IR 05000346/1989002
| ML20245J249 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse  |
| Issue date: | 02/24/1989 |
| From: | Bongiovanni A, Hasse R, Phillips M, Vandel T NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| To: | |
| Shared Package | |
| ML20245J236 | List: |
| References | |
| 50-346-89-02, 50-346-89-2, NUDOCS 8903060216 | |
| Download: ML20245J249 (11) | |
Text
,
-
__-.
._
..
.
.
....
-;...
,,
-
~
-
,.
-
h
'
.U.S. NUCLEAR REGULATORY COMMISSION REGION III'
~ Report'No. 50-346/89002(DRS)
' Docket No. 50-346, License No. NPF-3
-
' Licensee: ? Toledo Edison Company L300' Madison' Avenue Toledo, OH-43652
.
Facility Name:
Davis-Besse. Nuclear Power Station-Inspection At: Oak Harbor, OH 43449 Inspection Conducted:
January 9-13, 1989 Onsite
'
Additional Inspection Conducted
,
at the Region III Office
.
_
.
January 16 through February 9, 1989 NM t/uf f T)Y Inspectors:
R.
asse
.
Date
.
$fil. b}W A.2M. Bongiovanni 2hf/G Date
-
1 VIfEI T. E. Vandel Date G
g Approved By:
M.
illips, Chief h7
.
Operationa'l Progh;ns Section Date Inspection Summary Inspection on January 9 through February 9,1989 (Report No. 50-346/89002(DRS))-
Areas-Inspected:
Routine, announced inspection of design changes and modifications and assurance of engineering quality The inspection was conducted in accordance with Inspection Modules 37700, 35701, and 35741.
. Results: One concern relating-to audit coverage of engineering activities (Paragraph 3.a) was identified.
The licensee appeared to be strong in the
'
Technica1' depth of design analysis and reviews and the thoroughness of safety analyses relating to the consequences of transients and accidents.
Potential
- weaknesses were indicated in the completeness of design analysis and review
~and the application of the criteria relating to increases in probability of occurrence and impact on Technical Specification safety margins for determining the existence of an unreviewed safety question.
8903060216 890228 PDR ADOCK 05000346.
Q PDC
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
.
.
-
,
,
.
..
,
,
.
'
DETAILS
,
1.
Persons Contacted
,
Toledo Edison Company
- P. Hildebrant, Engineering Director
- V. Watson, Design Engineering Manager
- D. Maiman, Engineering Assurance Manager
- A. Weedman, Engineering Assurance
- M. Beier, Quality Assurance
+*A. Zarkesh, Independent Safety Engineering Group Supervisor
- A. VanDenabeele, Engineering Assurance
- +*R. Gaston, Nuclear Licensing
- R. Schrauder, Nuclear Licensing Manager
+M. Derivan, Nuclear Engineering
+K. Prasad, Nuclear Engineering
+J. Darby, General Supervisor, Systems Analysis USNRC
- P. Byron, Senior Resident Inspector Other personnel were contacted as a matter of routine during the inspection.
- Indicates those attending the onsite exit interview held on January 13, 1989.
+ Indicates those participating in a telephone discussion on January 27, 1989.
- Participated in final exit interview on February 9, 1989.
2.
Design Changes and Modifications The purpose cf this inspection was to determine if design changes and modifications at Davis-Besse had been conducted in accordance with the Quality Assurance Program, the technical specifications, the Safety Analysis Report (SAR), and 10 CFR Part 50, Section 50.59.
The inspectors emphasized the technical completeness of these design packages.
The results of the inspection are described in the following paragraphs:
a.
Auxiliary Feedwater (AFW) System Modifications The. inspectors reviewed three modifications to the AFW system.
These Facility Change Requests (FCRs) were:
FCR 85-065 - This modification changed the Auxiliary Feedwater
Pump (AFP) 1-1 discharge Valve AF 3870 from a normally closed to a normally open position.
The handwheel and local control station were locked to prevent inadvertent closure.
The intent
~
_ _ _ _ _
___- -
.
.
..
,
.
.
of the' modification was to improve the reliability of the AFW system based on the recommendations of a Probabilistic Risk Assessment (PRA) performed in 1985.
- FCR 85-0154 - This modification removed the Steam and Feedwater Rupture Control System (SFRCS) safety actuation signals from the Auxiliary Feedwater Isolation Valves AF 608 and AF.599'
(Trains 1-1 and 1-2, respectively) to minimize the probability of complete isolation of auxiliary feedwater to the steam generator.
FCR 86-330 - Two changes were made under this FCR.
