IR 05000334/1997002

Insp Repts 50-334/97-02 & 50-412/97-02 on 970316-0426. Violations Noted.Major Areas Inspected:Operations, Engineering,Maintenance & Plant Support

ML20148D796
Person / Time
Site:	Beaver Valley
Issue date:	05/23/1997
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:
Shared Package
ML20148D777	List: IR 05000334/1997002 ML20148D772
References
50-334-97-02, 50-334-97-2, 50-412-97-02, 50-412-97-2, NUDOCS 9706020108
Download: ML20148D796 (44)

Text

.

U. S. NUCLEAR REGULATORY COMMISSION

REGION I

License No DPR-66, NPF-73 Report No /97-02, 50-412/97-02 Docket No , 50-412

.

Licensee: Duquesne Light Company (DLC)

Post Office Box 4 Shippingport, PA 15077 Facility: Beaver Valley Power Station, Units 1 and 2 Inspection Period: March 16,1997 through April 26,1997

Inspectors: D. Kern, Senior Resident inspector :

F. Lyon, Resident inspector G. Dentel, Resident inspector '

R. Bhatia, Reactor Engineer, DRS J. Furia, Senior Radiation Specialist, DRS Approved by: P. Eselgroth, Chief Projects Branch 7 9706020100 970523 PDR ADOCK 05000334 G PDR ,_

j

.

EXECUTIVE SUMMARY Beaver Valley Power Station, Units 1 & 2 NRC Inspection Report 50-334/97-02 & 50-412/97-02 This integrated inspection included aspects of licensee operations, engineering, I maintenance, and plant support. The report covers a 6-week period of resident inspectio ;

in addition, it includes the results of an announced inspection by a regional inspector in the radiation protection area and supplemental inspection by a regional inspector in the electrical engineering area following the dual unit trip on March 1 Operations

• Operators responded appropriately to the dual unit trip on March 19 and maintained i good control of both plants. The trip occurred just before morning shift turnove '

Operators stabilized both units before conducting shift change, and the turnovers at both units were thorough. (Section 01.2)

]

• The Event Review Team (ERT) investigations of the cause of the dual unit trip and subsequent equipment problems were thorough and the Nuclear Safety Review Board review was comprehensive. The root cause analysis determined the cause of the dual unit trip conclusively and corrective actions were appropriately implemented to safely return the units to service. Confusion regarding the roles and interface between the ERT and the Nuclear Safety Review Board was a weakness which prolonged the event review process. (Section 01.2)

e The implementation of specific and standard reactivity plans have provided operators with effective tools to control reactivity evolutions. The inspectors independently verified that reactivity plan calculations were technically soun Operators effectively implemented the reactivity plans.. The reactivity plans were adequately controlled and efforts were in progress to further strengthen the administrative controls. (Section 08.5)

Maintenance e When considered individually, six missed technical specification surveillance requirements had minimal safety consequences; however, the number of missed surveillances identified over a relatively short period of time identified weaknesses in the surveillance test program. Each missed surveillance represented a longstanding condition. In some instances, inspectors assessed that the root cause analyses were weak or narrowly focused, inspectors noted that the events were licensee-identified, indicating good problem identification, that DLC's short term corrective actions addressed the immediate issues, and that DLC management has committed to evaluate the overall TS surveillance program to address generic aspects of these issues. Nevertheless, these failures to comply with TS surveillance requirements are multiple violations of Technical Specification (TS) 6.8.1.c, which requires that written procedures shall be established, implemented, and maintained covering surveillance and test activities of safety related equipment. (Section M8.2)

i

.

(EXECUTIVE SUMMARY CONTINUED)

Enaineerina e A misplaced wire on the Unit 1 emergency diesel generator (EDG) was a long- I standing design implementation error which made the EDG inoperable for short times during surveillance testing. System engineering and design engineering staff appropriately assessed and corrected the deficiency. The overall impact on the EDG 1 was minimal since the EDG was already declared inoperable for other reasons during l periods that the misplaced wire affected the governor, causing the EDG to be l inoperable. In addition, operator action could have been taken locally to start l the EDG in the event that the EDG was needed. (Section E1.1)

• The DLC Event Review Team satisfactorily identified the cause of the dual unit trip and operation of the switchyard breakers as a field wiring error in a 345kV bus backup timer associated with Unit 2 output breaker PCB-352. DLC electrical engineering, substations, and relay staffs conducted a thorough root cause analysis supported by both bench and field testing. The wiring error had existed since original construction. Corrective actions proposed by the staff, reviewed by the NSRB, and approved by DLC senior management were comprehensive to correct the immediate cause of the trip, to address generic concerns, and to prevent recurrence. (Section E1.2)

• Based on the inspectors' review and DLC's satisfactory test results, the inspectors concluded that DLC engineering staff had adequately confirmed the operability of the Unit 1 EDGs per station design following the dual unit trip on March 1 Inspectors assessed that system engineering staff's evaluation and testing were comprehensive and provided a sound basis to support the EDG operability conclusions. (Section E1.3)

• Operators observed reduced auxiliary feedwater (AFW) flow to the "B" steam generator following the March 19 reactor trip. The AFW injection line was obstructed by a failure of the check valve seat ring. The investigation and root cause analysis were well developed and effective in determining that a temperature transient across the valve resulted in the failure. The licensee concluded that the

.

vendor failed to provide a valve that met design specifications stated in the purchase order. Duquesne Light Company made a Part 21 notification on April 24 which clearly documented the failure mechanism. (Section E1.4)

• Engineers demonstrated a good questioning attitude which revealed three instances where the plant was not configured as described in the UFSAR. In two cases (Unit 1 steam dump closure time, Units 1 & 2 heat trace circuits) the plant had been modified in the past without performing required safety evaluations or updates to the UFSAR. A UFSAR verification project was initiated in January 1997 to identify and resolve such discrepancies which resulted from previous plant design control weaknesses. The licensee properly evaluated the restart issues in a timely and technically sound manner. The main steam isolation bypass valve closure time issue remains unresolved pending completion of an ongoing engineering evaluation and subsequent NRC review. (Section E2.1)

ii ._ ._ _ ._ _ . _ _ . _ - . . _ _ _ -

__

.

(EXECUTIVE SUMMARY CONTINUED)

Plant Sucoort e The radiation protection program was evaluated in a general overview by a specialist inspector. Effective programs were found in the areas of work control, ALARA, and high and locked high radiation area control. An area of concern was identified in the TLD Laboratory, which failed one of the NVLAP test categories in 1996. (Section R1)

e The dual unit trip on March 19 was a significant strain on Health Physics Department manpower due to the entries and work required in both containment The Health Physics staff responded to the challenge in a professional manner and maintained a good focus on personnel safety. (Section R1)

e Failure to maintain redundancy in the electricallineup to the emergency response facility (ERF) building caused the loss of power to the ERF on February 14. The failure was due to lack of procedures and lack of clear ownership of the ERF building. This was a weakness in DLC operations. Spurious actuation of a programmable logic controller (PLC) was the most likely initiator of the even Failure to resolve the PLC problems despite numerous previous occurrences and failure to complete corrective actions for previous occurrences was a weakness in DLC engineering support. (Section P8.1)

Safety Assessment and Quality Verification i

e inspectors concluded that the Event Response Team (ERT) investigations of the dual l unit trip on March 19 were thorough and that Nuclear Safety Review Board (NSRB)

'

review was comprehensive. However, inspectors noted that there was confusion among ERT and NSRB members about management expectations regarding their-responsibilities and product. Inspectors concluded that there were no safety consequences during this event from the lack of clear understanding of the roles and interaction of the ERT and NSRB; however, it was considered a weakness in the event review process wisch could prolong a forced outage duration. (Section 01.2)

iii

.. - . - . - - . -. - - - . _ ---

,

I

-

J TABLE OF CONTENTS l

Page EX EC UTIV E S U M M ARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i

!

!

TAB LE O F C O N TE NTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv l

1

,

l. Operations .................................................... 1 1

01 Conduct of Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 01.1 General Comments (71707) . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

01.2 Dual unit Trip on March 19 ........................... 1 I l 02 Operational Status of Facilities and Equipment . . . . . . . . . . . . . . . . . . . 4  !

i O2.1 Engineered Safety Feature System Walkdowns (71707) . . . . . . . 4 04 Operator Knowledge and Performance . . . . . . . . . . . . . . . . . . . . . . . . . 4

, 04.1 Supplementary Leak Collection and Release System l Inoperability (71707) ............................... 4 .

4 05 Operator Training and Qualifications .......................... 4 !

05.1 Self Checking Training (71707) ........................ 4 I 08 Miscellaneous Operations issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4  ;

08.1 (Closed) Licensee Event Report (LER) 50-412/96008 ......... 4 l 08.2 (Closed) URI 5 0-412 /9 5 0 8 0-0 3 . . . . . . . . . . . . . . . . . . . . . . . . . 5 08.3 (Closed) LER 5 0-3 3 4/9 601 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

08.4 (Closed) LER 5 0-41 2 /9 6 001 . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 -

08.5 Reactivity Plan .................................... 6 08.6 (Closed) LER 50-334/97005-00 ........................ 7 1 11. M a i n t e n a n c e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 i M1 Conduct of Maintenance .................................. 7

]

M 1.1 Routine Maintenance Observations (62707) . . . . . . . . . . . . . . . . 7 M1.2 Routine Surveillance Observations (61726) ................ 8

M8 Miscellaneous Maintenance issues ........................... 8 M8.1 (Closed) Licensee Event Report (LER) 50-412/96005 ......... 8 M8.2 (Closed) Unresolved item 50-334(412)/97001-02

, Deficiencies in the Surveillance . . . . . . . . . . . . . . . . . . . . . . . . . 9  ;

< (Open) eel 50-334(412)/97002-04,05,06,07,08,09 .......... 9

'

M8.3 (Closed) Unit 1 Licensee Event Report (LER) 97002-0 Emergency Diesel ................................. 15 M8.4 (Closed) Unit 1 LER 97003-00 . . . . . . . . . . . . . . . . . . . . . . . . 15 M8.5 (Closed) Unit 1 LER 97004-00 . . . . . . . . . . . . . . . . . . . . . . . . 15 M8.6 (Closed) Unit 1 LER 97006-00 ........................ 15 M8.7 (Closed) Unit 1 LER 97007-00 ........................ 15

,

M8.8 (Closed) Unit 1 LER 97008-00 ........................ 15 i Ill . E n g ine e ring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 4 E1 Conduct of Engineering .................................. 16

E Unit 1 Emergency Diesel Generator Starting Circuit Wiring .... 16 E1.2 Root Cause Analysis of Dual Unit Trip on March 19 . . . . . . . . . 17 4 E1.3 Emergency Diesel Generator (EDG) 1-2 Operability Assessment . 20

!

E1.4 Auxiliary Feedwater Check Valve Failure . . . . . . . . . . . . . . . . . 22

, iv i

!

_

. _ ._ . _ _ . _ . . . _ _ . __ _ _ _ _ _ _ _ _ _ . _ _ _ _ __ _ _ _ _ _ . _

i I

E2 Engineering Support of Facilities and Equipment . . . . . . . . . . . . . . . . . 24 E Engineering Resolution of Unit 1 Restart issues ............ 24 {

]

,

I V. Pl a nt S u p p o rt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 j R1 Radiological Protection and Chemistry Controls ................. 27 ;

. R7 Quality Assurance in RP&C Activities ........................ 30 !

R8 Miscellaneous Radiological & Chemistry Issues . . . . . . . . . . . . . . . . . . 31 i R8.1 (Closed) Violation 50-334(412)/96004-01 . . . . . . . . . . . . . . . . 31 R8.2 Updated Final Safety Analysis Report ................... 31 )

P8 Miscellaneous EP Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 i P8.1 (Closed) Unresolved item (URI) 50-334(412)/97001-04 ...... 32 l J

'

L1 Review of FSAR Commitments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 S8 Miscellaneous Security and Safeguards issues . . . . . . . . . . . . . . . . . . 33 i S8.1 (Closed) Licensee Event Report 50-334(412)/96S03-01 ...... 33

, V. M a n a ge m e nt Me eting s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 l

,

X1 Exit Meeting Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 i i X3 Management Meeting Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 l

ATTACHMENT .................................................. 35 l

,

,

l l

I

'

~

\

i I

i Y

J

.

