IR 05000339/1989200

Insp Rept 50-339/89-200 on 890213-17 & 0227-0303.Potential Enforcement Items Noted.Major Areas Inspected:Evaluation of Planned Design Changes & Mods Against Regulatory Requirements & Licensee Commitments

ML20245J594
Person / Time
Site:	North Anna
Issue date:	06/07/1989
From:	Haughney C, Imbro E, Parkhill R Office of Nuclear Reactor Regulation
To:
Shared Package
ML20245J560	List: IR 05000339/1989200 ML20245J558
References
50-339-89-200, NUDOCS 8907030104
Download: ML20245J594 (33)

Text

_ - _ - _ _ - - _

- - , - -

y y: "i g .

.

-

.

-

i

U.S. NUCLEAR REGULATORY COMMISSION 1

'

0FFICE OF NUCLEAR REACTOR REGULATION Division of Reactor Inspection and Safeguards Report No.:- 50-339/B9-200 Docket No.: 50-339

' Licensee: Virginia Electric and Power Company (VEPCO)

p Facility: North Anna Power Station Unit 2 Inspection at: .VEPCO, Innsbrook Corporate Offices Richmond, Virginia Inspection Conducted: February 13 through 17 and February 27 through March 3, 1989 Inspection Team Members:

Team Leader: R. W. Parkhill, RSIB, NRR Instrumentation and Control: S. V. Athavale, RSIB, NRR J. B. Jacobson, RSIB, NRR Mechanical Systems: D. C. Prevatte Consultant Electrical {pwer: W. G. Drumond, Consultant Mechanical Components: F. Vasiliadis,-Consultant Civil Structural: Hai-Boh Wang, RSIB, NRR Regional Support: M. Thomas, Region II

$$/ Vf R. W. Parkhill, Team Leider 5- 2 Z -2 9'

Special Inspection Branch, NRR

.,.

Reviewed By: [ I- 4 - S - f 8)

E. V. Imbro, Section Chief Special Inspection Branch, NRR  ;

Approved By: u /// 7!8f Charles J/ Haughney, Branch Chief Special Inspection Branch, NRR

~

W Q

inn 88@p '

-___ _-._- - _- --__ _ ______ -

' '

'

...

.

TABLE OF CONTENTS PAGE 1.0 I NTR ODU CT I ON AN D S UMMAR Y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I 1.1 Ba c kg round a nd Pu rpo s e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I 1.2 Inspection Effort and Report Organization ..................... 1 1.3 Summary of Inspection Activities and Findings by Discipline ... 2 1. Instrumentation and Control Discipline ................. 2 1. Mechanical Systems Discipline .......................... 3 1. Electrical Power Discipline ............................ 5 1. Mechanical Components'01scip11ne ....................... 6 1.3.5 Ci vil Structu ral Di s ci pl i ne . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 2.0 IhSPECTION FINDINGS INDICATIVE OF LICENSEE WEAKNESSES ......... 7 2.1 Design Verification ........................................... 7 2.2 Design Modification Interface Control / Design Process Control... 9 2.3 Safety Evaluations ............................................ 11 2.4 Slow FSAR Updating ............................................ 12 3.0 INSPECTION FINDINGS INDICATIVE OF LICENSEE STRENGTHS .......... 12 3.1 Control of Design Input ....................................... 12 3.2 Design Modification Control ................................... 12 3.3 Procurement of Safety-Related Electrical Components ........... 13 APPENDIX A - PER50 TINEL CONTACTED ................................... A-1 APPENDIX B - MODIF4 CATIONS REVIEWED BY THE INSPECTION TEAM ......... B-1 APPENDIX C - FINDINGS .............................................. C-1

.

9,

_ _ . _ _ _ . _ _ _ _ _ . . _ _ _ _ _ _ _ _ _ _ _ _ . . _ = _ __ . _ - _ _ .:..._.. .____- _______ _ _ _ __ -

' *

..

.

.. INTRODUCTION AND SUMMARY B_ackground and Purpose 1.1.1 Background The Nuclear Regulatory Comission (NRC) initiat*d the Safety System Outage Modification Inspection (SSCMI) Program in 1985. This program generally '

consists of two team inspection activities (1) an outage design inspection to evaluate planned design changes and modifications against regulatory requirements and licensee commitments; and (2) a preoperational readiness inspection to ensure plant readiness for startup through review of licensee controls, inspection of turnover package closecuts, verification walkdowns of installed systems, and observation of selected inprogress testin .This report describes the activities and findings associated with the first phase of the SSOMI Program - the outage design inspection of North Anna Power Station, Unit Some of the items identified by the team may be potential enforcement finding Region 11 will identify and execute any required enforcement action .1.2 Purpose The purpose of this phase of the SSOMI Program was to examine, on a sampling basis, the detailed design and engineering required to support plant modifica-tions planned during the current refueling outage. This assessment addressed the technical adequacy of modifications to ensure that the licensee had not vio-lated any licensing commitments or regulatory requirements by designing and installing the modifications. Appendix B contains a complete list of all modification packages reviewed by the tea .2 Inspection Effort and Report Organization 1. Inspection Effort .

NRC personnel conducted the inspection, with contractor assistance, at the licensee's engineering offices in Richmond, Virginia, during February 13 through 17 and February 27 through March 3, 1989. Inspection team members-visited the North Anna site on March 1, 1989. Selected team members provided technical expertise and experience in each of the engineering disciplines evaluated during the inspection. Inspection activities concluded on March 3, 1989, with an exit interview held at the licensee's engineering offices, that was attended by those persons noted in Appendix l The SSOMI design inspection primarily emphasized the adecuacy of design details or products as a means of measuring how well the design pt wess had functione l The team inspected five engineering disciplines within the scope of the project: 1

,

l instrumentation and controls, mechanical systems, electrical power, mechanical  !

/

components, and civil / structural.

I i -1-l

_ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

__

.v- .

j

.. I i.2.2 Report Organization j l

This inspection report is organized to present the team's findings in a femat that will facilitate its use by different groups of readers with varied interests and responsibilities. Section 1.3 provides an overview of the team's cctivities and a sunnary of major findings organized by discipline. Sections 2 and 3 analyze the effectiveness of the licensee's design effort in terins of weaknesses and strengths, respectivel l Three appendices are attached to the body of the report. Appendix A lists personnel contacted during the inspection, and Appendix B lists all modifica-  ;

tion packages reviewed. Appendix C lists specific deficiencies organized by I discipline and documented in detail to aid in their resolutio i 1.3 SummaryofInspectionActiviI1es'andFindingsbyDiscipline 1. Instrumentation and Controls Discipline ,

l The team reviewed the following design changes (DCs), engineering work requests '

(EWRs) and jumpers (i.e., temporary modifications) in the instrumentation and j controls discipline: 1 (1) .DC 84-036-3 Addition of eight pressure transmitter loops, four temperature loops and four flow loops in the service water syste (2) DC B4-043-3 Complete instrumentation tie-in of the service water spray array (3) DC 85-050-2 Addition of two, three phase relays for 4-kV

,

,

undervoltage protectio .(4) DC 87-012-2 Addition of ATWS system which would react after a connon mode failure of the reactor protection syste (5) DC 87-025-2 Addition of position in'dicator lights on the main control board for pressurizer spray valve (6)- DC 87-029-2 Addition of flow transmitter and square root extractor in the charging flow loop and change in instrumentation r4nges for control room indicatio (7) DC 88-004-2 Elimination of reactor trip on turbine trip below .,

30 percent powe (B) DC 88-012-2 Addition of pemanent reactor vessel level monitoring in the control room to be used when reactor vessel head is remove (9) EWR 87-649 Replacement of motor-operated valve actuator due to inadvertent overthrustin '

(10) EWR 87-658 Change in safety injection valve actuator gear ratio to improve stroke tim _ _ - _ - _ -

. _ _ _ _ _ _ ._ _ _

-

l,

.

(11) Jumper 842 Removal of temporary modification which eliminated a nuisance alarm associated with an inaccessible ,

stuck limit switc (Note that this was the only l temporar I outage.)y modification scheduled to be worked this j In general, the team deteruined that VEPCO's program for performing design changes and modifications to the facility was adequate. Proper reviews were being performed and the design work appeared to be performed with adequate contro ,

System interfaces were taken into consideration where required and appropriate j attention was paid to regulatory requirements. The team found that design- j

! related evaluations demonstrating compliance to Appendix R to 10 CFR 50, 10 CFR 50.59, ALARA, GDC-17 of Appendix A to 10 CFR 50 and electrical load growth were done in a detailed manner. The station jumper program was effective in con-i trolling and reducing temporary modifications, and the setpoint program effec-tively prevented unauthorized setpoint change Where the team identified weaknesses, those weaknesses usually appeared to result from poor engineering judgment or a less than full understanding of the problems identified due in part to a lack of staffing, rather than from overall weaknesses in VEPCO's design change programs. However, two programmatic weak-nesses were identified. First, the team identified the need for an instru-mentation setpoint procedure for establishing a consistent setpoint calculation methodology. Second, post-modification testing needed to be specified in the design change packages and engineering work requests to ensure engineering agreement with the testing required to demonstrate functionality of all affected equipmen Also, the team's review of specific modification packages identified weaknesses in VEPCO's design,and procurement of motor-operated valves (MOVs) in that certain service kater system MOVs had been specified for a design differential pressure that was too small. Associated with this MOV issue, the team identi-fied that the plant operators were not adequately trained with regard to operation of the service water bypass MOVs and that the simulator had been improperly modified to reflect operation of the. service water bypass MOV Finally, the team found that a non-Class IE transmitter on the service water system was improperly isolated from the Class 1E power suppl .3.2 Nechanical Systems Disciplines The team reviewed the following design changes and engineering work requests in the mechanic 61 systems disciplin *

(1) DC B4-043-3 These DCs involved the addition of the new .