First, the
automatic AFW flow control was changed from control by varying Auxiliary Feedwater Pump Turbine (AFPT) speed to the use of a flow control valve.
This was done due to an instability in the automatic AFPT speed control system.
Second, cavitating venturis were installed in the AFW lines to restrict flow te the steam generators to no more than 800 gpm.
This was the flow rate prior to steam generator isolation used in the existing safety analysis in the Updated Safety Analysis Report (USAR) assessing the consequences of a steamline break.
Since these modifications were interrelated, they will be discussed as a single package.
The inspectors reviewed the documentation for these modifications on a sample basis.
This included safety evaluations, interdisciplinary design reviews, design verification including post modification testing, procedure and drawing updates, and required training.
Particular attention was given by the inspectors to the emergency operating procedure updates and post modification testing for FCR-0330.
The ability of the cavitating venturis installed by this modification to limit flow to a faulted steam generator was critical to the safety evaluation for the modified AFW system.
The test contained the appropriate' acceptance criteria and was successfully performed.
No documentation deficiencies were identified for these modifications.
The inspectors had two concerns with the design and evaluation process for these modifications.
The first concern dealt with the completeness of the design analysis and review process.
There was evidence that this process was conducted in depth.
The Nuclear Engineer organization identified the need for a recriticality analysis following a steamline rupture as a result of FCR 85-065.
A single failure analysis identified an unanalyzed condition relating to Modification FCR-0154; however, another single failure associated with this modification was not detected until the Independent Safety Engineering Group (ISEG)
performed a safety system outage modification inspection for the fifth refueling outage (see Inspection Report No. 50-346/88015(DRP)). While the identification of the recriticality issue and a single failure issue is indicative of an in-depth review, the failure to identify a second single i
_
.
.
.
.-
.
.
~
failure could indicate a lack of completeness or thoroughness of these reviews. The licensee had taken action to evaluate and take corrective action relative to this concern.
The second concern involved the ana' lysis performed pursuant to
.
10 CFR Part 50, Section 50.59. The safety evaluations were well
'
documented and contained a thorough discussion of the changes and impact on' system rarformance and plant safety; however, the assessment relative to the existence of an unreviewed safety
. question did not adequately address potential increases in the probability of occurrence of equipment malfunctions and impact on margins of safety defined in the bases of Technical Specifications. Of particular concern was the 10 CFR 50.59 evaluation for FCR-85-065.
The safety evaluation for FCR 85-065 addressed the final AFW system configuration resulting from several modifications since they were interrelated. The system configuration prior to these modifications was as follows: AFW discharge valve AF 3870 was in a normall position; AFW isolation valve AF 608 (downstream of AF 3870) y closed was in a normally open position; both valves received a close signal from the SFRCS on a low steam generator pressure (indicating a faulted steam generator),. Subsequent to these modifications, the system configuration was as follows: AF 3870 was in a normally open position; AF 608 was in a normally open position; only.AF 3870 received the SFRCS close signal on low steam generator pressure; a cavitating venturi in the AFW~1ine limited flow to a faulted steam
. generator to 800 gpm.
One of the safety functions of the SFRCS is to isolate a faulted steam generator on low steam generator pressure. Prior to these modifications, the probability of the failure to perform this function was determined by the the probability of AF 3870 failing to close on an SFRCS signal and the probability of AF 608 failing to close on an SFRCS signal.
Following the modifications, the probability of AF 608 failing to close on an SFRCS signal was set at one (i.e., the SFRCS close signal had been removad). The net result is an increase in the probability of the failure of the SFRCS to isolate a faulted steam generator and constitutes an unreviewed safety question as defined in 10 CFR 50.59 (i.e., an increase in the probability of malfunction of equipment important to safety).
In addition, the 10 CFR 50.59 evaluation stated that the proposed change did not represent an increase in the probability of malfunction of equipment important to safety since the close signal for AF 3870 is
. retained and AF 608 could be closed manually if required.
(The SAR
'
analysis of a steamline rupture assumes no o mitigate the consequences of the accident.) perator action to The inspector discussed the issue with the licensee. They stated that this modification had been submitted to the NRC as part of their " Course of Action Report" and was subsequently approved by the NRC in NUREG-1177, " Safety Evaluation Report Related to the Restart of Davis-Besse Nuclear Power Station Unit 1. Following the Event of June 9,1985." On l
this basis (NRC approval), no unreviewed safety question existed.
(.L-___ _ _
_ __
_ _ _- -
-
. _ _.
-
.
'
.
."
-.
- ..
'
The Linspector's concern was the' failure to apply the 10 CFR 50.59.'
' criteria.
