on December 30,1996.
The team reviewed Condition Report 96-0394 corrective actions, and determined that an Updated Safety Analysis Report revision was not required. The spool 42 ,
i
. _ ~ - . . _
l l
l piece was accurately described in the Updated Safety Analysis Report. The licensee stated that there were no plant equipment or systems important to safety, which depend, directly or indirectly, on either the temporary or permanent installation of the removable spool piece for their operating or accident mitigation.
5. The licensee revised the Updated Safety Analysis Report and operating procedures (later determined to not need revision) to accurately reflect high pressure coolant injection and other similar valve configurations. In this case, the valves were being water sealed by the suppression pool and connected to a closed system within the primary containment. The Updated Safety Analysis i Report defined Class B valves as process line valves that do not directly l communicate with the reactor vessel, but penetrate the primary containment and l communicate with the primary containment free space. These high pressure i coolant injection valves no longer fit the Class B description. One example given 1 was High Pressure Coolant injection 17CV in Penetration X-2108, which was i tested properly.
The licensee issued Condition Report 96-0397, which concluded that changes to the Updated Safety Analysis Report regarding water sealed valves, and changes of the containment leak rate testing procedures were performed correctly; however, the Updated Safety Analysis Report tables required revision to reflect the actual plant configuration. Condition Report 96-0397 was closed on August 6,1996. Revising the Updated Safety Analysis Report tables was deferred to Condition Report 96-0160 and Problem Identification l Report 1-20175. Specifically, the licensee incorporated updated versions of l Updated Safety Analysis Report, Tables V-2-2 and V-2-7, into the Updated Safety Analysis Report, Figure V-4-1, and eliminated Updated Safety Analysis 1 Report, Tables V-2-2 and V-2-7, to streamline the Updated Safety Analysis Report and retain necessary information. in addition, the licensee revised the Updated Safety Analysis Report primary containment text references and 1 Table Vll-3-1 to reflect the actual plant configuration. The corrective actions to I Condition Report 96-0160 were completed and the condition report was j
,
subsequently closed on June 17,1997. l l
The inspectors reviewed Condition Reports 96-0397,96-0160 and their corrective actions, and determined that their corrective actions were appropriate to resolve the issue.
<
6. The licensee reviewed orifico sizing and pump test data to confirm that the residual heat removal pumps had the required net-positive suction head (NPSH) l l under all conditions as stated in the Updated Safety Analysis Report. In addition, i l
if necessary, the licensee would reduce technical specification residual heat l removal flow to 8100 gpm during the improved technical specification
'
conversion.
The licensee's disposition of this issue indicated that the reason for the upper limit of 8400 gpm was pump run out protection, and was not associated with loss of coolant accident requirements. The licensee stated I that Calculation NEDC 94-231,"RHR Pumps NPSH/ Maximum Flow," Revision 3, i
)
>
, . - -_. .
- - -- -
.
l l demonstrated that if the technical specification requirement for a maximum residual heat removal pump flow of 8400 gpm at a pressure of 20 psid was fulfilled, the pump flow will not exceed 9450 gpm. This was the pump run out condition. Therefore, present technical specification pump flow of 7700-8400 ;
, gpm was correct and did not need to be revised. Design Change 94-32,"RHR Minimum Flow Bypass Valve Modification," utilized this calculation to justify that I- even with mini-flow valves full open, the residual heat removal pumps would not ;
i reach run ont conditions. i l
- The team reviewed Calculation NEDC 94-231 and Design Change 94-32, and determined that the present technical specifications limits of residual heat
,
removal pump flow of 7700-8400 gpm was correct, and that no revision was ]
l necessary. ;
i 1 l E8.8 (Closed) Inspection Followuo item 50-298/9624-12: Quality Assurance Program l Requirements and Programmatic Weaknesses Regarding Standby .iquid Control j l System 1 l
l a. Backaround i
! I In a letter (EA 97-017) to G. R. Horn, dated May 14,1997, the NRC opened this item to address the licensee's statement that the standby liquid control system was not subject to any quality assurance program requirements. The licensee committed to provide an '
'
accurate description of the quality assurance requirements for the standby liquid control ;
system and to ensure that all of the identified quality assurance weaknesses pursuant to l Generic Letter 85-06," Quality Assurance Guidance for Anticipated Transient Without Scram Equipment that is not Safety-Related," were addressed. In addition the NRC l identified the following six areas of weaknesses:
l
- Scaling calculations for standby liquid control system tank level indication did not exist !
!
l * Calculations of shutdown boron worth were not retrievable to support emergency ;
'
operating procedures
- Nonconservative errors were identified in the standby liquid control system pump net-positive suction head calculation l * The standby liquid control system tank was not being mixed as described in the i
General Electric Topical Report submittal for an anticipated transient without scram event
,
- The licensee did not have procedures to implement compensatory measures for i i- addressing failure of the standby !! quid control system tank heater as described j in the Updated Safety Analysis Report l
- The licensee did not revise the Updated Safety Analysis Report to reflect new
. and revised calculations that support the basis of the technical specification i surveillance requirement for the standby liquid control system relief valve set
- point
( 44
.
,
w v - , ri
b. Insoection Followuo in their letter, NLS970126, " Standby Liquid Control System Commitments," dated July 10,1997, the licensee stated that the standby liquid control system had been within the scope of the licensee's quality assurance program since initial plant operation, and ,
was subject to the objectiver and of principles 10 CFR Part 50, Appendix B, described in I the tables attached to the quality assurame plans. The letter described controls, which were equivalent to those applied to safety-related systems, such as, operation and testing; maintenance, troubleshooting, and post maintenance testing; design and design basis; and procurement controls. The team reviewed the licensee's description of quality assurance program scope for standby liquid control system and found it acceptable.
1. Scalina Calculations for standby liauid control system Tank Level Indication:
l The licensee subsequently prepared scaling calculations provided as Appendix C to Calculation NEDC 93-142, "SLC Storage Tank Setpoints and Concentration Requirements," Revision 1, dated June 16,1997. The team confirmed that the scaling calculations related " percent full" and " gallons" to bubbler instrument pressure, and included the appropriate correction for density and temperature variation.
2. Shutdown Boron Worth Calculations were not Retrievable l As discussed in Section E8.5b.1 of this report, the team concluded that approved calculations existed and provided the necessary inputs to the emergency operating procedure.
3. Nonconservative Errors in the Standbv Liauid Control System Pumo Net-Positive Suction Head Calculation: l The team rev!ewed Revision 1 of Calculation NEDC 92-015," SLO Pump Net-Positive Suction Heaa," revised to correct the errors identified in the inspection. The errors involved using the properties of water (rather than sodium pentaborate solution); omitting an entrance factor when calculating head loss; incorrectly translating friction factor from a friction factor chart; and incorrectly computing piping length. The revision resulted in a decrease in the solution temperature at which cavitation would be of concern from 143 to 142 degree F.
The original calculation conclusion had indicated cavitation was not of concern for solution temperatures >140 degree F, therefore, there was no impact on the conclusion of the calculation. The high temperature alarm set point was 110 degree F providing sufficient margin before onset of cavitation. The team found these corrections acceptable.
The licensee reviewed four additional net-positive suction head calculations, and identified one minor conservative error in a licensee calculation and several minor nonconservative errors in a calculation prepared by the nuclear steam l supply system vendor. The licensee prepared Problem identification l Report 2-20646 to resolve these minor additional errors, which were of little or no l
safety significance. The team reviewed the licensee's detailed evaluations i
l
. _ _ .
documented in Memorandum DED 97380, dated Deember 31,1997, and found them acceptable.
l 4. Standbv Liauid Control System Tank Mixina:
The licensee identified that General Electric Topical Report NEDE-31096-P l addressed three alternatives for meeting the anticipated transient without scram rule (10 CFR 50.62). These alternatives were: 1) two-pump operation, 2) increased concentration of sodium pentaborate, or 3) enriched boron concentration.
-
l Section 2.2.2.2 of Report NEDE-31096-P described the need for continuous I mixing of the storage tank if the increased concentration of the sodium )
pentaborate alternative was used. The licensee stated that they satisfied the ,
anticipated transient without scram rule by using the two-pump operation I alternative, without increasing the concentration of sodium pentaborate, therefore, concluded that continuous mixing was not required. The team reviewed test data showing that the standby liquid control system tank concentration remains adequately uniform and did not need to be mixed prior to )
monthly sampling. This data was documented in CNSS932952,"SLC Tank Sparge Prior to Sampling," dated November 2,1993, and further data and evaluation was provided in Memorandum DED 97225, " Support Information for Response to NRC SSFI (safety system functional inspection] Report on the SLC ,
System," dated June 18,1997. Based on review of these documents, the team I agreed with the licensee's conclusion that continuous mixing and mixing prior to sampling was not a generic requirement for the two-pump operation alternative, and that the licensee's test data and evaluation showed that samples taken without air sparging were consistent with results from samples taken after ,
mixing. l 5. Procedures for imolementina Compensatorv Measures to Address the Failure of the Standbv Liauid Control System Tank Heater The team reviewed Procedure 2.2.74," Standby Liquid Control System,"
Revision 29, which the licensee revised to include a provision for the addition of water in the tank to decrease the concentration if the heater failed and the room temperature was below the minimum tank temperature of 85 degrees F. The ;
team found this acceptable. However, the team also determined that the I licensee's failure to provide procedures for compensatory measures as described in the Updated Safety Analysis Report, was a violation of 10 CFR Part 50, Appendix B, Criterion V. This was considered to be an example of violation (50-298/9815-01). The team reviewed the licensee's corrective actions and found them to be thorough and comprehensive.
6. Bases for the standby liauid control system Relief Valve Setooint:
l l In their Letter NLS970126," Standby Liquid Control System Commitments,"
dated July 10,1997, the licensee summarized the results of Revisions 0 and 1 of Calculation NEDC 87-167," Standby Liquid Control Systcra Operating Pressure with Two Pump Operation." in addition, the licensee performed NEDC 97-011,
!
!
l
\ .
-_ _ _ _ _ _ __-__ ___-_____ _ ___ _
"SLC Specification Limit (1450 psig)," Revision 0, to reconfirm the conclusions in Revision 1 to Calculation NEDC 87-167.
As summarized in Letter NLS970126, Revision 0, of Calculation NEDC 87-167 established a minimum relief valve setting of 1450 psig, which was sufficiently high to preclude premature opening and to minimize minor leakage that could occur prior to opening. The calculation resulted in a 71 psi margin from normal operating pressure assuming two pumps running and the failure of one squib valve to open. However, the licensee also stated that failure of a squib valve need not be assumed in satisfying the anticipated transient without scram rule.
This approach was also reflected in Calculation NEDC 97-011. The team determined that there was no requirement for the standby liquid control system to be single-failure proof in either 10 CFR 50.62 or the licensing basis and, therefore, agreed that the licensee need not assume failure of a squib valve to open for this scenario.
Updated Safety Analysis Report, Volume 111, Section 9.4, "[SLC] Safety Evaluation," stated, in part, that, ". . . to assure the availability of the SLC system to meet its safety objective, two sets of components required to actuate the system pumps and explosive valves, are provided in parallel redundancy." The team determined that this statement was not consistent with the licensee's interpretation of the licensing and design basis as indicated in Letter NLS970126, and Calculation NEDC 97-011, which concluded that the failum of a squib valve was not required to be postulated. Therefore, the team found that Updated Safety Analysis Report, Volume Ill, Section 9.4, had not been updated to reflect Calculation NEDC 97-011.10 CFR 50.71(e) requires, in part, that the licensee periodically update the final safety analysis report to assure that the information included contains the latest material developed.
Contrary to this requirement, the team found that the licensee failed to revise the Updated Safety Analysis Report to reflect the results of Calculation NEDC 97-011, which eliminated the squib valve failure assumption documented in preceding Calculation NEDC 87-167, Revisions 0 and 1. This was a violation of 10 CFR 50.71(e). This failure constitutes a violation of minor significance and is not subject to formal enforcement action. Furthermore, the team concluded that the licensee's Updated Safety. Analysis Report rebaselining program, due to its defined scope, thoroughness and schedule would have likely identified this issue. The licensee entered this discrepancy into their Updated Safety Analysis Report rebaselining program for correction.
Post-modification testing revealed that standby liquid control system back l
'
pressure was higher than anticipated for two-pump operation, therefore, the licensee re-evaluated the relief valve settings. General Electric revised Calculation NIDC 87-167 and concluded there was still sufficient relief valve ,
pressure margin at the design flow rate with both pumps operating. The l licensee subsequently obtained from the pump vendor a basis for estimating the pump ripple effects, for inclusion in Calculation NEDC 97-011.
Calculation NEDC 97-011 concluded that the 1450 psig operability limit for the relief valves was adequate, provided the accumulators are functioning properly and both squib valves fully open. The team reviewed Calculation NEDC 97-011 and found it to be reasonable. l l
47 !
l
..__-_m_-___ _ _ _ _
I L
l \
l I
E8.9 (Open) Violation 50-298/9624-14: Eight examples of 10 CFR 50.71(e) failure to update l the Updated Safety Analysis Report; and B. three examples of fai'ure to conduct ;
.10 CFR 50.59(b)(1) evaluations. I i l
'
Violation A: 10 CFR 50.71(e)- Failure to Update the Updated Safety Analysis Report 1 The licensee stated that their corrective action to prevent recurrence of the violation was implemented in accordance with the Updated Final Safety Analysis Report rebaseling I program. This item will remain open pending an NRC review of the licensee's ,
l completed Updated Safety Analysis Report update. l
!
a. Violation A Backaround
!
Example 1 The Updated Final Safety Analysis Report, Section XII-2.3.5.2.2, "[ Seismic Analysis] l Piping," and Appendix C, " Structural Loading Criteria," Section 3.3.3.2, " Piping Seismic !
l Analysis," was not updated to accurately reflect the seismic analysis practices at the time. l l
Since initial construction of the facility, these sections of the Updated Safety Analysis )
Report (and the Final Safety Analysis Report), had described, in detail, the procedure for dynamically analyzing Class 1 seismic piping systems without restricting the requirement !
.
for dynamic analysis to large bore piping. However, since initial construction, the dynamic l l seismic analysis described in the Updated Safety Analysis Report was not performed for 2-inch and smaller piping systems. j Example 2
' Updated Safety Analysis Report, Section 111-9.3, *[ Standby Liquid Control System]
Description," was not updated to accurately reflect the expected room temperatures for the standby liquid control system and the controls in place to ensure safe operation with a room temperature of 50 degrees F. Updated Safety Analysis Report, Section X-10.3.2
"[ Heating, Ventilation and Air Conditioning Systems) Station Heating System," stated that winter design temperatures for the system are given in Table X-10-1. Table X-101,
"[ Heating, Ventilation and Air Conditioning Systems] Station Heating System Cngn 1 Temperatures (Winter)," stated that the normal minimum indoor temperature for the reactor building was 50 degrees F. The standby liquid control equipment was installed in a room in the reactor building. However, as of November 1,1996 (and since initial construction), Updated Safety Analysis Report, Section 111-9.3, stated that, "The equipment containing the solution was installed in a room in which the air temperature was to be maintained within the range of 65 F to 100*F." >
l Examole 3 l
Updated Safety Analysis Report, Section 111-9.4, "[ Standby Liquid Control System] Safety l
Evaluation," was not updated to correctly describe the safety basis for the standby liquid l control system relief valves. Design Change 86-34A,"SLC/ATWS Modifications,"
'
Revision 0, dated March 4,1988, changed the safety basis for the standby liquid control syste m relief valve settings to assure that injection into the reactor occurred while in an antic' pated transient without scram. Specifically, Section 111-9.4 stated, "The SLC system and pumps have sufficient pressure margin, up to the allowed system relief valve setting
l l
-. .. - -- . . - ~ - - - __ - . . . . - . .. . . - -- - . - _ -
1'
l range of 1450 to 1680 psig, to assure solution injection into the reactor above the normal j pressure of approximately 1030 psig in the bottom of the reactor."
Example 4 l Updated Safety Analysis Report, Section 111-9.3, was not updated to be consStent with l Technical Specification Figure 3.4.2. The Updated Safety Analysis Report stated that, at the minimum room temperaturo of 65 degrees F, the maximum permitted sodium pentaborate solution concentration was 12.5 weight percent. Section lll-9.3 also stated that a concentration of 11.5 percent corresponded to an adjusted saturation temperature l of 61 degrees F. The Updated Safety Analysis Report adjusted saturation temperature l included a 10 degrees F margin over saturation, which was consistent with the definition l for the technical specification minimum allowable temperature. However, Technical l -
Specification, Figure 3.4.2, " Percent Sodium Pentaborate by Weight of Solution versus
- Temperature," indicated that at 65 degrees F, the maximum permitted concentration was 12.1 percent. At 11.5 percent concentration, the minimum allowable temperature was 62 degrees F.
Example 5 Updated Safety Analysis Report, Section IV-9.3, "[ Reactor Water Cleanup System)
Description," was not updated to be consistent with a system change implemented by Design Change 86-34A, which modified the reactor water cleanup system isolation valves'
controllogic. Further, neither Section IV-9.3 nor Section 111-9.3 was updated to indicate
, that following the modification it was necessary to close both motor operated valves to
! ensure that a single failure did not compromise the isolation function of the reactor water i cleanup isolation valves.
l Updated Svety Analysis Report, Section IV-9.3 stated that, "In the iniet piping to the l cleanup recirculation pumps, two motor-operated isolation valves, one on either side of j l the primary containment, are automatically closed by . . . standby liquid control system j l actuation." Design Change 86-34A changed the reactor water cleanup system isolation l l valves' control logic such that initiation of one train of the standby liquid control system no l
,
longer closed both motor operated valves. To compensate for a single failure of the j reactor water cleanup isolation valves, the licensee implemented administrative
! procedures, which required the operators to operate both trains of the standby liquid control system to assure that isolation occurred.
i Examole 6 i
'
l
- In 1994, dunng a surveillance test validation program status review, the licensee identified l the following two discrepancies in the Updated Safety Analysis Report, which were not l corrected in the July 22,1996, update to the Updated Safety Analysis Report
l (a) Updated Safety Analysis Report, Table Vll-3-1, " Pipeline Penetrating Containment," Note 4, incorrectly stated that the control rod drive system solenoid valves open during a reactor scram. In a reactor scram condit.on the solenoid
,
valves remain closed and the air-operated scram valves open to insert the control
rods and to exhaust water to the scram discharge volume.
49 ,
l l
l l
(b) Updated Safety Analysis Report, Section Vll-4.5.44, "[ Core Spray System Control i and Instrumentation] Core Spray Valve Control," incorrectly stated that two l pressure switches monitor system pressure (for the low pressure permissive). In l addition, it indicated that either switch car initiate opening of the core spray pump l discharge valves. There were actually four pressure switches designed in a l 1-out-of-2-taken-twice logic, and a minimum of two switches were required to open i the core spray valves.
I Examoles 7 and 8 l
!
Example 7: Updated Safety Analysis Report, Table V-2-2, " Penetration Schedule," l pages V-2-9 to V-2-12, was not updated to correctly list all the penetrations, the quantity of I lines in three penetrations, and line descriptions in five penetrations, 1
Example 8: Updated Safety Analysis Report, Table V-2-7, "Testab;e Primary Containment I isolation Valves," pages V-2-44 to V-2-46, did not list 23 penetrations (X-20, X-30E and-30F, X-33E and -33F, X-35A through E, X-45D, and X-229A through L) and their associated valves. ,
b. Violation A Inspec'. ion Followuo Example 1 l The licensee's reason for the violation was that the piping systems were designed in accordance with USAS B31.1-1967, which did not require detailed calculations for pipe support locations and has less restrictive requirements for piping less than 2-1/2-inch diameter than for the large bore piping. The small bore piping systems were designed and installed using bounding static analysis. The NRC accepted this method of analysis as documented by NRC Bulletin 79-14, Revision 1, and NUREG-0800. The licensee I
stated that the description in the Updated Safety Analysis Report, which has existed since the original Final Safety Analysis Report, did not differentiate between less than l 2-1/2-inch piping, due to a general industry understanding that no detailed analysis was requirc:, and, therefore, a dynamic seismic analysis was not performed. The licensee
- acknowledaed that when the original Final Safety Analysis Report was updated, this
! should have been clarified.
l The team reviewed the licensee's corrective actions and found that the licensee revised Updated Safety Analysis Report, Section Xil-2.3.5.2.2, and Appendix C, Section 3.3.3.2, j to indicate that for Class I seismic piping systems 2-1/2 inches and greater in diameter,
'
dynamic analyses were performed, and for Class i Seismic piping systems less than 2-1/2 inches diameter, piping and supports were field routed using span and load tables.
The team noted that both Updated Safety Analysis Report, Section Xil, and Appendix C were revised as stated by the licensee. Therefore, the team determined that the l licensee's corrective actions were adequate to correct this violation example.
!
Example 2 The licensee stated that the reason for the violation was that at the time the statements were placed in the Final Safety Analysis Report, the description did not take credit for heaters, which were installed to maintain the solution temperatures. The Final Safety
. . - - -
Analysis Report, updated in 1983, was based on the best available information, which lacked clarity and completeness. The update was unclear in that it did not address that with the reactor building at a minimum temperature of 50 degrees F, the standby liquid control system solution minimum temperature was maintained with the addition of heaters or dilution if the heaters were to fail.
The team redewed Updated Safety Analysis Report, Section 111-9.3, which was revised to be conNstent with Section X-10.3.2. The team determined that the licensee's corrective actions were adequate to correct and prevent recurrence of this violation example.
Example 3 The team reviewed the licensee's corrective actions, which included revising Updated Safety Analysis Report, Section 111-9.4, to be more consistent with the change in the safety basis resulting from Design Change 86-34A. The team noted that the revised Section 111-9.4 now stated, "The standby liquid control system and pumps have sufficient pressure maigin, up to the allowed system relief valve setting range of 1450 to 1680 psig, to assure solution injection into the reactor at anticipated transient without scram pressures (near 1100 psig), which are above the normal pressure of approximately 1030 psig in the bottom of the reactor." The team determined raat the licensee's corrective actions were adequate to correct this violation example.
Example 4 The team reviewed the revised Updated Safety Analysis Report, Section lll-9.3, and found it to be consistent with Technical Specifications Figure 3.4.2. The Updated Safety Analysis Report description was clarified to state that at the minimum allowable 11.5 percent solution concentration, the adjusted saturation temperature was 62 degrees F. In addition, the licensee revised the Updated Safety Analysis Report to state that the adjusted saturation temperature was equal to the actual saturation temperature plus 10 degrees F. The team determined the licensee's corrective actions were adequate to correct tnis violation example.
Exam _ple 5 l
The inspectors reviewed the revised Updated Safety Analysis Report, Section IV-9.3, l which clarified that starting standby liquid control system Pump A closed the inboard reactor water cleanup system isolation valve, and starting standby liquid control system Pump B closed the outboard reactor water cleanup system isolation valve. The team determined that the licensee's corrective actions were adequate to correct this violation i example.
Example 6 l
l l The inspectors reviewed Updated Safety Analysis Report, Table Vll-3-1, Note 4, which was revised to indicate the correct control rod drive system valve positions on a reactor scram. The licensee revised Updated Safety Analysis Report Section Vil-4.5.44 to indicate the correct core spray system pressure switch logic for opening the discharge valves. In addition, the licensee revised Procedure 0.29.2," Updated Safety Analysis i 51
!