.

J

,

!

i

<

.

4

.

.i

<

v I

.

. -_. - .

_ __ _ ____

, ,

I l

.

ReDort Details Summary of Plant Status Unit 1 began this inspection period at full power. On March 19,1997, a reactor trip !

occurred due to inadvertent operation of a bus backup timer relay in the 34P ' distribution system (discussed below). Mode 5 (cold shutdown) was entered on Mard z to repair a secondary side leak on a "C" steam generator handhole flange. Leaks '%o also found and repaired on an "A" steam generator handhole flange and on the body .o-bonnet flange of MOV-RC-591, the 1 A reactor coolant cold leg loop stop valve. Following completion of forced outage work, Unit 1 was returned to full power operation on April 16, i

Unit 2 began this inspection period at full power. On March 19, a reactor trip occurred due to inadvertent operation of a bus backup timer relay in the 345kV distribution system (discussed below). Mode 5 was entered on March 20 to evaluate and correct the cause for reduced auxiliary feedwater flow to the "B" steam generator observed following the j reactor trip. Following completion of forced outage work, Unit 2 was returned to power j operation on March 30. On April 13, power was reduced to 39% to evaluate a steam leak !

on the end bell of moisture separator drain receiver tank 2HDH-TK22A. The receiver tank was repaired and Unit 2 was returned to full power on April 1 . ODerationS 01 Conduct of Operulons 01.1 General Comments (71707)'

Using Inspection Procedure 71707, the inspectors conducted frequent reviews of ongoing plant operations, in general, the conduct of operations was professional and safety-conscious; specific events and noteworthy observations are detailed in the sections belo .2 Dual Unit Trio on March 19 Inspection Scope (71707,93702)

Inspectors monitored operator response to simultaneous unit trips on March 19, the DLC root cause analysis, implementation of corrective actions, and subsequent recovery of Units 1 and 2. Additional documentation of specific equipment issues discovered following the trip on both units is located in the Maintenance and Engineering sections of the repor ' Topical headings such a 01, M8, etc., are used in accordance with the NRC standardized reactor inspection report outline. Individual reports are not expected to address all outline topic .

,

b. Observations and Findinas-f On March 19 at 6:06 a.m., Units 1 and 2 experienced simultaneous reactor trips from 100% power. A phase to-ground fault occurred on the Ohio Edison transmission system's Mansfield Hoytdale 345kV line (located about 10 miles from the site) just prior to the unit trips. The fault lasted for 13.5 cycles and was sensed by the Beaver Valley switchyard electrical protection circuitry. Bus backup timer relay 62-J143 (Model SRU) on 345kV bus #3 inadvertently actuated in response to the fault and opened eight 345kV breakers in the switchyard, including the Unit 1 and 2 main generator output breakers, which initiated the unit trips, investigation of the root cause of the trips is discussed further in Section E1.2 of the report.

, inspectors responded to the control room and monitored operator actions during plant stabilization. Unit 1 was stabilized in Mode 3 (hot standby). Plant equipment

, operated as designed during the trip. All control rods inserted completely. The auxiliary feedwater system started on low steam generator water level as expected, and there was no safety injection. It was noted, however, that Unit 1 emergency diesel generator EE-EG-1 (EDG 1-1) started and EE-EG-2 (EDG 1-2) did not start during the event. EDG 1-1 started due to a momentary undervoltage on 4kV

'

emergency bus AE during the electrical transient, but was not required to load since the bus AE undervoltage condition cleared. EDG 1-2 did not start and was declared inoperable until subsequent testing demonstrated that the undervoltage condition on a 4kV emergency bus DF was of insufficient duration to start the EDG After evaluating the test results, DLC engineering staff concluded that both EDGs functioned as designed. Inspectors reviewed the issue and concurred. Evaluation of the operability of the EDGs is discussed further in Section E1.3. Opotors reacted appropriately to the unit trip and maintained good control of the plan {

inspectors noted that the plant was stabilized before morning shift turnover was I conducted, and that supervisors maintained clear control of the plant during the I turnover. Post-event containment inspution discovered a small secondary side leak l on a handhole flange on the "C" steam generator, and Unit 1 was subsequently l cooled down to Mode 5 (cold shutdown) on March 22 to conduct repairs. Leaks l were also found and repaired on an "A" steam generator handhole flange and on the body-to-bonnet flange of MOV-RC-591, the 1 A reactor coolant cold leg loop stop l valv :

Unit 2 was stabilized in Mode 3. Plant equipment operated as designed during the transient with the exception of auxiliary feedwater (AFW) flow to the "B" steam generator. Operators noted that flow in the "B" AFW injection header was lower than expected (about 150 gpm versus an expected flow of about 270 gpm). In addition, three condensate relief valves lifted and failed to reseat during the transient, but, there were no adverse consequences. Subsequent investigation indicated that the low AFW flow was caused by a failure of the "B" injection header l check valve (2FWE-100) during the event. The investigation and corrective actions for the failed AFW check valve are discussed further in Section E1.4. The "B" AFW header was declared inoperable and operators commenced a cooldown of Unit 2 to

~

Mode 4 (hot shutdown) in accordance with technical specification requirements at 12:10 p.m. Unit 2 was subsequently taken to Mode 5 on March 20 to conduct evaluation and repair of the AFW check valves. Operators responded appropriately

. . . _ . _ _ _ . _ _ _ _ _ . _. - _ _ . _ . , _ _ _m..__

_

__ _. _. __ . _ _

a*

)

l to the unit trip and maintained good control of the plant. Inspectors noted that the

plant was stabilized before morning shift turnover was conducted, and that shift l turnover was conducted smoothly and without unnecessary disruption. DLC j notified the NRC of the event in accordance with 10 CFR 50.72. The events were documented on Condition Reports 970539 and 970540, s

! The Vice President-Nuclear Operations assigned an Event Review Team (ERT) for j' each unit to determine the cause of the trip and subsequent equipment problems and to recommend corrective actions to prevent recurrence. The root cause

analysis and corrective actions of the ERTs were reviewed by the Nuclear Safety

Review Board (NSRB) and approved by the Plant Manager before the units were

restarted. ERT findings are discussed further in Section E1.2 of the repoit, i Inspectors concluded that the ERT investigations were thorough and that NSRB

'

review was comprehensive. The root cause analysis conclusively determined the cause of the dual unit trip and corrective actions were appropriate to safety return the units to servic Inspectors noted that there was confusion among ERT and NSRB members about management expectations regarding issues such as (1) what product the ERT would produce from its investigation, (2) who the ERT was working for, (3) what authority would enforce the corrective action recommendations, (4) how commitments would be tracked, (5) the authority of the NSRB to hold restart, (6) how restart commitments would be enforced, and (7) the role of the NSRB in approving ERT recommendations and conclusions, inspectors reviewed Nuclear Power Division l Administrative Procedure (NPDAP) 8.13, "NSRB." It states that the NSRB is l responsible to review ERT reports and recommend to the Plant Manager written j approval or disapproval; no additional guidance is provided. Some general guidance regarding ERTs is provided in NPDAP 5.6, " Processing of Condition Reports," and NPDAP 5.8, " Root Cause Analysis," but specific guidance is not provide )

Inspectors concluded that there were no safety consequences during this event  !

from the lack of clear understanding of the roles and interaction of the ERT and )

NSRB; however, it was considered a weakness in the event review process which could prolong a forced outage duration. Licensee management acknowledge the inspectors' findings for revie Conclusions -

Operators responded appropriately to the dual unit trip on March 19 and maintained good control of both plants. Both units were stabilized before the morning shift turnovers, and the turnovers at both units were conducted without disruption to the safe operation of the plant The ERT investigations of the cause of the dual unit trip and subsequent equipment problems were thorough and that NSRB review was comprehensive. The root cause analysis determined the cause of the dual unit trip conclusively and corrective actions were appropriate to safely return the units to service. Confusion regarding the roles and interface between the ERT and the NSRB was a weakness which unnecessarily prolonged the event review proces l

!

_ _ _ _ __ _.,

'

i

.

02 Operational Status of Facilities and Equipment O 2.1 Enaineered Safety Feature System Walkdowns (71707)

The inspectors walked down accessible portions of selected systems to assess equipment operability, material condition, and housekeeping. Minor discrepancies were brought to DLC staff's attention and corrected. No substantiva concerns were id> t tified. The following systems were walked down:

Unit 2 Quench Spray System

-

Unit 2 Service Water System 04 Operator Knowledge and Performance O n.1 Supolementary Leak Collection and Release System inocerability (71707)

Supplementary Leak Collection and Release System train "B" was inoperable from March 17 at 0857 to March 23 at 2240 due to exhaust fan and vortex damper repairs. On March 23, operators made the emergency diesel generator (EDG 2-1)

inoperable during bar-over of the EDG in preparation for the monthly surveillance run. The nuclear shift supervisor was unaware that during the 17 minutes that the EDG was inoperable, TS 3.0.5 was inadvertently entered since the "A" SLCRS train did not have an ops:3ble emergency power supply. The on-coming nuclear shift supervisor correctly identified the condition and EDG testing was postpone Condition Report 970799 was written to evaluate the issue and to implement corrective actions. The inspectors observed that insufficient operator knowledge resulted in entering TS 3.0.5. The inspectors noted good questioning attitude by the on-coming operators and licensing engineer i l

05 Operator Training and Qualifications  !

05.1 Self Checkina Trainina (71707)

The inspectors reviewed the operator se;f-checking training program implemented as !

a corrective action to a recent NRC viciation on configuration control. The self-checking device was effee, .'e m reinforcing self-checking principles, proper communications, and procedural compliance. Previous use of this se4-checking training by Instrumentation and Control (l&C) technicians resulted ir,2 drop in LERs caused by l&C technicians (seven LERs in 2 years to none in the following 3 years).

Operators interviewed indicated that the training was beneficial in identifying potential pitfall Miscellaneous Operations issues (71707, 92700) i l

08.1 (Closed) Licensee Eventfeoort (LER) 50-412/96008: Manual Reactor Tri l This LER documented the performance of a manual reactor trip on December 3, 1996. This trip was initiated in order to establish plant conditions to perform testing to resolve reactor head vent system leakage issues. The unit had been in an

i i

.

abnormal control rod configuration due to low power physics testing. The inspectors determined that the decision to manually trip the reactor rather than to delay the shutdown several hours to restore a normal control rod configuration was conservative and appropriate. The reactor trip system functioned as designed. The LER accurately documented the event and properly addressed the reporting criteria specified in 10 CFR 50.7 .2 (Closed) URI 50-412/95080-03: Flow through the "B" Service Water System header to the recirculation spray coolers was less than the flow required by technical specification On July 14,1995, DLC dicovered that 2SWS-82, the recirculation spray cooler discharge header cross-connect valve, was shut and out of its normal locked open alignment. The circumstances surrounding the event were the subject of NRC Special inspection Report 50-334(412)/95-80. Analysis of the service water system (SWS) with the valve shut indicated that all SWS subsystem flows were above the minimum required by technical specifications (TSs) except the "B" train i to the recirculation spray coolers. Analyzed flow was 10,890 gpm; required flow in accordance with TS 3.6.2.2 was 11,000 gpm. Taking into account the conservatisms incorporated in the computer model used to analyze the flow, however, DLC concluded that the SWS would have met its design basis. DLC engineering staff did additional analysis of SWS flow through the coolers following the mispositioning of 2SWS-MOV-105D, the service water discharge isolation valve for the "D" recirculation spray cooler, on October 3,1995. The issue was documented in NRC Inspection Report 50-334(412)/95-16. In that incident, total flow through the "B" SWS train was calculated to be 9783 gpm; however, DLC analysis concluded that the system would have performed its safety functio inspectors independently reviewed the analysis and determined that the conclusion was soun Notwithstanding the conclusion that reduced flow through the recirculation spray coolers while 2SWS-82 was in the shut position would not have prevented the system from performing its safety function, the failure to satisfy TS 3.6.2.2 flow requirements was a violation. SWS performance remained within analyzed limits, and DLC corrective actions to address the root causes of recurring configuration control issues are in progress (see NRC IR No. 50-334(412)/96-10 and the associated Notice of Violation dated March 24,1997). Therefore, this licensee-identified and corrected TS violation is being treated as a Non-Cited Violation, consistent with Section Vll of the NRC Enforcement Policy (NCV 50-412/97002-01).