The 10 CFR 50.59 evaluation should have simply stated
'that.this_did represent an unreviewed safety question which had been presented to and approved by the NRC.-
The second concern with this 10 CFR 50.59 evaluation involved the margin of safety as defined in the basis of the Technical specifications.
In addressing this criterion, the evaluation S
stated, "The proposed change does not reduce the margin of safety _as defined in the basis of any Technical Specification.
Technical Specifications do not specify a time limitation for auxiliary feedwater isolation following a main steam line break." A primary concern during a large break LOCA is. containment pressure.
A failure to isolate feedwater to a faulted steam generator could impact the ' peak containment pressure by continued boiloff through the break.- The basis for_ Technical Specification 3.6.1.4 (Primary Containment Internal Pressure) states that, "The limitations on containment internal pressure ensure that (1) the containment structure is prevented from exceeding its design negative pressure differential with respect to the annulus atmosphere of 0.5 psi and (2) The peak containment pressure does not exceed the design aressure of 40-psig during LOCA conditions.
The maximum peak pressure obtained from a LOCA event is 37 psig.
The limit of 1 psig for initial positive containment pressure will limit the total pressure to 38 psig which is less than the design pressure and is consistent with the safety analysis."
(Emphasis added.) Thus, the margin of safety is 2 psig.
The 10 CFR 50.59 evaluation failed to address potential impact on this margin.
The design analysis did address the impact o.f.
continued feed-on peak containment pressure and found it to be'within the current accident analysis envelope; however, the
' failure to address this issue in the 10 CFR 50.59 evaluation may indicate a lack of_ understanding by the licensee of the term " margin'of safety as defined in the basis of a Technical Specification."
The inspector was satisfied that plant safety had not been compromised as a result of these modifications.
Further, the modifications had been reviewed and approved by the NRC.
The inspectors concern was with the inadequate application of the 10 CFR 50.59 criteria and the potential generic implication relative to the' adequacy of c.ner 10 CFR 50.59 evaluations performed by the licensee.
b.
-Steam and Feedwater Line Rupture Control System, (SFRCS)
I The purpose of SFRCS is to provide (1) isolation signals to mitigate the consequences of a steam or main feedwater line rupture; (2) automatic signals to start the Auxiliary Feedwater System under specified conditions; and (3) protection from steam generator overfill and spillover into the main steam lines.
During this outage, the licensee initiated several modifications to the SFRCS in response
,~
.
. _ _ _ _ _ _ _ _. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_
,
_
- - - - - -
- -
- -. - - - - - - - - - -
-
_ - - - - - - - - - - - - - - - -. - - - - - - - - - - _ _ - - - - - - _ _,
.
,
7.
,
.
to concerns identified in the Davis-Besse Detailed Control Room Design Review,.DCRDR.. The changes involved centralizing and grouping
-
'i SFRCS components into common cabinets and the deletion of the Safety
'
Features Actuation System (SFAS) signals to main steam and feedwater isolation valves.
The modifications were designed to increase the reliability and availability of the main feedwater system by reducing the.
possibility of spurious actuations.
(1) FCR 87-1107 This modification and other interfacing modifications supported several changes to SFRCS.
The following enhancements were accomplished through FCR 87-1107:
(a) Provided new logic and relay cabinets for each of the two actuation channels.
(b) Improved input and output panels for each logic cabinet which is divided into two halves to separate the logic channels within the same cabinet.
(c) Eliminated the auxiliary relays that interface between the output relays and SFRCS actuated equipment.
The function of these relays would be supported from the new cabinets.
(d) Added the steam generator level instruments into the new cabinets.
(e) Provided AC power feeders for all logic channels and eliminated all power feeds to external auxiliary circuits.
(f) Provided auctioneered-power sources for all single acting soleneids circuits.
(g) Changed the SFRCS actuation logic from 1 out of 2 twice to 2 out of 2 per actuation channel.
(h) Added a momentary seal-in signal to assure actuation of all SFRCS components before an automatic reset occurs.
(i) Removed SFRCS logic output trip signals to the AFW valves to ensure appropriate AFW actions when low steamline pressure trip signals are received from both steam generators.
(j) Modified the shutdown bypass circuitry to eliminate the
" Permission to block" lights and alarms when in the blocked mode.
(k) Enhanced testing capability of the logic channels.
l l
l
l l
._.____ -
h
'!'
.
~
(1) Deleted all SFRCS half trip actuations from a single logic-channel.
.(m) Added inhibit circuits to all SFRCS actuation signals ~for
~
the motor operated v'alves which receive.both open and closed signals from SFRCS logic.
(n) Eliminated eight;of-thecsixteen existing low steam line pressure trip switches.