DC 84-031-3 service water system spray array DC 84-036-3 (2) DC 84-070 Fitting insulation around the pressurizer safety /

relief valves to minimize waterhammer effects in downstream piping. if valves ope (3) DC B4-072-2 Upgrading of pipe supports for pressurizer safety / relief valve discharge pipin ,

_ _ _ _ _ - _

,

..

.

.

(4) DC 86-010-2 Removal of large-bore snubbers from primary coolant piping as a result of leak-before-break analysi (5) DC B7-026-3 Reinstallation of steam generator downcomer flow resistance plat (6) DC 88-004-2 Elimination of reactor trip on turbine trip below 30 percent power.

i (7) EWR 86-695 Removal of a block wall around the iodine filter unit in the containment ventilation system to permit changing of the filte (8) EWR 87-022 Installation of isolation valve and calibration tee for charging pump auxiliary oil pump pressure switche (9) EWR 88-112 Replacement of safety injection accumulator vent valves with environmentally qualified valve (10) EWR 88-329 Installation of thermocouple on safety injection lines and pressurizer surge line to detect cold piping to prevent excessive thermal stresse (11) EWR 88-330 Addition of vents to ensure that the charging pumps have a flooded suction to prevent cir bindin (12) EWR 88-357 , Inspection / replacement of nonsafety-related

"

feedwater piping to ensure an acceptable wall thickness considering erosion /ccerosion effect (13) EWR 89-036 Addition of diesel-driven air compressor EWR 89-036B and instrument air dryer in the instrument air syste ' Overall, the team found that the licensee's modification programs appeared to be well controlled and effective in implementing the principles of 10 CFR 50, 1 Appendix i thedesignchange(DC) process The programs and the engineering consisted of two primary)

work request elements:

(EWR proces The DC was generally used for" the more extensive modifications and the EWR for the smaller projects. The team reviewed the procedures controlling both processes (Procedures STDGN-001,  !

R2 vision 8 and ADM-3.7, dated November 1, 1988, respectively) as well as a l sample of modification packager nf both type The team found that the procedures appeared to have the proper level of detail to ensure that modifications were correctly performed in a controlled, uniform manner. The team observed that the procedures appeared to provide the proper c::ntrols in areas that are often poorly controlled, such as setpoint changes and replacement equipment equivalerec . _ - _ - ___

- __ _ _ - _ .__

s

'_

.

.

One weakness in the EWR procedure was observed by the team. Although the procedure required the originator of a modification to consider the ALARA aspects of installation, it did not require consideration of the ALARA aspects of the modification itself; that is, how operation of the plant with the completed modification might increase the radiation exposure of plant personnel and the general publi Another aspect of the modification process, 10 CFR 50.59 safety evaluations, appeared to be well covered by the recently revised procedure ADM-3.9, dated October 11, 1988. However, as evidenced in Finding MS-3 there were indications that what was required to perform a complete, comprehensive safety evaluation clas not yet universally understood by persons who must perform the The team also observed that there. appeared to be an inordinate number of revisions to many of the design changes reviewed. Although most of the changes tere minor, such as dimensional changes, corrections for physical interferences, and changes to installation or testing procedures to correct for some unfore-seen obstruction or difficulty, the number of changes seemed to indicate that there was insufficient attention to detail in the initial planning and genera-tion of the modification package .3.3 Electrical Power Discipline The team reviewed the following design changes and engineering work request; in the electrical power disciplin (1) DC 83-024-2 Addition of redundant fuses to prevent a fire in the main control room from adversely affecting emergency diesel generator operatio (2) DC 85-030-2*,. Replacement of station batterie (3) DC 88-005-3 Addition of third reserve station service transformer

'

to provide a back-up source of power for the 34.5 Kv transforme ,

(4) EWR 89-036 Addition of diesel driven air compressor to the instrumentation system.

I As stated previously the design change was used for major plant modifications, cnd the engineering work request was used for minor modifications. Both types of modification packages contained the required design change information, installation instructions, and test procedures in sufficient detail to permit implementation of the modification as described in the DC or EWR. The DCs and EWRs reviewed by the team were comprehensive and well documente Each package l provided a high level of assurance that the design changes would meet the applicable licensing requirements and achieve the objective of the change without changing the plant design basi l The team reviewed the planned design changes and modifications, the electrical design bases, and plant design margins. The scope of the review also included a verification that (1) adequate safety evaluations wEre performed to ensure that no unreviewed safety question existed, (2) independent design verifica-tions were performed as required, and (3) post-modification tests were adequate and included acceptable acceptance criteria.

,

-5-l

_ _ - _ _ _ _ _ _ _ _ _ _ - _ - _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _

_ _ _ _ _ _ _ _

_- _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ - - _ _

.' t

.

.

In general, the calculations that supported the modifications were documented in accordance with American National Standards Institute (ANSI) Standard N45.2.11. However, the team did note that the calculations supporting the switchyard modifications did not meet one or more of the following minimum requirements: 1) acequate references for design inputs, (2) evidence of r view, and (3)(sumary of calculation result The team identified two findings as a result of the electrical power system review. First, the team identified that the 4.16-kV vital bus feeder breaker was not coordinated with its two downstream 480-Volt load center feeder breaker This finding would have resulted in the loss of one complete safety division; it was the result of poor design practice and failure to meet VEPCO's comitment to Institute of Electrical and Electronics Engineers (IEEE) Standard 308. The second finding identified that VEPCO improperly dispositioned a quality control inspection report involving the routing of a nonseismic conduit over one of the fcur sets of station batteries. This finding raised concerns regarding adequacy of the review process both within the engineering organization and the station's 10 CFR 50.59 review proces .3.4 Mechantcal Components Discipline The team reviewed the following design changes and engineering work requests in the mechanical components discipline:

(1) DC 84-072-2 Upgrade of pipe supports for pressurizer safety /

relief valve pipin (2) DC B4-065-3 Branch connections added to help monitor service water corrosio '

(3) DC 86-010-2 ' Removal of large bore snubbers from primary coolant piping as a result of leak-before-break analysi (4) EWR 87-022 Installation of an isolation valve and calibration tee for charging pump auxiliary oil pump pressure switche (5) EWR 87-671 Modification of a snubber support baseplate to enlarge hole The modifications evaluated by the team involved a review of the associated piping stress analysis and pipe support designs. The majority of the calcula-tions reviewed were perfomed by VEPCO's contractors, either Stone and Webster Engineering Corporation or Westinghouse. These calculations, in general, wer technically adequate and supported the objective of the modification. However, the team did identify one VEPC0 performed calculation where significant reanalysis was required to substantiate the modification (i.e., EWR 87-671) and was viewed to be an example of inadequate design review within the engineering organization. Overall, the team concluded that VEPCO's modification process in the mechanical components discipline was technically adequat .3.5 Civil / Structural Discipline The team reviewed the following design changes in the civil structural discipline:

-6-

- _ _ - _ _ _ - _ - _ - _ _ _ _ - _ - l

- __ - _ _ -.

+

.

y

.

.

(1) DC 84-031-3 Addition of servic water reservoir spray and bypass pipin (2) DC 84-035-3 Service water valve house structural analysis and desig (3) DC 84-043-3 Service water rese-voir improvements, final systemstie-ins (electrW1/ mechanical).

(4) DC 84-037-3 Service water reservoir improvements, buried pipin In general the team found that the design changes were properly prepared and procedurally controlled. The calculations reviewed were performed by Stone and Webster Engineering Corporation as well as by VEPCO. The team was satisfied with the quality and content of the calculation The only weakness identified concerned timeliness in updating the final safety analysis report (FSAR). Specifically, the FSAR changes noted in design change 84-43-3 had not yet been mad Additionally, the team interviewed VEPC0 site personnel to evaluate how effectively engineering work requests and field change requests were processe The team concluded that the site personnel initiated and executed those requests in accordance with the existing procedures and guideline . INSPECTION FINDINGS INDICATIVE OF LICENSEE WEAKNESSES 2.1 Design Verification Design verification is the process of reviewing, confinning, or substantiating the design by one or more methods. When design reviews are used as the method of verification, the objective is to evaluate whether: (1).the inputs are correctly selected and incorporated in the design; (2) applicable codes, stan--

dards, and regulatory requirements are satisfied; (3) an appropriate design method is used; and (4) the design is suitable for the applicatio During the inspection, the team assessed the quality of design verifications through'the review of modification package details. This assessment revealed a weakness in the implementation of the design verification process, which ,

suggested a need for greater attention'to detail. Errors included: (1)

incorrect sizing of service water motor-operated valve actuators; (2) improper, isolation of nonclass 1E instruments from their Class IE power supply (3) -

-

inadequate design review of baseplate bolt hole enlargements, and (4) inade-quate breaker coordination between safety class buses. The following sections describe examples that demonstrate areas of weakness in the licensee's design verification process.

l

'

2.1.1 Incorrect Sizing of Service Water Motor-Operated Valve Actuators l The team reviewed Design Change 84-043-3 and questioned VEPCO's justification of the 50 psi differential pressure used for sizing the service water valve actuators. VEPCO confirmed that the 50 psi differential pressure was too low and with Limitorque reanalyzed the actuators using 100 psi differential k-7- \

- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ .

- _ _ _ _ _ _ _ _ _ _ _ _

'

.

.

pressure. The new calculation indicated that the installed actuators would not be able to deliver the required torque under the previously assumed 70 percent voltage condition. Additionally, the torque output of the motors would be limited by the actuator torque switch which had been set at a value coinciding with a valve differential pressure of 50 psi. As a result, several of the service water spray and bypass valves may not have operated as required under all design-basis conditions. The team considered this to be a safety-significant issue requiring resolution of the specific concern, and a review of all valves procured and designed by VEPCO since the facility was license VEPCO's response documented in a letter dated April 28, 1989, confirmed that they had reviewed all safety-related MOVs that they had replaced or modifie The results of that review revised some torque switch settings and replaced actuator spring packs but, in general, concluded that all Unit 2 MOVs replaced er modified have been verified to' meet differential design pressure and torque requirement ,

2.1.2 Improper Isolation of honClass IE Instruments From Class 1E Power Supply In the review of Design Change 84-036-3, the team identified that eight non Class IE pressure transmitters were connected to vital. instrument power buses without proper isolation. A nonClass 1E fuse block was used for isolation instead of a qualified Class 1E isolation device. A fault in the nonClass IE portion of the system could potentially degrade the class IE power suppl VEPCO's responses of March 31 and April 28, 1989, indicate that qualified isolation devices would be installed and that all modifications installed during the current outage would be reviewed to avoid similar problem However, VEPC0 has only committed to review this issue back until April 198 It is the team's position that all similar isolation practices at North Anna need to be identified and corrected prior to the end of the next refueling outage. This matter will be the subject of a meeting between VEPCO and the NRC

"

staf .1.3 Inadequate Design Review of Engineering Work Request EWR 87-671 enlarged the pipe support baseplate holes to facilitate installation during maintenance activities. The disposition'of the associated field request indicated that the pipe support calculation had been reviewed and that the holes could be enlarged. The inspection team reviewed the subject pipe support

,

'

calculation and identified that no design margin existed to justify enlargement of the baseplate holes. A reanalysis perfonned by VEPC0 after the inspection team identified the concern, demonstrated that the existing design was

,

adequate. However, the original disposition did not have adequate justifica-tion for permitting the change to be made. Therefore, VEPC0 is requested to '

sample 10 pipe support field change requests, randomly selected, to ensure ..

similar problems with design verification do not exist elsewhere in the facility. Also, VEPC0 needs to address what prograner,atic controls are in place to ensure proper review of field change request .1.4 Lack of Breaker Coordination Between Class IE Buses VEPCO's Electrical Distribution Coordination Study identified that the 4-kV vital bus feeder breaker was not coordinated with its downstream 480-Y load center feeder breakers, but concluded that the unit could be safety shutdow B-

_ - - _ _ - - -

_ _ _ _ _ _ _ _ _ _ _ _ _ _

_

. t 48-

,

However, the inspection team was concerned that a fault in one of the two '

' 480-Volt load centers would result in loss of both due to improper breaker

. coordination, resulting in the loss of one total electrical division. This lack of breaker coordination was indicative of a poor design practice and improper design verification. VEPCO was requested to review the subject breaker coordination to detemine if the relays could be reset to provide adequate coordinatio .2 Design Modification Interface Control / Design Process Control Modifications were controlled at North Anna through the procedures for design changes, engineering work requests and jumpers (i.e., temporary modifications).

Generally, the design change was utilized for the more significant modifica-tions and the engineering work requests for smaller projects. As a result of this. inspection, the team identified weaknesses in VEPCO's modification inter-face and design process control program: a plant change was not. incorporated into operator training program and also was modeled incorrectly on the simulator, no methodology existed for evaluation of the effect of plant changes on instru- (

mentation setpoint values, and post-modification testing did not perfom all necessary functional testing subsequent to installation of the modificatio These and other examples are also discussed belo . Inadequate Operator Training and Simulator Modeling The addition of the new service water system also resulted in the addition of bypass valves which did not have a " seal-in" circuit. Therefore, the switch ,

had to be held in the open position for the valve to open. VEPC0 documented in

'

Deviation Report 87-1405 an instance in which the bypass valves were thought to be fully open by the operator but were only partially open. Deviation Report 87-1405 identifigd that the most probable cause of the bypass valve not opening cas failure of the operator to hold the valve's switch in the open positio The inspection team identified that the training received by the operators on the service water system did not specifically address operation of the bypass .

'

valves. Additionally, when the simulator was changed to reflect the new service water system configuration, the bypass valves were incorrectly modeled with switches that required only momentary contact to fully open the bypass valve Therefore, neither VEPCO's specific training guidelines nor the simulator aided the operators understanding of how the bypass valves were controlle .2.2 Lack of Programmatic Controls for Performing Setpoint Calculations

'

In its review of DC 87-029-2 which was issued to change instrument ranges, the team identified various errors in the loop accuracy calculations. These errors included the following: omission of measuring and test equipment accuracy, '-

assumptions were not verified, and the instrument range change was not evaluated f for its effect upon the associated setpoint. Also the team was concerned that VEPC0 had been making hardward changes to instrument loops without the proper evaluation of the effect on the setpoint and assor.iated safety margin. VEPCO was requested to review 10 specific setpoint calculations to ensure that the safety margin had not been adversely affected. The cause of these omissions was viewed by the inspection team to be the lack of an approved procedure for performing setpoint calculations and an unawareness of when setpoint calcula-tions need to be revisite . _ _ _ - -

. ,.

.

.

.

VEPCO's response of April 28, 1989 confimed that the review of the 10 satpoint calculations was complete and where safety limits were applicable, the associated setpoints had a demonstrable margin of safety. - Also in the response of March 31, 1989 VEPCO comitted to review plant modifications installed during this refueling outage to assure that setpoint changes were

. properly performed and comitted to develop a procedure for perforsing satpoints calculation .2.2.3 Post-Modification Testing Requirements not Included in Change Packages

!'

'In its review of DC 87-012-2 for ATWS system installation, the inspection team noted that design change packages did not explicitly prescribe the necessary -l'

testing required to demonstrate functionality of the system and affected components following the change. Adequate modification control was not in place since the team identified two examples where the specific post-modification testing was being perfomed prior to the installation of the design change, '

Therefore, to ensure that modifications installed during the current outage were functionally tested subsequent to installation and to ensure that the capability of the affected systems to mitigate the design basis accidents had not been comprised. VEPC0 was requested to incorporat6 the specific post-modification  ;

tasting requirements into the design change packages and EWRs scheduled to be i installed for the 1989 outage. Additionally. VEPC0 committed to update the l associated design change procedures to ensure that the required testing would >

be accomplished subsequent to the installation of future modifications. The purpose of including the post-modification testing requirements in the modifica-tion packages is to ensure that the engineering organization establishes the required scope of post-modification testing and that the site test group then  ;

selects and schedules the types of specific testing procedures to meet the

'

testing objectives. At North Anna it appeared to the team that the site testing group was establishing the required scope of testing in lieu of the engineering organizatio .2.4 Too Many Revisions to Design Change Packages ,

The team observed that there appeared to be an inordinate number of revisions i to many of the design changes reviewed. Although most of the changes were minor, such as dimensional changes, corrections to account for physical inter-ferences, and changes to installation or testing procedures to correct for some unforeseen obstruction or difficulty, the number of changes seemed to indicate that there was insufficient attention to detail in the initial planning and 1 generation of the modification package .2.5 Engineering Work Requests - ALARA Considerations .

The engineering work request procedure required the originator of a modification i

!

to consider the ALARA aspects of installation. The procedure did not require consideration of the ALARA aspects of the modification itself; that is, how operation of the plant with the modification completed might increase the i

!

radiation exposure of plant personne J

_ -- _ - - - - - - - - - - - - _

. ;.

.

l

.