08.3 (Closed) LER 50-334/96011: Failure to Provide Administrative Control of Containment isolation Valves as Required by Technical Specifications (TSs).

This event was discussed in NRC IR No. 50-334(412)96-07 and resulted in a Non-Cited Violation. No new issues were revealed by the LER. All corrective actions have been complete .

08.4 (Closed) LER 50-412/96001: Condition Prohibited by Technical Specifications -

Missed Rod Position Surveillanc On February 11,1996, an electrical distribution system disturbance occurred on the 138kV distribution line, which resulted in numerous false computer and annunciator alarms in the Unit 2 control room. The alarms cleared and returned to a normal state; however, the Computer Rod Bank Pulse Step Counter Positions did not reset and indi:9ted O steps (falsely reading a reactor trip). The plant computer is designed such that when the computer reads a reactor trip, the Rod Position Deviation Alarm is bypassed. Therefore the Rod Position Deviation Alarm was bypassed due to the false reading of a reactor trip. The unit remained at 100%

power throughout this time period. Control room benchboard indications of rod position remained operable. With the Rod Position Deviation Alarm inoperable, TS 4.1.3.1.2 requires manual logging of rod position once per 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. Operators manually logged rod position once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> during their daily logs. Licensed operators discovered the inoperable Rod Position Deviation Alarm 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after it failed; therefore, the licensee did not comply with the TS requirement. This failure constitutes a violation of minor significance and is being treated as a Non-Cited Violation, consistent with Section IV of the NRC Enforcement Policy (NCV 50-412/97002-02). The inspectors verified that the corrective actions described in the LER were complete and that the reporting criteria required by 10 CFR 50.73 were !

properly addresse ;

08.5 Reactivity Plan

, Inspection Scope (71707)

l The inspectors reviewed the effectiveness of reactivity management programs for ,

Unit 1 and Unit 2. The inspectors examined specific and routine reactivity plans, I the supporting calculations and original documents, and control of the plans. The I inspectors interviewed operators, nuclear shift supervisors (NSS), and reactor engineers, Observations and Findinos in January 1997, Beaver Valley Unit 1 and Unit 2 implemented a reactivity plan to assist operators during routine power adjustments of less than 5% power or any unplanned power changes. The plan was generated by reactor engineers using the refueling cycle nuclear design and core management nuclear steam system supplier report and unit specific boron and dilution tables. The plan was independently reviewed by another reactor engineer and a nuclear shift supervisor. The inspector independently verified calculations and the unit specific informatio in addition to the routine reactivity plan, the operators use plant curve books to determine reactivity adjustments. The operators interviewed found the reactivity plan a useful tool to independently verify their own determination from the curve Unit 2 operators successfully used the reactivity plan when recovering from a recent unplanned boration (described in NRC Inspection Report No. 50-334(412)/97-01).

i

!

I

- .

. ,

The inspectors determined that the simplified reactivity plan provided clear guidance to perform reactivity change For preplanned changes, reacte engineering staff develops a more detailed specific reactivity plan. During recent power changes, the inspectors observed successful implementation of the specific reactivity plan. Operator standards for reactivity control were properly implemente The inspector reviewed the controls placed on the routine reactivity plan. Proper review of the plan was conducted prior to its implementation. The inspectors noted controls to ensure that the plan was updated at the proper time were not formalized, but rather relied on reactor engineers to perform updates. The inspectors observed that the reactivity plans were updated in a timely manner. The reactivity supervisor informed the inspectors that a procedure will be developed to formally control the reactivity plan Conclusions The implementation of specific and standard reactivity plans have provided operators with effective tools to control reactivity evolutions. The inspectors independently verified that reactivity plan calculations were technically soun Operators effectively implemented the reactivity plans. The reactivity plans were adequately controlled and efforts were in progress to further strengthen the administrative control .6 (Closed) LER 50-334/97005-00: Inadvertent Operation of 345kV Bus Backup Timer Relay Results in Dual Unit Reactor Trip The event is documented in the Operations and Engineering sections of this repor The LER provided an accurate description of the event, analysis, and corrective actions implemented and planned. The LER is close II. Maintenance M1 Conduct of Maintenance l

M 1.1 Routine Maintenance Observations (62707)

The inspectors observed selected maintenance activities on important systems and I components. Some of the activities observed and reviewed are listed belo l

• MWR 055323 LHSI Suction Valve Operator Computer Point

• MWR 062176 Remove Piping to inspect Flow Elements (FWE Piping) l l

• MWR 658994 Replace SOV-VS-110 l

l

. _ . . . _ . _ _ _ . . _ . - - . _ _ _ . . _ _ _ _ _ _ _ . _ . _ - _ _ . . _ . _ _ _ _ . _

.

!

p.

L: i 1-

,

• 1 CMP-6RC-LOOP STOP-1M Repair of 1MOV RC-591

! i

'

• MWR 62187 Repair Leaking Handhole Cover on "C" Steam l

. Generator  !

!  :

l * 1 CMP-6RC-E-1 A-B-C-2M Steam Generator Handhole and Inspection Cover

'

Removal and Reinstallation

! t f * EM 114175 RC-E-1C, Steam Generator 1C Secondary

! Manwa ,

.t ,

.

j The activities observed and reviewed were performed safely and in accordence with proper procedures. Inspectors noted that an appropriate level of supervisory attention was given to the work depending on its priority and difficulty.

I M1.2 Routine Surveillance Observations (61726)  !

! J

>

v l The inspectors observed selected surveillance tests. Some of the operational l

surveillance tests (OSTs) reviewed and observed by the inspectors are listed belo )

i

. 1

• 2OST 1.1 " Safeguards Protection System Train A SIS Go Test," Rev.10 l

].

j * 20M-30. " Service Water System Running Cold and Warm Weather Conditions," Rev. 2

?- * 2OM-30. "Sparn Service Water Pump Startup," Rev. 3

• 10ST-0 " Control Rod Assembly Partial Movement," Re + 1/20ST-44A.11 " Chlorine Actuation of Control Room isolation /CREBAPS System," Rev.12 The surveillance testing was performed safely and in accordance with proper procedures. Inspectors observed that during performance of 2OST 1.11B difficulties with cumbersome procedures and the need for use of other procedures resulted in additional Service Water System outage time. The inspectors noted that operators appropriately questioned supervisors and that procedures were followe Procedural enhancements were submitted by the nuclear shift supervisor, i Additional observations regarding surveillance testing are discussed in the following sections. The inspectors noted that an appropriate level of supervisory attention -

was given to the testing, depending on its sensitivit M8 Miscellaneous Maintenance issues (92700)

M8.1 (Closed) Licensee Event Reoort (LER) 50-412/96005: Failure of Motor Control Center Auxiliary Control Relays Due to Thermal Agin In October 1996 the licensee determined that control circuits for approximately 250 motor operated valves and fans were susceptible to failure due to accelerated aging

.. ._

l

.

!

of various J-series relays. This event and follow-up licensee actions were l previously documented in NRC Inspection Report No. 50-334(412)/96-08. The i inspectors verified that corrective action de:::; Led in the LER were complete. The LER accurately described the event in appropriate detail and properly addressed the reporting criteria required by 10 CFR 50.7 M8.2 (Closed) Unresolved item 50-334(412)/97001-02: Deficiencies in the Surveillance Testing Program. (Open) eel 50-334(412)/97002-04,05,06,07,08,09 Inspection Scope (92902,61726)

Inspectors continued review of DLC root cause analysis and corrective actions

'

surrounding three events that occurred last inspection period involving deficiencies in surveillance testing. The events involved the hydrogen recombiners on both units, reactor coolant system pressure isolation valves on both units, and the load meters on the Unit 1 emergency diesel generators (EDGs). Collectively, the issues indicated potential weaknesses in the scheduling and procedures that implement the surveillance testing program. The issues and short term corrective actions were documented in NRC Inspection Report 50-334(412)/97-01. The deficiencies were unresolved pending DLC's determination of corrective actions and NRC revie Observations and Findinas EDG Load Testing Following a review of industry operating experience, DLC concluded that there was inadequate assurance that the Unit 1 EDGs were tested to the minimum required technical specification (TS) load due to inaccuracies in the kilowatt meter instrument loop. As long-term corrective actions, Engineering Memoranda 113998 and

113996 were initiated for Nuclear Engineering Department to evaluate the need for more accurate control room meters for the EDGs. In addition, DLC will review a representative sample of surveillance test procedures where the acceptance criteria may be impacted by instrument loop inaccuracies to identify if revisions are required, inspectors reviewed the corrective actions with system engineering staff and assessed that the corrective actions satisfactorily addressed the issue with ;

instrument loop inaccurac l

!

DLC syste-m engineering staff concluded that the root cause of the load requirement deficiency in the EDG test procedure was lack of consideration of all aspects of the kilowatt moter instrument loop inaccuracies when the load requirements were i developed for the procedure; however, they did not determine why their process did not consider the loop inaccuracies when the procedure was developed. Inspectors !

assessed that the root cause analysis was weak in that aspec This failure to comply with TS Surveillance requirements is an apparent violation of TS 6.8.1.C (eel 50-334(412)/97-002-4).

.

s

. . . _ .. -- __- -. - _- . . - _ . .. . ---

l l

'

. 1

i

Pressure isolation Valve Testing During a Quality Services Unit (QSU) audit, auditors discovered that some reactor coolant system pressure isolation valves were leak tested prior to the plant entering cold shutdown rather than after the plant had been placed in cold shutdown, as

-

required by the TSs. Inspectors assessed that the causes of the event were weaknesses in the scheduling process and test procedures. Operations staff I changed applicable station startup procedures and surveillance test procedures to j clarify the required testing sequence, inspectors reviewed the procedure changes j and testing done on each unit prior to the startup from the March 19 dual unit trip, and assessed they satisfactorily addressed the issue. The affected valves were satisfactorily tested in the correct sequence during recovery from the dual unit forced outage.

This failure to comply with TS Surveillance requirements is an apparent violation of

.

TS 6.8.1.C (eel 50-334(412)/97-002-5).

~I Hydrogen Recombiner Testing

During a OSU audit, DLC auditors discovered that electrical continuity and

,

resistance-to-ground tests of the heater circuits on the hydrogen recombiners had

) been done before the functional testing, rather than after, as required by the TS )

! Outage and Operations staff concluded that the root causes of the issue were (1) i i personnel error in failing to recognize the proper sequence for performing the I surveillance, (2) procedural deficiencies in the precautions and limitations of the test

{

procedures, and (3) changing the scheduling of the electrical checks from an outage '

to non-outage timeframe without reviewing the applicable TS l Inspectors reviewed the testing and discussed the issue with the Outage Manager, General Manager-Nuclear Operations, system engineering staff, electrical maintenance staff, and planners and assessed that the primary contributing cause J was procedural deficiencies. The sequencing requirement of the operations surveillance test (OST) that performed the functional test and the maintenance j surveillance test (MSP) that performed the electrical checks were not clearly stated in the procedures. In addition, the procedures did not clearly state that both

continuity and resistance-to-ground checks were required to meet the TS.

, Following the initial discovery of the missed TS requirement, a meeting was held

{ that included representatives from operations, electrical maintenance, and system

engineering to determine exactly what needed to be done to complete the electrical

checks. The scope of testing identified by that group was wrong; it only included j the resistance-to-ground checks. It was not until shift supervisor review of the

-

completed resistance-to-ground checks that the continuity checks were added. The l delay in completing the electrical checks caused Unit 1 to exceed the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> i

testing window allowed by TS 4.0.3 by 10 minutes, which forced operators to i begin a plant shutdown. Corrective actions included significantly strengthening the

"

OSTs and MSPs to clarify the proper sequencing. Inspectors reviewed the l corrective actions for the event and assessed that they were satisfactor )

l

.

i

_ _ _ _ . . _ . ._ __ - - .-- - - - __ _ _ __ _ - - _

i o

in addition to immediate corrective actions, station management directed that QSU conduct an Assessment of TS Surveillance Requirements (Assessment 97-05) to identify those TS surveillances which are either sequence driven or event drive Inspectors reviewed the assessment and noted that QSU found no additional missed

TS surveillance requirements; they did recommend that 20 TS surveillances be reviewed further by Operations and Licensing staff for potential enhancements to administrative controls.