" -
(o) Removed the eight remotely located SG/feedwater differential pressure input auxiliary relays.
(p) Added circuitry to provide manual initiation functions.
(q) Added circuitry to the output circuits to provide blocking capability of the output trip signals.
(r) Added all control circuits for the SFRCS actuated solenoid valves into the new cabinets.
(s) Added a second solenoid valve to the Main Feedwater Control Valves, FW SP6A and FW SP6B.
A limited review was' conducted to determine the adequacy of the modification.
The inspector selected eight procedures and five drawings and determined that all appropriate changes were made to the controlled documents.
The 10 CFR 50.59 evaluation was acceptable, addressing the appropriate issues in adequate detail.
The inspector reviewed the preliminary Updated Safety Analysis (USAR) Change Notice 88-078 which included the necessary changes resulting from this modification.
As discussed with the. licensee,-
the USAR change notice will be submitted to the NRC in July as required by 10 CFR 50.59(b).
Amendments to the Technical Specifications were submitted to and approved by NRR prior to the restart.
Training on the SFRCS modification, the associated Technical Specification changes and the emergency procedure, DB-PF-02000 Rev 1, " Reactor Protection System, Safety Feature Actuation System, Steam and Feedline Rupture Control System Trip or Steam Generator Tube Rupture Procedure" was completed by the licensed operators prior to the restart.
The inspector had no concerns.
.(2) FCR 87-063 This modification involved the deletion of the Safety Features Actuation Systems (SFAS) signal from certain valves, the relocation of control switches and status lights to the control room center console and cable additions in support of FCR 87-1107.
The affected valves were Steam Generator (SG) 1 and 2 Main Feedwater Isolation Valves, FW 612 and 601; SG 1 and 2 Main
-
_ _ _ _ _
_ _ _ _
__.
~
.,.
Steam Isolation Valves, MS 101 and 100; SG 1 and 2 Main Steam
'
Warmup Drain Isolation Valves, MS 394 and 375; SG 1 and 2 Main Steam Warmup Isolation Valves, MS 100-1 and 101-1; and Atmospheric Vent Valves, ICS 11A and 11B.
Prior to this change, the above valves with the exception of Valves MS 375, MS 394, ICS 11A and ICS 11B closed on a SFAS Level 4 Containment Isolation Signal caused by a large break LOCA. 'As discussed in USAR Change 15, these-valves received a closure signal from SFAS as well as from SFRCS due to a steam line low pressure trip.
Remote manual operator action was available to close these valves to ensure containment isolation.
The deletion of the SFAS closure signal does not affect containment. integrity since the. valves receive a closure signal from SFRCS during a large break LOCA.
The valves meet the requirements of 10 CFR 50, Appendix A, Criterion 57.
The modification was discussed with and approved by NRR.
The review of the documentation showed it to be complete and technically adequate.
The 10 CFR 50.59 evaluation was acceptable and the inspector had no concerns.
(3) FCR 87-092 This modification involved the removal of the ten existing SFRCS manual initiation switches and associated wiring from the feedwater control panel to support FCR 85-109 which replaced the ten switches with four ww evitches.
Panel plugs were installed and were'verificd not to adversely' affect the seismic qualification of the panel.
This modification also replaced the existing Main Feedwater Control Valves solenoid valves SV-SP6A and SV-SP6B with pneumatically AND gated redundant solenoid valves, SV-SP6Al and 2 and SV-SP6B1 and 2.
The addition reduced the possibility of a loss of one train of main feedwater due to a single solenoid failure and allowed for corrective maintenance without placing one train out of service.
The inspector reviewed the package and determined it to be complete.
Controlled documents were revised to reflect the changes.
The 10 CFR 50.59 evaluation was acceptable.
The inspector had no concerns.
c.
Temporary Modifications, Lifted Leads, and Jumpers The inspector conducted a review of the temporary modifications j
l system described in Procedure No. DP-0P-20 dated November 26, 1988, l
entitled " Temporary Modifications." This procedure was reviewed l
along with the temporary modifications (TMs) control log maintained by the shift supervisors.
Each TM is consecutively entered into I
the log and its completion and closeout is recorded.
Required documentation of engineering safety reviews and evaluations and their approvals are attached to each of the currently open TM
l
__
-_
.
__
. _ _ _ _ -
,
-
..F
...
.
'
l
'
'
.
' items' maintained in theLlog.: Upon closecut~and restoration the
'
TM packages are removed and forwarded to records control.