2.2.6 Failure to Comply With Comitment Made in Response to a Previous J

hRC Violation

Violation 87-32-03 in NRC Inspection Report 50-338/87-32 and 50-339/87-32 cited I VEPCO for failing to address effects such as leakage currents in total loop instrument accuracy calculations. In its response dated May 19, 1989, VEPCO ;

comitted to revise the associated engineering standard by August 31, 1989 J to preclude further problems. During this inspection the team reviewed the 1 Design Change 87-29-2 associated with the installation of a charging flow differential pressure detector. The team reviewed the associated calculation l for detemining the instrument loop accuracy, which was perfomed 5 months l

' after the engineering standard was revised (i.e., February 10,1989)and i identified that it did not consider current leakage in a postulated harsh l environment due to degradation of the cable insulation system. This is an example of improper comitment implementation in that the progranvr.atic controls .

were in place but the design process result was unsatisfactory. After VEPCO became aware of this concern, the calculation was corrected with no detrimental effect. However, VEPC0 is requested to review other previous changes to the facility which may have affected instrumentation loops located in a harsh environmen .3 Safety Evaluations Licensees may make changes to the facility without prior Comission approval providing the proposed change does not involve a change to the technical specifications or an unreviewed safety question. Safety evaluations are performed to ensure that the aforementioned requirements are met. -The team was satisfied with the level of detail in the safety evaluation checklist (i.e., Attachment 1 to Administrative Procedure ADM-3.9, October 11,1988). I However, the team was concerned that VEPC0 did not correctly implement the safety evaluation procedure for the two following examples and consequently VEPC0 may not codpletely understand the requirements for perfomance of safety evaluation .3.1 Safety Evaluations for Removal of Block Wall and Effects of NonSafety-Related Equipment ,

Engineering Work Request 86-695 removed a portion of a block wall around the t iodine filter unit. The associated safety evaluation only considered the f effects of the wall removal of the function of the iodine filters. It failed to address the effect on radiation shielding on personnel / equipment and the effect on the original intended function of the wall. Engineering Work Request 89-036 and 89-036B aoded a diesel-driven air compressor and an air dryer, respectively, to the instrument air system. In the safety evaluation for both EWRs VEPC0 reasoned that since no safety-related equipment was modified, no .

unreviewed safety question was involved. The team noted that whether or not safety-related equipment was being modified is not the only criteria by which to judge whether or not an unreviewed safety question was involved. A simple example of nonsafety-related equipment located over and potentially falling on safety-related equipment denionstrates the flaw in that logi I-11-

_ _ _ _ _ _ - - _ _ - _ _ -

.

.

2.3.2. Safety Evaluation Failed to Identify Obvious Error in Disposition of Quality Control Inspection Report (QCIR)

The inspection team reviewed the design change (DC 85-030-2) associated with the replacement of station batterie Included in the design change package was a QCIR which identified that a nonseismic conduit was routed directly above one of the station batteries. The disposition of the QCIR by engineering was use-as-is with the justification that only one of the four channels would be lost during a seismic event. The inspection team identified that an improper engineering design verification was performed and that a properly perfonned safety evaluation should have identified the disposition as unaccept-able. Subsequent to the team's finding VEPC0 performed a seismic qualification of the electrical conduit to demonstrate that one battery channel was not lost during a seismic event. However, this subsequent justification did not resolve the concern that the safety evaluation should have identified the OCIR disposi-tion error, which was due to either a procedural shortcoming or inadequate revie .4 Slow FSAR Updating The team noted in its review of Design Change 84-43-3 that FSAR changes were identified for various revisions from July 1986 to June 1987. However, none of these changes were incorporated into the FSAR at the time of the inspectio VEPCO is required to submit FSAR changes no less frequently than annually for all changes made up to a maximum of six months prior to the date of filin . INSPECTION FINDINGS 1hDICATIVE OF LICENSEE STRENGTMS During the inspection, the team evaluated many design change packages and EWRs as identified in4ppendix A including the removal of one jumper. Some problems were identified, however, the majority of positive findings led the team to conclude that, in general, controls were in place to result in an adequate design product. The team also found the licensee engineering staff to be technically knowledgeable and in general, familiar with the North Anna facility. The following sections discuss examples of licensee. strength .1 Control of Design Input The team found that the licensee's modification packages were supported by detailed, comprehensive design requirements. These documents provided adequate design-basis data and adequate procedural control existed to ensure the preparation, review and approval requirements were met. Where calculations existed, the team observed that the stated purpose was effectively supported.by the analysis and documented in such a manner that an independent review could'*

be readily performed. Contractor performed calculations were generally thorough, especially those reviewed in the mechanical components discipline, and demon-strated a good design communication process between VEPC0 and the contracto .2 Design Modification Control Contrary to the previously concerns described in the design modification interface /

design process control section, overall the team felt that the procedures governing the control of design modifications were quite good. The team was impressed with the coordination reviews performed for design changes at the 30 percent and 70 percent

'

-12-l

__ _ _ _ _ .

=

l .*

.

.

I conceptuhl completion levels which demonstrated good internal coordination between all affected organizations (engineering, installation, test, operations, etc).

'

Additionally, VEPC0 was performing the majority of modifications itself (approx-imately 80 percent) with the balance contracted, primarily to the original architect-engineer. The changes were supported by a competent engineering organization, centrally located in Richmond, but well represented at the site and available to the facility. The temporary modifications (i.e., jumpers)

were well controlled and virtually nonexistent since only one was being worked during this outage and that was for remova .3 Procurement of Safety-Related Electrical Components

'l The team reviewed Design Change 87-12-2, "ATWS Mitigation System Actuation i Circuitry (ASKAC)" and identified.it as an example of an acceptable procurement !

process. The review concentrated on the procurement of the ASMAC panel to be used in the new ATWS System. The panel was purchased by VEPCO as safety i related with 10 CFR Part 21 and Appendix B to 10 CFR 50 invoked on the purchase )

crder. The panel was purchased from United Controls, who in turn procured the i safety related output relays from Electroswitch. The output relays were seismically qualified to Electroswitch Qualification Test Report 2983-3,

" Qualification Inspection of Series 24 LOR, LOR /ER, and LSR Auxiliary Relays and Lockout Relays." The procurement of this panel was found to be well planned ;

and effectively implemented by the cognizant VEPCO personne ..

.

.

.

l l-13-

_ _ _ _ _ - - _ - - - - - - _ _ . - - - - l

_ _ _ _ _ _ .__

... ..

., ..

. i

e '!

L APPENDIX A PERSONNEL CONTACTED NAME POSITION T. Abercrombie Electrical Engineer )

R. Berryman Manager - Nuclear Analysis & Fuel 1 G. Bischof Staff Engineer, Civil / Structural j CD. Blakenship .

Senior Staff Engineer. Electrical - I&C ,

'R. Boehling Project Engineer - Nuclear cP..Boulden ,

North Anna Power Station, System Fngineer

• M. Bowlin *

Assistant Station Manager  ;

P. Bradley Electrical Engineer '

P. Buhl Engineer. Electrical Engineering

• R. Calder Manager, Nuclear Engineering

• R. Carroll Nuclear Engineer 8ti. Cartwright Vice President - Nuclear

• D. Compton Senior Staff Engineer - Civil /Eng. Mec G.'Darden Nuclear Engineer-

• J. Davi Manager Nuclear Site Services B. Douglas Senior Construction Specialist B. Dunlap Project Engineer - Nuclear K. Dwivedy System Engineer Civil /Eng. Mec CM. Gettler Superintendent - NSS

• D..Glasska Senior Engineer (SEO) - Mechanical

'J. Graf- Electrical Engineer S. Harvey Electrical Engineer D. Heacock ,

Superintendent - Engineering

• J.-Hegner- Supervisor - Licensing B. Hill Electrical Engineer l R. Hurd Staff Engineer, Site Purchasing t B.. Jones QC Supervisor

• J. - Leberstein Licensing Enginee J. Lewis North Anna Power Station System Engineer

• MacCrimon Supervisor - Civil Engineering

• J. Maciejewski Manager. Quality Assurance D. Madden Senior Engineer - Civil /Eng. Mec F. McLaden North Anna Power Station - Maintenance Engineer G. Midas Project Engineer - Nuclear

'

• Miller Electrical Engineer

• Moore Vice President - Power Engineering Services W. Murray Nuclear Engineer -

G. Pannell Director, Licensing Group R. Pay 11k Senior Staff Engineer - Civil /Eng. Mec M.-Phillips Electrical Engineer (Power)

M. Pinion Project Engineer - Nuclear '

i A-1

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ .

- _ _ .

.e

[ .

i APPENDIX A PERSONNEL CONTACTED - CON NAME POSITION C. Ranganath System Engineer - Civil /Eng. Mec *R. Rasnic Supervisor - Mech./ Nuclear En J. Regic Senior Staff Engineer

• R. Riley Supervisor - Project Engineering C. Robinson, Jr.- Manager, Civil Engineering M. Sartain Project Engineer - Nuclear N. Smith

-

System Engineer - Nuclear Fuels

• W. Stewart Senior Vice President - Power K. Stacy Electrical Engineer R. Sturgill North Anna Supervisor of System En E. Taylor Staff Engineer - Mech./ Nuclear

• W. Thomas , J Senior Staff Engineer - Mech./ Nuclear

• W. Thompson Manager Electrical Engineering J. Thornton Staff Engineer - Civil / Structural M. Vick Electrical Engineer A. Vig Senior Staff Engineer - Civil /Eng. Mec M. Weeks Contractor to VEPCO L. Wroniewiz Supervisor - North Anna Site En C. Zalesiak Staff Engineer - Civil Eng./Eng. Mec * Attended Exit Meeting s'

I

.

O

!

A-2

- _ _ _ _ _ _ _ _ _ - _ _

-. ,.

..

.

.-

APPENDIX B DESIGN CHANGES (DC), ENGINEERING WORK REQUESTS (EWR)

AND JUMPERS REVIEWED BY THE INSPECTION TEAM SDC 83-024-2 Appendix R. Emergency Diesel Generator

• DC 84-031-3 Reservoir Spray and Bypass System

• DC 84-035-3 Valve House Structural Analysis and Design

• DC 84-036-3 Valve House Electrical, Mechanical and Final Structural

• DC 84-37-3 Buried Piping DC 84-043-3 Service Water Reservoir Improvements Final System Tie-In and Startup,  !

