IR 05000362/1987025

Insp Rept 50-362/87-25 on 870803-28.Two Potential Violations Noted.Major Areas Inspected:Repair Activities Associated W/ Atmospheric Steam Dump Valve 3HV-8419 & Main Feedwater Isolation Valve 3HV-4048

ML20238F394
Person / Time
Site:	San Onofre
Issue date:	09/01/1987
From:	Andrea Johnson, Johnson P, Tatum J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION V)
To:
Shared Package
ML20238F393	List: IR 05000362/1987025 ML20238F390
References
50-362-87-25, EA-87-174, NUDOCS 8709160120
Download: ML20238F394 (19)

Text

- _ _ --- - -

.

- _ _ _ _ _ _ ---

,-

,

-

,

%

,,

,

}

>;

'

O. S. NUCLEAR REGULATORY COMMISSION c REGION V

,

,

/

.) '

J '

'

Report N /87-25

"

EA-87-174

,

u >

Docket N ,<

'

License N NPF-15 i'

s Licensee: Southern California Edison Company .,

P. O. Bor,800 '

2244 Walnut Grove Avenue Rosemead. California 91770 ,,

/. s Facility Name: San Onofre Unit 3 /-

Inspection At: San Onofre, San Clemente, California

'

Inspection Conducted gust 3 - August 28, 1987 Inspector Ma ~

.

'7//! ' 7 J. um Resident Inspector ,t bate Signed

' ,, "k _

P. hns .-$hief Date Signed React c s Section 3

'

l v)f/ W , ,

A. D. John ~ 'n Date/ Signed Enforce Officer Approved: s ,p M '? 7 9. hnson, Chief

"

.

Date Signed Renc Projects Section 3 Summary:

,/-

Inspection on August 3 - August 28, 1987 (Report No. 50-362/87-25)

Areas Inspected: This is a report of a special inspection of Unit 3 to review the circumstances involved with the repair activities associated with atmospheric steam dump valve (ADV) 3HV-8419 and' main feedwater isolation valve (MFIV) 3HV-4048. The ADV was isolated for the period from March 1 through March 9, 1987, in order to make weld repairs tc the valve bonnet. The MFIV was blocked open on April 10 and again on Apri'l 24, 1987 so that repairs could be made to the piping associated with the valve hydraulic actuato Insge.ction Procedures 30703, 37702, 42701)". 62703, and 92701 were covered during this inspectio ).

8709160120 070901 PDR ADOCY. 05000362 G PDR"

/*

s

- -- - - - - - - - _ _ _ _ - - - _ _ _ - - - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ _

.

. .

'i i

l l

. ,

Results: Two potential violations were identified: (1) Failure to comply with Technical Specification requirements for equipment operability; and (2)

Failure to report events in accordance with 10 CFR 50.72 and 50.73. One unresolved item was identified involving the applicability of 10 CFR 50.59 during maintenance activitie I

l

l i

i i

!

l

<

.

- _ _ _ _ _ _ _ _

_ - _- , - - _ - _ _ _ _ - _ - - _ - - _ - _ - _ - . _ _ _ _ _ _ _ _ _ - - - . _ - - - - - - _ - -

- _ - _ _ - - - . - - - - - - - , - -

'

. ,

, ,

.

.

,

'

'

DETAILS'

, Persons Certactei ,

• 1. W. Moody, De,$uty Site Manabr "

• 1. H. Morgan, Station Matsger

• 1. J. Reilly, -Technicai Manage:-

• M. Wharton, Assistant Technical hanc:ge

• C. Chio e. a nant. Technical Msnager

. D. Schone, Quality Assurance Managstr-

' #R. Krieger, Operations Maaager

'#B. Zinti, Com;;11anca Manager

• T. Mackey; Cccpliance Su;)erviser

, M Herschtal. Engineer -

l SCE Corporei( Office M. Medford, Wulear Engineering , rad t icensing Mariage-R. Rosenblom, quality.Assurar.ce Managg J. Curran, nurtear ia?ety Manager D. Cox, Licensing S6pervisa

• DenuttS those attending the. exit meeting on Au,i:st 14, DB # Dent tes those attending tN. exit meeting on August 28, 1987. . {cclse of: HRC Review of Rglys to Atmospheric Qasp VQvg (ADt/) _