The-
'
. Operations Superintendent: conducts'a monthly review of-the--log
.l
.
and signs Attachment'2 in the front of"the log.on. sat.isfactory completions of.the review.' -The TM log and related supporting-L information were ' reviewed as follows:
~ *
There were 106 open TMs, including 23 opened in"1987 or earlier
,
b
'and 83. items opened..in 1988.'
The.0perations Superintendent ' log sign offs were cur _ rent-
-*
J
'through the end of November 1988.
A sampling review was conducted of TM documentation packages
- -
located'in the log books.
Eight packages, including all.old
.
packages (prior to 1987), were reviewed.for_ adequate content.
All-packages-appeared to be adequately-supported by.the.
required reviews, evaluations, and approvals and included
_
< -
identified closeout actions.
..
No violations or deviations were identified.
3.
Assurance of Engineering Quality i.
.The purpose of this inspection was to determine if adequate audi.t coverage and other engineering quality assurance activities were'being
. maintained.1:This was-prompted byga.recentTorganizational change in'which the engineering assurance staff were moved'to the Engineering department-from the QA department, and concerns expressed as a result of a previous inspection (Inspection Report No.. 346/88006(DRS)).
.
a.
Quality Assurance Audit Activities The-planning,' scheduling, and auditing activity were reviewed to determina if the Davis-Besse Nuclear Quality Assurance Program and the commitments therein were being met in spite of the reduce staff.
The results of this inspection were as follows:
Approved audit schedules for 1989 were reviewed.
These primarily
addressed audits required by the technical specifications.
This was' described by the Auditing. Quality Verification supervisor as representing the bare bones schedule of audits that must be completed each year by a required completion date.
Ha added that additional auditing activity in the engineering area necessary to assure program compliance, would be added as schedule permitted.
Four qualified lead auditors were available for scheduling of
all auditing activity.
Staff coverage for these planned and scheduled audits was augmented by use of technical personnel selected from other organizational areas within and outside
l e
_
.
.
,..
,
'
the Davis-Besse site organization.
The. core. program would require 22 audits to be performed, an average of two audits per month for the entire year.
It appeared that the four lead auditors would be able to provide coverage for only the scheduled core' audits.
The inspector was unable to determine how additional unscheduled audits in the engineering area could be performed.
The QA department also conducts surveillance of single
discrete activities lasting one to three days.
The 1989 schedule provided for only one surveillance of engineering in the first quarter of 1989.
The licensee should continue to evaluate the effectiveness of this limited QA effort in the engineering area to ensure that the audits are sufficient to provide the necessary overview of work.
-b.
Engineering Assurance Section The inspector conducted a review of the Engineering Assurance Section in relation to its activities as a part of the Engineering Department.
Tive following assesses the relevant aspects of this section's instructions, activities and independent operational base relevant to their quality assurance function as part of the department of engineering organization.
(1) Review of Applicable Procedures Engineering Division procedures applicable to the design and processing of plant modifications and Engineering Assurance
[
Section procedures applicable to its activities of evaluation j
and performance enhancement auditing were reviewed.
f The inspector discussed the feasibility, and usefulness of
!
a separate procedure directly applicable to the Engineering l
Assurance section describing:
(1) the activities the section is to be responsible for, as described in a licensee letter dated October 21, 1988 (i.e., review of procurement documents (
and engineering specifications, monitoring work packages for j
appropriate quality requirements, participating in engineering i
procedures development and conducting in-depth technical I
evaluations); (2) the qualification system for the auditors and lead auditors responsible for the section activities in keeping with licensee commitments; and (3) the methodology for developing the selection of engineering activities to be evaluated.
(2) Quality Improvement Engineering Task 88-02 The inspector conducted a review of Quality Engineering Task No. 88-02 performed by the Engineering Assurance section during July through November of 1988, as a design evaluation audit.
l
o
_.
.. ____-
. _ _.
..
r e
.
.
'
.
,,
d.
.
The inspector concluded that the evaluation effort was well.
l done. The concerns generated were significant, well documented
!
and promptly followed up and closed.
j The inspector concluded that there was no observable loss of j
independence in the performance of this evaluation.
No' violations or deviations were identified.
j 4.
Exit Interviews The inspectors met with licensee representatives (denoted in Paragraph 1)
at the conclusion of the onsite inspection on January 13, 1989, and summarized the purpose, scope, and findings of the inspection. The licensee stated that the inspectors had no access to proprietary
.information during the inspection.
Further discussions were held by telephone with licensee personnel (also denoted in Paragraph 1)
on January 27, 1989 and at the conclusion of inspection effort conducted in the Region III office on February 9, 1989.
!
l
- _ _ - _ _ _ _ _ - _ _ _ _ _ _ _ -