DC 84 o/0 Pressurizer Oven Installation, Rework  !

DC 84-072-2 Pressurizer Safety and Relief Valve Discharge !

Pipe Support Modifications  !

DC 84-085-3 Pipe Preservation - 14 inch Ccmponent Cooling !

Heat Exchanger Branch

• DC 85-030-2 Replacement of Station Batteries 0DC 85-050-2 Emergency Bus Undervoltage Relay Replacement i DC 86-010-2 Large Bore Snubber Leak-Before-Break Modifications DC 87-012-2 ATWS Mitigation System Modification 4 DC 87-025-2 Control Room Design Review - Pressurizer Spray Valve Indicator Lights cDC 87-026-3 Steam Generator Downcomer Flow Resistance Plate Installation DC 87-029-2 Control Room Design Review - Installation Range Changes DC 88-004-2 Eliminate Reactor Trip on Turbine Trip Below 30 Percent Power DC 88-005-3 ,- Installation of Third Reserve Station Service Transfonner DC 88-012-2 Reactor Coolant System Level Indication EWR 86-695 Iodine Filter Upgrade EWR 87-022 Install Isolation Valve and Calibration Tee

for Charging Pumps

• EWR 87-649 Evaluate Overthrust of a Charging MOV Actuator

• EWR 87-658 Safety Injection MOV Failed Its Stroke Time

• EWR 87-671 Modify Snubber Support Base Plate EWR 88-112 Replace Safety Injection Accumulator Solenoid Operated Valves EWR 88-329 Installation of Instruments in Response to NRC Bulletin 88-08 EWR 88-330 Charging Pump Air Binding ..

'

EWR 88-357 Feedwater Pipe Replacement EWR 89-036 Install Diesel-Driven Air Compressor EWR 89-036B Install Instrument Air Dryer (DRAFT)

Jumper 842 Alann In Control Room for an Inaccessible Stuck Limit Switch

• Indicates that DC or EWR was installed during previous outage i

i B-I l

l o-_____----.-- a p

..

'

...

' APPENDIX C FINDINGS Nomenclature / Contents: , Pag a

IC -' Instrumentation and Control System Findings' C-l '

MS - Mechanical Systems Findings C-9 EP - Electrical Power Systems Findings C-12 MC - Mechanical Components Findings C-14 CS -' Civil / Structural Findings C-15 FINDING IC-1:- Incorrect Differential Pressure Used in Sizing Service Water Reservoir spray and Bypass System Isolation Valves. (Unresolved Item 89-200-01).

Discussion:

The inspection team. reviewed the portions of Design Change 84-43-3 pertaining

- to the installation of the new service water reservoir spray and bypass system isolation valves. Specifically, the review concentrated on the methodology and assumptions siade in sizing the motor actuators for those specific valve During the. review, it was noted that VEPC0 Specification No. NAS-2018 referred to a maximum differential pressure rating-of 50 psi which was used by the valve-vendor in sizing the subject' actuators. In response to the inspection team's concerns, VEPCO Mas unable to provide a justification for the 50-psi maximum differential pressure. VEPC0 calculations performed during the inspection

. indicated that a differential pressure of approximately 100 psi could exist across the affected valves at a pump shutoff head condition. The inspection

team then expressed concern that the valve actyators, sized for a differential pressure of.50 psi, might not be able to open or close the affected valves should the differential pressure be above the assumed 50 psi. It'should be noted that valve thrust requirements are proportional to the differential pressure across the valve. VEPC0 in conjunction with Limitorque, then perfomed calculations in order to detemine if the actuators could still stroke the subject valves with an' assumed differential pressure of 100 psi

.

l (pump shutoff head). The new calculations indicated that the installed actuators would not be able to deliver the required torque to the subject valves under the previously assumed 70 percent voltage. Additionally, the .. l torque output of the actuators would be limited by the actuator torque switch which had been previously set for a valve differential pressure of 50 psi. As

.a result, several of the service water reservoir spray and bypass system

).

1 solation valves might not have operated as required under all design basis V condition VEPCO's March 31, 1989 response indicated that the service water spray valves needed the torque switches reset and the service water bypass valves needed new spring packs'for their actuators. Since the spring packs cannot be procured prior to restart, VEPCO is instituting administrative controlsVEPCO's to preclude adverse positioning the bypass valves in Modes 1 through C-1

..-

$

~

<

l April 28. 1989 response indicated that they had confirmed the adequacy of all safety-related MOVs that had been replaced or modified for Unit 2. As a result of this generic review, VEPC0 indicated that additional torque switch 4 setting changes were required. This item remains open pending completion of a similar review of Unit 1 MOVs that were replaced or modifie '

.Reculatory Basis:

Criterion III of 10 CFR 50 Appendix B requires that measures shall be established !

to assure that applicable regulatory requirements and design bases are correctly i transferred into specifications, drawings and procedure !

References:

(1) VEPC0 Design Change 84-43-3, " Service Water Reservoir Improvements, Final i System Tie-In and Startup/ North Anna Units 1&2."

'

(2) YEPC0 Specification No. NAS-2018. " Specification for Motor Operated Butterfly Valves for Service Water Reservoir Spray and Bypass .'

System Isolation Valves /horth Anna Power Station Units 1 & 2," Revision '

FINDING IC-2: Setpoint Calculation Omissions and Lack of an Approved Program for Performing Setpoint Calculations. (Unresolved Item 89-200-02).

Discussion:

The team reviewed DC 87-29 issued for control room design review (CRDR)

instrumentation range changes. This DC was issued to change the ranges of a few Class IE transmitters, replace the charging flow transmitters and add a square-root extractor in charging flow loop. The team noted the following: ,,, The loop accuracy calculation performed for the charging flow loop did not include measurement and test equipment (M&TE) accuracy, The accuracy calculation had many unverified assumptions, including allowances for uncertainties in process variables following a design basis-event, calibration period, letoown pressure and charging pressure. Also, the team noted that there was no existing program for tracking and resolving these assumptions before making the modification operabl The effect of instrumentation range changes on the associated setpoints was not evaluate ,.

,

Subsequent to inspection team's finding, VEPC0 engineers performed setpoint calculations for transmitters which had undergone range changes for DC 87-29, and these calculations were acceptabl The team requested to review the plant's setpoint calculations, but only the emergency operation procedure (EOP) indicating instruments uncertainty calcula-tions were provided. These calculations used assumed values of drift instead of vendor-published actual values as related to the surveillance frequency of cach loop. Also, these calculations used assumed values for calibration accuracy.

C-2  :

L___________________

-

.*

\

.

i The team believed that VEPCO should have a corporate procedure for perfoming engineering evaluations of setpuints resulting from design changes. The team '

was informed by VEPC0 engineers that the need of a uniforin corporate level procedure had been previously identified by VEPC0 and was currently being I developed. In addition, VEPC0 indicated that setpoint calculations for all safety-related systems would be reviewed as part of the design bases reconsti-tution (DBR) program scheduled to be completed within the next 3 to 5 year l l

To ensure that safety-related setpoints had not been adversely affected since the plant was licensed and since the DBR program was not scheduled for the innediate future, the inspection team requested VEPC0 to review 10 safety-related I&C loop VEPCO's response of March 31, 1989, committed to develop a controlled procedure for performing setpoint calculations and to review all modifications for this ,

outage to ensure setpoint calculations were properly performed. Also, in the j April 28, 1989 response, VEPC0 confiru d that the 10 setpoint calculations ;

reviewed had no adverse impact on safety limits on the associated margin of safet The inspection team reviewed two administrative procedures EEN-0211 for setpoint documentation and ADM-6.8 for administrative control of setpoint changes. The team noted that VEPC0 had effective control which prohibited unauthorized changes to setpoints and an efficient way for documentation of setpoint change '

This item remains open pending VEPCO's verification of the issuance of approved procecure for perfoming setpoint calculation Regulatory Basis:

CriterionIIIofdppendixBto10CFR50 states,inpart,"Designchanges, including field changes, shall be subject to cesign control procedures commensurate with those applied to the original design...".

ANSI N45.2.11, section 8 Design change control states, in part, " Documented procedures shall be provided for design changes to approved design documents, including field changes, which assure that the impact of the change is care-fully considered....

References:

(1) DC 87-29 (2) VEPCO,SetpointDocumentStandardEEN-0211. Revision 1. November 23,19Bf (3) VEPCO, Administrative Procedure for Sctpoint Changes ADM-6.8, June 26, 1988 i

FIND 1hG 10-3: NonClass IE Loads Connected to Class IE Buses Without Proper Isolatio (Unresolved Item 89-200-03).

l j Discussion:

DC 86-34-3 renovated the common service water system for North Anna Units 182 including installation uf eight pressure transmitter loops, four temperature 1 0-3 w --

- _ _ - - _ _ _ _ _ - _ _

L .;j ' .,. .