3HV 8419 and Main Feedu ter Isolation Valve (hEIV) 3H W O48 The initial review of the modification and repair activities associated with ADV SfiV 0419 an f iWIV .3HV s048 was discuased in paragraph (g) of Inspec', ion Re4 ort 5F362/87-15. The inspectors conducted a more detailed '

review of these activities duri1g this "nspecti i which included the following:

Discussions and 4terviews with station and corporate management and engineering personta "

Review of the licensta's QA program equirezents and implementing procedures for cone' acting Ersjircering Safety Evaluation

Review of the licentee'r UFSM. system * script. ions and a,ccident analyses applicable to the WIVs and /d *

Review of emergency operating procedures applicable to the ADV

Fe iew of work packUJes f or repair and modifications associated with W IV 3HV-4048 (April 19 vad April 2't, 1987), md for repair of ADV WV-8419 (March 1 througi) March 9,1987).

Review of Engineering f afety Evaluations apolicable to MFIV 3H\-4048 and ADV 3HV-8419 rapair and modification activitie __ , _ _ _ _ _ _ _ _ --- - - - - _ _ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

>

, .

'

,: 2

'

y

- -

.; ,

,

",' h iew of Techn? cal Specification requirements, f 4, .p 3, Inoperability of ADV 3HV-8419 During Reactor Startup

' '

Atmospheri1 Dump Valva (ADV) 3HV-8419 Repair

,

s On March 1, 1987, the licensee identified several cracks in the valve bonnet of ADV 3HV-841 The cracks were discovered during

<

hydrostst(c tscting fpilowing weld repair of the stuffing box while the unit was in mode 5. just prior to completion of the cycle III ref ueling outage. The licensee documented this condition on a nonconformance report (NCR 3-1762 Rev. 4, dated March 3, 1987) which was dispositioned to weld repair the bonnet. Although a Technical

'

's '

Speciffi:ation limf ting condition for cperation (LCO) did not exist spectfica11y for the ADV, the licensee administrative 1y limited the inoparability of SiiV-8419 to 7 days. The licensee did not consider this condition to be a' mode restraint as long as the ADV on the other steam generator (3HV-8421) remained operable. The reactor

-

intered mode 3 on March 3 and entered mode 2 on March 7,1987, and

, low power physics testing was completed while repairs were being made to 3HV-3419. The repairs were completed on March 9, and the unit entered mode 1 on March 12, 1987. The licensee stated that

, entty into mode 1 would not have occurred prior to repair of the valve and its return to servic Atmo=bheric Steam Dump System Description and Function l

The atmospheric steam dump system (ASDS) is part of the steam and

. power conversion system, and is described in section 10.3 of the licensee's Updated Final Safety Analysis Report (UFSAR). In addition, the ASDS is required for safe shutdown of the reactor as i discussed in section 7.4 of the UFSA '

E9ch steam generator has an ADV associated with it. As stated in ,

the UFSAR, "These valves are installed to provide for controlled I

'

removal of reactor decay heat during reactor cooldown when the condenser is not in service, when the plant is being started up or shut down, when a turbine trip occurs on loss of a condenser vacuum, or when a turbine trip occurs due to loss of electrical power to the turbine auxiliaries." The ADVs can be operated remotely from the j

,

control room, or locally at the valv A Seismic Category I l nitrogen source is installed to permit remote operation of the ADVs in the event normal instrument air supply is not availabl ?

l The accident analyses contained in section 15 of tFe UFSAR rely on '

the ADVs to cool down the reactor plant for the following accidents:

Increase in Heat Removal by the Secondary System

-

Decrease in Heat Removal by the Secondary System Control Element Assembly Ejection Decrease in Reactor Coolant System Inventory

, , _ _

_

____,__m____

_ _ _ _ - - _ _ _ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - --

__

_ _ - - _ _ _ _ _ - _ , -_ - _ _ _ _ _ _ _ - _ _ - - - _ - _ - - - ___ - _-__

. .' .

g .

,

. .