, This failure to comply with TS surveillance requirements is an apparent violation of TS 6.8.1.C (eel 50-334(412)/97002-0 Additional Missed TS Surveillances

inspectors also reviewed three additional missed TS surveillances that were identified by DLC staff during this perio Untested Logic Interlock a

'

Whilo reviewing solid state protection system safety injection testing, system engins6 ring staff found that the following logic interlocks were not tested: (1)

reactor coolant system (RCS) loop stop valve interlock with low steam pressure safety injection and low steam generator level reactor trip, and (2) diodes in reactor

trip breaker contact input to feedwater isolation (partial) and safety injection reset /autoblock. These interlocks had not been in the periodic test program since

original construction, i

At Unit 1, the channel functional test of the engineered safety features actuation

} system (ESFAS) functions " Safety injection and Feedwater isolation" on Automatic l l' Actuation Logic (TS 4.3.2.1.1, Table 4.3-2, item 1b) and " Steam Line isolation" on Automatic Logic (TS 4.3.2.1.1, Table 4.3-2, item 4b) did not include testing of the RCS loop stcp valve position block signal. The loop stop valve interlock, the P-11 interlock (pressurizer pressure), and steamline pressure are logic inputs to the

! Automatic Actuation Logic for both functions on low steamlire pressure. The

bimonthly testing of these functions was inadequate in that it f ailed to completely j test the channel logic. Also, the channel functional test for the reactor trip system

,1 (RTS) " Automatic Trip Logic" (TS 4.3.1.1.1, Table 4.3-1, item 22) did not include 1 testing of the RCS loop stop valve position block signal. The automatic reactor trip j function on steam generator low-low water level includes two logic inputs: steam

,

generator water level and the RCS loop stop valve position block signal from which the logic output in developed. DLC system engineers concluded that the bimonthly testing of this function was inadequate in that it failed to completely test the l channel logic.

!

'

The condition also applied to Unit 2 (TS4.3.2.1.1, Table 4.3.2, item 1b; TS

4.3.2.1.1, Table 4.3-2, item 4b; and TS 4.3.1.1.1, Table 4.3-1, item 22). The issue was documented on Condition Reports 970596 and 970597. Both units were

in cold shutdown at the time of discovery. The loop stop valve interlock was related

'

to N-1 loop operation, which is not permitted by the Unit 1 or 2 licenses and is not

.

.

used. However, system engineering staff concluded the interlock needed to be verified functional to prevent unnecessary blocks in the logic circui The Unit 1 review related to the safety injection (SI) function also identified a diode in the solid state protection system (SSPS) logic circuitry for the ESFAS P-4 interlock logic for both the Si Reset / Auto Block and the Feedwater isolation (partial)

functions was not tested. The Feedwater Isolation (partial) function involves closing the main feedwater valves on low primary temperature (Tavg) with P-4 indicating the reactor tripped. The P-4 permissive is generated from the reactor trip and bypass breakers. P-4 provides for feedwater isolation in conjunction with low Tavg and allows for manual reset of safety injection. A failure mode of this diode (i.e, open circuit) would result in an inoperable P-4 signal to the SSPS logic for these functions. The bimonthly testing performed to satisfy TS 4.3.2.1.2, which requires the logic for the ESFAS interlocks to be demonstrated operable during the at-power channel functional test of channels affected by interlock operation, would not detect this failure mode and would incorrectly conclude the interlock logic was operabl Therefore, DLC system engineers concluded the bimonthly surveillances were inadequate to demonstrate the operability of the ESFAS interlock logic related to the SI Reset / Auto Block and Feedwater Isolation (partial) functions. The condition also i applied to Unit 2 (TS 4.3.2.1.2). l DLC system engineering concluded that the cause of the oversight was procedural deficiencies. In the development of surveillances for the solid state protection l system (SSPS), DLC incorrectly assumed that the identified logic circuit was !

included in the semi-automatic test features of the original SSPS design. As l immediate corrective actions, DLC l&C technicians tested the interlock functions at both units while they were in cold shutdown. The testing demonstrated that the circuits involved were operable. The applicable surveillance procedures were l

,

changed to add the missing tests, in addition, DLC intends to conduct further evaluation of the semi-automatic test features of the SSPS as part of their Generic Letter 96-01 review in order to assess generic implication i inspectors discussed the issue with system engineering staff and assessed that corrective actions were sufficient to address the immediate issue. A weakness in the root cause analysis was the failure to determine why the assumption was made without verification during the development of the original surveillance test that these interlock features were tested by the semi-automatic test circui I This failure to comply with TS surveillance requirements is an apparent violation of TS 6.8.1.C (eel 50-334(412)/97002-0 CREBAPS Discharge Trip Valve Testing During routine review of the Valve Retest Log, a performance engineer identified ;

that Control Room Emergency Bottled Air Pressurization Subsystem (CREBAPS) '

discharge trip valves had not been tested in accordance with TS requirements. The CREBAPS is demonstrated operable at least once per 18 months by verifying that a chlorine / control room high radiation / containment phase B isolation test signal from either unit will initiate system operation. The acceptance criteria for the surveillance

l c

test requires that the discharge trip valves not exceed a prescribed ASME limiting stroke time. The criteria also requires that if the valves exceed their previously recorded stroke times by greater than 50% the test frequency will be increased to monthly. On January 28, valves TV-VS-101B, D, and E had stroke times with increases over 50% from the previous 18-month test; however, they were not {

retested until after the performance engineer log review on March 23. The valve retesting was completed successfull Operating Experience Department (OED) analyzed the event and concluded that the cause was inadequate coordination and communication between responsible site organizations, and inadequate procedures. A contributing cause was that the TS surveillance test program is not under the responsibility of a single departmen Inspectors reviewed the issue and concurred in the assessment. In this instance, I weaknesses in coordination and communication between OED, the IST (inservice test) Coordinator, and the Operations Scheduler resulted in failure to notify the scheduler of the increased testing frequency of the valve As immediate corrective actions, the valves were successfully tested and an interim I memo was issued to strengthen the notification process between the responsible i groups. Procedure changes were initiated during the period to implement permanent enhancements, in addition, DLC management has committed to an evaluation of the overall TS surveillance test scheduling and coordination process i for both units, with emphasis on centralizing the schedu!ing and coordination under the responsibility of one department. The evaluation and recommendations are due June 30 to DLC managemen This failure to comply with TS surveillance requirements is an apparent violation of TS 6.8.1.C (eel 50-334(412)/97002-08).

l Boron injection Flowpath While reviewing surveillance testing requirements for reactivity control systems, operators identified that monthly position verifications for two motor operated valves (MOVs) in the boron injection flowpath at Unit 2 were not being performed (2CHS-MOV289 and 310, the inlet and outlet of the regenerative heat exchanger).

Follow-up investigation revealed that the analogous valves on Unit 1 were not being checked and two manual valves were also not being checked (1CH-83 and 86, the intet and outlet to the blender). The safety consequences of the omission were minimal, however, since boron inb tion flow is continuously verified by system alarm function and is routinely verified by control room operator DLC operators concluded that the cause of the event was failure to identify all pertinent valves in the surveillance tests which implements the TS requirement Corrective actions were to verify the proper alignment of the valves and add them to the test procedures, inspectors reviewed the issue and noted that DLC failed to determine why the valves were not included in the surveillance test when it was developed. This was considered a weakness in the root cause analysis. Corrective actions were adequate to address the immediate issu l

-

a This failure to comply with TS surveillance requirements is an apparent violation of TS 6.8.1.C (eel 50-334(412)/97002-09).

Responsibility for the Surveillance Test Program Inspectors reviewed applicable DLC Nuclear Power Division Administrative Procedures (NPDAPs) for surveillance test program responsibilities and noted the following from NPDAP 8.12, " Control / Coordination of Surveillances, Calibrations, and other Periodic Tasks," Re The Manager, Maintenance Department, is responsible for performance of all maintenance test procedures (MSPs).

The Onsite Safety Committee (OSC)is responsible for review of surveillance and test activities of safety-related equipment. The requirement is also stated in NPDAP 8.10, "OSC," Re The Manager, Outage Management, is responsible for scheduling of maintenance outage related surveillances and for scheduling of monthly operations surveillance tests (OSTs).

The Manager, Maintenance Planning and Administration, is responsible for coordinating with outage management to ensure that electrical and mechanical maintenance surveillances and l&C MSPs are effectively schedule The Operations Manager is responsible for overall coordination and control of the '

operations surveillance program and for scheduling, performance, and tracking of all OST The Operations Experience Manager is responsible for ensuring that required refueling surveillances are performed and for overall control of the refueling surveillance program. However, refueling related activities (e.g., MSPs, OSTs)

performed by Maintenance and Operations shall be scheduled, tracked and controlled as described abov Each group responsible for surveillance testing shall monitor their own program to identify missed surveillance tests and initiating corrective action The Director, Licensing, is responsible for maintenance of the TS Procedure Matri NPDAP 8.31, Rev.0, " Preventive Maintenance Program / Maintenance Planning and Scheduling System," states that maintenance work planners / schedulers, in conjunction with operations, are responsible for scheduling OSTs to ensure the most efficient method of performing work, and achieving 12-week schedule completion within 25% of the MPS grace perio Inspectors assessed that the decentralized responsibility for scheduling and performing surveillances was a contributing factor to missed surveillances on the PlVs, the hydrogen recombiners, and the CREBAPS valves above. DLC OED

. . . . .

.

.

C reached the same conclusion with regard to the CREBAPS valves above. DLC rnanagement's commitment to an evaluation of the overall TS surveillance test scheduling and coordination process by June 30,1997 was appropriat Conclusions When considered individually, the above events had minimal safety consequences; however, the number of missed surveillances identified over a relatively short time period indicated a weak surveillance test program, particularly in scheduling and coordination and procedural support. Each missed surveillance represented a longstanding condition. In some instances, inspectors assessed that the root cause analyses were weak or narrowly focused. Inspectors also considered that the events were licensee-identified, indicating good problem identification, that DLC's short term corrective actions addressed the immediate issues, and that DLC management has committed to evaluate the overall TS surveillance program to address generic issues. Notwithstanding the minimal safety consequences of each of the events above, these failures to comply with TS surveillance requirements are six apparent violations of TS 6.8.1.C, which requires that written procedures shall be established, implemented, and maintained covering surveillance and test activities of safety related equipmen M8.3 (Closed) Unit 1 Licensee Event Report (LER(97002-00: Emergency Diesel Generator Watt Meter inaccuracy Results in Inadequate Technical Specification Surveillance Test. The issue was documented in Section M M8.4 (Closed) Unit 1 LER 97003-00: Failure to Test Reactor Coolant System Pressure Isolation Valves in Accordance with Technical Specifications. The issue was documented in Section M8.2.

M8.5 (Closed) Unit 1 LER 97004-00

Failure to Test Post DBA Hydrogen Control System Recombiners in Accordance with Technical Specifications. The issue was documented in Section M M8.6 (Closed) Unit 1 LER 97006-00: Failure to Test Solid State Protection System Logic in Accordance with Technical Specifications. The issue was documented in Section M M8.7 (Closed) Unit 1 LER 97007-00: Failure to Test Control Room Emergency Bottled Air Pressurization Subsystem in Accordance with Technical Specifications. The issue was documented in Section M M8.8 (Closed) Unit 1 LER 97008-00: Monthly Position Check of Valves in the Boron injection Flowpath. The issue was documented in Section M ,

Ill. Enaineerina

,

E1 Conduct of Engineering E1.1 Unit 1 Emeraency Diesel Generator Startina Circuit Wirina Inspection Scoce (37551)

The inspectors reviewed system and nuclear engineering response to the Unit 1 Emergency Diesel Generator (EDG) 1-1 failure to operate as expected during the performance of an operations surveillance test. The inspectors examined the licensee initial follow-up, extent of condition review, and operability determinatio The inspectors also discussed the issue with system engineers and reviewed surveillance tests to determine the historic impact on the operabiiity of the ED Observations and Findinas On April 7,1997, while performing 10ST 36.19, " Diesel Generator No.1 Start-up,"

Rev. 5, operators were unable to raise the governor speed setting from the low speed stop (LSS) to the high speed stop (HSS) as required per the procedure. The event occurred with Unit 1 in cold shutdowa. Technical specification requires only one EDG to be operable in this mode. Through troubleshooting (voltage readings, relay testing, and checking of individual wires), the sy'; tem engineer identified a mispositioned wire in the governor control circuit. EDG 1-2 was inspected and did not have the same condition. Under Maintenance Work Request (MWR) 062765, testing was performed to determine the effect of the misplaced wire on the syste System engineers demonstrated that with the wire improperly landed, it would effect the raising of the governor speed setting. The wiring was then properly restored to its correct position in accordance with controlled station drawing System engineers performed additional testing of EDG 1-1 using OST 36.19 and I Temporary Operating Procedure,1 TOP-97-10, " Diesel Gen. NO.1 Fast Start I Governor Test," Rev. O. The testing demonstrated the operability of EDG 1- l The inspectors reviewed the surveillance procedure and temporary operating procedure and concluded that EDG 1-1 would perform as designed with the wire landed in accordance with approved drawing The inspectors reviewed the effect that the improperly landed wire had on past operability. Tha system engineer identified that with the wire misplaced, the EDG would not go to the HSS position on a f ast start signal if the governor was not already at the HSS. During normal standby conditions, the diesel generator governor speed settings is at the high speed stop; therefore, EDG operability was not effected for this condition. During monthly surveillance testing, the EDG governor position is manually moved off the HSS position during the surveillanc Also, after shutdown of the EDG, the EDG will remain at idle for 11.5 minute During these conditions with the misplaced wire, the EDG would not respond to a fast start signal. However, the EDG is already declared inoperable during these portions of the surveillance test for other reasons, in addition, an operator is

l

- -. - . - .