.<

.

loops and 4 flow loops.- All of these instruments were classified as nonClass-L 1E. However, the eight pressure transmitter loops were powered from 120-Y ac Class IE vital instrument power buses without proper isolation. . The only isolation between nonClass IE circuits and the Class IE power source was -

a nonClass lE fuse block. In such a situation, a potential existed to

- degradate the Class IE power source due to a fault on the non1E portio Since' this power source fed the instruments of many safety system degradation of the power source might affect the operation of many safety system VEPCO's responses of March 31 and April 28, 1989, committed to providing the appropriate: isolation device for the subject pressure transmitters, as well as. reviewing all modifications to be installed during the current outage and

. making any necessary changes prior to restart. Additionally, VEPC0 committed to review all modifications made since April 1987, update the associated procedure and provide training to the affected personnel.- However, the team believes that a~ complete review of this isolation design practice needs to be-

~

done for the entire North Anna facility independent of modification installa-tion date. This review and any associated changes should be completed prior to the end of the next refueling outage.- VEPC0 has verbally requested the Project Manager to arrange a meeting with the NRC staff to discuss this matte This item remains ope Regulatory Basis:

Criterion III of Appendix B to 10 CFR-Part 50 states in part; " Design changes, including field changes, shall be subject to design control procedures corrrr.en-

.surate with those applied to the original design....

References:

%

'(1) DC 86-34-3 FINDING IC-4: MOV Thrust Calculation not Perforped when Changing Actuator Gear Ratios. (Closed).

Discussion: ,

The team reviewed Engineering Work Request 87-658 which identified that safety injection valve SI-MOV-2867B failed to complete its required stroke in the allotted time. Corrective action was to change the valve actuator gear ratio from 63:1 to 55.8:1. The lower gear ratio would decrease the stroke time of the valve; however, it would also decrease the maximum thrust output of the ..

actuator. No' calculation was performed to dertonstrate that the actuator as configured could still deliver the required thrust to stroke the valve under all assumed design-basis conditions. After the modification, nortral stroke tire testing performed at nominal plant conditions would not be adequate to snsure operation of this valve for all design basis conditions. After the team ioentified this finding VEPCO generated a new calculation for this actuator which showed that the reduced thrust output would still be suffi-cient to operate this valve under all design basis conditions. This item is close C-4

,

.__--___ __ - ___

44g

.

..

..  !

Regulatory Basis:

Criterion III;to 10 CFR 50 Appendix B requires that design changes be subject to measures commensurate with those applied to the original desig References:

(1).VEPCOEngineeringWorkRequest87-658datedOctober 22, 1987 FINDING 10-5: Failure To Report Undersized Service Water Reservoir Bypass Jsolation valve Motor Actuator (Unresolveditem 89-200-04).

piscussion: .

As.part of its review of DC 84-43-3, the team reviewed Deviation Reports 87-1405 and 87-1452 which identified problems with valve motor actuators installed by the design change. Deviation Report 87-1405 was written when'one of the service water reservoir bypass valves failed to close on initiation of a-signal from the control room. As a result, the valve was manually closed and all bypass motor-operated valves were isolated in the closed positio On reviewing the specifications for the affected valvei, a VEPCO engineer

.ncted that the bypass valve motor actuators were apparently undersized. As a result Deviation Report 87-1452 was written on December 22, 1987, documenting the apparent undersizing and recommended replacement of the actuators. On December 23, 1987, VEPCO determined that this deviation was "not reportable" because the bypass valvas were de-energized and locked closed and that flow would have been maintained through all safety-related components if the bypass valves had failed in the open positio %

This' item should have been reportable under 10 CFR 50.72(b)(2)(1) or (iii)(B),

or 10 CFR 50.73(a)(2)(11)(B) or (v)(B) because when the deviation was written, VEFC0 thought that the service water reservoir bypass isolation valves were inoperable because the actuators were undersized.' Although flow would have been maintained to all safety-related components if the bypass valves had failed to close, this situation would be outside the plant design basis which assumes full flow through the service water spray headers. This'1 tem remains open pending justification from VEPCO for not reporting the undersized service water bypass valve motor actuator Reculatory Basis:

10 CFR 50.72(b)(2)(1) requires that a licensee notify the NRC within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> nf

• any event, found while the reactor is shutdown, that, had it been found while

' the reactor was in cperatiori, would have resulted in the nuclear power plant, including its principle safety barriers, being seriously degraded or being in an unanalyzed condition that significantly compromises plant safety."

10 CFR 50.72(b)(2)(iii)(B) requires that a licensee notify the NRC within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of "any event or condition that alone could have prevented the fulfill-l n, tnt of the safety function of structures or systems that are needed to remove residual heat."

,

C-5 j

o n T* 'jg_- t

..

% '

.

.

Similar requirements for 30 day. reports are identified in 10 CFR -;

50.73(a)(2)(ii)(B) or (v)(B). j Reference .(1) VEPCO Deviation Report 87-1452 December 22, 1987 (2) VEPCO Design Change 84-43-3 " Service Water Reservoir Improvement .-

Final System Tie-In and Startup/ North Anna' Units 1&2"

'(3) VEPC0 Leviation Report 87-1405, December 8, 1987 <

FINDING IC-6: Inadequate Operator Trainin-(Unresolved Item 89-200-05)gandSimulatorModelin .

Discussion:

As a result of the team's review of Deviation Report 87-1405 associated with'

DC 84-43-3, a question arose concerning reactor operator training. Deviation

. Report 87-1405 identified the failure of a service wa'ter bypass motor-operated valve to close an initiation of a signal from the control room. VEPC0 investi-

.

gated the deviation and detennined that the most probable cause of the. valve !

' failure to close was that the. operator did not realize that the valves were throttleable and that the circuitry for the valve does not have a seal-in contact (without a seal-in contact, the operator has to continually hold the handswitch in the o ~l er closed position) pen or closed position to move the valve to the fully open

.

During the inspection, the team determined that reactor operators had received training on the sew' service water reservoir spray and bypass system but'that the training did Wot specifically cover the operation of the particular valves in question. In addition, when the simulator was changed several months later to reflect the service water system changes, the bypass valves were incorrectly mooeled with seal-in versus throttleable circuitry. This item remains open pending YEPC0 correcting the simulator bypass vqive control switch modeling and verification that the reactor operators have been properly trained to recognize which switches have seal-in versus throttleable circuitr Regulatory Basis:

10 CFR Part 55.11 requires reactor operators be trained in the operation of all plant system '

-

References:

(1) VEPCO Deviation Report 87-1405 December 8, 1987 FINDIhG 1C-7: Inadequate 1. cop Accuracy Calculation for Charging Flow Instrument (Unresolveditem 89-200-06)

Discussion:

l During the inspection, the team reviewed portions of Design Change 87-29-2 1 pertaining to the installation of a new charging flow differential pressure I detector. The review concentrated on the environmental qualification of the j C-6

_ _ _ _ _ _ _ _ - _ _ _ _ _ _ - .

[L

..

.

1 -

.

new detector and its effect on the overall instrument loop accuracy. During the review the team found that Calculation EE-0048 perfomed for determining the instrument loop accuracy, did not consider the effects of current leakage due the degradation of the cable insulation system in a postulated harsh

< Environment. In a postulated harsh environment, cable insulation resistance decrease which increases leakage currents and cause a corresponding decrease in instrument accuracy. This was a repeat of violation 87-32-03 cited in NRC-Inspection Report 50-338/87-32 and 50-339/87-32. During that inspection VEPC0 tas cited for failing to address the effects of characteristics such as leakage currents on total loop instrument accuracy calculations. In a response to this violation, submitted to the NRC on May 19,1988, VEPC0 comitted to revising

.

Engineering Standard STD-h-0025 by August 31, 1989, as necessary to preclude

'

further violations. This standard had been changed; however, the changes siade appeared to be inadequate for ensuring that loop accuracy calculations would be correctly performed when changes were made to environmentally qualified system Calculation EE-0048 was performed after the standard was change As a result of this finding, VEPC0 performed a new calculation which included the effects of the cable leakage currents. This calculation showed that the cable.added an additional 0.3 percent to the previously assumed error of 5 percent. This item remains open pending VEPC0's review of other previous changes to the facility which may have affected instrun,entation loops located in a harsh environment. Also, VEPC0 is requested to issue an approved proce-dure for perfoming instrument setpoint calculations which would reduce the possibility of similar errors in future modification Regulatory Basis:

10 CFR 50.49(d)(3) requires that the qualification file for electrical equipment important to safety specify the performance requirements under conditions exist-ing during and following design basis accidents. 10 CFR 50.49(j)(2) requires that the qualification file for electrical equipment important to safety demonstrate that the equipment meets its specified perfomance requirement References: ,

(1) VEPCO Design Change 87-29-2, "CRDR Instrumentation Range Changes, North Anna Unti. 2," November 3, 1988 (2) VEPC0 Calculation EE-0048, " Instrument on Channel Accuracy for Charging and Letdown Flow " Revision O. February 10, 1989 (3) NRC Inspection Report 50-338/87-32 and 50-339/87-32, November 25, 1987 (4) VEPCO Letter to NRC, Serial No.88-230, May 19, 1988 (5) VEPCO Response 1&C-002, *1R toss in Cable," February 16, 1989 (6) VEPCO Standard STD-GN-0025, * Equipment Qualification Standard", Revision 6 Change 2, October 13, 198 FINDING 1C-8: Inadequate Post Modification Test Progra (UnresolvedItem 89-200-07).

C-7

__-__ _ _ _ - _ _ _ _ _ - _ -

- _ _ _ _ - _ - _

.

+ ,

-

..

.

.