-

The'UFSAR does not discuss any situations where an ADV is not b available.for performing this functio Paragraph 7.4.1'of the Safety Evaluation Report related to the operation of San Onofre Nuclear Generating Station, Units 2 and 3, stated: "The review of u the" atmospheric steam dump system included the review of the

^ instrumentation and control of the atmospheric steam dump' valve The dump valves are required to close following a main steam line break. Subsequently, these valves must be available for opening for controlled cooldown of the plant. . ."

l Details of Repair of'ADV 3HV-8419 (March 1 through March 9, 1987)

3HV-8419 is a quality class II valv The licensee discovered

'

cracks in the valve bonnet during hydrostatic testing on March 1, and documented this condition on revision 4 to NCR 3-1762, dated March 3, 1987. The safety evaluation that was completed to support

.the NCR disposition indicated that modification of the valve bonnet by weld repair did not constitute an unreviewed safety question,~ and that.3HV-8419 would continue to operate as described in the UFSAR folluwing the repair Abnormal alignment of the atmospheric steam dump system during weld .

repair of 3HV-8419 was controlled by work authorization request I (WAR) 3-8606883A, which stated the following require.ments:

Evaluation for Mode 5 & 6

Capability Limitations: Mode 3 restraint j

. Equipment Redundancy Requirements: Steam Dumps are administratively required in Modes 1 - 3 The licensee subsequently authorized performance of the repair during mode escalation and administratively limited the time that 3HV-8419 was inoperable to 7' days'(after entry into Mode 3) by limiting condition for operation action requirement (LC0AR)

1. 3-87-075. This was allowed by Operating Instruction 5023-3-2.1 titled, " Atmospheric Steam Dump Operation," which stated:

"If'an atmospheric steam dump valve becomes stuck in any position other than closed while in Modes 1-4, within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />

, unlock and close its upstream isolation valv "If an atmospheric steam dump valve is declared inoperable while in Modes 1-3, operation may continue for a maximum of 7 day "If both atmospheric steam dump valves are inoperable or one is inoperable in excess of 7 days while in Modes 1-3, then within one-hour commence a plant shutdown and be in at least hot standby within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, at least hot shutdown within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and at least cold shutdown within the subsequent 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />."

t

__________-_-___-___________--_____ - _ D

-. .. - _ _ - - _ _ - - - - _ _ _ - _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ - - _ . _ - - - _ - - - - _ .

. .

The 7-day limitation was added to the operating instruction by temporary change notice (TCN) #3-4 dated October 22, 1982, which was the result of a letter from K. P. Baskin to J. G. Haynes dated August 25, 1982. The following excerpts, which were taken from this letter, discuss the safety significance and operability requirements for the r sspheric dump valves:

"Ac stated in FSAR Section 7.4.1.2, the atmospheric steam dump system is a required safe shutdown system. This reg ,rement exists because the valves are needed for safety grade controlled cooldown capability to Shutdown Cooling System initiation conditions; this capability is needed because the safe shutdown design basis for SONGS 2/3 is the cold shutdown condition.... Further, such cold shutdown must be achievable from the control room /switchgear rooms with local manual action outside this area only to mitigate single failures....In l

'

addition, local manual operation capability for the atmospheric dump valves is required for safe shutdown following a fire....

"While it may be argued that, per response to NRC Question 212.139, alternate means exist to dump steam in the event that the atmospheric steam dump system is not available, none of these other means meet the above licensing and design basis requirement In particular, the use of steam traps, vents, drains, the conCanser or the auxfliary feedwater pump turbine to dump steam for cooldown relies directly or indirectly on non-seismic water scurces. Nucitar Engineering and Licensing considers it inappropriate to rely on such means being available for safe shutdown of the plan "As to the main steam safety valves, manual operatior, could be usea for step-wise cooldown of the plant if the dump valves were unavailable. Indeed, this capability was considered by Reference (A) in specifying a permissible out of service time for each train of the atmospheric steam dump system. However, it would likewise be inappropriate to rely on ar, untested backup means of contrciling plant cooldewn in lieu of the system specifically designed to function for the purp6s " Based on the above, it is considered necessary that the atmospheric du.ap valves be available to perform their safe shutdown furction {i.e., be operable) in Modes 1, 2 and Consistent with the level of importance to safety of the ADVs (as discussed above and in Reference (A), c 7 day limit should be imposed fer ccqtinuing plant operation with one valve out of service, and a Specification 3.0.3 shutdown should be initiated ii both valves are out of service....