.-
Report Change Requests," on January 17,1997 to ensure proper control and verification of change documents. The team determined that the licensee's corrective actions were adequate to correct this violation example.
Examples 7 and 8 The licensee conducted a review of primary containment design change documents and drawings, and walkdowns in the plant to determine the extent of discrepancies in Updated Safety Analysis Report, Tables V 2-2 and V-2-7. The licensee discovered that Figure V-4-1, which included the penetration schedule, was also inconsistent with the information listed in Table V-2-2. In addition, the licensee determined that the existence of the tables and the figure added confusion to the description of primary containment l penetrrtions and associated valves. To consolidate and identify the correct configuration, the licensee deleted Updated Safety Analysis Report, Tables V-2-2 and V-2-7, and the information incorporated in Updated Safety Analysis Report, Figure V-4-1. Specifically, the licensee incorporated copies of Burns and Roe Drawing 4259, Sheets 1 and 1 A, into Updated Safety Analysis Report, Figure V-41, and into Burns and Roe Drawing 4260, Sheets 2A and 28, into a new Figure V-4-3. These l figures listed the penetrations, quantity of lines in the penetrations, and the line l descriptions, and replaced the inaccurate Updated Safety Analysis Report tables. In l addition, the licensee revised the training qualifications and increased management oversight for safety evaluatiens, and 10 CFR 50.59 screenings to ensure that changes to the Updated Safety Analysis Report are appropriately identified and subsequently updated in a timely manner to accurately reflect plant configuration. The team determined that the licensee's corrective actions were adequate to correct these two i violation examples.
l Violation B: 10 CFR 50.59(b)(1): Failure to perform adequate written safety evaluations The licensee stated that their corrective action to prevent recurrence of this violation was implemented as a part of their Updated Safety Analysis Report rebaseling program.
The specifics of each example are discussed below.
a. Violation B Backaround Example 1 Updated Safety Analysis Report,Section X.8.2.8.C, " Common Mode Failure Analysis -
Fire," stated that combustible materials should not be located in the service water booster pump room area since both trains of the service water system were located in close proximity to each other. The purpose of this statement was to prevent a common mode failure of the service water system due to a fire. However, Procedure 0.7.1,
" Control of Combustibles," Revision 6, allowed up to 90 pounds of wood or 5 gallons of flammable liquid in the service water booster pump room. In addition, as of Decemt'ar 2,1996, combustible materials (rags, papers, and flammable chemicals) were stored in
,
this area. The safety evaluation for the change to Procedure 0.7.1 was considered to i be inadequate, in that, a common mode failure analysis had not been performed to justify the presence of combustible materials in this area. Therefore, the safety evaluation did not provide a bases for the determination whether an unreviewed safety
- question existed.
i
{
i I
l l
Examote 2 I
Updated Safety Analysis Report,Section XII.2.2.7.1, " Intake Structure," states, in part, that I in order to keep ice away from the intake structure during cold weather, an ice deflector '
l was installed during the winter months. Although a portion of the ice deflector was installed on December 18,1996, the deflector had not been fully installed at any time i during the winter months. The failure to fully install the ice deflector during the winter I months was considered to be a configuration change that had not been evaluated, through a written safety evaluation, as a change to the facility. ,
l l
Example 3 Updated Safety Analysis Report,Section IV.10.3, " Nuclear System Leakage Rate Limits -
Description," stated, in part, that each containm:nt drywell sump has an alarm system and automatic starting sequence on rising water level. It also stated that both containment drywell sumps were equipped with a fill rate timer and alarm and that the alarm could be l set at or below the technical specification limit. The alarm would provide immediate l indication when the preselected rate was reached or exceeded. However, the team noted that the safety evaluation, dated December 20,1996, which addressed the failure of the automatic pump starting system and the failure of the sump fill rate timer and high level alarm, was inadequate in that it did not recognize that the control room fill rate timer and alarm was not available.
b. Violation B inspection Followuo Example 1 The licensee stated in its response to the violation that the as-found condition had been reviewed and evaluated by the NRC in an Appendix R exemption request for which a subsequent safety evaluation report granted the exemption. In addition, the licensee stated that the control of combustibles was documented in plant procedures. Therefore I l
the licensee concluded that while they failed to update the Updated Safety Analysis Report, no further safety analysis performed under 10 CFR 50.59 was required. The i NRC acknowledged that Procedure 0.7.1," Control of Combustibles," allowed up to l 90 pounds of combustibles in the service water booster purnp room. Furthermore, the ;
NRC's safety evaluation report, which supported the exemption was based, in pert, on a standard definition of low combustible loading, which was less than 40,000 Btu /f! The team noted that the loading in the area was less than 1000 Btu /ft . l As corrective action, the licensee modified Updated Safety Analysis Report, i l
Section X 8.2.8.C, to be consistent with the NRC exemption.
The team determined that the licensee's corrective actions were adequate to correct this violation example.
Example 2
'
The licensee stated that the reason for the violation was that high river levels made full installation of the ice deflector difficult. As part of their corrective actions, the licensee revised the Updated Safety Analysis Report to state,"An ice deflector is placed on the j
!
l
i
! Missouri River to direct float ice away from the intake Structure. The Ice Deflector is a non-essential component, which enhances plant operations. The presence of the Ice Deflector is scheduled around the Missouri River navigational season." The l 10 CFR 50.59 safety evaluation in support of this change determined that the ice deflector was not required to be in place, as it was not required to support any safety-related system, and that its absence would not result in an accident or abnormal transient. The safety evaluation further stated that, " . . . failure or absence of the ice deflector will have not impact on the ability of the service water system to satisfy its safety functions." This conclusion was based on an evaluation of the effect that a failure of the ice deflector and subsequent ice buildup in the intake structure would have on !
safety systems supported by service water or circulating water. The licensee concluded I that this change did not involve an unreviewed safety question.
The team reviewed the 50.59 safety evaluation, and agreed that an unreviewed safety 4 question did not exist.
'
The team determined that the licensee's corrective actions were adequate to correct I this violation example.
l Example 3 The licensee's corrective action was to revise the 10 CFR 50.59 evaluation to evaluate the effect of not having a functional fill rate timer and alarm. In their revised 10 CFR 50.59 safety evaluation the licensee concluded that the change did not involve ;
an unreviewed safety question. The team determined that the licensee's corrective j actions were adequate to correct this violation. I E8.10 (Closed) Unresolved item 50-298/9625-02: Acceptability of emergency diesel generator l Cylinder Differential Temperatures I a. Backaround The NRC identified that the emergency diesel generator cylinder exhaust differential temperatures had exceeded the licensee's 250 degrees F differential temperature limit specified in the vendor's manual. The licensee originally had operated these emergency diesel generators with a limit of 100 degrees F differential temperature based on the vendor's manual recommendation, which was considered an industry-accepted standard. However, the licensee increased the differential temperature limit ;
because they were unable to maintain the originallimit. In addition to the differential l temperature increase, the licensee also increased the cylinder maximum differential firing pressure limit from 75 psi to 180 psi. The emergency diesel generators at Cooper Nuclear Station were manufactured by Cooper Bessemer.
b. Inspection Followuo l After further review of the differentia 1 temperature concern by the NRC staff, it was i concluded that the current vendor's recommendations did not address cylinder temperature differentials because the vendor believed that cylinder exhaust temperature was not a reliable indicator of engine balance. However, the vendor continued to recommend trending of the individual cylinder temperatures as an indicator of an
_ - . . _. _ _ _ _ _ __
. _ . _ - _ _ _ _ . _ _ . _ _ .
)
l
!
I engine malfunction. It was the staff's understanding that no anomalies in the trending ;
L data of the exhaust temperatures had been observed. In summary, the licensee's '
actions regarding cylinder temperatures were consistent with vendor recommendations.
With regard to the cylinder pressure differential concern, it was generally accepted that a substantial difference in cylinder peak firing pressures meant that an engine was unbalanced, and that the cylinders with the highest firing pressures were doing more I work than the other cylinders. If the differential was of sufficient magnitude (i.e., greater )
than recommended by the vendor), it was reasonable to expect that the cylinders doing the most work are likely to degrade faster than the other cylinders. However, quantifying the effect of an unbalanced engine in terms of increased degradation and decreased 1 reliability was not feasible. An engine imbalance could increase the potential for i emergency diesel generator failure due to increased loading of engine components in l l the affected cylinders such as piston pins, piston rings, valves and bearings. l The emergency diesel generator cylinder peak firing pressure differential exceeded the l l
vendor-recommended maximum by about 20 psi (180 psi actual vs.160 psi l recommended). However, the vendors' recommendation was based on an average 1 peak firing pressure of 1690 psi, or a maximum of 1750 psi. The emergency diesel j generators were operating between 1300 and 1500 psi average peak firing pressure, l l which equates to a maximum of about 1590 psiin the cylinders with the highest firing )
'
pressures. Since this pressure was substantially less than the maximum peak pressure j i recommended by the vendor, the engine imbalance was not a cause for concern.
i However, the absence of a concern was based on the maximum value of cylinder firing l pressure only. The emergency diesel generators were not balanced in accordance with i vendor recommendations, it was concluded by the NRC that the licensee should 1 continue to evaluate the root cause of the higher-than-recommended peak firing pressure differential with the objective of reducing the differential to acceptable levels at ;
the earliest opportunity. The team noted that while the licensee restarted from the last 1 refueling outage within the vendor limit, the differential pressures were slightly above the l vendor limit. The licensee was tracking and trending this parameter accordingly. Based on the monthly run data, it was th'e licensee's practice to target specific cylinder i
inspections during the emergency diesel generator inspections scheduled for the next - !
i l refueling outage. The licensee stated that if an adverse trend was detected, they would take action before the next refueling outage. The licensee also stated that should the cylinder inspections reveal a condition adverse to quality, the corrective action program would be entered so that the condition could be further evaluated and corrected. ,
l l
E8.11 (Closed) Inspection Followuo item 50-298/9707-07: Determine Whether 10 CFR 50.59 !
l Safety Evaluations Were Performed l l a. Backaround !
This issue was based on an NRC finding that Procedure 3.4.5," Engineering Evaluations," Revision 1C2 required a 10 CFR 50.59 screening review for all engineering evaluations, except those dispositioned as rework (return to original
,
configuration), those used to collect information, and those which met a 10 CFR Part 50,
Appendix B, screen in accordance with Procedure 3.4. In the course of that previous
'
inspection, the licensee stated that the Appendix B screen effectively functions the same !
!
' I
l
!
i
-.- - . _
.- -- . . - . . - - - - - _ . . .. . ,
i as a 10 CFR 50.59 screen and, as a result, could be used interchangeably to determine if a full 10 CFR 50.59 safety evaluation is required. The concern was that the licensee may have been relying on an Appendix B screen in lieu of performing a 10 CFR 50.59 screen for some engineering eva!uations (engineering evaluations), and that the requirements of 10 CFR 50.59, in come cases, may not be adequately addressed by performing an Appendix B screen.
b. Inspection Followyg l
Upon further review of Procedure 3.4.5, the team noted that Attachment 4, step 3.2.2, to the procedure required a safety review to be performed in accordance with l Procedure 0.8 for all engineering evaluations, excluding rework engineering evaluations. Informational engineering evaluations were also excluded from the ,
requirement to perform a safety review by step 5.1 of Procedure 3.4.5. Procedure 3.4, ;
step 8.1, stated, "When assigned a project which requires documentation controlled by ;
this Procedure, the Plant, Design, or Operations Engineer shall complete an Appendix B l screen (Attachment 1) and a Safety Review per Procedure 0.8." On the basis of these l instructions in the respective procedures, the licensee indicated that they do not substitute 10 CFR Part 50, Appendix B, screens for 10 CFR 50.59 screens, and where 10 CFR 50.59 was specifically exempted (for informational engineering evaluations and )
rework engineering evaluations),10 CFR 50.59 had not been violated. The licensee indicated that previous statements regarding the use of Appendix B screens in lieu of 50.59 screens were in error.
E8.12 (Closed) Unresolved item 50 298/97201-01: Review of Licensee's Evaluation of ,
Residual Heat Removal Pumps Flowrate I a. Backaround j The NRC identified that, during the residual heat removal pump flow surveillance test, the flow was measured using existing process instrumentation without accounting for instrument uncertainties. The NRC reviewed Surveillance Procedure 6.1RHR.101,
"RHR Test Mode Surveillance Operation," Revision 4C3 (Division 1) and 6.2RHR.101, Revision 4C3 (Division 2). The surveillance procedures specified the minimum technical specification flowrate for one pump of 7700 gpm, which was one of the acceptance criteria for the pump test and did not allow for instrument uncertainties. Technical Specification, Section 4.5.A.3.d, for the low pressure coolant system requires that the i residual heat removal pump be tested once every 3 months to demonstrate that a single l pump was capable of delivering a flowrate of at least 7700 gpm, but no more than !
8400 gpm against a system head equivalent to a reactor vessel pressure of 20 psid l above drywell pressure with water level below the jet pumps. The NRC found that no formal calculations documented the instrument uncertainties. However, informal calculations performed by the licensee indicated that the flow recorder had a total i uncertainty of about +/- 500 gpm and that the local pressure indicators had a measurement uncertainty of about 1 percent of full-scale range. The NRC determined that during the surveillance test the pump flow rate could be below the technical specification minimum of 7700 gpm because no allowance for surveil!ance test instrument uncertainties was considered.
l
. _
. . _
l The NRC determined that the safety analyses in the Updated Safety Analysis Report, i l Sections VI and XIV-6.3, were performed using the minimum single residual heat
!
removal pump flow rate of 7700 gpm as an input assumption with no allowance for surveillance test instrument uncertainties. In addition, the NRC reviewed i Calculation NEDC 94 230, " Vessel Head-Over-Drywell Capacity Curve for input into ECCS Analysis," Revision 3, and found it was based on the 7700 gpm pump flowrate. l The NRC determined that if the actual flowrate was less than 7700 gpm, the available l l safety margins could have been reduced or eliminated. The NRC concluded that the l design bases for the pump flow was not properly translated into test procedures.
!
b. Inspection Followuo l
l l The instrument loop uncertainty of +/- 500 gpm was based on an informal calculation
! using a very conservative pump flow of 20,000 gpm and, therefore, was not realistic
!
for determining instrument uncertainties. The team reviewed General Electric Specification 22A1472AB, " Residual Heat Removal System," dated October 13,1969,
, and found that the 7700 gpm flowrate for one residual heat removal pump had a built in j
!
uncertainty of +/- 400 gpm with an uncertainty of +/- 600 gpm for both pumps. In l addition, the licensee recalculated the instrument uncertainties using a single pump flowrate of 7800 gpm and determined the instrument uncertainty was +/- 263 gpm.
This uncertainty of +/- 263 gpm was documented in Memorandum DED 98127, dated May 20,1998. The team determined that this uncertainty, though less conservative, was more realistic. Based on the revised uncertainty value of +/- 263 gpm and the l General Electric specification built-in instrument uncertainty of +/- 400 gpm, the team l concluded that the existing surveillance precedure was adequate to insure that the i
licensee's technical specifications were being met for the residual heat removal pump '
performance.
E8.13 (Closed)Insoection Followuo item 97201-02: Residual Heat Removal Pump Suction Strainer Modification a. Backaround l
l In response to NRC Bulletin 96-03," Potential Plugging of Emergency Core Cooling
- Suction Strainers by Debris in Boiling-Water Reactors," dated May 6,1996, the licensee l replaced the original residual heat removal pump suppression pool suction strainers with l !arger capacity passive strainers via Modification Package 96-132," Emergency Core j Cooling Systems Suction Strainers Modification." The modification package stated that
! the new strainers satisfied existing plant design and licensing bases, and increased the available net-positive suction head margin. The sizing of the replacement residual heat l removal strainers was based on an allowable strainer head loss margin that was
! established to ensure that adequate net-positive suction head was available for the residual heat removal pumps. However, the NRC identified that the modification l package and Calculations NEDC 97-041 and NEDC 97-042 for the sizing of the new suction strainer and net-positive suction head evaluation for the residual heat removal
,
pumps did not consider the effect, if any, of a 3 psi margin between the containment
! pressure and the pressure required for minimum net-positive suction head at the residual heat removal pump. This 3 psi margin was assumed in the original plant safety evaluation.
i 57
!
- .- .-
l l
!
l l I
! The licensee initiated Problem Identification Report 2-20641 to address the lack of consideration of the 3 psi margin. The licensee performed a preliminary evaluation that concluded that the 3 psi margin was maintained for the replacement strainers if a dynamic velocity head loss term was removed from the available net-positive suction head calculation for the replacement strainer. The licensee's evaluation conclusion was l
,
confirmed in a letter from General Electric to the licensee dated December 15,1997.
l This letter stated that the dynamic velocity head loss term was not included in the
,
existing licensing basis net-positive suction head determination. l
'
l l b. Inspection Followup l
The team noted that since the General Electric letter specified that the dynamic velocity head loss term was not included in the existing net-positive suction head loss term, the 3 psi margin was not affected by the modification. The team also noted that since the newly installed strainers had a lower pressure drop than the original strainers, the
- design of these strainers met or exceeded the original strainer design performance and that adequate net-positive suction head was retained for the residual heat removal pumps. In addition, the calculations demonstrated that an adequate net-positive suction head was maintained during strainer debris loading conditions.
i
! E8.14 (Closed) Inspection Followuo item 97201-03: Residual Heat Removal Pump Net-Positive Suction Head for Fire Events
.Backaround Report GE-NE-T23-00742-01," Fire Evant Analyses for Cooper Nuclear Station," dated l March 1997, calculated peak post-event suppression pool temperatures as high as j 218.5 degrees F after an Appendix R fire event. Because the residual heat removal
-
j system was required to operate during a safe shutdown, the team questioned whether the residual heat removal pump net-positive suction head requirements at these elevated pool temperature conditions had been evaluated. The licensee initiated Problem Identification Report 2-20629 to address this concern. Preliminary evaluations performed by the licer.see, documented in Engineering Evaluation 97-335 dated
'
December 1,1997, concluded that adequate residual heat removal pump net-positive suction head would exist when credit for containment pressure was taken. However, the cc ~t inment pressure values credited in the evaluation were not conservatively cr2, !ated using assumptions that minimize the calculated pressure. The licensee stated that in a telephone conversation with General Electric on December 2,1997, General Electric indicated that based on their experience, the containrr ont pressures i
calculated using assumptions that minimize the pressure would be about 3 4 psiless l than the values presented in Report GE-NE-T23-00742-01. Even with this lower containment pressure, since pump net-positive suction head requirements were less at the lower residual heat removal flowrates, it appeared that residual heat removal pump (
l net-positive suction head would be acceptable. However, the licensee recognized that a l more rigorous evaluation was appropriate.
l l Inspection Followup The team reconfirmed that Engineering Evaluation 97-335, dated December 1,1997, Attachment 3, concluded that adequate residual heat removal pump net-positive suction i
!
l
,
_. - - _ - -. - -- . - . - - . - _ .-. .-.
i l l
!
head would exist when credit for containment pressure was taken. To close out the I
,
-
issue, however, the licensee requested a more rigorous evaluation from General l l Electric. A new analysis, which evaluated the net-positive suction head margin available l for Appendix R fire events, Report GE-NE-B13-01920-016 was provided, which I
established that the necessary net-positive suction head was available for the residual heat removal pumps under the Appendix R scenarios. The revised analysis provided l
the basis for justification of the containment pressures used in Engineering Evaluation 97-335 and the original fire event analysis. This justification was based on the fact that the long time to peak pool temperature in the Appendix R scenarios allowed j the pool pressure to reach its maximum value as calculated in the original fire event l
analyses. The pool pressure was calculated based on the assumption of instantaneous heat transfer between the pool water and the air space. This assumption maximizes the j pool pressure response, in that, the pressure would increase with the increase in pool temperature. This assumption only aHected the pressure response during the initial part of the event. For the fire event, the peak pool temperature occurs at about 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after event initiation. This long time peak pool temperature development allowed the pool pressure to reach its maximum value as originally calculated. The conservative assumption and approach applied in this evaluation (e.g., applying the required net-positive suction head at 7000 gpm) also bounded potential variations in available net-positive suction head due to pool pressure variations.
The team concluded that the net-positive suction head available for the Appendix R l
events exceeded the necessary minimum net-positive suction head available during design basis events.
E8.15 (Closed) Unresolved item 97201-04: Residual Heat Removal Pump Minimum Flow Backaround in Letter NLS 8800347, dated July 8,1988, addressed to the NRC, the license stated that the four residual heat removal pumps had been shown, by actual test results, to have adequate minimum flow capacities and to not have adverse pump-to-pump interactions. The letter concluded these pumps were not adversely affected by the problems suggested in NRC Bulletin 88-04, " Potential Safety-Related Pump Loss."
In response to questions posed by the NRC regarding the licensee's response to NRC Bulletin 88-04, the license documented a re-evaluation of all safety-related pumps in Letter NLS940141, dated December 29,1994. In this supplemental response, the l licensee identified that the manufacturer concurred with the previous conclusion that j minimum flow capacities were adequate, and parallel residual heat removal pump i operation on minimum flow for a duration of 15 minutes will not stress the pumps to the point of imminent failure. On August 24,1994, the pump vendor agreed that parallel l operation of the pumps for 15 minutes or less at a flowrate of 1450 gpm, was acceptable. l l
'
The NRC reviewed Procedures 2.2.69, " Residual Heat Removal System," and 2.2.69.1,
"RHR LPCI Mode," to determine how the minirnum flow restrictions were addressed.
Neither of the procedures specified operationallimitations for the residual heat removal pumps as stated by the vendor-recommended minimum flowrates during both short- and ;
i long-term operation. The team concluded that the design bases for residual heat l
.
l 59
. - - . - - - - . . ~ - . - - - . - - . - ._- -
I u
removal pump minimum flow requirements were not correctly translated into procedures.
I Inspection Followuo j
Upon review of Procedure 2.2.69, the team concluded that minimum flow operational limits were identified, although somewhat unclear, in the procedure. Further, the residual heat removal system had been designed so that the pumps could operate for at least 15 minutes on minimum flow. This capability was demonstrated in site-specific j tests. Considering the entire spectrum of loss-of-coolant-accident break sizes, the j maximum time residual heat removal was required to remain on minimum flow in order I to provide low-pressure-coolant-injection to mitigate an accident was 15 minutes. If the break was large, low-pressure-coolant-injection flows above minimum will be required prior to 15 minutes. If the break was small, the vessel will not depressurize and will be mitigated by high pressure injection systems. Under this condition, operators are directed by the emergency operating procedures to immediately secure pumps or i establish flow to the suppression pool. The suppression pool cooling procedure l (Procedure 2.2.69.3) cautions the operators against operation for greater than 10 j
'
- minutes on minimum flow.
,
in addition, the team noted that in response to this concern, Night Order 97-035, l subsequently replaced by Night Order 97-039, which in turn, was replaced by Standing '
Order 98-006 was issued notifying operators of the specific minimum flow requirements !
and associated operating time limitations. The team reviewed procedure change
,
requests for Operating Procedures 2.2.69,2.2.69.3,6.RHR.301,6.2RHR.102, l 6.1RHR.102,6.1RHR.101, and 6.2RHR.101, which were to be revised to incorporate j the amplifying information contained within the night orders, in addition the licensee performed an evaluation, which demonstrated that the residual heat removal pumps
'
have not degraded in a manner that invalidates the strong pump / weak pump interaction analysis conclusions.
The team concluded that minimum flow operational limits were properly addressed.