.

. . .- . _- -

.

stationed at the EDG during the surveillance test and could take manual action if

,

,

needed to operate the diesel governor.

!

Due to the electrical configuration, the mir olaced wire was not identified during

'

monthly EDG surveillance tests. System engineers and design engineers searched j Technical Evaluation Report, Design Change Package, and Maintenance Work l

Request databases and identified that the last known change that affected the wire l

was prior to initial plant startup. However, a recent change during the last refueling outage added a diode to the circuit and supplied a flow path that allowed the misplaced wire to effect the EDG governor control.

10 CFR 50 Appendix B Criterion V, " Instructions, Procedures, and Drawings," l requires that " activities affecting quality shall be prescribed by ... drawings .. shall

! be accomplished ;n accordance with these ... drawings." Contrary to this, the j

~

misplaced wire constituted a failure to properly maintain the design basis configuration as specified in the license drawings. This licensee-identified and 4

,

'

corrected violation is being treated as a Non-cited Violation, consistent with Section Vll.B.1 of the NRC Enforcement Policy (NCV 50-412/97002-03). Conclusions The misplaced wire on the EDG constituted a long-standing design implementation error. System engineering and design engineering appropriately assessed and corrected the deficiency. The overall impact on the EDG was minimal. The EDG was already declared inoperable during periods that the misplaced wire affected the governor. In addition, operator action could have been taken tocally to start the ED E1.2 Root Cause Analysis of Dual Unit Trio on March 19 Insoection Scone (37551,92903)

Inspectors monitored the root cause analysis of the dual unit trip on March 19 done by the DLC Event Review Teams (ERTs) and corrective actions implemented by DLC to prevent recurrence. In addition, inspectors reviewed associated Beaver Valley switchyard relay protection design documentation, walked down the switchyard and affected equipment, and interviewed Electrical & 1&C Engineering staff and Substations staf O_burvations and Findinas Prior to the event, both units were operating at full power supplying the 345kV electrical grid. The outputs of 345kV buses #3 and #4 were connected to buses #5 and #6, respectively, which is the normal configuration. At 6:06 a.m., recorders indicated a phase-to-ground fault occurred on the Ohio Edison Mansfield-Hoytdale 345kV line. The fault was detected by Beaver Valley switchyard electrical protection equipment which began shedding various loads by opening line breaker During the 13.5 cycle duration of the fault, eight switchyard breakers opened: PCB-341, PCB-331, PCB-362, PCB-333, PCB-366, PCB-346, PCB-352, and OCB-9 <

.. _ __

.

The opening of Unit 1 and 2 main generator output breakers PCB-331,341,352, and 362 resulted in simultaneous unit trip Beaver Valley Bus Protection Scheme

'

The Beaver Valley bus protection scheme consists of differential relays, static breaker failure unit (Model SBFU) relays, and static relay unit (Model SRU) timer Each 345kV and 138kV bus in the Beaver Valley switchyard is protected by two redundant (primary and secondary) sets of high speed (1-2 cycles operating time)

bus differential relays. In the event of a bus fault, these protective relays would first independently detect the fault and then trip and block the reciosing of all connected breakers on the bus to isolate it from the rest of the system. Similar protection is also provided for the feeder line The SBFU relays and SRU timers are used as part of a backup protection scheme and are designed to operate on detection of a stuck (failed) breaker. This combination of relays and timers serves as a backup to the various bus differential relays. Normal protection for a bus fault is provided by the bus differential relays, which would open the feeder breakers to isolate a faulted bus. However, if any of <

the breakers fail to open, the breaker failure scheme using the SBFU relays and SRU l timers is use If a breaker feeding a faulted bus fails to open, the breaker failure scheme would trip the next breaker (s) in the circuit in a continuing attempt to isolate the fault from the bus. The backup protection scheme operates with a time delay following bus I differential relay initiation. The SRU timer is automatically reset if the detected fault is cleared within the established time delay period (8 cycles). The breaker failure scheme consists of one SBFU relay for each breaker on the bus and one SRU bus backup timer (BBUT) for the entire bus. The SRU BBUT has two inputs for each l breaker on the bus as sensed through each individual SBFU relay. These inputs - l consist of a differential relay operation and a breaker overcurrent condition if the SRU timer times out and the fault has not yet been cleared by the differential relays, l then the timer will operate. Operation of the timer will trip the next breaker (s) in the circuit for any of the lines on the bus that are indicating an overcurrent condition in an attempt to isolate the fault and the apparent stuck breake l Root Cause of the Unit Trips l The cause of the plant trips was identified as a field wiring error between the SBFU relay 50-J140 for the Unit 2 output breaker PCB-352 and its associated 345kV bus l

1. 3 SRU timer 62-J143. The output wires on SBFU relay 50-J140 were reversed for the overcurrent input to the SRU and the bus differential relay input to the SRU. As a result of the cross-connected wiring, the differential output of the SBFU was connected to the current input of the timer and the current output of the SBFU was connected to differential input of the time t With the SRU timer scheme wired with the SBFU outputs reversed, two conditions were needed for the timer to operate. First, there needed to be a current condition greater than the setpoint of the SBFU relay (providing a false differential input to the

, 18

.

SRU timer). Second, a sufficient fault current duration was needed to operate the timer. The current setting of the SBFU relay was 400 amps and the measured i ground current of the Mansfield Hoytdale line at the time of the fault was 2800 '

amps. The timer was set for 8 cycles and the fault existed for 13.5 cycles. Since l both conditions were met, the timer operate i The wiring error had existed since the Unit 2 breaker SBFU protection was added to the switchyard during initial construction of the unit. The bus protection scheme, !

as identified on the elementary electrical schematic diagrams from original design in 1984, correctly identified the SBFU relay and SRU wiring connections. However, the wiring connections were reversed when the protection scheme was transferred from the elementary diagram to the associated wiring diagram used during '

, construction. The installed wiring matched the wiring diagram, which was incorrect. The design review process in effect in 1984 did not detect the error between the elementary diagram and the wiring diagram. The onsite engineerir g l organization was not involved in the review process for the switchyard in 1984; since then, the process has been changed to require Nuclear Engineering staff review and approval of changes to the switchyar DLC concluded that the typical testing for both trip checking and routine relay i calibration done during installation in 1984 would not have revealed the wiring l error, since the scheme would check satisfactorily when testing each breaker l interlock individually. Inspectors reviewed DLC's conclusion and concurred. The l wiring error was discovered during post event investigation when the timer was I tested with multiple inputs. DLC electricians confirmed the root cause through !

bench and field testin Corrective Actions i inspectors discussed the root cause analysis, evaluation, and corrective actions with DLC Nuclear Engineering Department staff, including the Director, Plant Electrical & l&C Engineering, and Substations staff, including the Manager, the i Director, and the Protection Supervisor for Western Substations District, and the j Protection Supervisor for Beaver Valley Power Station. In addition, inspectors monitored meetings of the Nuclear Safety Review Board regarding the event and i discussed issues with applicable member Corrective actions completed and planned by DLC included the following:

1. DLC electricians confirmed through testing that the system fault coincident with the existing wiring error would actuate the backup protection scheme. Following actuation, the timer functioned as designed to isolate the breakers it sensed as faile . The wiring error between the PCB-352 SBFU current interlock relay and its SRU timer was corrected and tested satisfactorily, and the wiring diagram was correcte . DLC staff reviewed all switchyard 345kV and 138kV protection elementary

, diagrams and wiring diagrams for additional discrepancies. Additional discrepancies 19 l l

,

were entered in the Condition Report system for resolution (Condition Report 970638); no significant discrepancies were foun . All 345kV protection circuits were verified in the field anc' bacLup timer relays were tested, including testing the SRU timers with multiple inputs All 138kV backup timer relays and SRU timers are scheduled to be tested within 30 days of achieving 7 days of stable full power operation for both units (due to the risks associated with testing in the 138kV yard when the units are shutdown, since it supplies all site power at that time).

5. DLC intends to review and revise, if necessary, post modification testing practices to ensure that future modifications are adequately teste . DLC intends to review the current switchyard modification and work processes to ensure that adequate requirements and design controls are in place to prevent similar design recurrenc . DLC intends to evaluate current training requirements for conducting switchyard activities and revise them as necessary, Conclusions Based on review of documentation, walkdown of equipment, and observation of the switchyard transient recorder data, the inspectors concluded that DLC had satisfactorify identified the cause of the dual unit trip and operation of the switchyard breakers, in addition, DLC adequately addressed the configuration discrepancies between field wiring and design documentation associated with the Beaver Valley switchyar DLC electrical engineering, substations, and relay staffs conducted a thorough root cause analysis supported by both becoch and field testing. Corrective actions proposed by the staff, reviewed by the NSRB, and approved by DLC senior management were comprehensive to correct the immediate cause of the trip, to address generic concerns, and to prevent recurrenc E1.3 Emeraency Diesel Generator (EDG) 1-2 Operability Assessment Inspection Scope (37551. 92903)

During the dual unit trip on March 19, operators noted that the Unit 1 emergency diesel generator EE-EG-1 (EDG 1-1) auto started and EE-EG-2 (EDG 1-2) did not start during the event. EDG 1-1 started due to a momentary undervoltage or. 4kV ]

emergency bus AE during the electrical transient, but was not required to load since the bus AE undervoltage condition cleared. DLC declared EDG 1-2 inoperable until ;

an evaluation could be done to substantiate that it had operated properl I The inspectors discussed the issue in detail with system engineering staff, reviewed )

EDG technical documentation, electrical diagrams, ano design requirements, and i l

20

!

.

- - - - . - - .. . . - - . - - . - . - - - - - - . - ,. ~- - .