" Implementation of the above requirements before significant decay heat is established in the core is considered important to safet You are therefore requested to incorporate the above requirements into plant procedures as soon as it is practicable."

.

- _ _ - _ . .

. 3-

,

. .

Reference (A), which whs. referred to-in the letter, is a letter from

' L ' Richter to B. Katz. and H. E.14 organ dated JGly 15,198L The following excerpts were taren from this letter:

"The SONGS 2&3 Operating License does not include a Technical Specification on the atnespheric steam dump system. However, the atmospheric steam dump system,: consisting of atmospheric steam dump valves (ADVs), associated controls s'oc bottled nitrogen supply, is required for that portion of safe shutdown from normal. operating temperature to shutdown'ccoling initiction,.as discussed in TSAR Section 7.4.2. (Most of the FSAR Chapter 15 design basis over.ts require ADVs ?or controlled cooldown.) As you are aware, the omission of a Technical

'

Specification on such safe shutdown equipment from-the Standard j Technical Specification format docs nat relieve SCE from~the

'

responsibility of ensuring plant oper.ation within the det.ign basi "Accordingly, the following requirements should be included in the. plant procedures:

" Both ADVs must be OPERABLE in Modos 1. 2 and 3 (w{th irradiated fuel in ?,he reactor vessel). Consistent with the level of importance to safety of the ADVs, operation may continue for a mayimum of 7 days'with one valve out'of service; a Specification 3.0.-3

~

shutdown should be initiated if both valves are rMt of service. (It is noted that these out-of-service'

. limits are considerably mare lenient than the limits imposed by the.NRC on the equally necessary auxiliar feedwater system only because of the last resort capability for step-wise cooldewn by manual. safety valve operation.)....

"The above requirements should be incorporated into plant surveillance procedures prior to initial criticality. .. ."

Administrative controls for ADV operability were subsequently included in the operating procedures as previously discussed abov The Techt:1 cal. Specifications do not include a limiting ccridition for 0;:cration applicable to ADV operatio , J, operability of MFIV 3HV-4048 During Reactor Operation Main Feedwater Isolation Valve 3HV-4048 Repairs While the unit was operating at 100% power, an oil leak developed at a grayloc flange connection in the hydraulic supply piping for MFIV l 3hy-4048. During ncrmal cperation, the hydraulic oil pressure oppose the closing force beiag exerted by nitrogen in order to keep the va?ve open. On April 10, 1987, with the unit at 100% power, the licensee clamped the valve stem of 3HV-4048 in the open position and the hdraulic fluid end nitrogen were evacuated from the valve actuator to allow repairs to t.e made to the hydraulic supply piping.

l

_ _ - _ _ - _ _ _ _ _ - _ - _ _ _ - _ _ _ _ - - _ - _ _ - - _ - - _ _ _ _ - _ _ _ _ . __ -

-

.

. .

g l

The licensee administratively limited valve inoperability to 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Documentation showed that repairs were completed and 3HV-4043 was restored to an operable condition in 8 1/2 hours. The repairs were unsuccessful in stopping the hydraulic leak, and the licensee prepared a temporary facility modification (TFM) to etcnge the hydraulic supply piping configuration and stop the oil lea On I

, April 24, 1987, while the unit was at 100% power, 3HV-4048 was rendered inoperable in the same manner as before while the TFM was completed. The came administrative controls were used, and the valve was restored to an operable status in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The TFM was l successful in stopping the oil leak, b. Fpdwater System Description and Function The feedwater system is part of the stera and power canversion system, and is descrihed in section 10.4.7 of the licensee's UFSA Feedwater is added te the steam q nerators through the feedwater piping ai)d valre; associatied with each steam genarator. As stated in the UF.MR:

"A pneumatically-operated feedwater control vc1ve is located in the main feedwater line supplying each steam gW.erator. A manually * operated block valve is located upstream, and an electrohydraulic & operated block valve iG located downstream of the pneumatically-operat2d feedwater sontrol valve. Seismic Category I main feedwater isolation valver are slso provided in esch of the two feedwater lines downstream of the electrohydraulic-operated valves. The main feedwater tschtion velves are held in the open position by a hydraulic systes which exerts pressure w the bottom o* a piston actuator; Nitrogen pressure on top of the piston actuator acts as the driving force for valve closure. For these valves to shut and perform their safety function, redundant actuation solenoids, powered from separate if power soerces, open and dump hydraulic oil from the bottom of the piston actuator thropgh twQ separate dump lines. AM of thes'e valves are located outside the containment."