Discussion:

Design Change 87-12 for installation of the ATWS mitigation system interfaced with various Class 1E systems such as the auxiliary feedwater system, reactor protection system, containment isolation portion of the steam generator sampling system, steam generator level monitoring system and nonclass 1E systems such as steam generator blow-down system and turbine trip system. During installation of this design change, wiring changes included providing interlocks and permissives between ATWS output rel6y contacts and initiating circuits for the above Class IE and nonClass IE systems. The team reviewed engineering requirements for the post-modification testing and noted that the scope of this testing was limited only to newly installed hardware. Since the modification involved disconnecting and/or reconnecting various relay contacts, limit switch contacts of Class IE E0Vs, and output contacts of various Class IE instruments, the team was concerned that during installation, a potential existed for stroneous alteration of wiring or terininations which could be in the vicinity but not related to this modification. This could lead to a situation where the modified circuit (s) might operate properly for objectives of the modification but could have been disabled for other safety functions. Therefore, circuits of the affected systems should be verified by post-modification testing to ensure that the pre-modification capacity of the Class 1E system to mitigate an accident has not been coniprised due to inadvertent error during installation of the modificatio Additionally, the team identified two examples where the post-modification testing was performed prior to the installation of the ATWS modificatio Test Procedure 2-PT-57-4 " Safety injection Functional Test" included auxiliary feedwater pump actuation on a safety injection signal and steam generator blowdown valves closing on a safety injection signal. Both of these tests were done prior to the ATWS modification installation. Therefore, this item remains open periding confirmation from VEPC0 that:

(1) The post-modification testing requirements had been included in all the design change packages / engineering work requests installed during this outage and the required testing was implemented subsequent to modification

installatio (2) The design change process and engineering work request procedure f have been updated to require inclusion of post-modification testing requirements from project engineering and implementation by the site test grou (3) The two aforementioned safety injection tests were completed .

subsequent to the ATWS modificatio ..

Regulatory Basis:

Appendix B. Criterion K1 of Appendix B requires that a test program be established to assure that all testing required to demonstrate that structures, systems and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and

,

acceptance limits contained in applicable design document In this regard ANSI N18.7-1976 Section 5.2.19, item (4), states; "The test program shall cover all required testing including tests during design,

C-8 l

L_ _ _ _ _ _________. _ _ _ _ _ _ _ _ _ _ _ _

_

_ _ _ _ _ _ _ _ -

3y

'*,

-

-

..

i

.

'

fabrication and construction activities associated with maintenance and modifi-cations during operational phase and the demonstration of satisfactory performance following plant maintenance and modifications or procedural

. changes."

References:

.(1) _ DCP 87-12 ATWS modification package (2) Periodic Test Procedure 2-PT-57-4 Safety Injection Functional Test FINDING MS-1: Contains Safeguards Information, Transmitted Under Separate Cover Letter (Unresolved Item 89-200-08).

FINDING MS-2: Confirmation of Le'ak Detection Capability for Leak-Before-Break Analysis. (Unresolved Item 89-200-09).

Discussion:

In DC 86-10-2, VEPCO had taken advantage of the relaxation of GDC-4 to eliminate several. of the' pipe snubbers on the primary coolant piping. As required, a leek-before-break analysis was perfomed on the affected pipin In the submittal to the NRC in support of this modification, a comitment was made to detect a leakage rate of 1-gallon per minute-leak'in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. The team requested details concerning the design and operation of the equipment upon which this claim was based. Although some information was provided concerning the operation of the equipment, no definitive information was provided concerning the design of the equipment. The information provided about the design seered to be in conflict with the operational infomatio ' At the conclusion of the inspection, no definitive, nonconflicting'information had been provide (. The team was surprised that the design engineering organi-zation was'unableato provide this information over a period of approximatel one and one-half weeks. This, along with observations in other sections of this report, would appear to indicate a weakness in the instrumentation and controls area of the design organizatio This item remains open pending a detailed description of how the aforementioned leakage rate is detecte Regulatory Basis:

10 CFR 50, Appendix A General Design Criterion 4. Environmental and Missile

'

Design Bases," requires that structures, systems, and components important to safety be protected from the dynamic effects of a loss-of-coolant accident. .In 1987, this requirement was relaxed to allow elimination.of certain postulate high energy'line breaks and, also eliminate the snubbers originally designed to  ;

restrain the piping if the leak-before-break criteria of NUREG-1061, Volume 3 were satisfied. One requirement of such an analysis is the ability to detect a 2-gallon per minute leak in 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> AhSI h45.2.11-1974, Section B.2, states that the designated organization shall have demonstrated competence in the specific design area of interest and have an adequate understanding of the requirements and intent of the original desig C-9 I

l

_- ._ __

>,,,

..

-

,

l} References:

>(1) DC-86-10-2 "Large Bore Snubber Leak-Before-Break Modifications, North Anna Unit 2." December 22, 1988

'

.(2) NUREG-1061, Volume 3. " Evaluation of Potential for Pipe Breaks" FINDING MS-3: Inadequate 10 CFR 50.59 Safety Evaluation (Unresolved Item 89-200-10).

,

q Discussion:

The team found.several instances where it did not appear that the requirements for performance of 10 CFR 50.59 s'afety evaluations were well understood. EWR-86-695 removed a portion of a block wall around the iodine filter unit in the containment ventilation system to facilitate changing of the filters. It also installed bolt-in-place dams.at the resulting opening and at the original access to the room to prevent potential flooding of the filters. The team found that the 10 CFR 50.59 safety evaluation for this modification did not address significant technical considerations. Block walls are generally incorporated in nuclear plant design to provide radiation shielding for person-nel and/or equipment. They may also perform other functions, such as support for.other structures or equipment, or credit may be taken for them in the plant's high energy line break analyses. Therefore, rerroval of these walls has the potential to have other safety implications. In addition, it may affect other nonsafety-related, yet important, design considerations such as ALAR The safety evaluation for EWR 86-695 was deficient in that it did not' address eny of the effects of' removal of this wall with respect to the possible origi-nally intended function (s) of the wall itself. It only addressed how removal'

.of the wall woul(not affect the function of the iodine filter EWRs69-036 and 89-036B added a diesel-driven air compressor and an air dryer, respectively, to the instrumentation system. At several locations in both EWRs. statements were made that "since this EWR does not modify any-safety-related equipment....no unreviewed safety question is created. Whether or not safety-related equipment was modified is not the only criterion in the unre-viewed safety question determination since, it does not consider interactions  ;

cf safety and nonsafety-related systems. It therefore appeared that an incor- .

rect criterion was use This item remains open per. ding VEPC0 issuing augmented procedural guidance with regard to safety evaluation Regulatory Basis: '. '

.

10 CFR 50.59, " Changes, Tests, and Experiments," allows the licensee to make changes in the facility and procedures as described in the FSAR and to conduct tests and experiments not dcscribed in the FSAR without NRC approval if the

. changes, tests, or experiments not described in the F$AR do not involve a change in the technical specifications or an unreviewed safety questio I ANSI h45.2.11-1974: Section C states that documented procedures shall be provided for design changes to approved designs, including field changes, f which assure that the impact of the change is carefully considere C-10 l

__ _ _ _ _ - _ _ - - - -.

- _ - _ - - _ _

J a ;.n

.

, '

References:

,

(1) North Anna Administrative Procedure ADM-3.9, Safety Evaluation 10 CFR 50.59 Review October 11, 1988 (2) EWR 86-695, Modification of Emergency Iodine Units, Revision NA, March 20, 198 (3) EWR E5-036. Installation of Backup Air Compressor, Revision NA, January 24, 198 (4) EWR 89-036B, Installation of Instrument Air Dryer, Draft, February 14, 198 FINDING MS-4: Inadequate Identification of Calculation Inputs I

(Closed).  !

Discussion:

The team reviewed two calculations associated with DC 87-026-3, Steam Generator Downcomer Flow Resistance Plates Installation, in which sources were not given for several of the inputs and formulae used. In every other respect, the calculations were excellent. However, since recourse to the originator was' required to fully understand the analyses and verify the adequacy of the result, they did not meet ANSI N45.2.11 Section requirements. This item is provided for infonnation purposes only, and is considered close Regulatory Basis:

h 10 CFR 50, Appendix B, Criterion III, Design Control, requires that measures

' shall be established to assure that design bases are correctly translated into specifications, drawings, procedures, and instruction ' ANSI N45.2.11-1974 Section 4.2 Design Analysts, requires that " analyses shall

.be sufficiently detailed as to purpose, method, assumptions, design input, references and units such that a person technically qualified in the subject I can review and understand the analyses and verify the adequacy of the results j

'

without recourse to the originator.'

Peferences:

(1) VEPC0 Calculation SM-553. Tube Uncovery Time for North Anna Steam Generator Tubes Covered During a Steam Generator Tube Rupture, Revision,0,

.

dated September 21, 198 (2) VEPCO Calculation SM-554, Determination of Power Level for Keeping Steam ,

>

Generator Tubes Covered During a Steam Generator Tube Rupture, Revision 0,

,

l dated September 27, 198 (3) DC 87-026-3, Steam Generator Downcomer Flow Resistance Plates Installatio <

C-11

__ - -_ _-__--

, m .f

..

,.

'*

FINDING EP-1: Protective. Devices on Safet-(UnresolvedItem 89-200-11)y Class Buses Not Coordinated.'