)

?

walked down the EDG starting circuitry. Inspectors reviewed and assessed DLC's 1 l evaluation of EDG operability during'the event.

i i b. Observations and Findinas i i

[ Review of the Sequence of Events Recorder (SER) showed an undervoltage EDG

[ start permissive existed for O.200 seconds on 4kV bus AE, which is tied to l EDG 1-1, and 0.166 seconds on 4kV bus DF, which is tied to EDG 1-2. DLC -

. concluded that the most probable cause for EDG 1-2 not to start was that the start q

j permissive actuated for too short of a period of tim '

i t DLC conducted functional testing of the EDG 1-2 undervoltage autostart circuit on

! March 20. The testing demonstrated that the start actuate time for EDG1-2 on l Start Circuit #1 was 0.198 seconds and on Start Circuit #2 was 0.194 seconds.

l The 4kV bus DF undervoltage EDG start signal that existed during the Unit 1 trip j was 0.166 seconds. Based on the measured start actuate times being longer than j i

the start signal which existed during the event, DLC concluded that EDG 1-2 should l l not have autostarted, and it responded as designed in response to the plant i conditions that existed during the transien Undervoltage autostart testing was also performed on EDG 1 1. The start actuate time for EDG 1-1 on Start Circuit #1 was 0.170 seconds. The 4kV bus AE I undervoltage EDG start signal which existed during the Unit 1 trip was 0.200 seconds. Based on the measured start actuate time being less than the duration of i the start signal which existed during the event, DLC concluded that EDG 1-1 started as designed in response to the plant conditions that existed during the transien The start actuate time for EDG 1-1 is faster than EDG 1-2 due to having one less relay in the start circuit. EDG 1-2 has an interposing relay (62-VF100XX) for Appendix R separation that is not in the circuit for EDG 1-1. System engineers also noted that 4kV bus A is typically more heavily loaded than 4kV bus D, because bus ,

A supplies a reactor coolant pump. As a result, during an electrical transient, bus A '

would start the transient from a lower voltage (typically about 40V lower) and so take longer to recover from an undervoltage condition than bus D. Inspectors noted j that EDG 1-1 has had similar auto-starts in the past during the bus swap to off-site power following a reactor trip, and that EDG 1-1 typically will auto-start when reactor coolant pump 1 A is started, due to the starting surge effect on 4kV bus DLC intends to submit a T3 amendment to change the undervoltage setpoints to match those on Unit 2 and eliminate unnecessary EDG auto-starts on Unit The Unit 2 EDGs were not affected by the issue since they have a different design with different technical specification Conclusions Based on the inspectors' review and DLC's satisfactory test results, the inspectors concluded that DLC had adequately confirmed the operability of each EDG per station design. Inspectors assessed that system engineering staff's evaluation and

_

.

testing were comprehensive and provided a sound basis to support the EDG operability conclusio E1.4 Auxiliary Feedwater Check Valve Failure Insoection Scoce (71707)

i Following the dual unit reactor trip on March 19,1997 (Section 01.2), operators observed reduced auxiliary feedwater (AFW) flow to the "B" steam generator. The inspectors evaluated system and design engineers effectiveness through examination of the troubleshooting efforts, the root cause analysis, and subsequent corrective actions. The inspectors reviewed and/or observed the following surveillances which were conducted during troubleshooting and post-maintenance testing:

• 20ST-2 " Steam Turbine Driven Auxiliary Feed Pump [2FWE"P22]

Test," Rev. 25

• 20ST-2 " Auxiliary Feedwater System Check Valve Exercise and Flow Verification," Rev.12

• 20ST-24.8A " Auxiliary Feedwater Check Valve Reverse Flow Test," Rev. 5

• 2OM-24.4.Q " Response to Steam Binding or Depressurization in Auxiliary Feedwater System," Rev. 4 Observations and Findinas After the reactor trip, AFW actuated as expected and flow to all steam generators was initially normal (250-280 gpm). Flow to the "B" steam generator dropped within the first 2 minutes to 150 gpm without a change in system controls. The reduced "B" steam generator flow was verified on two redundant control room instruments. Flow to the "A" and "C" steam generators remained in the expected range of 250 to 280 gpm. The "B" steam generator level recovery lagged behind the "A" and "C" steam generators. Through control room indication end local valve position indication, operators verified that the "B" steam generator AFW throttle valves were full open. The inspectors observed that the decreased flow to the "B" steam generator did not significantly complicate the reactor trip and initial stabilizatio Upon reviewing post trip data, the "B" AFW header was declared inoperable, and the plant was placed in cold shutdown (Mode 5). System engineers developed a .

comprehensive troubleshooting plan to test the flow transmitters, to perform the OST to measure reverse flow through the check valves, and to inspect the restricting orifice for foreign material. System engineers also developed contingency actions if the preceding methods did not identify the root cause of the reduced flo The inspectors observed that the troubleshooting plan was thorough and contingencies were well thought ou The inspectors noted that poor coordination of activities between operctions, maintenance, system engineering, and radiation protection personnel resulted in additional time to accomplish the troubleshooting plan. Initial troubleshooting

activ; ties did not disclose the cause of "B" header reduced flow. IJsing contingency plans already developed, the system engineer determined that the 2FWE-100 AFW check valve was obstructing AFW flow to the "B" steam generator. This valve was removed from the system and inspected. The seat ring on the valve was observed to have backed out, thus restricting travel of the disc by 90%. The valve was shipped to the vendor for further analysi System engineers and design engineers conducted an investigation and root cause analysis with support from the vendor. The engineers concluded that the thermal gradient conditions created by the cold water flowing through the hot valve created a rapid cooldown and corresponding contraction of the seat ring, allowing it to displace. Engineers further concluded that the vendor's manufacturing process made the seat ring susceptible to this thermalinduced movement, immediate corrective action was to install set screws to secure the seat ring. The "A" and "C" AFW discharge check valves were also inspected and refitted with the set screw The inspectors reviewed the root cause analysis and supporting documentatio The engineering evaluation was excellent with good supporting information gathered through material analysis and review of existing data. The inspectors independently reviewed the calculations and found no discrepancies in the engineering analysi Additioned corrective actions specified in Condition Report 970554 are as follows:

• Revise 20ST-24.6 to install test pressure gauges upstream of the AFW discharge check valves;

• Evaluate alternative valve designs to ensure the current design is the preferred design for the long term;

• Schedule a preventive maintenance inspection for 2FWE-100 during the next refueling outage;

• Revise 1/2 CMP-75-ENERTECH CHECK-1M to inspect for seat ring ,

movement and set screw condition on the AFW discharge check {

valves;

• Revise 2OM-24.4.O to place additional administrative controls to ensure a high temperature differential will not exist across upstrcam AFW check valve J The licensing department conducted a 10 CFR 21 evaluation and determined that i the AFW check valve failure was reportable. Licensing engineers concluded that I the defect could have significantly degraded AFW flow and, as a result, the safety j system may not have performed its function for postulated accident condition Inspectors reviewed the Part 21 notification, dated April 24, and determined that it was technically soun ,

The inspectors reviewed the reportability analysis, original purchase order ( D122117), and original purchase specification (Spec. No.10080-DMS-0242) for the l AFW check valves. The inspectors determined that original purchase specifications i adequately identified the design temperatures and pressures of the system. The check valve failed to meet its design function within those design temperature and pressures. The temperature transient seen across the valve (430oF initial valve body temperature vs. 60 F AFW injection water temperature) caused the I displacement of the seat ring and resulted in reduced AFW flow. The inspector !

l

1

)

!

!

-

O determined that the ability to provide adequate AFW cooling was adversely affected, and the safety system may not have performed its safety function for the postulated accident Conclusions I Operators observed reduced auxiliary feedwater (AFW) flow to the Unit 2 "B" steam generator following the March 19 reactor trip. The AFW injection line was obstructed by a failure of the check valve seat ring. The investigation and root j cause analysis were well developed and effective in determining a cause. The root cause identified that the temperature transient across the valve resulted in the failure. The licensee concluded that the vendor failed to provide a valve that met design specifications stated in the purchase order. DLC appropriately made a Part '

21 notification on April 24, i

E2 Engineering Support of Facilities and Equipment E2.1 Enaineerina Resolution of Unit 1 Restart issues j l inspection Scoce (37551. 92903)

j The licensee identified three restart issues after the "A" and "C" steam generator handhole cover leaks and MOV-RC-591 body-to-bonnet leaks were repaired. Each issue presented a potential deviation from plant design as described in the UFSAR j or TS. The inspectors interviewed personnel, reviewed technical documentation i and station records, and performed field walkdowns to determine whether the {

licensee properly evaluated and resolved the issues prior to restar Observations and Findinas Unit 1 Steam Dumo Fast Closure Time While reviewing Westinghouse Topical Report DLC-97-051, " Rod Control System j Setpoint Optimization for Beaver Valley Units 1 and 2," engineers identified a discrepancy between the evaluated Unit 1 load reject transient response and the j plant response stated in the BVPS-1 UFSAR. Report DLC-97-051 stated that the reactor would trip due to reaching the overtemperature delta temperature protective setpoint. BVPS-1 UFSAR sections 7.7 and 10.3.1.2 stated that the steam dump control system valves would fully open within 3 seconds enabling the plant to accept the sudden loss of load without incurring a reactor trip. The engineers determined that the fast (3 second) trip open feature was intentionally disabled in 1979 to resolve a single failure concern which had caused a reactor trip with safety injection. The actual steam dump opening time was now approximately 8 second On April 4,1997, Condition Report (CR) 970665 was initiated to research and resolve this differenc The Onsite Safety Committee (OSC) reviewed the as-found steam dump opening time (8 seconds) versus the UFSAR description (3 seconds) and associated transient responses. The OSC initially determined that the plant configuration change created

.

an unreviewed safety question (USO). The Nuclear Safety Review Board (NSRB)

independently reviewed the issue and determined that a USQ did not exis Engineers, the OSC, and the NSRB continued to evaluate the issue for 2 days and on April 8 concluded that the change did not create a USQ. The inspectors attended several of the OSC arid NSRB meetings and had no exceptions to the I licensee's final conclusions that the above change did not create a USO. The l committee members demonstrated a1 open and questioning attitude when )

reviewing the issue and performed a aomprehensive, technically sound safety I evaluation prior to Unit 1 restar The inspectors reviewed technical drawings with engineers to fully understand the i basis for the steam dump control system modification and assess applicability to !

Unit 2. Engineers demonstrated strong system knowledge and correctly concluded that Unit 2 which has model 7300 process control equipment was not affecte Wastinghouse Technical Bulletin NSD-TB-82-01 indicated plants whose steam dump l control circuits used model 7100 control modules were potentially vulnerable to the ,

single failure conditio The inspectors noted that a safety evaluation was not performed in 1979 to support the plant change as required by 10 CFR 50.59. A safety evaluation was subsequently performed in 1992, but corresponding UFSAR updates were not performed as required by 10 CFR 50.71(e). The OSC and NSRB performed their .

safety evaluations without knowing that one had been performed in 199 I Engineers informed the inspectors that applicable UFSAR updates would be evaluated and processed as part of CR 970665. The inspectors determined that the steam dump control system discrepancy would most likely have been identified by the licensee's ongoing 100% UFSAR verification initiative. Therefore, consistent with Section Vll.B.3 of the NRC Enforcement Policy, this issue is not subject to enforcement actio Unit 1 Main Steam Isolation Valve Bvoass Valves Engineers initiated CR 970680 and a safety evaluation to determine whether the ;

existing 11-18 second main steam isolation bypass valve stroke times satisfied the !

TS and UFSAR requirements for main steam !ine isolation. TS table 3.3-5 requires i steam line isolation to be accomplished in .18 seconds. The TS does not ;

specifically identify which valves must shut upon receiving the main steam line isolation signal. UFSAR section 14.2.5 states that for any steam line break, no more than one steam generator would blowdown even if one of the isolation valves failed to close. The accident analysis assumed steam line isolation and complete -

blowdown termination within 10 seconds. The UFSAR specifically addressed the main steam isolation valves (MSIVs), but did not describe the 2-inch bypass valve The bypass valves (MOV-MS-101 A/B/C) are normally shut and are only opened to equalize pressure across and open the 32-inch main steam isolation valves. As an temporary measure, plant startup procedures were revised to ensure that only one I bypass valve is permitted to be open at a time. Engineers stated this change will remain in effect until they confirm whether the bypass valve stroke time is within

!

1

.

the current steam line rupture safety analysis. The inspectors determined this was a conservative action to assure positive control over the bypass valve Upon further evaluation the licensee identified several UFSAR revisions which would

'

more clearly delineate which valves were required to shut within 10 seconds for main steam line isolation. The engineers also determined that the bypass valves, which receive a train B main steam line isolation signal, should be added to Table 3.6-1, " Containment Penetrations." An engineering evaluation to determine whether the TS main steam line isolation criteria pertains to the MSIV bypass valves was in progress at the close of the inspection period. The issue regarding whether the existing MSIV bypass valve closure time violates TS requirements remains unresolved pending NRC review of the ongoing engineering evaluation (URI 50-334/97002-05). The inspectors discussed the safety evaluation, procedure changes, and planned UFSAR updates with the engineers and determined that licensee response to this issue was technically sound. Engineers demonstrated a good questioning attitud Unit 1 and 2 Heat Trace Circuit Redundancv in response to previous freeze protection system concerns and configuration control problems, engineers performed detailed walkdowns of heat trace equipment. While inspecting a heat trace panel, a maintenance engineer observed that both the normal and the standby heat trace circuits were energized with similar temperature setpoints. The engineer determined that this was inconsistent with the UFSAR system descriptions and initiated CR 970703 to evaluate this discrepanc .