The MFIVs and the main feedwater block valves (MFBVs.) are operited Pemotely from ihn controi room, and they a;,itomatically close within 10 secoMs on rece$t of a containment isolation ectuation s0gnal (CIAS) or n: sin steam isolation siomi (MSIS) generated by the engineered safety features actuation system (ESFAS). Ine MFIV and MFSV fail closed on loss of electrical powe The safety evaluati6n in section 10.4.7.3 of the UFSAR steed:

"Feedwater line isoiation limits the energy release and the magnitude of reacter coolant system cooldown in the event of a main steam line break."

The accident analyses that pertain to containment systems are discussed in section 6.2 of the UFSAR, and they rely on the NFIV to close to prevent overpressurization of containment during a main steam line break (MSt.B) inside containment. The design basis

_ . . . _

__ - _- _ -___- __ _ _ - _ . _

.

...

-

,.

' 7 sfb ' ,

,

~

' '

accident (DBA) for' containment is a MSLB inside containment with a 4 ,

single failure of one train- of containment. cooling. During this-

- event, the analysis showed peak' pressure inside containment. to be

. 55.7 psig compared to the design pressure of 60 psig. Section

.6.2.1.4.2 of the'UFSAR contained.the following dOcussion of single:

failure considerations

"Although MSIV and .MFIV failures are not considered' credible, analyres have been performed to show that the. containment design pressure'is not exceeded even if the failures are postulated. As discusted in paragraph 6.2.1.1, the following single active failures have been considered: (1) loss of one containment cooling train; (2) MSIV failure; (3) MFIV failure. .

The assumptions for each case are given belo "For the loss of one containment coeling train, the MSIVs and-MFIVs are' postulated to w rk....

u

"For the MSIV failure, the NFIVs and both containmerit cooling trains ar6 postulated to work....

"For the MFIV failure, the MSIVs and both containment cooling , j trains tre postulated to wor The 1374 cubic fett of steam in '1 the' steam line between the M3a'k and the nearest MSIV expends l into the containment.but the '6958 cubic feet of steam between I the MSIYsland the turbine stop' valves it isolated along with'

the intact steam generator and the steam line upstream of the intact unit MSIV. The MFIV nearest to the' ruptured steam j generator is postulated to fai The MFIV is backed ~up by l 10-second closure backup: isolation valves-HV4047, HV4051(

HV1105 and HV1106. The 193 cubic feet of feedweter betWeen the j MFIV and the backup isolation valve flashes along with the 230 l ( '

cubic feet of feedWater between the MFIV and the ruptured steam ':

!

generato The containment sprays and four cont 61nment .

emersency fan _ coolers are assumed."

" Details of 'Aepairf of MFIV 3HV-4045 (April 10 and April 14, )

1987)

.{

'

~

3HV-4048 is a quality class :11 valve. When the hydraulic fluid supply pipiag (cuality class III) developed a leak,~the lHeensee made plans to fix the ' leak whils the unit was l cperating st 100% power. On April 10, 3HV-4048 was removed J from service between 0830 and 1712 while an attempt was made to )

repair the oil leak and, in accordance with maintenance order i

..

s

.(MO) #87032S40001, the valve st(m was clamped in the open position and'the nitrogen and hydraulic fluid W re evacuated from the valve actetor. Blocking open 31/V-404B was controlled I L/ by work authorization request (NAR) 3-87017P3, which stateri the  !

following requirements:

Eveluatio^n for Mode 1 1

)

j

!

i i

< k

_

. _ . .-. __

.