E8.16 (Closed) Insoection Followuo item 97201-05: Residual Heat Removal Pump-to-Pump Interaction
, a. Backaround l An analysis of 1987-1988 inservice test data supporting Design Change 86-125,
! " Removal of RHR Minimum Flow Orifices," indicated that the differential pressure between the A and C pumps was less than the differential pressure between the B and D pumps. The team reviewed Calculation NEDC 94-258," Technical Specification Acceptance Criteria for LPCI Pumps Flowing at 7800 gpm," and noted that the residual
! heat removal pump surveillance test criteria would allow acceptance of pump performance combinations with one pump head degraded by about 100 feet more than the other pump. The team was concerned that a condition could result in a pump-to-pump interaction due to a relatively flat pump performance curve at low flows.
The licensee issued Problem identification Report 2-08280 to evaluate pump-to-pump interaction based on the worst case degradation allowed under the surveillance test program.
- - - - ..- . -_ -. - - . - - - - - - - . - - ---.-_- -
l b. Inspection Followuo
!
The licensee performed an informal evaluation that determined the relative performance )
'
.
of the residual heat removal pumps had not changed since 1986 when site-specific l minimum flow performance testing was conducted. Therefore, current plant conditions
- were bounded, with respect to this concern, by the results of the previous plant-specific minimum flow test results.
The licensee performed Calculation 98-005, " Minimum Flow Line Capacity for RHR i Pumps During Single and Parallel Pump Operation," which determined the minimum
- flow contribution that would exist from the most degraded of a pair of pumps possessing the largest possible differential, which would meet the technical specification ;
requirements for both individual and multiple pump performance. This flow contribution was then compared to that determined to exist during the 1986 test. Based on this comparison, the licensee determined that no additional testing or administrative controls )
were necessary, in addition, the licensee revised the residual heat removal design i control document to include the results of Calculation 98-005. i l
The team additionally asked whether the ASME Section XI (inservice testing) pump test !
flow and head tolerances were bounded by the technical specification quarterly pump l flow surveillance test requirements. The licensee provided excerpts of Test i Procedures 6.1RHR.101 and 6.2RHR.101, which integrated the technical specification l
'
reference values into the inservice testing flow and head acceptance limits. The team agreed with the licensee's conclusions and considered the licensee's response to this issue to be comprehensive and thorough.
]
E8.17 (Closed) Unresolved item 50-298/97201-06: Residual Heat Removal Heat Exchanger
Performance Testing l
a. Backaround j l
The team identified errors and questionable input parameters in Calculation NEDC 93-08,"RHR Heat Exchanger Fouling Factor Determination for Mode C2," Revision O. The errors included incorrect service water temperature, an incorrect heat transfer area, and input parameters based on test data that showed a considerable heat load mismatch between the residual heat removal and service water sides of the heat exchanger. As a result of thess incorrect input parameters, the performance of Procedure 13.17," Residual Heat Removal Heat Exchanger Performance Evaluation," for residual heat removal Heat Exchanger A on October 5, 1 1991, showed a significant mismatch in heat removed from the residual heat removal !
side of the heat exchanger and heat entering the service water side of the heat I exchanger. The licensee issued Problem Identification Report 2-19713 to document these issues.
A review of Condition Adverse to Quality Report 97-0831 indicated that residual heat ,
removal heat Exchanger A was tested since March 1993 and was cleaned for 4 years l'
l (between November 1991 and November 1995). In addition, residual heat removal Heat l- Exchanger B was not cleaned for 4 years (between April 1993 and April 1997) and was not tested since October 1995. Neither residual heat removal heat exchanger was tested during the last recent plant outage in April 1997.
i l 61
Procedure 13.17 specified an acceptance criterion of 222 Btu /hr-F-ft2 for the heat transfer coefficient. This value was based on the heat exchanger's capability to remove the accident heat load at a service water temperature of 85 degrees F. In 1990, the design basis service water temperature was increased to 90 degrees F. The NRC noted that the acceptance criterion for the heat exchanger should have been established taking into consideration the higher serv!ce watar temperature. To resolve these concems, the licensee stated that the method of evaluation would be changed and the acceptance criterion would be established based on heat removal capability required to mitigate accident conditions.
b. Inspection Followuo incorrect Inout used in Calculation NEDC 93-08 The team reviewed Problem identification Report 2-19713, which was written to document that an incorrect input was used in Calculation NEDC 93-08. In resolving the problem identification report, the licensee superceded Calculation NEDC 93-08 by Calculation NEDC 94-034," Review of GE Nuclear Analyses GENE 673-020-0993 and GENE 637-045-1293, Supporting the increase of the RHR Heat Exchangers Tube Plugging Margin," which used a service water temperatu e of 90 degrees F as an input condition.
This new calculation demonstrated that the heat exchangers would provide adequate heat removal at the 90 degree F service water inlet temperature.10 CFR Part 50, Appendix B, Criterion Ill, " Design Control," requires, in part, that measures be established to assure that applicable regulatory requirements and the design basis for those structures, systems, and components to which this appendix applies are correctly translated into specifications, drawings, procedures, and instructions.
The failure to properly translate the 90 degrees F service water temperature into Calculation NEDC 93-08 is an example of a violation of 10 CFR Part 50, %pendix B, Criterion 111 (50-298/9815-02).
The team reviewed the data collected during the October 5,1991 test, and noted the significant heat transfer mismatch between the shell and tube sides of the heat exchanger. Specifically, the data showed that a heat load of 800x10 8Btu /hr was being removed from the residual heat removal side of the heat exchanger, while a heat load of 61x108Btu /hr was entering the service water side. In addition, four separate data sets collected at approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> interval revealed a constant 80 degrees F residual heat removal outlet temperature despite varying residual heat removal inlet temperatures. The team questioned instrument performance and instrument calibration data spanning the last 8 years. The team reviewed this instrument data and found it to be acceptable. Despite the obvious data error, licensee personnel did not question the data.
Incorrect Acceptance Criteria in Procedure 13.17 The team reviewed Procedure 13.17 and found that the overall heat transfer coefficient j (U-factor) was calculated in the test procedure based on measured shell and tube side inlet and outlet fluid temperatures. This calculated U factor was then compared to the vendors acceptable U factor range. The vendor's acceptable U factor range was based
. ..
i l
on design basis service water and residual heat removal water temperatures and flows. '
As such, this data was not a meaningful comparison. The team verified through a l l review of Calculation NEDC 94-034 that the U-factor was adequate because the present tube plugging margin was below the limiting margin.
l 10 CFR Part 50, Appendix B, Criterion V," Instructions, Procedures, and Drawings," l states that activities affecting quality shall be prescribed by documented instructions, l procedures, or drawings, of a type appropriate to the circumstances. Criterion V further states that these instructions, procedures, or drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactcrily accomplished. The team found that Procedure 13.17 failed to provide appropriate acceptance criteria or an method suitable for comparing actual data to the acceptance criteria. Therefore, the procedure was inadequate to demonstrate that the residual heat removal heat exchanger performance was acceptable. This was an example of a violation of 10 CFR Part 50, Appendix B, Criterion V (50-298/9815-01).
Prolonaed Period of Time Without Testina l
The licensee's Generic Letter 89-13 program for the residual heat removal heat i exchangers required testing and/or inspection every other refueling cycle. With regard i
'
i to residual heat removal Heat Exchanger A, this had not been performed since March l 1993 and had not been cleaned for four years between November 1991, and November 1995. This, however, was identified by the licensee as part of their corrective action from previous escalated enforcement, EA 97-424 (01023), dated December 31,1997.
Specifically, the licensee reviewed past operation, maintenance, and testing to i determine if either residual heat removal Heat Exchanger A or B could have been 1 significantly degraded in the past. No past unidentified instances of significant degradation were found, although the as-found condition of residual heat removal Heat j Exchanger B, which was inspected during Refueling Outage RE-17, did reveal
'
significant degradation. This degradation was discussed in NRC Inspection Reports 50-298/97-07 and 97-12. The licensee revised Procedure 13.17," Residual Heat Hemoval Heat Exchanger Performance Evaluation," to include reference to the appropriate bases for tests and for the cleaning frequency. The licensee also re-evaluated their Generic Letter 89-13 Maintenance and Testing program, related commitments and program implementation, and developed a formal Generic Letter 89-13 program document, with defined ownership roles and program criteria. The corrective actions are adequately outlined in Condition Adverse to Quality 97-0831 and SCAO 97-0742, and have been or are in the process of being implemented.
E8.18 (Closed) Unresolved item 50-298/97201-09: Residual Heat Removal System Suppression Pool Cooling Throttle Valve Stroke Time l a. Backaround Design Change 87-170 modified the stroke time of residual heat removal system suppression chamber cooling throttle Valves RHR-MO-M034A&B (also referred to as residual heat removal pump test line isolation valves) from 24 to 39 seconds. In the
' justification section of Design Change 87-170, the licensee stated that considering the
! recirculation discharge valve closure time, full low-pressure-coolant-injection will take place at 49.9 seconds following a loss-of-coolant-accident, and Valves RHR-MO-34A&B
l
!
l
_ _ _ _ - _ _ - - - --_ _ _ _ _
'
will close prior to the recirculation discharge valves. The safety evaluation for the modification confirmed that even with the longer stroke time, the valves would successfully close prior to the start of low-pressure-coolant-injection. Licensing Change Request 94-0049, dated December 5,1994, eliminated the timing requirement for the residual heat removal pump test line isolation valves from the Updated Safety Analysis Report. The request referenced Constion Report 94-0297 as a basis, which stated that a closure time of 90 seconds for Valvr , RHR-MO-M034A&B would be acceptable based on a standard valve specification. Section 4.2.7.5 of General Electric Specification 22A1472 Revision 0, dated May 20,1969, specified that the closing speeds of the valves in the system test lines need not be greater than the manufacturer's standard speed. The specification further stated that the emergency core cooling system was not designed to recover from secondary modes of operation, such as testing, because the period of time that the emergency core cooling system was in these modes of operation was sufficiently short that the effects on overall reliability were insignificant. Surveillance Procedure 6.1RHR.201, "RHR Power Operated Valve Operability Test-Division I,"
specified an operability limit of 45 seconds for Valve RHR-MO-34A.
When the team requested the 10 CFR 50.59 safety evaluation for Licensing Change Request 94-0049, which deleted timing requirements for residual heat removal test line isolation valves, the licensee indicated that a 10 CFR 50.59 evaluation for the Updated Safety Analysis Report change was not completed. In Problem Identification Report 2-01693 dated December 2,1996, the licensee identified that Updated Safety Analysis Report changes associated with Licensing Change Request 94-0049, did not have a safety evaluation, however, at the time of the inspection in November 1997, the license had still not completed the safety evaluation.
The team noted that Condition Report 94-0297 stated that the plant safety analysis for a loss-of-coolant-accident demonstrated acceptable performance without low-pressure-coolant-injection operation as justification for the 90 seconds closure time for torus cooling outboard Valves RHR-MO-39 A&B. This appeared to conflict with the requirement for the valves to close prior to start of low pressure-coolant-injection and with the requirement that low-pressure-coolant-injection and core spray systerns provide reactor core cooling, following some accident scenarios.
b. Insoection Followup The team found that the present stroke time requirement of 39 seconds was less than the standard valve specification of 90 seconds that it met General Electric specification requirements, and that it closed satisfactorily before the full low-pressure-coolant-injection initiation time of 49 seconds. Furthermore, valve closure prior to low pressure safety injection was not a requirement of General Electric specifications. Therefore, the team concluded that the current configuration from a stroke time perspective was satisfactory.
The team reviewed the safety evaluation related to Licensing Change Request 94-0049, which covered the Updated Safety Analysis Report change to remove stroke times from the Updated Safety Analysis Report, and found it to be acceptable. Subsequent to the NRC request for the safety evaluation in the November 1997 inspection, the licensee issued Problem 'dentification Report 2-21502 dated December 3,1997, to address untimely corrective action regarding this issue. The absence of a safety evaluation for
_ _ _ _ _ _
___ _ _ . - _ _ _ _ . _ _ . _ _ _ . _ _ _ _ _ _ _. _
this change was identified by the licensee and documented in Problem identification Report 2-01693 dated December 2,1996. This is one of 41 Updated Safety Analysis Report changes that the licensee identified as lacking a safety evaluation. This part of this unresolved item is addressed in Section E2.1b of this report.
E8.19 (Closed) Unresolved item 50-298/97201-10: Reportable Condition of Containment isolation Valves Which Did Not Have Diverse Power a. Backaround in Problem identification Report 2-01582 dated July 24,1996, the licensee identified that the motors and operators for outboard primary containment isolation Valves RHR MOV-M0166A/B at torus Penetration X 214 had been classified as nonessential. The motor-operated valves are used to vent noncondensable gases from the residual heat removal heat exchanger during the steam condensing mode of operation, and had been de-energized in the closed position in July 1996.
Valves RHR-MOV-MO166A/B were powered from the same source as the inboard containment isolation Valves RHR-MOV-MO167A/B and were manually controlled from the control room. The evaluation for this problem identification report contained in Condition Adverse to Quality 96-0634 indicated that torus Penetration X-214 had been evaluated as a Class B penetration and, as a result, required two diversely powered isolation valves located on the line outside primary containment that close automatically on a containment isolation signal. This original plant design feature had not considered the primary containment isolation requirements during the design development, and the requirement for diverse power sources for containment isolation valves in the same line had been overlooked.
The licensee determined in Condition Adverse to Quality 96-0634, dated August 6, 1996, that this condition was not reportable based on the fact that residual heat removal steam condensing mode had never been placed in operation at the Cooper Nuclear Station. However, the NRC noted that for 23 years the required equipment had been operational and procedures had been in place that supported operation in the steam condensing mode. The licensee subsequently deleted procedural guidance for this mode of operation in May 1997, and the associated equipment was abandoned in place.
The NRC also identified that although the plant would not be operated in the steam condensing mode, the inadequate design of power sources to the containment isolation valves should have been reported. The licensee further reviewed Condition Adverse to Quality 96-0634, and determined that the associated reportability analysis incorrectly concluded that the lack of diverse power supplies for primary containment isolation Valves RHR-MOV MO 166A(B) and RHR-MOVM0167A(B) was not reportable. The licensee subsequently issued Licensee Event Report 97-017, dated December 31, 1997, to report that condition in accordance with 10 CFR 50.73.
b. Inspection Followup In July 1996, the licenset ioentified that the motors and operators for residual heat
. removal heat exchanger vent Valves RHR-MOV-MO166A(B) had been classified as nonessential, and that diverse power sources and automatic isolation signals had not been provided for these containment isolation valves. Therefore, redundant isolation had not been provided for containment Penetration X-214 in accordance with the design
.
and licensing basis. Furthermore, the licensee's operating Procedure 2.2.69.4,"RHR Steam Condensing Mode," Revision 7, would have allowed these valves to be manually opened under certain conditions.
10 CFR 50.73(a)(2)(ii)(B) requires, in part, that the licensee submit a licensee event report within 30 days after discovery of any condition that resulted in the nuclear power plant being in a condition that was outside the design basis. In Condition Adverse to Quality 96-0634, the licensee erroneously concluded that the lack of diverse power supplies for primary containment isolation Valves RHR-MOV-M0166A(B) and
- M0167A(B) was not reportable. Therefore, the licensee failed to report that the plant was in a condition that was outside its design basis. This is a violation of 10 CFR 50.73(a)(2)(ii)(B) (50-297/9815-06).
Subsequent to the NRC's identification of the failure to report a condition outside the design basis, the licensee issued Licensee Event Report 97-017 to report the condition as required by 10 CFR 50.73(a)(2)(ii)(B). The licensee deleted the procedure, which l prescribed the steam condensing mode of operation, and removed power to the valves.
The team confirmed that design control document, Design Change Document-9, l
" Primary Containment (PC) System," Revision 0, identified the active and passive components, which function as the containment boundary and included the functional l requirements and operational restrictions for containment isolation valves. Based on a i review of Design Change Document-9 and condition adverse to quality 96-0634, the team concluded that the preparation and validation of Design Change Document-9 i should adequately address the extent of condition with respect to support power l requirements.
To determine the extent of condition, the licensee performed an informal assessment of a sample of previous significant conditions adverse to quality with respect to disposition of reportability, and dV not identify a need for additionallicensee event reports or revisions to existing Imsee event reports. The licensee's corrective actions also l included training licensing engineers on the "Reportability Handbook - 10 CFR 50.72 l and 50.73," Revision 0, dated April 1998. In addition, this handbook was placed in the control room. The licensee reported that training was scheduled for operations staff, but not currently planned for engineering. The team noted that it would be prudent to include system and design engineering organizations in the training. The team reviewed the handbock, and found that it appeared to provide the proper scope for event assessment and reporting requirements to prevent similar reporting inadequacies.
In addition, the handbook contained several examples of reporting situations, including Licensee Event Report 97-017.
E8.20 (Closed) Unresolved item 50-298/97201-11: Technical Specification Lower Limit for !
Degraded Voltage Set Point Was Below Analytical Limit I a. Backaround l The NRC identified that Technical Specification Table 3.2.B. page 3, specified a second level undervoltage relay setting limit of 3880 52 volts for the emergency buses. i l
Calculation NEDC 88-0868," Set Point Determination of Second Level Undervoltage Relays," Revision 7, specified an analytical limit of 3847 volts for degraded voltage, 66 l
.. _ - - _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
which was above the lower technical specification limit of 3828 volts. Therefore, the technical specifications permitted second level undervoltage relay settings to be less than the analyticallimit for the emergency bus degraded voltage, which would have allowed a relay to drift below the analytical limit and still be considered operable.
However, the team noted that protection of .!oads from degraded voltage conditions would not have been provided at set point values permitted by the technical specifications. The team reviewed the undervoltage relay test and calibration Procedures 6.1EE.303 and 6.2EE.303, and found that the lower calibration limit was 3866 volts, which was above the analytical limit of 3847 volts; therefore, the team considered the settings to be acceptable.
In response to this NRC concern, the licensee issued Problem identification Report 2-19696. Resolution of this issue included an instant procedure change for Procedures 6.1EE.303 and 6.2EE.303 for undervoltage relay testing and calibration to identify 3847 volts as the lower analytical limit and the threshold at which the buses should be declared inoperable in lieu of the lower technical specification limit of 3828 volts. The licensee also issued Technical Specification interpretation Request 97-016 to revise the technical specification setting limit for the emergency bus undewoltage relays to 3880 +52 / -33 volts.
b. Insoection Followuo Discussions with the licensee revealed that this discrepancy had been previously identified by the licensee in Condition Report 97-0507 initiated October 17,1996; however, the licensee had closed the condition report without modifying the technical specification or revising the foregoing sunteillance procedures to identify the analytical limits.
The team confirmed that the relays, as calibrated in accordance with Procedures 6.1EE.303," Emergency Bus Undervoltage Relays Testing and Calibration (Div.1)," Revision 0.1, and 6.2 EE.303, " Emergency Bus Undervoltage Relays Testing and Calibration (Div. 2)," Revision 0.2, were set sufficiently above the analytical limit. '
Therefore, no operability concern existed. The team also confirmed that the technical specifications and the revised procedures reflected the corrected lower analytical limit of 3847 volts.
The team reviewed Condition Adverse to Quality 97-1452,"Second Level Undervoltage Relay Settings - Apparent Cause Evaluation," dated February 12,1998, initiated by the licensee to determine the cause of their failure to revise the technical specifications and surveillance test procedures. The licensee concluded that the cause was inadequate attention to emerging issues, due to narrowly focusing on the technical issue of the set point, thereby, preventing recognition of the larger issue of configuration management.
The licensee also identified the subsequent emergence of an improved culture and emphasis on configuration management and procedure adherence as program attributes intended to preclude recurrence. The licensee provided the team with examples of internal guidance to managers, supervisors, and lead personnel such as
"Today's issue," dated March 10,1997, which focused on procedural adherence and knowledge of technical specification / procedure requirements. The team found the licensee's actions to be comprehensive and acceptable.
. .. . ..
.
.
.
_ _ _ _ _ _ _ -
- - _ _ _ _ ____-___ _ _ - _ _ _ _ _ _ _ _ - _ _
\
l l
The team found that while the licensee identified this issue as a condition adverse to quality, they failed to correct the technical specifications and surveillance procedures to identify the analytical limits. However, the team determined that while this was a violation of 10 CFR Part 50, Appendix B, Criterion XVI," Corrective Action," the ramifications of this corrective action problem constitutes an additional example of Violation 50-298/9712-02 and is not being cited individually. No additional response to Violation 50-298/9712-02 is required.
E8.21 (Ocen) Inspection Followup item 50-298/97201-12: Basis for instrument Uncertainties for Indicator Channels That Support Technical Specification Compliance and Operator Actions a. Backaround The NRC inspection team ncted that previous NRC inspections (documented in NRC Inspection Reports 50 298/96-26,96-31, and 97-07) had identified concerns regarding inadequate consideration of instrument uncertainties. The licensee stated that possible instrument uncertainty deficiencies existed that were documented in Problem Identification Report 2-13343, dated October 20,1997. The licensee's investigation of these possible deficiencies was underway at the time of the NRC inspection. On December 4,1997, the licensee issued Report SCAO 97-1407, which acknowledged that instrument unce:tainty had not been taken into account when establishing the acceptance criteria for surveillance tests.
Specific instances where instrument uncertainty had not been considered were for residual heat removal flow Recorder FR-143 and service water temperature Indicator Ml-TR-3020. The impact of residual heat removal flow measurement uncertainty on residual heat removal pump test results and service water temperature measurement were addressed in Unresolved items 50-298/97201-01 and 50-298/97201-22 discussed in Sections E8.12 and E8.29, respectively, of this report.
This item addressed the licensee's programmatic efforts to evaluate the impact of instrument uncertainties on measurements the licensee uses to determine compliance with technical specification requirements, acceptance of surv.eillance test results, and implementation of operator actions that are based on instrument indications.
b. Insoection Followuo in response to this finding, the licensee issued Night Order 97-030 to ensure that adequate margin existed between the documented technical specification surveillance results and the technical specification limits for 11 technical specification parameters included in the licensee's daily surveillances. This night order was the licensee's method to account for instrument uncertainty until they could conduct a complete evaluation of this issue. The night order recommended 11 specific instrument uncertainty tolerances for the following instrument measured parameters: river inlet temperature, river level, torus level, suppression pool temperature, identified and unidentified leak rates, drywell and torus oxygen concentration, liquid nitrogen quantity, fuel pool level, standby liquid control system tank volume, and standby liquid control system solution temperature.
!
__- - _ .
On November 29,1997, the licensee processed a change to Procedure 6. LOG.601,
" Daily Surveillance Log (Technical Specifications)," Revision 9, Change 2, to incorporate the information in Night Order 97-030. The team confirmed that the procedure change was consistent with the night order.
In addition, the licensee provided the team with a copy of Memorandum ESD97187,
" Night Order 97-030 on Instrument inaccuracies," dated November 6,1997, which the licensee had prepared to evaluate and confirm the adequacy of the margins identified in the night order and subsequently incorporated into the daily surveillance procedures.
The memorandum concluded that in all cases the margins represented a conservative confidence level. However, during this inspection, the licensee was unable to retrieve any analyses or other documents to support this conclusion. In addition, during the inspection the licensee was unable to identify the basis for limiting its evaluation scope to these 11 parameters.