'

Engineers expressed concern that the existing configuration could mask failure of one heat trace circuit with the second circuit. Electrical separation concerns were i also discussed. BVPS-1 UFSAR 8.5.2.8 states that certain vital lines are traced by two circuits. Each of these circuits are 100% capacity with one designated as the normal circuit and one as standby. BVPS-2 8.3.1.1.3.2.b (for safety injection lines) ,

states that only one of the two heat trace circuits is energized at a time. The l redundant circuit is electrically isolated from its supply to provide required safety train independenc :

l Engineers determined that the heat trace circuits were originally ccenfigured with one in normal operation and the electrical supply breaker to the standby circuit ope Therefore, if the normal circuit failed, a control room alarm would be received when the line temperature decreased to the specified setpoint. An operator would be required to manually close the standby circuit breaker to restore heating to the line. j The inspectors reviewed procurement specification BVS-473, " Heat Tracing for l BVPS-1," and confirmed that this was the original construction configuration. This l configuration was also consistent with IEEE 622-1979, "lEEE Recommended Practice for the Design and Installation of Electric Pipe Heating Systems for Nuclear Power Generating Stations," which the BVPS-2 UFSAR committed t In 1993 and 1990 respectively, the BVPS Units 1 and 2 heat trace circuit lineup procedures were revised which changed the configuration from that described in the UFSAR. A safety evaluation was not performed to support these revisions as required by 10 CFR 50.59 and the UFSAR was not updated as required by 10 CFR

.

50.71(e). The inspectors determined that the heat trace circuit configuration discrepancy was likely to have been identified by the licensee's ongoing 100%

UFSAR verification initiative. Therefore, consistent with Section Vll.B.3 of the NRC Enforcement Policy, this issue is not subject to enforcement actio On April 9-10,1997, operations and engineering personnel performed a non-intent revision to the Unit 1 and Unit 2 heat trace circuit lineup procedures to restore the standby circuit power supply breakers (approximately 190 breakers) to the open position, consistent with the UFSAR. Engineers verified that each circuit was 100%

capacity and redundant. The control room shift supervisors approved the procedure revisions, and operators promptly restored the design configuration. The inspectors observed that the engineers used a well controlled, systematic review process to :

evaluate each of over 200 sets of heat trace circuits and initiated clearly written procedure revisions. However, the inspectors questioned whether the procedure revisions received an appropriate safety review prior to implementation, i

The heat trace circuit line-up procedures had been changed in 1990 and 1993 without safety evaluation. Therefore, the inspectors questioned whether the current configuration and system performance was clearly known. The non-mtent change process used in 1997 did not review issues such as operator capability to I identify a failed circuit and energize the standby heat trace circuit within required l times. In addition, this current revision could reintroduce the problem (vital lines '

freezing) which had originally led the licensee to revise the line-up procedures in 1990 and 1993. The inspectors discussed these observations with engineering management. The licensee subsequently performed safety evaluations for the heat trace circuit lineup procedure revisions. The inspectors reviewed the safety i evaluations and determined that the procedure revisions were properly evaluate I c. Conclusions The inspectors determined that engineers demonstrated a good questioning attitude which revealed three instances where the plant was not configured as described in l the UFSAR. In two cases (Unit 1 steam dump closure time, Units 1 & 2 heat trace circuits) the plant had been modified in the past without performing required safety evaluations or updates to the UFSAR. A UFSAR verification project was initiated in January 1997 to identify and resolve such discrepancies which resulted from previous plant design control weaknesses. The licensee properly evaluated the restart issues in a timely and technically sound manner. MSIV bypass valve closure time remains unresolved pending completion of an ongoing engineering evaluatio IV. Plant Support R1 Radiological Protection and Chemistry Controls a. Inspection Scone (8375_01 The inspector reviewed the radiation protection program established by DLC, especially in the areas of work control, ALARA, control of high and locked high

.. - -- . . - . .- . . .. ._- . . . -

!.

radiation areas and dosimetry. This inspection consisted principally of a program overview.

i Observations and Findinas The inspector conducted numerous interviews with DLC personnel and toured rnost of the radiologically controlled areas (RCAs) within Units 1 and 2, as part of this inspection. The Health Physics Department reports directly to the Plant Manager, and is itself divided into three major working groups. Each unit is headed by a Director, Radiological Operations. Within this group, a number of health physics specialists, supervisors and technicians are assigned to support the unit's radiation protection program, radiological instrumentation calibration, and ALARA. A second group, responsible for radwaste/ transportation, effluents, environmental monitoring and industrial safety, is headed by the Director of Safety and Environmental Services. The third group includes respiratory protection, internal and external dosimetry, and is headed by the Director of Radiological Engineering and Health. At the time of this inspection, DLC had 93 persons assigned to the Health Physics Department, which is a relatively large staff when compared to other pressurized water reactors. However, the department does have some areas of responsibility not always found at other plant For work planning, work control and ALARA, DLC has a work control center which forwards all work requests involving areas within the RCA to the Health Physics Department. An ALARA/RWP (Radiation Work Permit) office receives these work requests, assigns an RWP, (while making an effort to group common tasks together within a single RWP, where practical), and forwards those requests requiring an ALARA review to the senior health physics ALARA specialist. In general, during normal operations, identification of work to be performed in the RCA is made to the Health Physics Department less than 3 weeks in advance. This is in comparison to the work control center's use of a 12-week planning schedule. While the inspector did not identify any work which was not properly assigned an RWP or had not received an ALARA review, where applicable, the relatively short lead time between identification of work to the Health Physics Department and the commencement of that work is considered a possible weakness. Discussions with plant staff indicated that work hold-ups based on waiting for radiological paperwork, such as the RWP or ALARA review, is not an uncommon occurrence at Beaver Valle The inspector also noted the difficulty experienced when accessing historical data for RWP planning and ALARA reviews. DLC maintains three separate data bases .

involved in ALARA/RWP planning. The data from work control is placed on a corporate data base, and includes the request for an RWP and the RWP number, when assigned. This system is incompatible with the main health physics data base, which is where the RWPs are written and exposures are tracked. The main j health physics database receives input from the radiological access control system, which logs personnel in on a particular RWP, sets parameters such as dose rate and total dose alarms on electronic dosimeters, and feeds exposure data back to the heath physics staff following an RCA entry. Information collected during work in the RCA, such as area or component surveys, and air sample data, is maintained in a hard copy format, which is ultimately attached to the RWP. Once the RWP is 28 i

]

.

closed, the paperwork is dispositioned to the corporate records center. Due to this multiple system usage and incompatibilities between them, records on surveys, air samples, etc. are not readily retrievable and therefore not readily available for use by the ALARA/RWP staff when preparing work permits or task ALARA evaluation During tours of the various portions of the RCA in both units, the inspector noted the low dose rates found in the general work areas. These low dose rates are reflected in the ALARA goals established in both units for 1997. At Unit 1, the ALARA goal assumes approximately 10-plus months of operations plus a 45-day refueling outage in the fall. For the operating months, a goal of 16 person-rem has been established. At Unit 2, which is assumed to operate all year without any outage, a goal of 9 person-rem has been establishe In the fall of 1996, Unit 2 underwent its sixth refueling outage. An outage goal of I 140 person-rem was established, based on an outage duration of approximately 45 )

days. Due to emergent work identified during the latter portion of the outage, the I outage length increased an additional 60 days, and total outage exposure was ;

160.8 person-rem. A detailed review of the outage ALARA performance will be I conducted during a future inspection. In general, both outage and operational l ALARA performance at both units has improved over the last 5 year During tours of the RCA, the inspector noted that DLC was actively working on I reducing the contaminated areas and number of leaking valves within the RC Numerous postings were also observed in the plant encouraging an improvement in plant housekeeping, in spite of this, considerable work remains within both units in I order to improve plant housekeeping, which is recognized by the Plant Manage The inspector focused on DLC's system for controlling access to high and locked high radiation areas. In part as a response to both NRC and licensee Quality Assurance identified findings, DLC has replaced most high radiation boundaries not I controlled by a door with an air curtain system. This is a replacement for the use of ropes and stanchions for these areas. The inspector discussed with DLC staff the control of keys to locked high radiation areas, and the access control afforded by l DLC's electronic dosimetry /RWP access system. The inspector also attended meter qualification training, which is given to employees to allow them to enter high or locked high radiation areas without continuous health physics staff coverage. This training was approximately two hours in length, and required students to pass both a written and a practical examinatio On March 19, during this specialist inspection, both units at Beaver Valley tripped off-line. In response to this event, DLC determined the need to make entries and repairs within both containments during this forced outage. Since both containments are maintained at sub-atmospheric pressure during operations, initial entries into these structures require self-contained breathing apparatus. The number of personnel who can be in the containment is limited by the capacity of the containment air lock. Since both units required containment entry and work, this represented a significant strain on the manpower of the Health Physics Departmen The inspector observed work planning conducted by the Health Physics staff, and determined that the staff reacted to this event in a professional manner, and

-- - - - - . . -- - . . - . - . . . ~ . . . . - - . - _ . -- - - - ,

..

. I' maintained a focus on personnel safety. A number of RWPs were written to i

support this work, and considerable planning was accomplished in order to ensure the radiological und occupational safety of the entry partie The inspector reviewed DLC's external dosimetry program, specifically the National Voluntary Laboratory Accreditation Program (NVLAP) certified Thermoluminescent Dosimetry (TLD) laboratory maintained by the Health Physics Department. In late 1996, DLC underwent biennial testing of its TLD processing program by NVLA DLC maintains certification in eight of the nine categories, the exception being Category Vill, neutrons. (The licensee utilizes a NVLAP-certified vendor laboratory 1 for neutron dosimetry.) The results of the biennial testing were transmitted via letter dated January 27,.1997, and indicated that DLC had failed testing in Category 1, Accident, Low Energy Photons. While this category and the type of radiation measured is not seen at Beaver Valley except under certain accident conditions, the failure demonstrates a serious weakness in the dosimetry progra In response to this result, DLC conducted a self-assessment of the TLD system, which was published on February 14,1997. At the time of this inspection, DLC was in the process of making programmatic changes suggested in the self- i assessment. Additionally, DLC was preparing to submit a second set of Category l l tests to NVLAP. Since this testing will require 3 months to complete, the inspector will review this issue during a future inspectio ; Conclusions  ;

DLC has established procedures that contribute to effective programs in the areas of work control /ALARA and control of high and locked high radiation areas. The dual unit trip on March 19 was a significant strain on Health Physics Department manpower due to the entries and work required in both containments. The Health Physics staff responded to the challenge in a professional manner and maintained a good focus on personnel safet The cumbersomeness and complexity of databases and information management systems used to support the RWP and ALARA development processes appear to impact on the use and effecth eness of work process controls and ALARA plannin Continued attention to improvement in general plant housekeeping is warrante The failure of the TLD Laboratory in Category l NVLAP testing and the consequent remediation will be reviewed during future inspection R7 Quality Assurance in RP&C Activities Insoection Scoce (83750)

The inspector reviewed audits and surveillances conducted during 1996 in the area of health physics by DLC's Quality Services Uni .- - - - - -

I

.

1 Observations and Findinas

The inspector discussed the quality assurance program as it pertains to health 4 physics with a lead Quality Assurance (QA) auditor. This discussion included a review of the licensee's most recent QA audit, conducted during the Unit 2 l refueling outage (RF06), and surveillances conducted by QA during the remainder of 1996. The inspector noted the focus of both the audit and surveillance on in-plant i performance, with a special emphasis placed on radiological worker practice Fifteen surveillances in health physics, and five surveillances in radwaste/ transportation were conducted in addition to the audit. In general, these reports were determined to be of sound technical basis, and of sufficient depth to

'

identify both existing issues and declining trends in health physics performanc Conclusions DLC's QA program for health physics, including audits and surveillances, is of

<

generally high quality. Sufficient scope and technical depth is present to aid in the timely identification of issues and declining performance in health physics.

a R8 Miscellaneous Radiological & Chemistry issues R (Closed) Violation 50-334(412)/9S004-01: Improper radiological worker practices.