.

Discussion:

The team reviewed DC 83-24, " Appendix R Emergency Diesel Generator." This-

design change' has initiated to comply with NRC's IE Information Notice 85-09, which stated that a fire in the main control room could adversely affect the cables routed to the emergency diesel generator and 4160-V generator circuit

, breaker control circuits. This could result in loss of the control circuit fuses.

'

The design change added redundant fusing and a means of transferring between the normal and emergency fuse fuses would eliminate the problem,The noted team in theagreed information that the addition notic of these As part of this review, the team observed that the Electrical Distribution System Coordination Study (Appendix R. Reanalysis Chapter 9, prepared by VEPCO in 1966) showed that the 4160-V vital bus feeder breaker was not coordinated with its downstream 480-V load center feeder breakers; the 4160-volt breaker supplies power to two load centers. The report also stated that coordination cannot be obtained in sone cases between the 4160-V s~witchgear supply breakers and the downstream 480-V load center supply breakers. Since separate studies had shown that either unit at North Anna could safely shut down utilizing the opposite unit's 4160-V and 480-V power sources through the'use of mechanical cross-connects on the charging and component cooling water systems, the requirements of Appendix R are nut violated in this case. However, the team was concerned that a single fault'at one of the 480-V buses could cause the 4160-V feeder breaker to trip, causing the loss of both 480-V load centers, which constitutes the loss of one division. The team recognized that this lack of breaker coordination was not a violation of the single failure criterion since the other division would still be available, but was indicative of poor design practices.N This concern was applicable for all the safety class buse This item remains open pending VEPCO's review of the protective device coordina-tion to determine if. the relays can be reset to provide adequate coordinatio Regulatory Basis: ,

This condition was not in accordance with the design philosophy of IEEE 308, Standard Criteria for Class IE Power Systems, Section 6.2, Alternating Current Power Systems to which VEPCO was connitted according to Chapter 8 of the update

. FSA Item Number 6 of IEEE 308, Section 6.2 states that protective devices should be provided to limit the degradation of Class 1E power system References:

.,

(1) VEPCO's " Appendix R. Reanalysis Chapter g," 1986 (2) DC 83-24, Appendix R. Emergency Diesel Generator (3) NRC IE Information Notice 85-09

,

I C-12

]

-

w .s n

,.-

-

-

l FINDING EP-2: Inadequate. Design Evaluation and Safety Evaluation of Quality 1 Control Inspection Report. (UnresolvedItem 89-200-12).

I Discussion:

The inspection team reviewed DC 85-30-2 which was associated with replacement of the station batteries during the previous outage. Also included in the design change package was-Quality Control Inspection Report (QCIR) IR-N-86-281A dated March 21, 1986, which identified that a nonsetsmic.li-inch conduit was routed directly above the Class IE battery located in Battery Room 2-III. The disposition-of the QCIR was use-as-is with the justification being that only cne of the four channels would be affecte ,

The inspection team notea that this OCIR disposition as written was a violation of Regulatory Guide 1.29lwhich require protection of safety-related squipment from unacceptable interaction with nonseismic items. In response to the inspection team's concern, VEPC0 perfomed Scismic Analysis SE0-1064 Revision 0, which demonstrated that the_ conduit supports were structurally adequate to withstand the design-basis seismic event. VEPC0 further explained that the engineer who dispositioned the QClk was capable of performing the

' required seismic analysis but had elected to offer the aforementioned-inappropriate system-based dispositio As a result of this review, the inspection team had three concerns. First, as stated previously, a quantitative analysis was not perforned which demonstrated that the conduit was designed to withstand the design-basis seismic even Second, the 10 CFR 50.59 revi w did not identify the invalid disposition on the QCIR due to either a precedural breakdowr or inadequate review. Third, an ineffective and/or nonexistent design verification was perfomed for the QCIR disposition within the desip organizatio This item remains'open pending VEPCO's review of a sample (minimum 10) of DCIR's performed in conjunction with design changes to ensure an adequate and substantiated disposition exist Regulato y Basis: .

The arrangement of an unanalyzed component over seismic Category I equipment violates the seismic design requirement outlined in Regulatory Guide 1.29, Section C, paragraph 2. This paragraph states that those portions of struc-tures, systems, or components whose continued function is not required but whose failure could reduce the functioning of a seismic Category I feature should be designed and constructed so that the safe shutdown earthquake would not cause such failur .

,,

References:

(1) Analysis of North Anna 1. Stationary Battery Replacement. E-1, Rev. February 5,1986 (2) Calculation EE-009,125-Yde System Analysis, Revision 0, February 28, 1989 (3) Quality Control Inspection Report IR-N-86-281A, March 21, 1986 (4) DC 85-30-2, Replacement of Station Batteries (5) Seismic Analysis SE0-1064 Revision 0 C-13

__ - u

_ *

.' j

,

. FINDING MC-1: Oversized Holes in Baseplate Accepted Without Proper Justificatio l (Unresolved Item 89-200-13). l

Discussion: -1 The-inspection team reviewed EWR 87-671 which involved removing pipe support .

'2-H55-WGCB-3B for. accessibility to perform maintenance work on a valve. The i support could not be. reinstalled over- the existing 1-inch diameter anchor bolts without damaging the threads, since the bolts were installed at 4*-6*

angularity. Therefore, a field change request (FCR) was initiated to enlarge three out of the eight holes f rom 1-1/6-inch diameter to 1-1/4-inch diamete The disposition of the FCR accepted this enlargement claiming that the asso-cisted pipe support calculation (SWEC calculation 22050-2-1020, Rev. 0) had been reviewe The inspection team also reviewed the pipe support calculation and identified two concerns. First, the existing bolt interaction was at a maximum value of 1.0 (actual 1.04), considering all eight bolts were in shear. Second, the .

impact of baseplate flexibility on the anchor bolts was not included in the !

criginal calculation. Therefore, the disposition of the FCR was clearly inappropriate because it was solely based on the existing calculation and a nsw analysis needed to be perforned prior to dispositionin After the inspection team's identification of this finding, a calculation was performed by YEPCO which utilized the GT STRUDL computer program to distribute the support loads properly through the frame. The baseplate was analyzed using the computer program BASEPLATE II to consider the appropriate baseplate flexibility. _The calculation also considered higher anchor bolt allowable loads, due to higher concrete strength and longer embedment lengths which were es-built verified. The three anchor bolts with the oversized holes were excluded from thbshear resistance of the anchor bolt qualification. Based on this analysis, the new anchor bolt interaction ratio was calculated to an acceptable value of 0.76. The team accepted this quantification method and recommended that it be added to the EW This finding remains open pending VEPCO's review of 10 randomly sampled pipe support field change requests to ensure similar problems with design verification is not pervasive. Also, VEPC0 needs to explain what changes have or need to be made to ensure that an adequate design verification is performed for future modification Hegulatory Basis:

ANSI N45.2.11-1974, Section 8 states that design changes, including field ..

changes shall be justified and subjected to design control measures l consnensurate with those applied to the original desig ANSI N45.2.11-1974, Section 6.1 states that measures shall be applied to verify the adequacy of desig References:

(1) SWEC Calculation 12050-2-1020 Revision 0, April 28, 1977 (2) VEPC0 Calculation CE-0509, Revision 0, March 1,1989 (3) Nuclear Standard STD-CEN-0024, Revision 1 December 9,1987

.

C-14

- _ - _ _ _ _ _ _ - _. __ _ _ _ - _

- _ _ _ _ _ _ _ - __

.

o ** J .o

_

a FINDING CS-1: Lateness.in Updating UFSA (Unresolved Item 89-200-14).

Discussion:

DC 84-43-3 sumarized the UFSAR changes required by the service water system improvement. The changes were not only from DC 84-43-3, but from DC 84-3-3, DC 84-37, DC 84-35-3, etc. The UFSAR changes just appeared in DC 84-43- ]

'Rev. 9. dated July 10, 1986, revised by DC 84-43-3, Rev. 51, dated June 4, '

1987. The following were' examples of some of the UFSAR changes:

[1) Codes and Standards changes:' (UFSAR Section 3.8.1.2.1) ACI-318-83 11. AISC 8th Edition -

iii. ACI-301-84 (2) . Mechanical Splices - Use of Dywidag Threaded Rebar Splices (USFAR Section

{

3.8.1.7.3)

(3) Added grade 60 rebar which was used for the service water system improvement (USFAR Section 3.8.1.7.2)

-(4) Portable water from Orange, VA was used for concrete mixing (USFAR Section

'3.8.1.7.1.3)-

None 6f the FSAR updates listed in DC 84-43-3 were implemented at the time of the 1_nspection. Since the system was put into service in 1987, it appeared that' the licensee was late in updating the UFSA Regulatory Basis:-

10 CFR 50.71 Main enance of records, making of reports, Section (e)(4)

requires that "... revisions (to UFSAR) shall be filed no less frequently than cnnually and shall reflect all changes up to a maximum of 6 months prior to the date of filing."

.

References:

(1) DC B4-43-3, " Service Water Reservoirs Improvements, Final System Tie-In and Startup," Revision 9. July 10,1986 and June 4, 198 ~(2) DC 84-35-3, ' Service Water Reservoir Improvements, Valve House Structural Analysis ano besign," Rev. 34, January 13, 198 .,

.

C-15