Regarding generic implications, at the time of this followup inspection, Evaluation SCAO 97-1407 and Condition Adverse to Quality 97-1453," Instrument Accuracy is Not Always Accounted for in Determining Compliance with Tech Specs and Equipment Operability (SCAO 97-1407) and inadequate, Untimely Resolution of NRC Concern (CAO 97-1453)," was underway to determine the cause of the failure to document the consideration of instrument uncertainties arising from installed plant instrumentation and measuring and test equipment, in calculations supporting technical specification equipment operability determinations, emergency operating procedures, and the evaluation of surveillance test results used to demonstrate technical specification compliance. The scope of the evaluation was to determine the extent of the condition, assess its safety significance, and recommend corrective actions to correct the condition and prevent recurrence. Regarding measurement uncertainties that could affect technical specification compliance, the evaluation was generally qualitative and did not present or reference quantitative analyses supporting the conclusion that individuallicensee programs addressed these effects. The licensee's evaluation concluded that the condition documented in Evaluation SCAO 97-1407 was merely the lack of a single document source that would compile the evaluations of instrument uncertainty effects for technical specification and emergency operating procedure or emergency support procedure related measurements. However, as noted above, during the inspection the licensee was unable to retrieve such individual evaluations to support this conclusion, nor was the licensee able to identify a specific i evaluation scope and basis.
The team considered that the licensee had developed and imp lemented recommended tolerances in the short-term for measurements supporting their daily technical specification surveillances. However, during this inspection the licensee was unable to retrieve analyses to support these recommended tolerances. In addition, the licensee was unable to identify the basis for limiting their evaluation scope to the 11 parameters, which supported daily surveillances. Therefore, acceptability of the short-term followup actions for this item remains open, pending the licensee's retrieval of analyses supporting the licensee's conclusion that their existing evaluations and calculations are technically adequate to document the acceptability of the impact of instrument
.
uncertainties on measurements used to determine compliance with technical specification requirements and the acceptance of surveillance test results.
The licensee's evaluation also identified longer-term corrective actions that included the development of a topical design criterion document on the subject of instrument uncertainty, development of an instrument scaling program to document the establishment of calibration requirements for instruments, and revision of Procedure 0.37 addressing measuring and test equipment selection and application in ;
support of surveillance procedures that are used to deterrnine technical specification operability.
The team concluded that the licensee's general scope for the foregoing longer-term corrective actions involving a systematic and comprehensive review appeared ,
appropriate. However, the licensee had not expended significant technical effort on these corrective actions at the time of this inspection, therefore, the team could draw no conclusions regarding effectiveness of the corrective actions. This inspection followup item remains open pending review of the licensee's long-term corrective actions.
E8.22 (Closed) Inspection Followuo item 50-298/97201-13: Basis for Technical Specification Set Point for Time Delay Permissive for Residual Heat Removal Heat Exchanger Bypass Valve a. Backaround i Technical Specification Table 3.2.B. lists the setting limits for the residual heat removal heat exchanger bypass time delay Relays RHR-REL-K93A&B as 2 min. t 0.2 min ( 12 sec). These time delay relays prevent manual closure of bypass Valves RHR--
MOV-66A&B during a loss-of-coolant-accident until a specified amount of time has passed after a low-pressure-coolant-injection initiation signal. Calculation NEDC 92-050BH,"RHR-REL-K93A&B Set point Calculations," Revision 0, determined the set point uncertainty to be i 6 second. The calculation specified the maximum allowable stroke time for the bypass valve opening as 100 seconds. The team noted that the valve stroke time did not depend on the time delay. The licensee agreed, but could not provide a basis for the two minute time delay set point. The licensee indicated that the technical specification would be revised to delete the setting limits for these relays.
b. Inspection Followup The licensee stated that the technical specification requirement for the residual heat removal heat exchanger bypass time delay would not be included in the forthcoming improved technical specifications currently under NRC review. The licensee stated that the time delay set point would become part of the technical requirements manual since it did not pass the 10 CFR 50.36(c)(2)(ii) scr;.ening criteria for inclusion in the improved technical specifications. The technical requirements manual will be incorporated by reference into the Updated Safety Analysis Report at improved technical specifications implementation. However, the licensee had not pursued removal of the time delay from the current technical specifications and reconstitution of its design basis, beliv s 'h s would not be a beneficial use of their resources in light of their improved tech m ;
l specification position. In support of the proposed improved technical specife. mo%, the licensee's " Discussion of Changes - ITS 3.3.5.1 - Emergency Core Cooling System )
(ECCS) instrumentation," Revision 0, stated that the time delay provides additional assurance that the maximum amount of residual heat removal flow would reach the reactor vessel during a loss-of-coolant-accident. However, the licensee did not take
!
credit for this delay time in mitigating a design basis accident or transient. Improved Technical Specification, Section 3/4.2.B.19, "RHR Heat Exchanger Bypass T. D," dated November 1995 also presented this rationale. The licensee told the team that their review of Updated Safety Analysis Report, Chapters 6,14, and Appendix G supported the conclusion of their improved technical specification review.
Notwithstanding the licensee's proposed exclusion of the time delay from the improved technical specifications, the team confirmed that Revision 1 to NEDC 92-050BH had corrected the calculation, and requested the licensee's design basis for the current ;
technical specifications. The licensee retrieved the NRC's " Safety Evaluation by the l Dimetorate of Licensing Supporting Amendment No. 4 to Facility Operating License No.
DPR-46, Change No. 7 to the Technical Specification, Nebraska Public Power District, Docket No. 50-298," dated October 15,1974. This safety evaluation report, in part, l reflected the licensing basis for the technical specification value, reporting that the licensee's proposed improved technical specification change slightly relaxed the tolerance for the residual heat removal time delay relay setpoints. The safety evaluation report identified the basis for the delay time as a delay to prevent the operator from assuming control of various low pressure coolant injection components after automatic initiation until the system had sufficient time to carry out its design function. The safety I evaluation report also stated that the range of the setpoint would not prevent proper I operation of the low pressure coolant injection system or interfere with subsequently required operator actions and, therefore, wou d have no adverse effect on low pressure coolant injection system operation. The team concluded that the safety evaluation report reflected a licensing basis for the current time delay and tolerance and that the value appeared to be reaconable.
E8.23 (Open) Inspection Followup Item 50-298/97201-14: Technical Specification Bases for Condensate Storage Requirements.
a. Backaround Updated Safety Analysis Report, Section VI-4.4, stated that refueling operations could be conducted with the suppression pool drained, provided an operable core spray or low pressure core injection system was aligned to take suction on Condensate Storage Tank 1 A. The condensate storage tank was required to contain at least 150,000 gallons of water. Technical Specification 3.5.F.5.c required that 230,000 gallons be available in the condensate storage tank with one control rod drive housing open while the suppression pool chamber was completely drained. Technical Specification 3.10.F required that 150,000 gallons be available in the condensate storage tank when the suppression pool chamber was completely drained. Technical Specification Bases 3.5 stated that, under worst-case leak conditions, water inventory in the react .r well, spent fuel pool, and condensate storage tank was required to provide approximately 60 minutes of core cooling and sufficient water inventory to permit the water, which has drained from the vessel to fill the torus to a level above the core spray and low-pressure-coolant-injection suction strainers.
No supporting calculations were available to confirm that the 150,00 and 230,000 gallon requirements would satisfy the technical specification bases. The licensee informally estimated that a volume of 169,000 gallons was requked to flood the torus with the old residual heat removal suction strainers and 281,000 gallons with the new suction
__ _. _ _ ___ ___ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ . _ _
strainer design. The licensee indicated that the 150,000 gallon requirement was based on NUREG-0123," Standard Technical Specifications for GE Boiling Water Reactors,"
and was consistent with NUREG-1433," Standard Technical Specifications for General Electric Plants, BWR/4." The licensee indicated that in their proposed improved technical specifications, the 230,000 gallon requirement was changed to 150,000 gallons consistent with NUREG-1433. The licensee also stated that they had received
.
similar questions regarding the condensate storage tank volume requirements from the NRC program office in a request for additional information resulting from their review of the improved technical specification submittal.
b. Inspection Followuo The licensee prepared Calculation NEDC 97-097, " Condensate Storage Tank Minimum -
Water Volume," Revision 0, which provided the basis for the 230,000 gallon
, requirement. This calculation determined the minimum condensate storage tank volume l needed during refueling activities, as well as the vortex limit for the tank itself. The l calculation determined that with the suppression pool drained, the minimum volume to l
prevent vortex formation in the condensate storage tank was 130,000 gallons, for which I the technical spacification requirement was 150,000 gallons. With the suppression pool
'
drained and a control rod drive unit removed, or if operations having the potential for draining the reactor vessel were underway, the minimum reserve volume was calculated to be a rninimum 220,000 gallons, for which the current technical specification requirement was 230,000 gallons, j The licensee stated that the requirement for a minimum volume in the condensate storage tank of 230,000 gallons, as specified in Technical Specification 3.5.F.5.c, for operations having the potential for draining the reactor vessel during refueling, does not have a specific counterpart in the improved technical specification. The acceptability of the 150,000 gallon value in the improved technical specifications was based on the availability of other sources of water that would normally be available during an outage.
During operations having the potential for draining the reactor vessel, improved technical specification surveillance requirement 3.5.2.1.b allowed only one required system to take credit for the condensate storage tank volume. Improved Technical
- Specification Surveillance 3.5.2.1.a required the suppression pool to be available as a l
! source of water for the other required low pressure emergency core cooling system injection / spray systems. In effect, the improved technical specifications did not permit operations to occur that had the potential for draining the reactor vessel without i additional sources of water. .
This issue remains open pending the NRC program office review of the licensee's response to the request fpr additional information.
l E8.24 (Closed) Unresolved item 50-298/97201-16: Weakness in the Design, Evaluation, and l Operation of the Radioactive Floor Drain System
,
a. Backaround i
,
~
The NRC identified that Section X-14.3.3 of the Updated Safety Analysis Report stated that during a design basis loss of coolant accident, any emergency core cooling system
,
component leakage was routed directly or indirectly by the radioactive drainage system
.
l
I l
l l to the reactor building sumps. The NRC noted that Section X-14.3.3 stated that the reactor building floor drain sumps would operate for the duration of the accident to i maintain sump level and pump collected fluids from the emergency core cooling systern l component leakage and other reactor building drain sources. This section further stated that the sump pumps were powered by emergency power sources and were available during post-accident conditions. In addition, the NRC found that the alarm Procedure 2.3.2.20 indicated that the sump pumps started automatically on an increase in sump level and directed operators to enter emergency operating procedures and to manually start any sump pump that was not operating. The NRC noted that the emergency operating procedure directed the operator to operate available sump pumps to restore l
and maintain the water level below its maximum normal operating level. The licensee indicated thtt the sumps would be isolated by the operator in response to a high radiation alarm. The NRC noted that the emergency procedure instructions conflicted I with Procedure 2.3.2.20 for sump level alarms and with the flow chart in Emergency i Procedure 5.8.
l The NRC determined that the emergency core cooling system leakage limit was 602 ml/r,in, which could cause sump levels to rise, initiate automatic actuation of the sump pumps and discharge sump water outside the secondary containment. If aciqation were not automatic, alarm response and emergency procedures directed the operator to operate available sump pumps to restore and maintain the level below its maximum normal operating level. The licensee stated that such discharges from the pumps had not been considered in the offsite and control room dose calculations. The l NRC considered thic to be a weakness in the design, evaluation, and operation of the radioactive floor drain system ard in the offsite and control room dose calcuations.
l b. Inspection Followuo The team reviewed Procedure 5.3.1," Main Steam Line High Radiation," Revision 17, and determined that when radiation in the secondary containment increased, the sump pumps were switched off to prevent a radioactive release. The team reviewed the procedure conflicts with other NRC staff members, and c'etermined that the procedure l conflicts were acceptable since the control room supervisor s.ould direct the staff to use l the emergency procedures, which were applicable. The emergency operating l procedures are symptom-based, and boiling water reactor plants depend on the control l room supervisor to make the decision on which procedure to follow depending on the i
! symptoms. I
'
The team reviewed Problem Identification Report 2-20905, dated October 31,1997, which the licensee initiated because the Updated Safety Analysis Report incorrectly specified that the sump pumps were essential equipment. The licensee stated that the wording in the Updated Safety Analysis Report was contrary to the original design basis j for the sump pumps. The team reviewed Section 14.3.3 of the original Updated Safety i Analysis Report and found the radioactive f oor drainage system was not referred to as i essential and was not required to be in operation during a design basis foss of coolant .
j accident. The problem identification report recommended revising the Updated Safety l
-
Analysis Report to delete the incorrect wording. The team reviewed Design Change 94-250," Emergency Core Cooling System Leakage and RHR Heat Exchanger
'
A Flange Leak Collection," dated September 20,1996. The team determined that the modification was performed to establish the emergency core cooling system leakage
!
i
!
l l
monitoring program, which included leakage from components such as pump seals, valve packing, and flanges bypassing primary containment barriers into secondary containment, i
!
Licensing Change Request 95-037 resulted in the Updated Safety. Analysis Report description of the radioactive floor drain system stating that during a design basis loss of
'
coolant accident, emergency core cooling system leakage was routed directly or indirectly by the radioactive drainage system to the reactor building sumps. In additio 1, the Updated Safety Analysis Report stated that reactor building floor drain sump pumps l would operate the duration of the loss of coolant accident to maintain the sump level and process drain flow from emergency core cooling system components and other reactor building sources. These statements were contrary to the design basis for the sump pumps and the fact that the pumps were not reliM upon during post-accident ,
conditions. The team found that the licensee failed to verify the adequacy of the design in implementing Licensing Change Request 95-037, which introduced inaccurate l
information into the description of the radioactive floor drain system in the Updated l Safety Analysis Report. The team concluded that the licensee's Updated Safety Analysis Report rebaselining program would have likely identified this issue. Therefore, this item is closed.
The maximum emergency core cooling system leakage of 602 ml/ min, which could l cause sump levels to rise and initiate automatic actuation of the sump pumps and i discharge sump water outside the secondary containment, was not considered in the I offsite and control room dose calculations. The team reviewed Problem identification Report 2-20905, dated October 31,1997, which contained an evaluation of the leakage :
rate. The licensee calculated that the maximum emergency core cooling system l leakage allowed over a 30-day period which would remain below the maximum safe floor level vac 454 ml/ min, which was less than the 602 ml/ min leakage limit. The team noted that the ,icensee plans to prepare a formal calculation to make 454 ml/ min the new acceptance criteria.
E8.25 (Open) Inspection Followuo item 50-298/97201-17: Emergency Core Cooling System Pump Seal Failure j a. Backaround
Regarding passive failure of an emergency core cooling system pump seal, Section 2D !
of SECY-77-439, stated that the current practice was to assume fluid leakage owing to I gross failure of a pump or valve seal, but not pipe breaks, during the long-term cooling mode following a loss-of-coolant-accident. The team questioned how the licensee addressed long-term passive failure of a seal in the emergency core cooling system design and sump pump operating requirements. The licensee stated that the emergency core cooling system pump seal failure was outside the licensing basis as stated in answer to Question 10.5b in Final Safety Analysis Report, Amendment 11.
b. Inspection Foilowuo The licensee determined that the single passive failure requirement, of which the emergency core cooling system pump seal failure was an example, was not part of the licensing basis. The licensee's response to Final Safety Analysis Report,
- -
Question 10.5b, and the Final Safety Analysis Report, Chapter 14, accident analysis substantiates this position. With respect to radiological release, Emergency Procedure 5.3.1 directs the operators to place the sump pumps in a pull-to-lock mode under a fuel damage scenario, thereby, containing highly contaminated water from a sea' iailure occurring at the time of a fuel damaging accident. This issue has been referred to the NRC program office for resolution, therefore, this item remains open pending the completion of the NRC program office review.
E8.26 (Closed) Inspection Followup ltem 50-298/97201-19: Hydraulic Analysis for Service Water Backup to Residual Heat Removal a. Backaround Updated Safety Analysis Report, Sections 1V-8.5.1, VI-5.2.6, and X-8.2.5, state that a crosstie is provided from the residual heat removal service water syster1 to the residual heat removal system (Loop A only) to provide emergency post-loss-of-coolant-accident core and/or containment flooding in the unlikely eveni of loss of all emergency core cooling system functions. Section 9.3.4 of the original safety evaluation repe,rt (Safety Evaluation Report) prepared by the Atomic Energy Commission, dated February 14, 1973, also mentioned this capability. The crosstie was snown on the residual heat removal system flow Diagram 2006, Sheet 4, Revision N32. Instructions for initiating this beyond-design-basis emergency cooling function were outlined in Emergency Operating Procedure 5.8.6,"RPV Flooding Systems," Revision 4C1. The team requested a copy of the hydraulic calculation or other documentation that demonstrated that the residual heat removal service water system was capable of performing this function. The licensee could not locate such documentation, and initiated Problem Identification Report 2-19698 to document this deficiency. As recommended in the problem identification report, preparation of a new calculation (NEDC 97-086) was !
initiated. )
i b. Inspection Followup .
The team reviewed Calculation NEDC 97-086 and found that it adequately demonstrated that the service water system was capable of delivering at least 4000 gpm to the reactor vessel under worst case beyond design basis accident conditions. The calculation concluded that the service water system, in conjunction with its booster pump is capable of providing 4000 gpm to the reactor vessel under zero psig reactor ,
pressure conditions for emergency core reflooding, irrespective of river water levels. j i
As described in Updated Safety Analysis Report Volume X, Section 8.2.5, the capability !
to flood the core using the residual heat removal service water booster pump would only be required in the event of multiple failures of engineered safety feature equipment, and is considered to be beyond the scope of credible accidents. Core flooding was not an analyzed safety function of the residual heat removal service water booster system, but '
rather a design feature provided for conservatism for beyond design basis events.
E8.27 (Closed) Unresolved item 50-298/97201-20: Adequacy of Safety Evaluation Supporting Updated Safety Analysis Report Change, Which increased the Maximum Ambient Temperature Value for the Residual Heat Removal Service Water Booster Pump Room ;
75
!
. . . . . - - - - - - - -. . - _ . - . _ _ . . . ..
a. Backaround Licensing Change Request 93-0010, dated February 5,1993, initiated a revision to Updated Safety Analysis Report, Figure X-10-2, to specify a residual heat removal service water booster pump room temperature limit of 131 degrees F during abnormal conditions. This change was required, because the room had no safety-related ventilation system and the fan coil unit provided for the room was designed as non-essential. The 10 CFR 50.59 safety analysis dated October 29,1992, in support of the Updated Safety Analysis Report change concluded that this change did not involve an unreviewed safety question, because there were no physical changes to the plant.
Calculation NEDC 92-063," Maximum SWBP Temperatures with No Cooling From Control Building HVAC," estimated that, under natural ventilation, the room temperature would reach 130 degrees F with one residual heat removal booster pump running and all other major heat loads, such as air compressors, dryers, and lights, de-energized.
Step 4.10 of Abnormal Prndure 2.4.8.4.9," Control Building Temperature Above or Below Temperature Limits," dated October 20,1997, required the operator to open the Room C-903 equipment hatch to the basement, open specific doors, and secure residual heat removal service water pumps. Operators were also required to secure instrument air compressors and dryers so that the residual heat removal service water booster pump room temperature would not exceed 130 degrees F with one residual heat removal service water booster pump or one air compressor running. However, Procedure 2.2.70, "RHR Service Water Booster Pump System," Revision 37, allowed operation of both residual heat removal service water booster pumps when required by emergency operating procedures. Also, Emergency Procedure 5.2.5," Loss of Normal AC Power - Use of Emergency AC Power," Revision 30, dated October 11,1997, specifically directed operators to start air compressors and air dryers. Furthermore, if low-pressure-coolant-injection were required concurrent with suppression pool cooling, residual heat removal flow would be established through two heat exchangers requiring two residual heat removal service water pumps. In addition, operation of two residual i heat removat service water booster pumps was preferred for mitigation of the accident. l The emergency operating procedure flowcharts (primary containment control) l specifically diact the operators to use "all available suppression pool cooling." l However, the plant's design basis requires only one residual heat removal service water i booster pump for accident mitigation.
The NRC found that the licensee failed to address the following in their 10 CFR 50.59 safety evaluation performed for the Updated Safety Analysis Report change:
l Assessment of the radiation dose to aperator(s) while establishing natural
'
1.
ventilation in the residual heat removal service water booster pump room during an accident; 2. Loss of normal power to the overhead crane, which was required to lift the hatch covers; emcrgency power was not supplied to the crane; 3. Introduction of potentially contaminated turbine building air into the control building during all accident scenarios requiring the residual heat removal service ;
water booster pumps. Calculation 92-063 estimated that an air flow rate of i 3720 cfm from the turbine building is required if only one residual heat removal
l l
. _ . _
service water booster pump is operating and if all other equipment is de-energized. If two booster pumps were operated, an air flow rate of 8193 cfm would be required; 4. The ability to provide air at a temperature not greater than 100 F from the turbine building to the residual heat removal service water room; 5. The effect of not operating the instrument air system, which is being relied upon
. in operation and accident mitigation procedures; and 6. Conflicts between emergency operating procedures, which require operating all available suppression pool cooling as well as starting of air compressors and air dryers, and the abnormal procedure, which requires maintaining room temperature below limits.
b. Inspection Followuo The licensee revised the 10 CFR 50.59 safety evaluation to address the NRC inspection concerns, however the conclusion that the change did not involve an unresolved safety question did not change. The team reviewed the revised safety evaluation and found it to be acceptable.
The team confirmed the following corrective actions taken by the licensee in response to the NRC inspection concerns:
1. Radioloaical Dose Conseauences to Ooeratore The licensee evaluated the radiological dose consequences to the operators '
resulting from the requirement to open the hatches and doors as a part of the revised 50.59 safety evaluation and documented it as Engineering Judgement EJ 97-135 dated December 4,1997. The engineering judgement considered a loss-of-coolant-accident without offsite power available. The licensee assumed one hour to perform the actions and a constant dose rate for duration of these actions. Based on transient temperature calculations reported elsewhere in this section, the licensee concluded that operator actions would not be required earlier than two hours into the event, and that the expected dose to the operator would be acceptable because the calculated dose rate peaks in approximately 30 minutes (at approximately 34 rem / hour) and falls rapidly after the first hour to approximately 90 millirem / hour at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. For the same reason, the licensee concluded that contamination of the pump room would be acceptably low.
The engineering judgement stated that if the operator began action for the first 30 minutes of the event, his resulting dose would exceed regulatory limits.
Likewise, for 30 minutes after the start of the event, the dose would be significant, but the overall 30-day dose would remain below regulatory limits.
The licensee concluded, in EJ 97-135, that after 30 minutes, the increase in operator dose would be negligible when compared to the design basis thyroid dose established in Calculation NEDC 94-071, "CNS Control Room Operator
Thyroid Dose Calculation," and after 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, the dose would be substantially lower. The team agreed with the licensee's engineering judgement.
2. Staaina of a Chain Fall Moist for Hatch Removal Based on the licensee's documentation (Problem identification Report 2-20649 and attachments), a dedicated chain fall hoist had been pre-staged by the hatch.
The licensee stated that a preventative maintenance procedure had been generated to add this chain fall hoist to the annual verification of rigging equipment. The team found this to be acceptable.
3. Introduction of Potentially Contaminated Air into the Control Buildina Following a loss-of-coolant-accident with offsite power available, both essential and nonessential ventilation systems could be operating; without offsite power, )
only the essential ventilation systems would operate. The licensee considered that the ventilation systems could draw the contaminated air into the control building, however, they also determined that the bulk of this source term would be purged from the control building prior to the time required for operator action.