'

DLC undertook corrective actions regarding both the NRC-identified and QA-identified instances of improper radiological worker practices, including individual counseling, enhancements to the control of high radiation area entrances, and addition of lessons learned from these events to the General Employee Training

(GET) annual training program. This item is closed.

'

R8.2 Uodated Final Safety Analysis Reoort

A recent discovery of a licensee operating their facility in a manner contrary to the Updated Final Safety Analysis Report (UFSAR) description highlighted the need for a

special focused review that compares plant practices, procedures and/or parameters to the UFSAR descriptions.

'

While performing the inspections discussed in this report, the inspector reviewed the applicable portions of the UFSAR that related to the areas inspected. The inspector verified that the UFSAR wording was consistent with the observed plant practices, procedures and/or parameters, with the exception of the description of administrative organization for the Health Physics Department found in paragraph 12.5.1.2 of the Unit 2 UFSAR. During the exit interview on March 21,1997, the inspector was informed that the licensee is currently committed to providing a corrected UFSAR to the NRC in 1998. Corrections to this section will be included in this s' 5 missio .

P8 Miscellaneous EP lssues (71750, 92904)

P (Closed) Unresohd item (URI) 50-334(412)/97001-04: Deficiencies associated with the loss of power to the Emergency Response Facility (ERF) on February 1 Insoection Scoce (92903. 92901)

DLC's immediate corrective actions for the loss of power to the ERF were appropriate; however, the event indicated potential weaknesses in operating

.

'

procedures for the ERF building, delegation of responsibility among site organizations for the ERF, and follow-up of corrective actions for previous similar events. DLC management had not reviewed the Event Response Team (ERT)

evaluation and long term corrective action recommendations et the end of the last inspection period (NRC Inspection Report 50-334(412)/97-01). Deficiencies associated with the loss of power to the ERF were an unresolved item pending completion of DLC evaluation and subsequent NRC revie Observations and Findinas inspectors reviewed UFSAR and Emergency Preparedness Plan requirements for the ERF, reviewed the material history of the programmable logic controllers (PLCs) and associated previous events. Inspectors also discussed issues associated with the February 14 loss of power, with various DLC staff, including the ERT leader (system engineering), Supervisor-ISEG, Manager-Procedures Upgrade Project, and General Manager-Nuclear Operations Unit, and attended NSRB discussion of the ERT repor inspectors noted that DLC had experienced at least seven previous openings of the ERF 4kV bus supply breakers since 1988 where it was determined that the cause of the breakers tripping originated from a PLC output when no valid inputs to the PLC could be confirmed. These generally had minimal consequences to plant equipment, but were challenges to operators. The most serious previous event was a loss of power to the ERF Substation in 1993 (LER 2-93-008) due to simultaneous opening of the ERF 4kV supply breakers. Following the loss of power in 1993, ISEG conducted an independent evaluation and recommended several corrective actions (ISEG ltr NDISEG:0852 dated June 29, 1994). Inspectors reviewed the corrective actions for previous events and discussed them with system engineering and electrical /l&C engineering staff. While not all the corrective actions were complete, inspectors assessed that even if they had been, they would not have prevented the February 14 loss of power to the ERF. Nevertheless, failure to resolve the PLC problems despite numerous previous occurrences and failure to complete corrective actions for previous occurrences was a weakness in DLC engineering suppor The root cause of the loss of power to the ERF was failure to maintain a split electricallineup to the building. Recovery of the ERF following the event was slow incause there were no procedures available to restore the electricallineup. The lack of procedures and lack of clear ownership of the ERF building was a weakness in DLC operations, inspectors discussed the lack of procedures with operations staff and noted no other systems, components or structures with a similar lack of procedural suppor ,

!

I Inspectors reviewed the operation of the uninterruptable power supply batteries during the event with system engineering staff and assessed that they operated as designe DLC immediate corrective actions for the February 14 event were completed before placing the ERF building 480V distribution system into a reliable configuratio These included procedures to support the operation and recovery of the ERF building, replacing the PLC output module associated with the event, and adding surge suppressior, on the power supply inputs to the PLCs to make them less susceptible to spurious electrical transients. DLC intends to install coincidence logic to the PLCs as long-term corrective action (TER 10984, currently scheduled for June 10,1997). Additional corrective actions are being tracked under Condition Report 970292. Inspectors assessed that the ERT report and corrective actions were adequate to address the event, Conclusions inspectors assessed that no regulatory requirements were violated during the event, because the alternate emergency facilities were available in accordance with the Emergency Preparedness Plan. Failure to maintain redundancy in the electrical lineup to the ERF building caused the loss of power to the ERF. The failure to restore power to the ERF in a more timely manner was due to lack of procedures and lack of clear ownership of the ERF building. This was a weakness in DLC operations. Spurious actuation of the PLC was the most likely initiator of the even Failure to resolve the PLC problems despite numerous previous occurrences and failure to complete corrective actions for previous occurrences was a weakness in DLC engineering support. The unresolved item is close L1 Review of FSAR Commitments The discovery of a licensee operating their facility in a manner contrary to the Updated Final Safety Analysis Report (UFSAR) description highlighted the need for a special focused review that compared plant practices, procedures and/or parameters to the UFSAR descriptio While performing the inspections discussed in this report, the inspectors reviewed the applicable parts of the UFSAR that related to the areas inspected. Detailed discussions for certain equipment are contained in Sections E2.1 and R8.2. The inspectors verified that the UFSAR wording was consistent with the observed plant practices, procedures and/or parameters with the exceptions noted in Sections E and R S8 Miscellaneous Security and Safeguards issues (92904)

S8.1 (Closed) Licensee Event Report 50-334(4121/96S03-01: Unaccounted for Safeguards Information. This event was discussed in inspection Report 50-334(412)96-07 and resulted in a violation (VIO 50-334(412)/96007-07). The changes described in the supplement to the LER were minor and LER supplement was close !

V. Manaaement Meetinas X1 Exit Meeting Summary The inspectors presented the inspection results to members of licensee management at the conclusion of the inspection on May 7,1997. The licensee acknowledged the findings presente The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary information was identifie X3 Management Meeting Summary X3.1 Operational Safeauards Resoonse Evaluation (OSRE)

An OSRE was conducted at Beaver Valley Power Station from March 31 through April 3. The NRC inspection team was led by Mr. D. Orrick of NRR Safeguards Branch. The resuits of the inspection were discussed with DLC management at an exit meeting on April 3 at the site and will be promulgated via separate correspondenc .

34

_

l ATTACHMENT PARTIAL LIST OF PERSONS CONTACTED DLC J. Cross, President, Generation Group R. LeGrand, Vice President, Nuclear Operations, and Plant Manager S. Jain, Vice President, Nuclear Services B. Tuite, General Manager, Nuclear Operations C. Hawley, General Manager, Maintenance Programs Unit K. Beatty, General Manager, Nuclear Support Unit J. Arias, Director, Safety & Licensing K. Ostrowski, Manager, Quality Services R. Vento, Manager, Health Physics D. Orndorf, Manager, Chemistry L. Freeland, Manager, Nuclear Engineering Department F. Curl, Manager, Nuclear Construction A. Dulick, Manager, Operations Experience d J. Matsko, Manager, Outage Management Department A. Brunner, Manager, Procedure Upgrade Project C. Custer, Acting Manager, System and Performance Engineering M. Perger, Director, Quality Services Unit R. Hart, Senior Licensing Supervisor, Compliance A. Mizia, Supervisor, Quality Services Unit T. Porter, Supervisor, Quality Services Unit B. Sepelak, Senior Engineer, Nuclear Safety NRC D. Ke:n, SRI G. Dentes, RI F.Lyon,RI

. .

- - __ -

INSPECTION PROCEDURES USED l

IP 37551: Onsite Engineering IP 61726: Surveillance Observation IP 62707: Maintenance Observation IP 71707: Plant Operations IP 71750: Plant Support IP 83750: Occupational Radiation Exposure IP 92700: Onsite Follow-up of Written Reoorts of Nonroutine Events at Power Reactor Facilities IP 92901: Follow-up - Operations IP 92902: Follow-up - Engineering IP 92903: Follow-up - Maintenance IP 92904: Follow-up - Plant Support IP 93702: Prompt Onsite Response to Events at Operating Power Reactors ITEMS OPENED, CLOSED AND DISCUSSED Opened 50-334(412)/97002-04 eel Missed Surveillance Test (Section M8.2)

50-334(412)/97002-05 50-334(412)/97002-06 50-334(412)/97002-07 50-334(412)/97002-08 50-334(412)/97002-09 50-334/97002-05 URI Acceptablilty of MSIV Bypass Valve Closure Time (Section E2.1)

Closed 50-334(412)/96004-01 VIO Improper Radiological Worker Practices (Section R8.1)

50-334(412)/97001-02 URI Deficiencies in the Surveillance Testing Program (Section M8.2)

50-334(412)/97001-04 URI Deficiencies Associated with the Loss of Power to the Emergency Response Facility (Section P8.1)

50-412/95080-03 URI Flow Through "B" Service Water System Header Less than required by TS (Section 08.2)

50-412/96008-00 LER Manual Reactor Trip (Section 08.1)

50-334/96011-00 LER Failure to Provide Administrative Control of Containment isolation Valves as Required by TS (Section 08.3)

50-412/96001-00 LER Condition Prohibited by TS - Missed Rod Position (Section 08.4)

50-334(412)/96S03-01 LER Unaccounted for Safeguards Information (Section S8.1)

50-412/96005-00 LER Failure of Motor Control Center Auxiliary control Relays Due to Thermal Aging (Section M8.1)

l

,

50-334/97002-00 L5R Emergency Diesel Generator Watt Meter inaccuracy Results in inadequate Technical Specification Surveillance Test (Section M8.3)

50-334/97003-00 LER Failure to Test Reactor Coolant System Pressure isolation Valves in Accordance with Technical Specifications (Section M8.4)

50-334/97004-00 LER Failure to Test Post DBA Hydrogen Control System Recombiners in Accordance with Technical Specifications (Section M8.5)

50-334/97005-00 LER inadvertent Operation of 345kV Bus Backup Timer Relay Results in Duel Unit Reactor Trip (Section 08.6)

50-334/97006-00 LER Failure to Test Solid State Protection System Logic in Accordance with Technical Specifications (Section M8.6)

50-334/97007-00 LER Failure to Test Control Room Emergency Bottled Air Pressurization Subsystem in Accordance with Technical Specifications (Section M8.7)

50-334/97008-00 LER Monthly Position Check of Valves in the Boron injection Flowpath (Section M8.8)

50-412/97002-01 NCV Flow Through "B" Service Water System Header Less than required by TS. (Section 08.2)

50-412/97002-02 NCV Condition Prohibited by TS - Missed Rod Positio (Section 08.4)

50-334/97002-03 NCV Mispositior.ed Wire on EDG 1-1 Governor Control Circuitry. (Section E1.1)

Discussed None I

l 37

___

m

O LIST OF ACRONYMS USED AFW Auxiliary Feedwater ALARA As Low as Reasonably Achievable BBUT Bus Backup Timer BVPS Beaver Valley Power Station CR Condition Report DLC Duquesne Light Company EDG Emergency Diesel Generator ERF Emergency Response Facility ERT Event Review Team GET General Employee Training gpm Gallons per Minute HSS High Speed Stop l&C Instrumentation & Control IR inspection Report ISEG Independent LER Licensee Event Report LSS Low Speed Stop MSlV Main Steam isolation Valves MSP Maintenance Surveillance Procedure MWR Maintenance Work Request NCV Non-cited Violation NPDAP Nuclear Power Division Administrative Procedure NRC Nuclear Regulatory Commission NSRB Nuclear Safety Review Board NSS Nuclear Shif t Supervisor NVLAP National Voluntary Laboratory Accreditation Program OM Operating Manual OSC On-site Safety Committee OSRE Operational Safeguards Response Evaluation OST Operational Surveillance Test PDR Public Document Room PLC Programmable Logic Controller QA Quality Assurance QSU Quality Services Unit RCA Radiologically Controlled Area RWP Radiation Work Permit SER Sequence of Events SI Safety injection SSPS Solid State Protective System SWS Service Water Systen TER Technical Evaluation Report TLD Thermoluminescent Dosimetry TS Technical Specification UFSAR Updated Final Safety Analysis Report URI Unresolved item USO Unreviewed Safety Questions VIO Violation

.

.

..

.

..

. .