Therefore, the licensee concluded that performance of these actions (opening i the equipment batches and doors) af ter 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> into the event would have l negligible impact on thyrcid doses to the operator. The licensee also concluded that radiological conditions could be confirmed by emergency response or radiation protection personnel prior to beginning these actions.
The team agreed with the assumptions and the methodology used by the j licensee to reach the conclusions in Engineering Judgement EJ 97-135, which was supported by a computer code identified as PADD (post-accident design dose). The code calculated the concentration of radioisotopes in the control room at specific time intervals, then multiplied by the appropriate breathing rate, occupancy factor, and dose conversion factor. The concentration was calculated by multiplying the concentration immediately outside the control room by the filtered and unfiltered flow rates and dividing by the control room volume.
However, since the concentration immediately outside the control room had not been explicitly calculated by PADD, the licensee adjusted the input parameters to estimate this value. To account for buildup and dilution in the control building, the control room volume was set equivalent to the control building volume, and the nonessential control building ventilation flow rate was used as the control room intake flow rate. The actual volume of the control building as derived from design drawings was further reduced by half to account for fill and to eliminate the control room volume from consideration. Sensitivity runs were performed to identify that the most conservative dose rates occurred at higher flow rates, and dose rates were thereby calculated at various intervals from one minute to eight hours after initiation of the event. Engineering Judgement EJ 97-135 described the rapid drop in dose rates after 30 minutes that resulted from the assumption that contaminated air conditions were assumed for the first 30 minutes and the corresponding atmospheric dispersion factor was significantly larger than it was for noncontaminated air conditions. The basis for this assumption was Regulatory Guide 1.3," Assumptions Used for Evaluating the Potential
l Radiological Consequences of a Loss of Coolant Accident for Boiling Water l
Reactors," Revision 2.
The team agreed with the licensee's conclusion that 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> (or more) after the I accident, performance of the actions required to remove the hatch and open the
!
door between the turbine building and control building to assure free convection l cooling would have negligible impact on operator thyroid doses.
i 4. The Ability to Provide Air from the Turbine Buildina with a Maximum Temoerature of 100 Dearees
'
Engineering Evaluation IEE 97-332 dated November 24,1997, evaluated the assumptions used in the temperature calculations for the residual heat removal service water booster pump room. The licensee used the maximum summer design temperature of 100 degrees F for the turbine building, and assumed that any residual heat load in the turbine building would have decayed and become negligible in a few hours. The licensee stated in IEE 97-332 that they performed informal sensitivity modeling that showed even if a turbine building temperature of 150 degrees F was assumed, the change in service water booster pump temperature would be negligible after 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, and after 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> there would be less than a 1 degree F increase in the service water booster pump room temperature. On that basis, the team agreed that turbine building temperature would not be of concern for this scenario.
5. Temperature Calculations for the Service Water Booster Pumo Room Engineering Evaluation IEE 97-332 dated November 24,1997, concluded that the assumptions in Calculations NEDC 92-063," Maximum SWBP Room l
Temperature with no Cooling from Control Building HVAC," Re. vision 1, and l NEDC 92-064," Transient Temperature Rise in SWBP Room After Loss of Cooling," Revision 1, were conservative and bounding. These calculations provided a basis for transient temperature rises in the service water booster pump room after ventilation to the room is lost. Revision 2 of Calculation NEDC 92-064 concluded that with two service water booster pumps running and ano air compressor running at full load, the time required to reach the 131 degrees F ambient temperature limit for the service water booster pump room would be more than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. By including the compressor heat loads, this conclusion supported the ability to use the instrument air system for accident mitigation.
Based on a review of these evaluations, the team agreed with the licensee's conclusion. However, the team identified that Calculation NEDC 92-063 referenced Updated Safety Analysis Report data as a design input for maximum summer temperature rather than providing a technical basis for the values used in the calculation. In addition, in determining internal room heat loads, l
- Section 5.1.5 of Calculation NEDC 92-063 used incorrect values for computing the heat dissipated by motor control center control power transformers.
Specifically, the calculation used kVA units rather than VA units for the control power transformer ratings, which resulted in control power transformer heat loads being overestimated. Because the results of this error were conservative
, 79
!
l l
for the purposes of the calculation in which it occurred, the team did not have a safety concern.
6. Conflicts in Procedures The team confirmed that procedure changes to Abnormal Operating Procedure 2.4.8.4.9," Control Building Temperature Above or Below Temperature Limits," Revision 14, were implemented to provide instructions to ,
open all three C-903 equipment hatches to provide room cooling. The licensee I verified that the new steps provided in the procedure for removing the equipment hatches could be performed under accident conditions with loss of offsite power.
Night Order 97-36 was issued to alert operators of the changes in the procedures.
The team also confirmed that Procedure 5.2.5," Loss of Normal Power - Use of Emergency AC Power," Revision 30, Change 5, had been implemented to add a step to direct operator action to Procedure 2.4.8.4.9 if nonessential ventilation could not be restored. The team found the licensee's actions to be acceptable.
E8.28 (Closed) Unresolved item 50-298/97201-21: Update Safety Analysis Report and Technical Specification Discrepancies a. Backaround The NRC identified 13 examples of a failure to update the Updated Safety Analysis Report. As discussed in Section E8.9 of this report, on June 15,1997, the licensee was cited for a failure to update the Updated Safety Analysis Report as required by 10 CFR 50.71(e).
b. Insoection Followuo l
'
In response to this violation, the licensee initiated an Updated Safety Analysis Report rebaseline project in March 1998. This project, scheduled to be completed by December 1999, should identify all further Updated Safety Analysis Report :
discrepancies and initiate the appropriate corrective actions. Since Violation 50-298/96024-14 remains open pending NRC review of the licensee's completed program, the findings identified in this unresolved item were subsumed by the licensee's program. Therefore, this unresolved item is considered to be closed. However, the ,
team also determined that the following violation examples would not have been )
identified by the Updated Safety Analysis Report rebaseline project.
1. Updated Safety Analysis Report, Section Vll, Figures Vll-4-7a, Vll-4-7b, and Vil-4-7c, were the functional control diagrams for the residual heat removal system. Updated Safety Analysis Report, Figure Vll-4-7a, Note 6, stated that motive power for Division I, Pumps A and C, shall originate from a different ac bus than the Division ll, Pumps B and D. Note 6 did not reflect deletion of the low-pressure-coolant-injection loop select logic that was incorporated via Modification Design Change 76-2. In the current design, residual heat removal l Pumps A and B (vice A and C) were powered from the same source and Pumps i 80 l
!
1 C and D (vice B and D) were powered from the same source. The licensee initiated Problem Identification Report 2-19703 to address this discrepancy.
This error was introduced in 1978 as a result of the licensee's failure to revise the Updated Safety Analysis Report to reflect changes from the implementation of a 1976 design modification, Design Change 76-02. The licensee stated that the Updated Safety Analysis Report Rebaselining project probably would not have identified this discrepancy, since the Updated Safety Analysis Report project does not review the as-built drawings. The team found that the licensee l did not revise Updated Safety Analysis Report, Figure Vll-4-7a, to reflect the changes implemented by Design Change 76-02 and, therefore, failed to assure that the information in the Updated Safety Analysis Report contained the latest material devdoped. This is a violation of 10 CFR 50.71(e). The licensee initiated drawing change notice 97-1672 to show the correct divisional separation of the power supply for the residual heat removal pumps. The team reviewed Problem Identification Report 2-19703, and drawing Change Notice 97-1672, and determined that these actions would correct the discrepancy. However, as stated above, the licensee's Updated Safety Analysis Report rebaselining project would not have identified this error, because drawings were not within the program's scope. Although the corrective actions taken to date were adequate for correcting this individual issue, the team concluded that this violation constituted an additional example of Violation 50-298/9624-14 and is not being cited individually. No additional response to Violation 50-298/9624-14 is required.
2. Updated Safety Analysis Report, Section 1.7.1, stated that a comparison of the reactor protection system and emergency core cooling system design with each design requirement of Standard IEEE-279-1971, " Criteria for Protection Systems for Nuclear Power Generating Stations," was documented in Atomic Power Equipment Division Topical Report NEDO 10139, " Compliance of Protection Systems to Industry Criteria: General Electric BWR Nuclear Steam Supply System." Topical Report NEDO 10139 addressed the low-pressure-coolant-injection design concept in effect prior to implementation of Design Change 76-02. The licensee issued Updated Safety Analysis Report, Rebaselining Project item 97-432, to address this discrepancy.
This discrepancy was int"oduced in 1978 as a result of the licensee's failure to j revise the Final Safety Anelysis Report to reflect changes from the implementation of a 1976 design modification, Design Change 76-02, implemented in 1978. The licensee admitted that the Updated Safety Analysis Report rebaselining project probably would not have identified this discrepancy, since it did not require a line-by-line verification of source documents. Design Change 76-02 removed the low-pressure-coolant-injection loop select function, and as a result, the discussion in Topical Report NEDO 10139 about low-pressure-coolant-injection was no longer applicable. The team found that the licensee did not revise Updated Safety Analysis Report, Section 1.7.1, to reflect changes implemented by Design Change 76-02 and, therefore, failed to assure that the information in the Final Safety Analysis Report contained the latest material developed. This is a violation of 10 CFR 50.71(e). At the time of this inspection, the licensee was in the process of developing an Updated Safety
1
- .. . . . . - . . .- -- ._ - - .- _ -.- . . . - - . . ..
s
<
q Analysis Report change request to clarify that Design Change 76-02 modified the low-pressure-coolant-injection such that the discussion in Topical
- Report NEDO 10139 concerning low-pressure-coolant-injection loop selection
, was no longer applicable. The team reviewed Updated Safety Analysis Report,
'
Rebaselining Project item 97-432, and the draft Updated Safety Analysis Report
,
change request, and determined that these actions are adequate to correct this discrepancy. However, as stated above, the licensee's Updated Safety Analysis
- Report Rebaselining Project would not have identified this error, because it did not require a line-by-line review of the Updated Safety Analysis Report drawings.
Although the corrective actions planned and taken appear to be adequate for a
correcting this individual issue, the team concluded that this violation constituted an additional example of Violation 50-298/962414 and is not being cited individually. No additional response to Violation 50-298/9624-14 is required.
E8.29 (Closed) Unresolved item 50-298/97201-22: Instrument Uncertainties Not Taken into ,
Account When Measuring the Maximum Service Water Temperature
-
a. Backoround The NRC identified that, according to Design Change Document 3 for the service water system, the design basis temperature for service water was 90 degrees F. The NRC noted that the service water temperature was indicated by Temperature Recorder Mi-TR-3020 in the control room and was loggcd in Procedure 6. LOG.601,
" Daily Sun /eillance Log (Technical Specifications)." The NRC determined that -
'
instrument loop uncertainty was not taken into account when the maximum allowable sen/ ice water temperature was established. The NRC also noted that instrument i
'
uncertainty was not considered in procedures for the thermal performance of heat exchangers cooled by service water. Operators indicated that they would have allowed service water temperature to rise up to 90 degrees F (as read in the control room). The l
'
team noted that, due to instrument uncertainties, the actual temperature could have been higher. The licensee estimated that the maximum value was,91.1 degrees F without taking drift, temperature effects, calibration effects, and reading error into account. On November 4,1997, the licensee issued Night Order 97-030 to change the ,
maximum service water temperature from 90 degrees F to 87 degrees F in Procedure 6. LOG.601. ;
,
b. Inspection Followuo
..
The team reviewed Procedure 6. LOG.601, Revision 10C1, and determined that the
'
procedure was revised to change the service water temperature from 90 to '
87 degrees F. The team determined that notes were added to the procedure, which required engineering to be contacted, when the river inlet temperature was greater than 87 degrees F to determine available instrument margin. An additional note was added, which stated that when the river inlet temperature was greater than 90 degrees F, plant shut down was required. The team reviewed Condition Report 97-1407, dated October 21,1997, which was generated to address instrument uncertainties. The team noted that the licensee's corrective action plan included the development of a topical design criterion document to address instrument uncertainties.
. .- ._ _ .. _-
10 CFR Part 50, Appendix B, Criterion V, states in part that instructions, procedures, or drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. As of December '997, Surveillance Procedure 6.OG.601, " Daily Gurveillance Log,"
Revision e not include appropriate acceptance criteria because the procedure specified a limit of 90 degrees F without taking into consideration the instrument loop uncertainties of Temperature Indicator Ml-TR-3020 that was used to monitor service ;
water temperature. The failure to include instrument uncertainties in Surveillance i Procedure 6.LOS.501 acceptance criteria was considered to be a violation of ;
10 CFR Part 50, Appendix B, Criterion V (50-298/9815-01).
E8.30 (Closed) Unresolved item 50-298/97201-23: Reactor Equipment Cooling System Inventory Loss a. Backaround l I
During a review of the reactor equipment cooling system, the team noted that the I reactor equipment cooling system was losing water inventory. The team questioned the ;
licensee to determine if the system's surge tank was properly sized to address this water j loss. In response to this finding, the licensee determined that the current leak rate was !
over 200 gallons per day, most of which was attributable to a continuous flow through I the filter demineralizer sampling system. Manual Sample Valves REC-V-728, -V-733, and -V-737 had been maintained open since the demineralizer was installed in accordance with Design Change 90-085, ' REC Filter Demineralizer Skid Addition." The licensee reviewed the system status and determined that in the event of an accident, the inventory in the reactor equipment cooling surge tank would have been depleted in less )
than 1 day, resulting in a loss of the reactor equipment cooling system. The reactor 1 equipment cooling system was required to be operable during the long-term following an accident. The licensee issued Problem Identification Report 2-19697, isolated the I
sampling flow, and revised Procedure 2.5.3.7, " REC Filter Demineralizer Skid," to change the position of Valves REC-V-728, -V-733, and -V-737 from normally open to normally closed. On November 9,1997, the licensee notified the NRC of this condition as required under 10 CFR 50.72, and issued Licensee Event Report 97-014, dated December 12,1997.
b. Insoection Followup in 1991, the licensee implemented Design Change 90-085, which resulted in Manual Sample Valves REC-V-728, -733, and -737 being maintained normally open. The reactor equipment cooling system, in part, supplies essential cooling to safety-related equipment, which included the core standby cooling systems, such as high pressure coolant injection, core spray, reactor core isolation cooling, and residual heat removal room coclers, as well as residual heat removal pump seat water coolers, under ;
postulated accident and transient conditions. A nonsafety-related supply of demineralized water was provided to the systems surge tank to ensure the inventory of the system is maintained. In the event of an accident, the nonsafety-related makeup l
could not be relied upon. Therefore, the team found that under certain accidents
! analyzed in the Updated Safety Analysis Report, the inventory in the reactor equipment cooling surge tank would have been depleted in less that 1 day, resulting in the loss of reactor equipment cooling. J
'
l l
l l
The Updated Safety Analysis Report did not explicitly state how long residual heat I removal or core spray must operate to provide long-term cooling to the core and/or how I long reactor equipment cooling must operate to provide cooling to the residual heat removal and core spray pump rooms. However, the licensee determined that 30 days l was reasonable, through an extensive review of the Updated Safety A,nalysis Report, I
'
Chapter 14, analyses, the staff's Safety Evaluation Report, and other design documents.
Upon a low level alarm on the reactor equipment cooling surge tank, operators were directed by an abnormal procedure to ensure the reactor equipment cooling header j isolation valves were closed. In 1993, the licensee implemented Design l l Change 93-057, which modified the reactor equipment cooling and service water )
i systems. Design Change 93-057 included the relocation of valves, switching of divisional power supplies, and the installation of essential divisionally separate power supplies to the service water backup supply to the reactor equipment cooling system.
Prior to this modification, the ability to isolate the noncritical reactor equipment cooling header and the ability to supply service water as a backup to the reactor equipment cooling system surge tank were not available if Division I power was lost since the service water to reactor equipment cooling crosstie motor-operated valve operator was only supplied by Division I power. Therefore, in the event of an accident, the inventory in the reactor equipment cooling surge tank would have been depleted in less than one day resulting in loss of reactor equipment cooling, because the nonsafety-related makeup would not be available. Actions to mitigate this event, without Division I power available, would have required entry into the reactor building in a post-loss-of-coolant- ;
accident environment, which was an unanalyzed condition. I immediate corrective actions included issuing Problem Identification Report 2-19697, which recommended isolating the sampl!ag flow, revising Procedure 2.5.3.7 to chenge the position of Valves REC-V-728, -V-733, and V-737 from normally open to normally closed, and making changes to Procedure 2.5.3.7 to monitor and limit the systern leak rate. The team reviewed this problem identification report and agreed with the proposed corrective actions. On November 9,1997, the licensee notified the NRC of this condition as required under 10 CFR 50.72, and issued Licensee Event Report 97-014, dated December 12,1997. Long-term corrective actions taken by the licensee included revising the 10 CFR 50.59 safety evaluation process and implementing training certification requirements for personnel that perform design reviews and safety evaluations. In addition, the licensee performed a detailed review of continuous chemical sampling methods for other safety-related systems to identify the existence of similar conditions as a result cf this event. No similar conditions were identified.
Generic considerations will be evaluated under the licensee's Strategy for Achieving Engineering Excellence, which contained plans for additional reviews of past modifications, and in the development of design control documents for safety-related systems, which provided a consolidated source of system design basis requirements.
Updated Safety Analysis Report Volume IV, Chapter X, Section 6.3 states,"The [ REC]
system shall be designed to supply an adequate supply of cooling water to the CSCS areas and the residual heat removal pumps under all accident and transient conditions."
As described in 10 CFR 50.59(a)(1), a licensee may make changes in the facility as l described in the safety analysis report without prior Commission approval, unless the t proposed change involves an unreviewed safety question.10 CFR 50.59(a)(2) states l that a change involves an unreviewed safety question if the probability of a malfunction
'
of equipment important to safety may be increased. In 1991, the licensee made l
l 84
l changes to the facility, described in the Updated Safety Analysis Report, that would '
have rendered the reactor equipment cooling system incapable of pedorming its safety function to provide an adequato supply of cooling water to the core standby cooling systems room coolers under all accident conditions. This change increased the i probability that, during certain postulated accidents, the high pressure coolant injection, core spray, reactor core isolation cooling, and residual heat removal pumps would have malfunctioned due to inability of the core standby cooling systems room coolers to provide adequate room cooling, therefore, the team considered that the change introduced an unreviewed safety question. This is a violation of 10 CFR 50.59 l I
(50-298/9815-07).
'
E8.31 (Closed) Unresolved item 50-298/97201-24: Evaluate Effect of Roora Cooler Not 1 Starting When Both residual heat removal Pumps were Running
a. Backaround l l
The NRC identified that Calculations NEDC 93-093," Analysis of STP 93-062 Data RHR I Quad Heatup," Revision 0, and NEDC 93-050, "RHR Quad Temperature," demonstrated l that the test data that measured temperatures in the residual heat removal pump area l with one pump running, and without operation of the fan coil unit provided acceptable ambient room temperatures. Since a low pressure coolant injection signal would start ;
both residual heat removal pumps in the room, the NRC questioned whether the natural i circulating room cooling would provide sufficient room cooling during operation of two I residual heat removal pumps. The NRC noted that if a failure of the fan coil unit was considered, the potential existed that the ambient temperature could be higher than the 155 degrees F limit for the pump motors.
The NRC found that on the basis of this calculation, the licensee submitted a request for technical specification amendment in 1993 to delete explicit operability requirements for the room coolers in the residual heat removal pump rooms from the technical specifications. The NRC approved this technical specification ame.ndment in license Amendment 163.
The NRC noted that the licensee issued a night order on October 29,1997, to secure one of the residual heat removal pumps in a quad room if the fan coil unit in that quad room was not operable.
b. Inspection Followuo The team reviewed Night Order 97-27, dated October 29,1997, which required that whenever a residual heat removal fan coil unit became inoperable, one of the residual heat removal pumps in the affected quad would be disabled and a 30-day limiting condition of operation entered for that pump. The team reviewed Problem identification Report 2 21090, dated October 29,1997, which the licensee issued to address the problem of a fan coil unit being inoperable with two residual heat removal pumps operating. The licensee dispositioned the problem identification report by requiring controls to be in place to prevent operation of two pumps with a fan coil unit inoperable.
The licensee also considered revising the calculations to include two pump operation.
The team reviewed Problern identification Report 2-19692, dated November 9,1997, which was issued to address the failure to consider two pumps operating in one room
__ _ _ . _ . _ ___ _
under accident conditions. The licensee performed an informal evaluation, which concluded that the net effect on the average bulk temperature in a quad room under accident conditions was almost immeasurable. The problem identification report recommended revising the calculation.
10 CFR Part 50, Appendix B, Criterion Ill, requires, in part, that design control measures shall provide for verifying or checking the adequacy of the design, such as by performance of design reviews, by the use of alternate or simplified calculational methods, or by the performance of a suitable testing program. Design control measures for verifying or checking calculation NEDC 93-050, "RHR Quad Temperature,"
Revision 1, were not adequate, in that the calculation assumed heat loads from one pump instead of two. Operation of both pumps during accident conditions, when the fan coil unit for the room was inoperable, could potentially damage both pumps due to high ambient temperatures. The licensee's failure to consider the heat loads with two residual heat removal pumps running was considered to be an example of a violation of 10 CFR Part 50, Appendix B, Criterion 111 (50-298/9815-02).
E8.32 (Open) Inspection Followuo item 50-298/97201-25: Reactor Equipment Cooling System Design a. Backaround !
Technical Specification Bases 3.12 described the reactor equipment cooling system as consisting of two, distinct subsystems, each containing two pumps and one heat exchanger. This was consistent with Updated Safety Analysis Report, Sections X-6.5.1, X-6.6 and X-5.8.3, which stated that the reactor equipment cooling system consisted of I two subsystems with independent loops for those components that must function during postulated accidents and transients and that the two independent loops had the capability to be interconnected through crossties equipped with isolation valves.
The safety evaluation report prepared by the Atomic Energy Commission, dated February 14,1973, stated that the reactor building closed loop cooling water systern included two independent closed loops each containing two pumps and one heat exchanger with crossties providing essential cooling services from two essential service water headers. As originally submitted, the system could not support shutdown following a safe shutdown earthquake considering a concurrent single failure of an active component in the Class I (seismic) piping system, or a shutdown considering a single passive failure not concurrent with a safe shutdown earthquake or design basis accident. The system was upgraded to meet this requirement through seismic upgrades and the addition of service water cross-connections.
Design Change 93-057,"SW and REC System Modifications," modified the service water and reactor equipment cooling systems to establish two electrically independent trains in each system. The reactor equipment cooling system, as noted in Design Change 93-057, was not mechanically redundant and separated because the critical reactor equipment cooling loop return headers were physically cross connected and the cross-connect valves were required to remain open at all times to allow inventory makeup to the single surge tank. The design change further identified that service water-reactor equipment cooling cross-connect valves would be reclassified as essential to provide backup to the reactor equipment cooling system for cooling critical loads.
The NRC questioned whether the reactor equipment cooling system, as described in the Updated Safety Analysis Report and in the Atomic Energy Commission safety evaluation, was consistent with the as-built system, which did not have two mechanically indepen .' ant loops due to the common system surge tank for both loops.
b. Inspection Followuo The licensee stated that the reactor equipment cooling system design and configuration was consistent with the originallicense conditions. The licensee based their statement on the original design criteria that had not changed, and the definition of the term
" independent," which the licensee assumed to mean electrically independent. The original design subrnitted to the NRC for review included a common surge tank. The Atomic Energy Commission's safety evaluation repoit concluded that the two loops, although not mechanically independent was acceptable. The licensee believed that in ,
combination with the existing features added by Design Change 93-057, the service
'
water system provided adequate backup for the reactor equipment cooling system. The rationale for these conclusions was detailed in an informal evaluation prepared in response to the NRC's question, which was reviewed by the team. A licensing change request was in process to clarify how the design requirements were met by the system configuration. In addition, the licensee prepared Calculation NEDC 97-074 to justify the i service water capability to provide adequate cooling to the reactor equipment cooling emergency loads. Notwithstanding the licensee's documented position, the team noted that the two trains of reactor equipment cooling share a common surge tank, and have since original design. This inspection followup item remains open pending review by the NRC program office.
E8.33 (Open) Inspectico Followup item 50-298/97201-26: Effect of loss-of-coolant-accident induced piping failure on reactor equipment cooling system piping I
a. Backaround The reactor equipment cooling seismic Class 11 piping inside the drywell is in close proximity with high energy piping such as the recirculation and residual heat removal system piping. In response to NRC questions, the licensee stated that the residual heat removal piping intermediate point pipe break stresses do not exceed twice the hot allowable stress (2.0 Sn) specified in USAS B31.1.0-1967 and therefore, no intermediate breaks were postulated. The Atomic Energy Commission's safety evaluation report, Supplement 1, dated July 16,1973, stated that breaks were assumed to occur at all terminal points and at two or more intermediate points in each piping run. The licensee '
l replied that based on an informal review, which included the criteria of NUREG 0800, no intermediate breaks were postulated. With regard to the recirculation system piping, the licensee stated that the pipe whip restraints were designed to prevent pipe whips due to a line break from damaging the reactor equiprnent cooling piping. The licensee also l stated that jet impingement, due to a longitudinal recirculation pipe split that could cause damage to the reactor equipment cooling piping, was highly unlikely.
l l The team considered that damage to reactor equipment cooling piping within the drywell could result in the reactor equipment cooling system becoming inoperable because of a loss of water inventory. Although the service water tie-in can be opened from the 87 ,
'
!
l
[
,
i t
control room after operator recognition of the event, the team noted that the use of l service water was credited only for a seismic event.
b. Insoection followuo The ucenseo stated that postulating the concurrent failure of the reactor equipment
,
cooling piping inside containment concurrent with a loss-of-coolant-accident was outside
! the design basis for the reactor equipment cooling system. In addition, the licensee reevaluated the potential for damage to reactor equipment cooling piping within the drywell using the existing design and licensing bases, and verified that pipe whip would not cause a break in the reactor equipment cooling piping. The licensee also reevaluated the pipe whip analysis using current standards (NUREG 0800 criteria) and l determined that under these assumptions, pipe whips would not cause a break in the reactor equipment cooling piping. As a result of an evaluation of the jet forces from a longitudinal split of the reactor recirculation piping, the licensee determined that only 10 percent of the total reactor recirculation piping is in close proximity of the reactor equipment cooling piping. Of this10 percent, only 10 percent of the circumference I
would direct the jet force toward the reactor equipment cooling piping. Another mitigating factor the licensee considered was that the original seam welded reactor recirculation piping was replaced with seamless pipe curing the 1984 outage. Based on the foregoing, the licensee concluded that it is unlikely that a longitudinal split in the reactor recirculation piping would damage the reactor equipment cooling piping.
The licensee refined their analysis that substantiates the adequacy of the service water backup to the reactor equipment cooling system using a more rigorous methodology.
The new analysis supported the licensee's position that the service water system is an acceptable backup to the loss of reactor equipment cooling due to a break inside the dry j well. This issue remains open pending review by the NRC program office. I E8.34 (Closed) Unresolved Item 50-298/97201-27: Reactor Equipment Cooling Heat Exchanger Testing .
a. Backaround The NRC identified that calculation 94-021," REC-HX-A/B Maximum Allowable Accident Case Fouling," Revision 2, used incorrect inputs, such as indicated service water temperature, without addressing instrument uncertainty and a lower than maximum heat load. Furthermore, the NRC found that the reactor equipment cooling temperature could not be monitored from the control room when the noncritical loop was isolated.
Therefore, to ensure that the reactor equipment cooling temperature did not exceed 95 degrees F, the operators were required to maintain a flow of 400 gpm, as established by Calculation NEDC 94-021. The NRC noted that by not considering instrument uncertainty, maintaining a 400 gpm indicated flow might not be sufficient to ensure reactor equipment cooling temperature remains at or below 95 degrees F. As a result of the NRC discussions, the licensee revised the calculation to incorporate additional margins to account for tube plugging, heat load for two residual heat removal pump operation, and a more restrictive acceptance criterion for the heat exchanger fouling factor. The licensee concluded that the heat exchangers could still perform their heat removal functions during an accident.
Procedure 13.15.1," Reactor Equipment Cooling Heat Exchanger Performance Analysis," implemented the licensee's commitment to meet the requirements of Generic Letter 89-13," Service Water System Problems Affecting Safoty-Related Equipment."
The NRC reviewed data and test results from reactor equipment cooling heat exchanger tests and found that the recorded data appeared to be inaccurate, which lead to erroneous test results in addition, the NRC noted that calibrated test instruments were not used during the test. Specifically the following errors were identified:
- The NRC found that test results from 1996 and 1997 identified a substantial mismatch in heat load between the reactor equipment cooling system side and the service water system side of the heat exchanger.
- The NRC found that evaluated test results indicated negative fouling factors, which was not possible.
- The NRC found that instrument uncertainty was not considered in determining the heat removal capability of the heat exchangers, which could result in the results being nonconservative.
- The licensee found that Attachment 3 to Procedure 13.15.1," Reactor Equipment Cooling Heat Exchanger Performance Analysis," Revision 8, page 16, included an incorrect formula for log mean temperature difference.
l
= The NRC identified that during the performance of Procedure 13.15.1, the service water flow to the heat exchangers was not constant.
The licensee issued Problem Identification Reports 2-23179,2-23190,2-19747, and 2-20640 to document and resolve these deficiencies.
b. Insoection followuo incorrect input and inaooropriate Acceptance Criteria in Calculation 94-021 ,
I Calculation 94-021," REC Heat Exchanger A/B Maximum Allowable Accident Case Fouling," used, as inputs, service water temperature without considering the instrument uncertainty. The licensee indicated in a procedure change request that application of '
instrument uncertainties would be addressed within the test procedure. The team agreed that applying instrument uncertainties within the test procedure was appropriate, and found the licensee's planned corrective actions acceptable. The part of this unresolved issue related to instrument uncertainty in Calculation 94-021 is considered closed.
. Inadeauate Test Procedure 13.15.1 Test Procedure 13.15.1, " Reactor Equipment Cooling Heat Exchanger Performance Analysis," contained several errors, such as an incorrect equation for calculating the log mean temperature difference, incorrect values to compensate for plugged tubes, not accounting for instrument uncertainties of the instruments used for the tests, and equation errors in a spreadsheet used to supplement the analysis performed within the body of the procedure. Due to these errors, test data collected in 1996 and 1997
_. .- - .. .- . .- . -
revealed a significant mismatch between the shell side and the tube side with respect to heat transferred and fouling factors. As a result of the errors in Test Procedure 13.15.1, data collected in eight tests resulted in negative fouling factors. The licensee did not identify this as a concern with heat exchanger operability. The licensee based their decision on the fact that since the heat exchangers were cleaned periodically, consistent with Generic Letter 89-13 requirements. The fouling factors were immaterial. The licensee relied on the actual performance of the reactor equipment cooling system during normal power operation as the indication of the heat exchangers capability. In addition, as stated in their response to Generic Letter 89-13, the licensee maintained
.
reactor equipment cooling heat exchanger operability by means of periodic maintenance of the heat exchangers as opposed to testing.
10 CFR Part 50, Appendix B, Criterion V," Instructions, Procedures, and Drawings,"
states that activities affecting quality shall be prescribed by documented instructions, <
procedures, or drawings, of a type appropriate to the circumstances. Criterion V further I states that instructions, procedures, or drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been 1 satisfactorily accomplished. The team found that errors in Procedure 13.15.1 resulted in I inaccurate test data and results. Therefore, the NRC concluded that the procedure was inadequate to demonstrate that the residual heat removal heat exchanger performance i was acceptable. This is considered to be an example of a violation of 10 CFR Part 50, l Appendix B, Criterion V (50-298/9815-01). The licensee subsequently revised the !
procedure, and used it for testing both reactor equipment cooling Heat Exchangers A and B in January 1998 with acceptable results.
E8.35 (Open) Insoection Followup Item 50-298/97201-28: Electrical Separation Criteria a. Backaround The NRC reviewed Design Change 93-057,"SW and REC System Modification," which modified the interconnection between the reactor equipment cooling system and the service water system to provide control of the interconnecting valves from cross-connection switches in the control room. The Division il cross-connection switch operated Valves REC-MOV-714, REC-MOV-698, SW-MOV-887 and SW MOV-889. All of these valves were powered from a Division 11 motor-operated control center except for Valve REC-MOV-698, which was served from a Division I motor-operated control center.
The valve control circuit wiring for Divisions I and It was terminated on the Division 11 cross-connection switch. The licensee was unable to verify whether a failure analysis had been performed for possible wiring faults that could affect the circuits of both divisions.
The NRC's concern involved the Division ll switch, which provided a control signal to the Division i powered valve, REC-MOV-698. The terminating of a Division 1 power supply on a Division 11 switch created the potential for postulated wiring or device failures in one division to propagate into the other division. The licensee initiated a single failure assessment to address any vulnerability of this wiring arrangement.
b. Inspection Followup The licensee performed a single failure assessment to evaluate the wiring configuration of the service water and reactor equipment cooling system valves associated with the service water-reactor equipment cooling cross-connection control switch, which was in draft form at the time of this inspection. The licensee's preliminary results indicated that the effects of all credible postulated failure modes would not result in consequences more limiting than the loss of one train of the service water / reactor equipment cooling cross-connection.
Because the licensee had not finalized their analysis during this inspection, the team could not draw a conclusion about its acceptability. However, the team discussed the licensee's approach to the failure analysis. The discussion included: (1) the design and licensing basis for the use of fuses as isolation devices, (2) the licensing basis for the ;
acceptability of terminating cables from two divisions on one switch, (3) the applicability I of separation criteria in effect at the time of a modification, and (4) planned revisions to Design Change Document-34, a summary of which is provided below:
1. Desian and licensina basis for the use of fuses as isolation devices The team noted that the acceptability of the preliminary results of the licensee's failure analysis required credit for control power fuses as isolation devices.
When requested by the team, the licensee was unable to retrieve licensing and design basis documents that support the use of fuses as isolation devices ;
between redundant circuits. l
, 2. Licensino basis for the acceptability of terminatina cables from two divisions on l one switch in their response to Final Safety Analysis Report, Question 7.4, Amendment 15, (reference discussion of " Spacing of Wiring and Components in Control Boards, Panels, and Relay Racks"), the licensee stated, that:
" Components and wiring in panels, control boards, and relay racks are spaced to preserve the independence of redundant channels as described under ' Physical Separation' (see paragraph 7.4.2.E).
"For those isolated cases where complete separation in different panels for each channel is not possible, the cabinet where two redundant elements are installed is designed with special precautions to comply with the slng e failure criteria such that barriers are provided or a minimum of six inch air space is provided. Redundant cables are not connected to single switches.
" Internal wiring is performed such that destruction of one wiring bundle by shorting, opening, or grounding or a combination of same will not disable the protective function."
l l
l l
- ._ _ _ __ _ _ _ - ._ . _ _ __ _ _ _ _. _ . _ _ ._ _.
i The licensee stated that when completed, the results of their single failure
, assessment will satisfy the licensing basis requirement that " redundant cables
! are not connected to single switches," because the cables from the two divisions
'
that were terminated on a common switch were not functionally redundant. l
,
3. Apolicability of separation crit.ena in effect at the time of a modification t
l The team noted that Upumud Safety Analysis Report, Section Vll-1.7.3.1, l " Criteria for Preserving the Independence of Redundant Channels," stated, in l part," Future cable installation resulting from additional equipment installation or l system upgrading will be installed in accordance with the current separation
!
criteria in effect at the time of the modification."
The team noted that the cables installed under Design Change 93-057 should
,
'
comply with the separation criteria, such as IEEE Std 384-1992 or Regulatory l Guide 1.75. Since Regulatory Guide 1.75 does not accept the use of fuses as isolation devices, termination of two divisional cables on one switch would not 1 satisfy Regulatory Guide 1.75.
To address whether Regulatory Guide 1.75 applied to Design Changa 93-057, l
'
l the licensee stated that they interpreted " cable installation" as installation or rerouting of field cable, but did not consider changes to internal wiring within existing panels to be cable installation. The team agreed with the licensee's interpretation. The licensee stated that field cables at the main control board had not been rerouted or changed in Design Change 93-057, and that if field cables were rerouted or new cables installed, contemporary criteria would have applied.
This item remains open pending the licensee's completion and NRC review of the failure analysis.
E8.36 (Ocen) Inspection Followuo item 50-298/97201-29: Design Basis for reactor equipment cooling Discharge Header Pressure and Time Delay Set point a. Backaround l
Calculation NEDC 92-050X determined the set point for pressure Switches REC-PS-452A, REC-PS-452B1, and REC-PS-452B2 that isolate the noncriticalloads from the reactor equipment cooling system on loss of pressure in .
the system header. The calculation stated that the 55 psig set point for the pressure switches was given in Updated Safety Analysis Report, Section 6.5.3. I However, this information could not be found in the Updated Safety Analysis Report.
The licensee was not able to provide any documented basis for the 55 psig set point.
The purpose of these pressure switches was to ensure that the critical safety related portions of the reactor equipment cooling system would be isolated so that system water inventory would be maintained. For Relays REC-REL-PS452AX, REC-REL PS452B1X and REC-REL-PS452B2, Calculation NEDC 90-50AC determined the time delay from the occurrence of a low pressure condition to the initiation of the closure of the isolation l
'
valves. The relays were set at 40 seconds. Calculation NEDC 92-050AC concluded tt.at the 40 second time delay, adjusted for an uncertainty of 30 percent, was i i I l
( 1
' 92
.
acceptable, because it ensured reactor equipment cooling recovery would occur within the allowable time of 5.1 minutes for loss of reactor equipment cooling. The NRC noted that the 40 second time delay setting (which should be based on limiting loss of reactor equipment cooling inventory) did not depend on the 5.1-minute limit (which is the time that the Updated Safety Analysis Report presented as the allowable time after a loss-of-coolant-accident for a loss of reactor equipment cooling). The licensee issued Problem identification Report 20635 to dccument these findings.
b. Inspection Followuo l In Problem Identification Report 20635, the licensee proposed that the calculations be revised to correct identified deficiencies. The team reviewed the problem identification ,
report and agreed that the proposed corrective actions proposed therein were adequate to correct the identified discrepancies. j The licensee stated that the design basis for the 55 psig set point and the 40 second tirne delay was contained in the safety evaluation for design change, Design Change 93-057,"SW/ REC Modifications." The team reviewed the safety evaluation ,
and found that the existing Updated Safety Analysis Report analyticallimit for reactor !
equipment cooling low pressure isolation was based on the minimum allowable pressure l
corresponding to the maximum allowable flowrate through the reactor equipment cooling i heat exchangers. The team found this to be acceptable evidence of a design basis for the analytical limit for the low pressure set point.
The licensee stated that Calculation NEDC 92-050AC would be revised to resolve the incorrect association of 5.1 minutes with the upper analyticallimit of the reactor i equipment cooling isolation delay, and to provide an acceptable basis for the 40-second I time delay. This revision was scheduled for completion by August 1998. The team l concluded that the incorrect use of the 5.1 minute value in the Updated Safety Analysis Report as a design input to Calculation NEDC 92-050AC, Revision 0, for use as an upper analytical limit was a weakness in the calculation. This item. remains open pending review of the revision to Calculation NEDC 92-050AC, that will address the l
'
design basis for the 40-second time delay.
E8.37 (Closed) Unresolved item 50-298/97201-30: Service Water Interface with Reactor Equipment Cooling System a. Backaround Calculation NEDC 97-074," Evaluation of the Service Water System to Provide Direct Back-up Cooling to the REC System's Critical Loops," Revision 1, demonstrated that the service water system was capable of providing cooling to safety-related equipment in the reactor equipment cooling system. The NRC noted that to avoid introducing river water into the reactor equipment cooling system the licensee did not perform testing to verify actual service water flow to the safety-related equipment in the reactor equipment cooling system. The team reviewed NEDC 97-074, dated May 14,1997, and identified the following:
1. The calculation did not address instrument uncertainties.
.
2. The calculation used room heat loads from another calculation, which assumed one residual heat removal pump operating instead of two. In addition, the calculation did not consider that an residual heat removal pump motor was replaced with a new motor of lower efficiency, which results in more heat rejected into the residual heat removal room.
3. The calculation did not use reactor equipment cooling system surveillance test flow to determine the percentage of total flow to each piece of equipment, and to calculate the service water flow distribution. I
The licensee revised Calculation NEDC 97-074 to address these findings and others identified by the licensee. Specifically the calculation was revised to consider: (1) a higher heat duty for the reactor building fan coil units using a conservative fouling factor of 0.005, (2) new performance curves provided by the manufacturer that established greater heat removal capability of the fan coil units, (3) flow rates to the fan coil units !
based on surveillance test data, (4) increased heat loading due to operation of reactor I core isolation coolant and both control rod drive pumps; and (5) a service water maximum temperature of 90 degrees F. The NRC reviewed the revised calculation and agreed that it demonstrated the capability of service water system to cool the safety-related reactor equipment cooling system. In addition, the licensee issued l Problem Identification Reports 2-19692,2-19746, and 2-20200 to address and resolve these issues, b. Inspection Followup )
i The team reviewed Problem Identification Reports 2-19692,2-19746, and 2 20200. l In order to meet the service water maximum temperature of 90 degrees F assumed l in Calculation NEDC 97-074, the licensee established a service water operational l limit of 87 degrees F to account for instrument uncertainties, which were not considered in the data used as inputs to the calculation. The licensee stated that the heat exchanger Test Procedure 13.15.1," Reactor Equipment Cooling Heat Exchanger Performance Analysis," was revised to account for instrument uncertainties.
Therefore, it was concluded that a service water temperature of 90 degrees F was acceptable for use in the revised calculation. The team confirmed that the revision to Calculation NEDC 97-074 addressed the NRC's concerns, and concluded that it demonstrated the capability of the service water to cool safety-related equipment in the reactor equipment cooling system. The team did not identify any operability concerns.
10 CFR Part 50, Appendix B, Criterion Ill, " Design Control," requires, in part, that measures be established to assure that applicable regulatory requirements and the design basis, for those structures, systems, and components to which this appendix applies, were correctly translated into specifications, drawings, procedures, and instructions. The licensee's use of non-conservative and incorrect inputs to Calculation NEDC 97-074 is another example of a violation of 10 CFR Part 50, Appendix B, Criterion Ill (50-298/9815-02).
I l
l
.
- _ _ _ _ _ _ _ _ _ _ _ _ .
, .
E8.38 (Closed) Inspection Followup Item 50-298/97201-31: Instrument Air Pressure Regulator Failure a. Backaround Paragraph 3.2.17 of Design Change Document 3, "A Service Water (SW) and Residual Heat Removal Service Wster Booster System," Revision 1, stated that Valves SW-AO-TCV451A & B were analyzed for loss of air. The team questioned if the effect of full air header pressure on the valve air operators was analyzed to account for the potential failure of the upstream air pressure regulator. The licensee stated that this scenario had not been analyzed, and investigated the potential failure modes for this valve. The licensee determined that it was possible for the valve to failin the nonsafe position, but expected plant operators to recognize the failure when the reactor equipment cooling temperature exceeded 95 degrees F and take compensatory action by venting the air from the solenoid to open the valve.
The licensee also investigated the possibility and consequences of other similar failures in the instrument air system. Preliminary results indicated that:
= There were potentially 96 essential air operators of different sizes, pressure ratings, and types that could be affected by air pressure regulator failures.
- Six valves were found to have diaphragm type operators with a maximum allowable pressure less than the normal instrument air pressure of 125 psig.
,
Exceeding the pressure rating may cause operator case and stem damage such that the valves may fail in the non-safe position.
Nineteen valves had diaphragm type operators with no specific manufacturer information on the pressure rating.
Thirty-nine valves have cylinder type operators, which might be able to withstand an air pressure of 125 psig.
No design information was available for eighteen valves.
The licensee issued Problem Identification Report 2-20632 to document this issue.
b. Insoection followuo The licensee's response to the initial inspection team inquiry regarding the two service water air-operated valves was expanded to eventually address 357 essential or environmentally qualified air operators in the plant. This number included air operators on essential dampers as well as on essential valves. The purpose of the investigation was to determine if failure of an air regulator could cause the associated valve to fail in an unsafe position. Fif ty-eight of the 357 air operators were designed for fullinstrument air pressure. The remaining 299 operators required further evaluation to determine the impact of overpressure on the air operator and the associated valve or damper.
The licensee performed an operability assessment and found that there were no immediate operability concerns for this failure mechanism. If a regulator failed in the
1 . .
.
_ - _ . - _ - _ _ _ _ _ _
__ . _- __ . _ __ _, . . _ _ _ _ _ _ . __
l i
manner described, changes in the associated valve's performance would be identified by the plant operators. The affected component would than be declared inoperable and the appropriate corrective actions would be initiated. if the evaluation identified a potential valve problem, additional problem identification reports would be written and !
the consequences evaluated on a case by case basis. The licensee did not identify any
'
instances of air regulator failures i
The licensee completed the evaluation of the essential air operators, and concluded l that the 357 essential valve air operators were either designed for full instrument air ,
pressure, or that the failure of the air operator would not prevent the associated valve or
damper from failing to its safe position. Since the regulators were divisionally separate, i
. the failure of a single non-essential regulator would not prevent the safe shutdown of the l 1 plant. The results of this evaluation were being incorporated in the instrument air design I control document and will be included in engineering support personnel training.
The team considered the licensee's actiorm regarding this issue to be pro-active, thorough, and comprehensive.
E8.39 (Closed) Inspection Followuo Item 50-298/97201-32: Adequacy of Corrective Action for Overranged Residual Heat Removal Service Water Booster Pump Suction Pressure 4 Gauges and Leaking Service Water Valve a. Backaround During a system walkdown, the NRC noted the following two conditions adverse to i quality that were not promptly corrected by the licensee i
!
'
. Safety-related, normally closed, manually-operated Service Water Valve SW-V-1265 had been leaking around the stem for about 4 years.
- Residual heat removal service water booster pump suction pressure gauges, 3W-PI-385A through 385D, were pegged high. The licensee stated that Condition Report 96-0311 dated April 8,1996, had identified this issue and that the condition resulted from high river water level.
b. Insoection Followuo The licensee identified that the service water valve was leaking about one drop every 5 seconds, and scheduled Work Order 96-1785 to repair the valve in August 1998. The team agreed with the licensee's plan for correcting this adverse condition. The team noted that the licensee issued an engineering project request to replace the pressure gauges.
The licensee concluded in Condition Adverse to Quality 96-011, that the over-ranged Pressure Gauges SW-PI-385A through 385D were not used for surveillances to determine system performance. However, the team noted that these instruments were specifically utilized in the performance of inservice tasting Procedures 6.1SWBP.101,
"RHR Service Water Booster Pump Flow Test and Valve Operability Test (DIV 1),"
Revision 4, and 6.2SWBP.101,"RHR Service Water Booster Pump Flow Test and
Valve Operability Test (DIV 2)," Revision 4. Table 1 of those procedures identified that these gauges were used to measure post-start inlet pressure to the pumps.
Condition Adverse to Quality 96-0311 also identified that vendor information confirmed that these instruments did not have over-range protection. Ashcroft Bulletin DU-1 recommended using a gauge with a full scale pressure range of approximately twice the normal operating pressure and a maximum operating pressure that did not exceed 75 percent of the full scale range. The bulletin also stated that failure to select a gauge in accordance with these guidelines may ultimately result in gauge failure. The team concluded that the licensee failed to implement the vendor information and used gauges that did not have the proper range.
10 CFR Part 50, Appendix B, Criterion V, states, in part, that activities affecting quality shall be described in procedures appropriate to the circumstances and shall be accomplished in accordance with these procedures. The licensee implemented Procedures 6.1SWBP.101 and 6.2SWBP.101 for performing surveillance testing that specified the use of gauges that did not have the appropriate range. This is considered to be an example of a violation of 10 CFR Part 50, Appendix B, Criterion V (50-298/9815-01).
E8.40 (Closed) Licensee Event Report 50-298/95-010: Residual Heat Removal Minimum Flow Valve Position vs Design Basis Requirements !
a. Backaround As described in NRC Inspection Report,50-298/98-03, dated August 1994, the licensee identified that the normally closed position of the residual heat removal minimum flow l valves conflicted with several design documents. In resolving these discrepancies, the licensee determined that these valves should be maintained in a normally open position, and in December 1994, implemented Design Change 94-322 to change the normal positions of the valves from closed to open. In reviewing the close-out documents for the design change the licensee determined that their previous practice of maintaining l these valves in the closed position placed the plant in an unanalyzed condition. l Specifically, the licensee identified a single failure vulnerability under certain loss-of-coolant-accident scenarios, where a f ailure of the 125 V de electrical distribution bus supplying power to the minimum flow valve for the non-affected loop would prevent the l valve from opening. This would result in the residual heat removal pump operating l under no-flow conditions longer than the maximum 20 seconds dead-headed operation provided by the pump vendor. On Anril 13,1995, the licensee made a 4-hour nonemergency report to the NRC in accordance with 10 CFR 50.72.
b. Inspection Followuo in 1978, the licensee implemented Design Change 76-02 in an effort to meet a peak cladding temperature of 2200 degrees F. The plant was originally licensed to meet a
- peak cladding temperature of 2700 degrees F, which was insured, under the most l limiting single f ailure, by the core spray system. At that time, the core spray system was
!
found to be inadequate to meet the more restrictive peak cladding temperature, therefore, the licensee initiated a design change to: (1) eliminate the recirculation loop selection logic, (2) revise the recirculation loop discharge valves to close upon an I 97 i
,
appropriate reactor pressure decrease, (3) change the crosstie valve between the two low-pressure-coolant-injection system headers from normally open to normally closed, and (4) change the motor operators on the low-pressure-coolant-injection valves from ac to dc on separate divisions.
In the safety analysis performed in support of Design Change-76-02, dated July 27, l 1977, the licensee failed to consider all the affects of this modification on the ability of ;
the residual heat removal system to meet its design basis function to provide low- j pressure-coolant-injection to the reactor core during a design basis loss-of coolant-accident. Specifically, in the event of a loss-of-coolant-accident, with no loa-of-offsite-power, and a single failure of the 125V de bus, which prevented the residual heat removal minimum flow valve from opening, the residual heat removal pump in the loop not associated with the break would start and run with no discharge flow in excess of the 20 seconds maximum run time while dead-headed before pump damage could occur, ]
10 CFR Part 50, Appendix B, Criterion 111, requires that the design bases are correctly translated into specifications, drawings, procedures, and instructions; and design changes are subject to design control measure commensurate with those applied to the original design. The team found that in implementing a design change in 1978, the licensee failed to properly translate the design bases of the residual heat removal system into drawings, procedures, and instructions to ensure that the residual heat removal system could meet its safety function to provide low-pressure-coolant-injection to the core during design basis accidents. This is a violation of 10 CFR Part 50, Appendix B, Criterion Ill. The team considered this violation to be an example of an old design issue. Therefore, the NRC is exercising enforcement discretion in accordance with Section Vll.B.3, namely (1) it was licensee-identified as a result of a voluntary initiative (an investigation into spurious oscillations of the core spray mini-flow valves),
(2) it was corrected within a reasonable time following identification, (3) the violation would not be categorized at Severity Level I, and (4) the violation would not likely to be identified by routine licensee efforts such as normal surveillance activities. After consultation with the Office of Enforcement, pursuant to Section Vll.B.3 of the Enforcement Policy, discretion is br/rg exerciced and a violation is not being issued.
ILflant Support F8 Miscellaneous Fire Protection Issres (92904)
F8.1 (Closed) Violation 50-298/9625-07: Failure to identify and Correct Transient Combustible Control Problems
,
a. Backaround The NRC identified minor examples of uncontrolled combustible material and identified that the licensee had not implemented adequate corrective actions for recurring problems with the control of transient combustible materials. Corrective actions for a previous, similar licensee finding included revising the administrative procedure for control of transient combustible materials and performing periodic fire protection personnel walkdowns of the plant to ider.tify transient combustible material control
l
. ._ _ _
problems. These corrective actions did not include a feedback mechanism to modify personnel behavior or increase management attention when problems continued.
b. Inspection Followup The team reviewed Procedure 0.7.1," Control of Combustibles," Revision 9, verified that revisions were made to address programmatic weaknesses, and verified that training on the procedure revision had been presented to plant personnel. The licensee also developed a transient combustible " Performance Indicator," for review by station management. Transient combustible material issues were tracked and tallied on a weighted-point scale according to issue significance. Performance goals were set and the indicator was monitored for trends. Management action was required when a 3-month cumulative point threshhold was exceeded. Management actions could take a variety of forms including site notifications, remedial training conducted by fire protection personnel, and disciplinary action. The team concluded that the licensee's actions in response to this violation were appropriate and should prevent recurrence.
F8.2 (Closed) Licensee Event Report 50-298/94-008. Revision 1: Inoperable Appendix A Fire Barrier Penetration Seal Resulting from inadequate Initial Installation a. Backaround The subject Licensee event report was a revision to a report issued by the licensee in 1994 and closed in NRC Inspection Report 50-298/95-17. The licensee had identified an inadequately installed fire barrier penetration seal. The seal was located in a fire barrier that was required in accordance with the licensee's commitments to Appendix A of NRC Branch Technical Position 9.5-1," Guidelines for Fire Protection for Nuclear Power Plants." The fire barrier was not located in a fire barrier required for safe :
shutdown per 10 CFR Part 50, Appendix R. !
The licensee identified that it had inadequate fire protection program oversight of the Appendix A fire barrier program. As corrective action, the licen.we initiated the Appendix A fire barrier walkdown and documentation reconstitution project, which included a complete review of Appendix A fire barriers, plant walkdowns, barrier repairs, and updates of station drawings, calculations, and surveillance procedures. During this effort, several additional penetration seals and dampers were found inoperable or degraded. Also, some penetration seals and dampers were not included in the surveillance program. The licensee initiated compensatory actions as deficiencies were identified and completed required repairs or testing. The as-found conditions of penetration seats did not significantly affect fire safe shutdown capability and all .
dampers that were tested satisfied their required functions. The licensee also performed inspections of a random sample of Appendix R fire barriers to verify that the )
deficiencies identified in the Appendix A fire barrier program were not present in the i Appendix R fire barrier program. No similar problems were identified. !
,
b. Inspection Followuo l
l The team reviewed the licensee's corrective actions identified in the licensee event l report. The team reviewed associated condition reports and procedures and concluded that the licensee had performed a thorough review of its Appendix A fire barriers, made 99 j
!
l
repairs when necessary, and had created a program that appeared acceptable to ensure integrity of the Appendix A barriers was maintained.
Technical Specification 3.19 required that integrity of all fire barrier penetration seals shall be maintained and Technical Specification 4.19 required inspections of fire barrier penetration seals.
As documented in the licensee event report, the licensee identified several examples of inoperable fire barriers and fire barriers that were not included in the surveillance program. These are considered violations of Technical Specifications 3.19 and 4.19.
However, these non repetitive, licensee identified and corrected violations are being treated as noncited violations, consistent with Section Vll.B.1 of the NRC Enforcement Policy (50-298/9815-08).
F8.3 {Q. losed) Licensee Event Report 50-298/96-009. Revisions 0.1. and 2: Accendix R Safe Shutdown Analysis Vulnerabilities a. Backcround As part of its 10 CFR Part 50, Appendix R, reevaluation effort, the licensee identified items that did not have acceptable coping strategies. The licensee issued Revision 0 of j Licensee Event Report 96-009 on August 26,1996, and the issues identified were
'
reviewed in NRC Inspection Report 50-298/96-25. The inspectors at that time reviewed the hcensee's findings, verified that corrective actions had been implemented to eliminate the vulnerabilities, and identified a Non-Cited Violation for the reported problems. ;
Revision 0 of the licensee event report identified that the Appendix R reevaluation effort was continuing, that additional supplements to the licensee event report would be submitted as necessary, and that the root cause of these Appendix R issues was still under investigation. The report was submitted in abstract form only and did not contain a narrative description, as required by 10 CFR 50.73(b)(2). This was acceptable at that time because the reevaluation effort was stillin progress. The licensee also identified a commitment that it would submit a final, non-abstract supplement to the licensee event report following completion of its Appendix R reanalysis.
On December 12,1996, the licensee issued Revision 1 to Licensee E' rent Report 96-009 because they identified another fire vulnerability. This supplement, again in abstract form only, identified the potentialinability of Valve RHR-MOV-MO39B,"SPC
[ Suppression Pool Cooling]/ TORUS SPRAY OUTBD VLV," to open from the alternate shutdown panel due to an interlock with Valve RHR-MOV-MO15B,"RHR PUMP B SDC
[ Shutdown Cooling] SUCTION." A fire-induced fault could cause Valve RHR-MOV-MO15B to open, and because of the interlock, an operator would not be able to open Valve RHR-MOV-MO39B and initiate suppression pool cooling within the credited time period. The report identified that circuit modifications would be performed to eliminate the vulnerability.
On January 10,1997, the licensee issued Revision 2 to Licensee Event Report 96-009 because they again identified another fire vulnerability. This supplement, again in abstract form only, identified the potential for fire-induced circuit faults to prevent the 100
l l
,
diesel-driven fire pump from either starting or stopping, depending on its initial state of operation. The report identified that circuit modifications had been completed to eliminate the vulnerability. This submittal also included the statement that the Appendix R reevaluation effort was continuing and that the report was being issued in abstract form pending completion of the analysis. The licensee's commitment identified that after the analysis completion, a final non-abstract report would be submitted.
b. Inspection Followuo The team verified that the licensee had completed actions to eliminate the identified vulnerabilities. I l
Valve RHR-MOV-MO39B l l
With respect to Valve RHR-MOV-MO39B, the licensee declared its alternate shutdown controls inoperable on November 12,1996. Technical Specification 3.2.1.2 required that the licensee restore the er!uipment to operable status within 30 days, or notify the NRC l and provide plans to restore the alternate shutdown capability. The licensee was unable l to complete a modification to restore the capability within 30 days. Therefore, the licensee reported the condition to the NRC in its December 12,1996, Licensee Event Report, Revision 1, and provided a plan to complete a modification. No date for completion of the modification was provided; however, the team reviewed Engineering Project Request 98-001, "RHR-MO-39B/RHR-MO-15B Interlock for ASD [ Alternate j Shutdown]," which identified that a modification had been approved for implementation. l l
The expected completion date for the modification was September 1,1998.
The team verified that the licensee implemented interim compensatory actions pending completion of the circuit modification for the Valve RHR-MOV-MO39B interlock. A change was made to Procedure 5.4.3.2, " Post-Fire Shutdown to Cold Shutdown Outside Control Room," Revision 15, on December 9,1996, which added operator actions necessary to open Valve RHR-MOV-MO39B should the valve not respond to an open signal from the control switch at the alternate shutdown panel. The additional operator actions consisted of sending an operator to locally depress the open contactor of the motor starter at the power supply breaker for Vdve RHR-MO'1.MO398 for 105 seconds to open the valve. Operating the valve locally at the power supply breaker bypassed the interlock with Valve RHR-MOV-MO158. Therefore, Valve RHR-MOV-MO39B could be opened if Valve RHR-MOV-MO158 had spuriously opened due to a fire-induced circuit fault.
The team had concerns with this solution. Operating the valve locally from the power supply breaker also bypassed torque switch and limit switch protective features of the valve actuator in addition to bypassing the interlock. The team was concerned that if an ;
operator inadvertently depressed the close contactor on the motor starter instead of the open contactor, that the valve disk of the already closed valve could be driven into the closed seat, and damage the valve body, yoke, stem, or actuator, and completely prevent establishment of suppression pool cooling. A!so, the operator was instructed to depress the open contactor for 105 seconds, which was the upper limit for acceptable valve stroke time defined in the inservice testing program. The team was concerned ;
"
that if the nominal stroke time was less than 105 seconds or if the valve was in mid-position at the start of the activity, that the valve disk could be driven into the open 101
)
)
J s
___
l
.
backseat of the valve, and potentially damage the pressure boundary. Alternately, the disc could become separated from the stem and potentially obstruct flow through the !
'
valve.
i The licensee informed the team that operating motor-operated valves from the power supply breaker was standard practice and had been applicable for other valves addressed in Procedure 5.4.3.2 since its inception. The team noted that neither Revision 0, nor the current revision (Revision 18) of Procedure 5.4.3.2 included a precaution to alert the operator of the importance of selecting the correct contactor at the power supply breaker. Also, the procedure did not require local verification at the accessible valves that the valve or actuator had not been damaged.
The team questioned whether this issue challenged the operability of this valve and, in addition, all of the motor-operated valves operated in this manner in Procedure 5.4.3.2.
In response, the licensee performed preliminarv calculations of all motor-operated valves that were designated by Procedure 5.4.3.2 as being subject this particular method of repositioning. In all cases, the licensee determined that no operating loads would be sufficient to cause pressure boundary rupture or disc to stem separation. The team briefly discussed this effort with the licensee and was satisfied that appropriate and conservative assumptions were made as design input to the calculations.
10 CFR Part 50, Appendix B, Criterion V," Instructions, Procedures, and Drawings,"
states, in part, that activities affecting quality shall be prescribed by procedures of a type appropriate to the circumstances. Procedure 5.4.3.2 was not of a type appropriate to the circumstances in that it used stroke times that did not consider the nominal stroke time of the valve. This non-repetitive, licensee identified and corrected violation is being treated as a noncited violation, consistent with Section Vll.B.1 of the NRC Enforcement Policy (50-298/9815-09).
Die , Driven Fire Pumo WiD mgard to the diesel-driven fire pump, the licensee implemented Plant Temporary Moonication 96-33,"FP-P-D, Disabling of Remote Stop Capability," on December 18, 1996. This temporary modification installed a jumper in the diesel-driven fire pump control circuitry to disable the remote stop capability of the pump and assure automatic pump operation for a fire in the control room or cable spreading room. The team considered this interim action acceptable pending implementation of a permanent modification.
Licensee Event Report ,
As discussed above, each revision of the licensee event report identified that it was l being submitted in abstract form pending completion of the Appendix R Reanalysis. l The licensee informed the team that Revision 0 of the 10 CFR Part 50, Appendix R l
! re-analysis was completed on June 17,1997. The team questioned why a final revision of the licensee event report was not submitted as discussed. In response, the licensee provided the team with a copy of its nuclear action item tracking closure evaluation for :
' the licensee event report. The evaluation concluded that no additional revisions to the l report were required because no additional Appendix R issues were identified in the I 102 l
i
. -. _ __ _ _ _ _ _ _ __ _._ _ _ . _ _ _ ._ . _ _ _ _ . . . _ _ _
,
l-
!
l Appendix R re-analysis and there would be no benefit to be gained by providing an l- additional supplement.
l
! 10 CFR 50.73(b)(2) requires that a narrative description of the event be included with the licensee event report. Neither Revisions 0,1, nor 2 of Licensee Event l Report 50-298/96-009 contained a narrative description of the event. The licensee
'
l stated that Supplement 3 to this licensee event report was submitted to the NRC in July l 1998. The failure to include the narrative description of the event in the licensee event report constitutes a violation of minor significance and is not subject to formal enforcement action.
c. Conclusion Similar to the NRC's review of the vulnerabilities identified in Revision 0 of Licensee
- Event Report 50-298/96-009, and documented in NRC Inspection Report 50-298/96-25,
'
the team concluded that the vulnerabilities identified in Revision 1 and Revision 2 of ,
Licensee Event Report 50-298/96-009 were a licensee-identified and corrected violation.
V. Manaaement Meetinas X1 Exit Meeting Summary The team met with the management of Cooper Nuclear Station on May 21,1998, and .
June 26.1998, to conduct technical debriefs prior to leaving the site. Following in-office review an exit meeting was conducted at the site on August 26,1998. While some proprietary information was reviewed, none was identified in this report.
.
103
!
l
- . ATTACHMENT
. 1 SUPPLEMENTAL INFORMATION PARTIAL LIST OF PERSONS CONTACTED Licensee M. Boyce Plant Engineering Manager j D. Buman - Assistant Plant Engineering Manager ]
'
' S. Freborg Senior Staff Engineer i T. Gifford Design Engineering Manager i
G. Horn Senior Vice President of Energy T. Hough Senior Tech Staff Engineer ;
' B. Houston Nuclear Licensing and Safety Manager l
'
D. Magan Licensing Specialist-M. Spencer Engineering Programs Assistant Manager J. Sumpter Licensing Supervisor K. Thomas Acting Supervisor, Codes R. Wenzel Project Manager NRC C. Skinner Resident inspector, Cooper Nuclear Station T. Stetka Acting Chief, Engineering Branch, Region IV l l
l INSPECTION PROCEDURES USED 37001 10 CFR 50.59 Safety Evaluations ,
37550 Engineering 92903 Followup - Engineering
'
92904 Followup- Plant Support 93809 Safety System Engineering inspection (SSEI)
ITEMS OPENED, CLOSED AND DISCUSSED OPENED 50-298/9815-01 VIO Multiple Examples of a Failure to implement and Follow Procedures as Required by 10 CFR 50, Criterion V l
I 50-298/9815-02 VIO Multiple Examples of a Failure to Control Design as Required by 10 CFR 50, Criterion lll 50-298/9815-03 VIO Failure to Perform an Adequate Testing After Relief Valve Adjustmcat as Required by 10 CFR 50, Criterion XI
!
l l
__ _ . _ _ __ . ._ _ _ . _ _ _ _. _ _ . _ _ _ _ _ _ . . _ _ _ _
50-298/9815-04 NCV Inadequate Technical Specification Bases Regarding the Number of Required Emergency Diesel Generator Air Staring Compressors 50-298/9815-05 IFl Review the Licensee's 10 CFR 50.59 Safety Evaluation for Fuel i Handling Accident Dose Consequences 50-298/9815-06 VIO Failure to Submit Information Required by 10 CFR 50.73 50-298/9815-07 VIO Failure to Determine Whether a USQ Existed in Accordance With 10 CFR 50.59 for a Modification to the Reactor Equipment Cooling System 50-298/9815-08 NCV Licensee Identified Examples of inoperable Fire Barriers and Fire Barriers that were not included in the Surveillance Program
)
50 298/9815-09 NCV Licensee Identified inadequate Procedure for Valve Stroke Times CLOSED 50-298/95001-01 URI Acceptability of Single Check Valve for Containment Isolation of Reactor Building / Torus Vacuum Relief Lines 50-298/9624-03 URI Possible 10 CFR 50.59 Violation Associated with Standby Liquid Control System 50-298/9624-05 URI Possible 10 CFR 50.71(e) Violation- Radiological Consequences 50-298/9624-06 VIO Failure to Torque Hydraulic Capscrews as Required 50-298/9624-09 VIO Failure to Correct Conditions Adverse to Quality 50-298/9624 10 IFl Review Licensee's Disposition of Condition' Reports 50-298/96024-12 IFl Quality assurance program requirements and programmatic weaknesses regarding standby liquid control system 50-298/9625-02 URI Acceptability of EDG Cylinder Differential Temperatures l l
50-298/9625-07 VIO Failure to identify Transient Combustible Problems l
50-298/9707-07 IFl Determine Whether 10 CFR 50.59 Safety Evaluations Were Performed 50-298/97201-01 URI Review of licensee's evaluation of residual heat removal pumps flow rate 50-298/97201-02 IFl RHR Pump Suction Strainer Modification i 50-298/97201-03 IFl RHR Pump Net Positive Suction Head (NPSH) for Fire Events 50-298/97201-04 URI RHR Pump Minimum Flow l
l l
.
_ _ _ _ _ _ _ - _ _ _ .
.. ..
. .. .
50-298/97201-05 IFl RHR Pump to Pump Interaction 50-298/97201-06 .URI RHR Heat Exchanger Performance Testing 50-298/97201-09 URI RHR System Suppression Pool Cooling Throttle Valve Stroke Time 50-298/97201-10 URI Reportable Conditien of Containment Isolation Valves Which Did Not Have Diverse Power 50-298/97201-11 URI Technical Specification Lower Limit for Degraded Voltage Setpoint Was Below Analytical Limit 50-298/97201-13 IFl Basis for Technical Specification Setpoint for Time Delay Permissive for RHR Heat Exchanger Bypass Valve 50-298/97201-16 URI Weakness in the Design, Evaluation, and Operation of the Radioactive Floor Drain System 50-298/97201-19 IFl Hydraulic Analysis for SW Backup to RHR 50-298/97201-20 URI Adequacy of Safety Evaluation Supporting USAR Change Which increased the Maximum Ambient Temperature Value for the RHR Service Water Booster Pump Room 50-298/97201-21 URI Update Safety Analysis Report / Technical Specification Discrepancies 50-298/97201-22 URI REC System inventory Loss 50-298/97201-23 . URI Reactor Equipment Cooling System inventory Loss 50-298/97201-24 URI Evaluate Effect of Room Cooler Not Starting When Both RHR
.
Pumps were Running
,
50-298/97201-26 IFi Effect of LOCA Induced Piping Failure on REC System Piping 50-298/97201- LIRI REC Heat Exchanger Testing
50 298/97201-30 URI SW Interface with REC System 50-298/97201-31 IFl Instrument Air Pressure Regulator Failure 50-298/97201-32 IFl Adequacy of Corrective Action for Overranged RHR Service ,
Water Booster Pump Suction Pressure Gauges and Leaking l Service Water Valve 50-298/9815-04 NCV inadequate Technical Specification Bases Regarding the ,
Number of Required Emergency Diesel Generator Air Staring J Compressors
i
. _
50-298/9815-06 VIO Failure to Submit Information Required by 10 CFR 50.73 50-298/9815-07 VIO Failure to Determine Whether a USQ Existed in Accordance With 10 CFR 50.59 for a Modification to the Reactor Equipment Cooling System 50-298/9815-08 NCV Licensee Identified Examples of inoperable Fire Barriers and Fire Barriers that were not included in the Surveillance Program 50-298/9815-09 NCV Licensee Identified inadequate Procedure for Valve Stroke Times DISCUSSED 50-298/96024-08 URI ATWS Emergency Operating Procedure issues 50-298/96024-14 VIO Eight examples of 10 CFR 50.71 failure to update the USAR and three examples of failure to conduct 10 CFR 50.59(b)(1)
evaluations 50-298/97201-12 IFl Basis for Instrument Uncertainties for indicator Channels That Support Technical Specification Compliance and Operator Actions 50-298/96201-14 IFl Technical specification bases for condensate storage requirements 50-298/97201-17 IFl ECCS Pump Seal Failure 50-298/97201-25 IFl REC System Design
.
50-298/97201-28 IFl Electrical Separation Criteria 50-298/97201-29 IFl Design Basis for REC Discharge Header Pressure and Time Delay Setpoint DOCUMENTS REVIEWED Condition Reports Number Description 94-137 PT neutral incorrectly landed; therefore DG2 did not have a loss of excitation auto trip.
94-0193 SP 6.3.4.3 (Sequential Loading of Emergency Diesel Generator) does not contain adequate steps to assure proper load shedding LAW TS 4.9.A.1.a.
94-0224 Fire Barrier Deficiencies
-- . -. __ - - - - - .. -- ... - . .._.-. .
Number Description 94-0288 SOP 2.2.19 (480 Vac Aux Power Distribution System) allows transfer of MCC X from Div ll to Div 1, contrary to design / calc basis, 94-0411 Control Room Low Air Flow Affects Radiation Monitor's Sample Flowrate 94-0450 Fire Barrier Deficiencies 94-0482 Operating limit of 4160 Vac bus voltage exceeded while served from emergency transformer 94-0731 Difficulty in adjusting electrical overspeed trip for diesel generator 94-0735- Outside Air inlet Valve HV-AOV-270AV and Exhaust Valve HV-AOV-272AV Are Interlocked With the Emergency Fan and Not With a High Radiation Signal 95-1365 DG2 overloaded during 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> run 96-0160 It was discovered that numerous inconsistencies existed between the
" Number Required" column section description and the actual number of penetrations that existed in the field with regards to USAR Table V-2-2.
96-0348 T.S. Table 3.2.J Minimum number of Operable Instrument channels for Reactor High Water Level Trip is non-conservative.
96-0372 During review of RHR operating procedures, and applicable section of the USAR, it appears that a discrepancy exists between operating procedures and the USAR.
96-0373 Testing methodology not in accordance with USAR safety evaluation.
96-0394 USAR does not describe discharging Reactor Water to Badwaste or Main Condenser with the RHR system when Secondary Containment is required.
A removable spool piece that connects from RHR to Main Condenser should not be installed any time Secondary or Primary Containment is in effect.
96-0397 During a review of HPCI operating manual procedures with applicable sections of the USAR, the licensee identified several inconsistencies.
96-0944 Use of uncontrolled sketches for troubleshooting 97-1474 During performance of SP 6.OG.304, both RHR-920 &921 MV valves are de-energized in the open position. This would prevent them from performing their isolation function if a Group 2 or steam line break isolation signal was received during performance of the SP 6.OG.304.
98-0089 Control room pressurization design change DC 94-262 did not appear to have evaluated impact on electrical loading
- _
. - - . . . - - - . - . . - . . _ . . . . .
.
Procedures -
Date/
Number Description Revision 997-015-00 In operability of diesel generator 1 due to degraded lube oil 12/12/97 pump 998-006-00 Safety relief valves found outside of Technical Specification 4/29/98 limiting safety system setting 0.23 CNS Fire Protection Plan 19'
O.29.1 Operating License Change Requests 5-0.29.2 USAR Change Requests 5 ;
0.3 Station Operations Review Committee 19 .]
0.31 Equipment Status Control, Section 8.6.1.6 4 C1 0.4 Procedure Change Process 26 .
!
0.4A Procedure Change Process Supplement 0 ;
'
0.42.1 Regulatory Commitment Tracking 2 O.5 " Problem identification and Resolution" 15
-
.
0.5.1 " Operations Review of Problem Identification 1 l
Reports / Operability Determinations * j 0.7.1 Controlof Combustibles 9 ]
0.8 Safety Assessment and Unreviewed Safety Question - 2 Determination BAR-1 ' " Breakers and Control Circuits (including Control Relays and 10/21/96 Hand Switches)"
2.0.7 " Plant Temporary Modification Control" 25 2.2.19' System Operating Procedure - 480 Vac Auxiliary Power 24 Distribution System l 2.2.84 System Operating Procedure - HVAC Main Control Room and 24 C1 l Cable Spreading Room
'2.2.70 RHR Service Water Booster Pump System 35.1 i 2.2.84 HVAC Main Control Room and Cable Spreading Room 24C 3.22.1 Technical Evaluation 2 3.32.10 Design Criteria Document Open items 2
.- .._ .- . . - . -- .. ._ - -.. -, .
Date/
Number Description Revision
. 3.4 Station Modifications 21 3.4.4 Temporary Design Change 7 3.4.5 Engineering Evaluations 1C2 3.4.7 Design Calculations . 12
. 3.4.5 Engineering Evaluations 1 C2 3.5' Special Procedures 15 5.2.1 Shutdown from Outside the Control Room 24 5.2.5 Emergency Procedure: Loss of Normal AC Power - Use of - 32 C2 Emergency AC Power 5.4.3.2 Post-Fire Shutdown to Cold Shutdown Outside Control Room 0 5.4.3.2 Post-Fire Shutdown to Cold Shutdown Outside Control Room 15 ,
.
' 5.4.3.2 Post-Fire Shutdown to Cold Shutdown Outside Control Room 18 6.DG.301 DG Sump Alarm Set point Test 2 6.DG.601 Diesel Fuel Oil Day Tank Particulate Contamination Test 2 >
6.DG.602 Diesel Fuel Oil Availability 2 6.DG.603 Diesel Generator Inspection 2 6.DG.604 Diesel Fuel Oil Storage Tank, Bunker A&B, Quality. Test 3 6.DG.605 Diesel Fuel Oil incoming Truck St.mpling 4 6.1 DG.101 DG Monthly Operability Test (Division 1) 10C4 6.1 DG.102 DG Demonstration of Operability Test (Division 1) 6C5 6.1 DG.103 DG Cycle Operability Test (Division 1) SC1
- 6.1 DG.104 Diesel Operability Test with Isolation Switches in isolate 3 (Division 1)
. 6.1 DG.105 " Diesel Generator Starting Air Compressor Operability" 7 L 6.1 DG.302 UV Logic Functional, Load Shedding, and Sequential Loading 3 Test (Division 1)
6.1DG.401 . DG Fuel Oil Transfer Pump IST Flow Test (Division 1) 4 L 6.1 DG.402 IST Closure Testing of DGSA Receiver inlet Check Valves 1
! (Division 1)
i
. . ._ . . . . . . . - . . . _ _ . . _ _ _ _ _ . - . _ . _ _ _ . _ . . _ _ _ . - _ _ .. __ . _ _
l
'
'
-
l
,
.,
[
Date/ -
LNumber Description- Revision 2 6.2DG.101 ' DG Monthly Operability Test (Division 2) 11C4 ;
6.2DG.102 . DG Demonstration of Operability Test (Division 2) 6C2 )
l 6.2DG.103 DG Cycle Operability Test (Division 2) SC1 )
,
!
6.2DG.104 - ' Diesel Operability Test with Isolation Switches in Isolate 801
'
(Division 2)
,
J
~ 6.2DG.105 ' DG Starting Air Compressor Operability (IST) (Division 2)
6.2DG.301 Fuel _ Oil Day Tank Level Switches Functional Test and Solenoid ' 2C2 Valvs IST Closure Test (Division 2) ;
l 6.2DG.402 IST Closure Testing of DGSA Receiver inlet Check Valves 1 l (Division 2) . ,
i 6.FP.203 Fire Damper Assembly Examination (Fire Protection System 18 '
'
2- ';
Month Examination)
6.FP.606 Fire Barrier / Fire Wall Visual Inspection 2 C2 !
)
6.HV.101 : Control Room Ventilation (31 Day IST) 2 .
l
_ 6.HV.103 Control Room Emergency Fan Filter Train Differential Pressure 2
. Test '
6.HV.104 Control Room Emergency Fan Charcoal and HEPA Filter Leak 3 Test, Fan Capacity Test, And Charcoal Sampling.
6.HV.105 Control Room Envelope Pressurization Test- ,
6.PRM.316 Control Room Air Sampling System Known Source Calibration 5 6.PRM.317 Control Room Air Sampling System Electronic Calibration 5 6.PRM.318 Control Room Air Sampling System Functional and Logic Test 3 7 2.55.2 HCU Scram Valve Operator Diaphragm Replacement 3
- 7 3.21.1 Fire Barrier Seal Installation - Grouting 5 4 7.3.21.4 Fire Seal Installations - Dow Corning Silicone Foam Seals 5
.7.3.17.1 "4160 Breaker Examination" 2 C.2 87-010 Measurement of Plant Electrical Loads, Attachment C, Section 0 Vill-8, Critical Pump Load Measurements o
J
$ {'
( 8 4 1 l ,
-
-
!
. - _ _ .
. , , _ _ . _ .
Problem identification Reports l l
Number Description Date
1-06503- During testing, diesel generator exhaust bypass pilot solenoid 1/15/96 )
operated valve failed to operate properly causing the diesel l generator bypass valve to fail open 1-15363 USAR Appendix G, Figures G-6-21,22, .23, and 24 indicate that 12/1/95 the Control Room HVAC (CREF) must be single failure proof 1-18238 Failure of Diesel Generator Jacket Water / Lube Oil Heat 12/13/95 Exchanger to Meet Acceptance Criteria for Performance Evaluation Procedure 13.18 1-24279 Located valve on top of the diesel generator west intercooler 4/18/97 that was not labeled and not on the service water component checklist
2-07309 Sizing calculations for ADS accumulators have non- I conservative assumption.
2-07324 Procedural Information Used to Derive DG Fuel Consumption 10/1/96 I Rates Not in Agreement With Approved Design Calculations )
2-07827 Concern regarding adequacy of existing T.S. fuel oilin storage tanks for diesels.
2-08308 Nuts on A.V. mounting Jrackets found installed but not tight.
2-09209 Each of the diesel generator #1 lube oil flex connections at the 2/16/98 I
'
main bearing caps had an additional pipe fitting and coupling installed ,
2-10538 One loose bracket nut found outlet scram valve on HCU 42-27, 2-12292 Conflict Between Diesel Generator Vendor Manual and CNS 4/29/97 Procedures Regarding Jacket Water Temperatures
'
2-14405 Noted % inch Of Water in DGDO Storage Tank "B" 4/15/97 2-15451 HVAC in the OSC is inadequate to keep the room cool under 4/20/97 mild temperatures 2-18349 Control Room Pressurization Enhancement Modification Did 1/28/98 i Not Evaluate The New Loading From the System Fans 2-20452 69 kV line voltage running high l 2-21162 USAR discrepancy: conCJrrent EDG overspeed trip and overspeed alarm setpoints i
i 2-21168 USAR discrepancy: Table Vill-5-1, post-accident loads
!
i
'
_ _ . . . ._ . _ _ . _ _ . _ . _ . . - _ _ _ _ _ . _ _ . . . _ . _ _ _ . . . _ _ . . - _ _ .- _ _ ._.
. >
e
r Number ~ Description - Date i
-
2-21180 USAR d' iscrepancy for load sequencer permissive for PMIS
'
UPS i
..
.. ;
2-22259 USAR Section X-10 (10.3.3.2) and Table X-10-2 are inaccurate 5/15/97 '
. 2-24077 _ (PIR Attachments 2,3) incorrect installation of DG overpower 04/30/98 I relay, resulting in inoperable overpower trip -
I 2-28063- Diesel generator manufacturer determined that there was 5/19/98 l'
'
inadequate. spring preloading in the oil pressure relief valve for ,
the engine driven lube oil pump
'
96-0041 Exhaust ports of diesel generator solenoid operated valves - 4/15/96 were susceptible to foreign material intrusion since and tubing were removed 96-0122 During testing, the diesel generator muffler bypass valve did not 2/9/98 fully open 96-0139 Operability assessment provided by engineering to address 2/5/96 concerns of Condition Report 1-06559 did not contain documentation to support engineering judgement
'
96-0240 Diesel generator was declared inoperable when the muffler 12/17/97 bypass valve was removed 96-0456 Committed housekeeping recommendations had not been 5/2/96 l incorporated into the procedure for the sample of the SLC tank !
'
and the EDG fuel oil storage tank 96-0601 An evaluation is required to determine the cause of the diesel 2/12/98
'
generator #2 muffler bypass valve failure 96-0635 Ar rendix R Compliance 96-0777 Installed non qualified relays prior to quality assurance 1/15/97 surveillance 96-0798 Service water air operated valve was leaking through 11/7/96 excessively. The leakage was 750 to 900 gpm 96-0960 Diesel generator #2 was declared inoperable due to a fuel leal: 12/16/96 causing a 7 day LC. Parts were unexpectably delayed for an additional 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> prior to reaching site 97-0560 Main steam safety relief valves failed as-found setpoint test 4/9/97 ;
requirements 97-1387 Six essential 4160 volt breakers were not overhauled in 1/27/98 accordance with the manufacturers recommended maintenance practices.
!
1
_ _ - . _ . ._ _ _ , - - - - - -
<
Number Description Date 97-1430 The 4160 volt breaker was thought to be overhauled but still 2/9/98 needs an operability assessment 97-1439 Pertinent plant conditions were not current with the limitations - 4/8/98 and the assumptions of PSA E5031 '
97-1466 During testing, the emergency diesel generator no.1 failed to .1/26/98 start in the slow start mode .
98-0057 4160 vac breakers were not being cycled consistently after. 3/25/98 .
'
being cycled out 98-0245 During testing, the diesel generator starting air compressor was 3/24/98 blowing mist out of the vent and the air pressure started to !
decrease Calculations l
-
Number Description Revision
NEDC 87-51 Emergency Diesel Generator Day Tank Capacity 2 NEDC 84-072 Flow / Hydraulic Calculations for DO/FO System Storage 0 Tank to DG Daily Service Tanks NEDC 86-105E AC Short Circuit Study 3 1 NEDC 86-105B Critical AC Coordination Study 6 NEDC 86-153 Contro: Room HVAC - Sizing of Intake Piping . O NEDC 86-155 Control Room HVAC - System Balancing 0 NEDC 86-161 Intake Duct Insulation Thickness 0
'
NEDC 87-047LX Load Summary for Motor Control Center LX 5 NEDC 87-052 Emergency Diesel Generator Storage Tank Fuel Capacities 1 NEDC 87-104A Plant AC Load Study 13 NEDC 87-132A Plant AC Voltage Study 7 NEDC 88-086B Setpoint Determination of Second Level Undervoltage Relays 7 NEDC 88-190 Essential Pump Minimum Flow Damage Susceptibility, NRC 0 ;
88-04 NEDC 88-233 Emergency Diesel Generator Fuel Requirements 2 NEDC 90-385 Grid Stability Study 0
Number Description Revision NEDC 91-043 Cable Impedance Calculation for 4160 Vac & 480 Vac Buses 3 and Essential Loads NEDC 91-045 Diesel Fuel Transfer Flow Rate With 8 5/8 Inch Purop 0 Impeller NEDC 91-157 Diesel Generator Transient Analysis 1 NEDC 91-182 Analysis of Small Bore IVP DO-1 Piping in The DG Building 0 NEDC 91-184 Motor Thermal Overload Heater Sizing 1 NEDC 91-185 MOV Thermal Overload Heater Sizing 2 NEDC 91-220 Diesel Generator Overpower Relay Setpoint Calculation 0 :
NEDC 91-239 Review of APA DG Jacket Water, Lube Oil, & Intercooler 0 )
Heat Exchanger Calculations NEDC 92-115 Calculations for DG Fuel Oil Filter Modifications 2 NEDC 93-043 Effect of Fire Dampers on Control Room HVAC System 0 NEDC 93-052 Control Room Heat Load 0 NEDC 93-054 Control Room Heatup During 24 Hour Period After Failure of 1 Control Room HVAC NEDC 94-071 Control Room Operator Dose Due to Inleakage to Controt 5 Room NEDC 94-110 Operability of DG1 with Additional Loads (inactive historical) 0 )
'
NEDC 94-134 Verification of Control Room Emergency Filter Systern 1 Capability NEDC 94-231 RHR Pumps NPSH/ Maximum Flow 3 l NEDC 97-012 Emergency Diesel Generator Fuel Oil On-Site Storage 0 Technical Specification Requirements 2.05,01 (Burns & Roe) Cable Sizing: Main Motor and Feeder Cables 0 2.05.02 (Burns & Roe) Cable Size Summary: 4160 Vac Motors and 0 :
Feeders 2.05.03 (Burns & Roe) Cable Size Summary: 480 Vac Motors & O Feeders 2.09.10 (Burns & Roe) Diesol Generator Protective Relays 0 2520-02 (Burns & Roe) HVAC Main Control Room 0
,
l.
. ~ _ . . _. _ . - -_ __ _ __ . . - . _ . . ._ _ _ __ _
Desian Chanaes Number - Description I
. Date 88-058. Replacement of Diesel Generator Lube Oil Filter Gasket 12/08/95-89-215 Control Room Damper AD-1021 A(B) Modification 07/07/97 90-224 Replacement of Impellers on DG Fuel Oil Transfer Pumps 08/03/94 91-083 Modification of The Diesel Generator Fuel Oil System 07/14/97 91-152 Kurman Relay and Motorola Power Supply Replacement in Diesel 09/18/97 Generators 1& 2 93-182 Diesel Generator Voltage Permissive Relay Replacement 10/26/97 -
93-257 Replace control room emergency booster fan with higher capacity 10/31/97 unit 93-257 Replacement of The Control Room Booster Fan BF-C-1 A With a 07/09/97 Higher Capacity Fan ,94-262 Control Room Pressurization Enhancements 10/24/96 95-036 Service Water Start Timer Setting Change 01/28/98 Desian Criteria Documents Number Description Revision 01 Emergency Diesel Generator .
4 l 04 AC Electrical Distribution System 2 10 Contro' 9oom Ventilation System 34 Electrical Separation: Section 4.1, Physical Requirements; O Section 4.5.1, Separation Requirements of Electrical Equipment and Cabling
,
Drawinas Number Description Revision
- APA M-1 Emergency Diesel Generator Flow Diagram with Piping Plan & N1 Details
,
E508 Sh 50 Auxiliary Relay Room Connection and Wiring Diagram (Control N05 Building H&V Emergency Supply Filter Booster Fan 1-BF-C-1 A)
l l 13
!
L
_
. a. ~- -, . - ~ - - - . - ~ . - - - - - . - - - - . . -
m L l
'
L.
j: - Number . Description Revision
'
.E508L Auxiliary " delay Room Connection and Wiring Diagram . (Contro! N01 E Sh 50A Building H&V Exhaust Booster Fan 1-BF-C-1B)
KSV-46-5 Diesel Generator Lube Oil Piping Schematic N2 KSV-48-5 Diesel Generator Starting Air Schematic, Sheet 1 N10 )
KSV-51-6 - Diesel Generator Fuel Oil Piping Schematic N7
'
2001 Sh 1 ' Flow Diagram Symbols & Abbreviations N16 ;
,
2001 Sh 2 Flow Diagram Symbols & Abbreviations N3 2007. Turbine Building Closed Loop Cooling Water System Flow Diagram N55
'2011 Sh 1 Diesel Oil Storag'e / Supply System Flow Diagram N26- !
-t
~ 2019 Sh'1 - Main Control Room, Cable Room, & Computer Room HVAC Flow N35
Diagram
,
N46 l'
'
2077 Diesel Generator Building Service Water, Starting Air, & Fuel Oil Flow Diagram ;
2100-1 Jelco In inch Air Intake Piping 5
- .
2100-2 Jelco in inch Air intake Piping 5 ,
l
'2100-3 Jelco Inc. 30 inch Diesel Exhaust Piping 1 1 2100-4 Jelco inc. 30 Inch Diesel Exhaust Piping 1 2217 HVAC - Control, Computer, & Cable Rooms, Plans - N8 1 2218 HVAC - Control, Computer, & Cable Rooms, Sections & D'etails N7 3001 Main One Line Diagram N10 i
3002 Sh 4 Auxiliary One Line Diagram: MCC Z, Switchgear Bus 1 A,1B,1E, & 'N30 Ciitical Switchgear Bus 1F,1G
- 3006 Sh 5 Auxiliary One Line Diagram: Starter Racks LZ and TZ, MCCs K, L, N62 LX,RA,RX,S,T,TX,X 3036 Control Elementary Diagram Sheet No. 5 (Control Building H&V N35 Emergency Supply Filter Booster Fan 1-BF-C-1 A)
u
-
!
i I
l
L j
Operability Determinations / Evaluations Number Description Revision OD 92-023 Diesel Generator Fuel Oil Flash Point Sample Below Minimum 6/16/92 Specified Requirement OD 94-119 Difficulty in adjustment of EDG electrical overspeed trips 09/17/94 OD 94-170 Part 21 for electrolytic capacitor for EGA governor 11/10/94 OD 95-010 Non Essential Drain Valve on Diesel Generator 1 Lube Oil Heat 1/28/95 Exchanger Missing Tag.
OD 95-022 Faulty flow controller in CREV radiation monitor samp e line 04/05/95 !
OE 94-000-017 Control Room Envelope Pressurization Test Failed to Meet 4/18/94 Acceptance Criteria OE 94-000-048 Jacket Water Leaking From Engine During Operation 8/17/94 l OE 94-088-058 Closed Loop Cooling Water System Piping Welds Have Crack 8/31/94 Indications OE 94-152-080 Misclassification of DG control relay as non-essential 10/13/94 OE 95-000-009 Service water pump start time should be 31 sec 01/20/95 OE 95-000-014 Jacket Water Leaking From Engine During Operation 2.7/95 Conditions Adverse to Quality
'
Number Description Date 92-070 Diesel Generator Fuel Oil Flash Point Sample Below Minimum 8/7/92 Specified Requirement 96-1098 Compliance to Technical Specification Minimum of 48,000 Gallons 5/8/97 Fuel Oil May Not Bc Adequate 98-1134 Technical Specification Minimum of 48,000 Gallons Fuel Oil 12/27/96 Availability is Not Consistent With Reg Guide 1.137 97-0337 Failure to Take Adequate Corrective Action to Prevent Recurrence 97-0946 . Coordination between EDG overcurrent and loss-of-field protection 97-1452 TS allows second level undervoltage relay settings to be less than analytical limit for degraded voltage i
e
Miscellaneous Documents Description Revision -
!
'
"50.59 Self Assessment" Report No. NLS-97-001, December 12,1997 NA Training Lesson Plan ADM003-01-01,"10 CFR 50.59' 4 Training Lesson Plan ADM004-01-01, " Codes, Standards and Classification" 3
' Training Lesson Plan ADM009-01-01,," Licensing Basis Orientation" 2.
Training Lesson Plan ADM009-01-02," Chapter XIV Accidents & Appendix G" 2.02 Training Lesson Plan ADM009-01-03," Transient & Overpressure Protection" 4 Quality Ass'urance Audit Report 98-04,"Special Programs," dated April 1,1998 NA
!
l
'
!
.
I I
I l
. l I
i
',.
l i
,
t i
..
l
,
b