Capability Limitations - 3 day shutdown adaintstrativity j applied; work window limited to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, if work l incomplete initiate shutdown; if a CIAS or MSIS is actuated ensure 3HV-4047, 3HV-1106 and 3FV- H21 go closed Equipment Redundancy Requirements - Ensure operability of 3HV-4047, 3HV-1106, and 3FV-1121 prior to issuing approval to geg 3HV-4048 open l The licensee administrative 1y limited the thne that 3KV-4048

! was inoperaMe to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> by LCOAR #3-87-143, which was in accordance with a draft Technical Specification Change

NPF-10/15-224. Since blocking open 3HV-4048 vas controlled by

'

the work authorization request, a safety evaluation was not comp'ieted, as permitted by Operations Division ProceWres 50123-0-23 titled, " Control of S,ystem Alignments," anu 50123-0-21 titled, " Equipment Status Control."

The initial attempt to repair the hydraulic oil leak was unstrecessfni, and the licer,see prepared a TFM package to modity the hydraulic supply piping on 3(N-4048 in order to stop the oil lea The talve was seroved from service between 0900 and 1710 on April 24, 1987 and the work was completed in accordance with TFM 3-87-AEA-00"t, MO #87032840002, M'J #87042380000 and WAR 3-8702017. During installation of the TFM, 3HV-4048 was blocked open and controlled in the saine manner as befor As required hy Engineering Procedure 50123-V-5.10 titled,

"Tempe .ry Facility M9dification," a safety evaluation was completed as part of the TFM package wnich sndicated that the modification did not involee a change to the Technical Specification or an unreviewed safety question. The inspector reviewed the n fety evaluation, and made the following observations:

The probability that equipment may malfunction during the time that the MFIV was inoperab'fe was not evaluate *

The effect of TFM installation on the consequences of accidents previously evaluated in the UFSAR was not addressed for the period of time when the MFIV was blocked open. The safety evaluation simply stated:

"During the implementation-n of the TFM when the valve is blocked open, the Hain Feedwater Block Valve, 3HV 4047, and the Main Feedwater Regulating Bypass Valve, 3HV-110% will close and isolate Mair Feedwater to Steam Generator E-088 in the event of a CIAS is generated."

LCO 3.3.2 of the Technical Specifications required the ESFAS instrumentation to be operable with response times as shown in Table 3.3-5 of the Technical Specification ._

__

)

'

'

'

I

,

(1) Paragraph 1.12 of the Technical Specifications stated the following definition:

,

The ENGINEERED SAJETY FEATURES RESPONSE TIME shall be th.at time interval from when the monitored parameter exceeds its ESF actuation setpoint at the channel sensor until the ESF equiprtent it capable of performing its safety function (1 e. , the vaitves travel to their required positions, pump discharge pressurn reach their required Malues, etc.). Times shall include diesel generator starting and sequence loading delays where applicable (2) Table 3.3-5 of the Technical Specifications lists a response time of 10.9 seconds fo; 3HV-404 (3) The Techafcal Specifications do net provide en action statement for the situation when 3HV-4048 is inoperabl The safety evaluation concluded that the TFt1 would not reduce the margin of safety as defined in the ba91s for any Technical Specification 1.00, and gave the following justification:

" Response time for 3HV-4048 is specified in Table 3.3-5.

l As mentioned previcesly, the implementation of this change

!

will have no effect on the response time to a CIAS or MSIS. "As stated in Attachment 11, prepar4 Technical l

'

Specification number E24 will specify the opera'oility requirements for 3HV-4048 and implementation of the change will r,ot reduce the margin of safety of this basis,"

Attachment 11 was a memo for file dat~ed April 9, 1987, and it stated in part:

"As soon as the 1, tem clamp is installed, the FWIV be:oines inoperable because it car, no longer perform its safety related closing functio Proposed Technical Specification Change 224 states that a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> action statement with one FWIV inoperable is entered during the performance of the repairs described above."

,

In addf tion to the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> actica statement that was propese6, l draft Technical Specification Change NPF-10/15-224 also stated-I

" Currently, these valves are governed by Technical Specification 3.3.2 table 3.3-5. . . . for ESF resperase times. But Technical Specification 3/4.3.2 does'not identify specific LCO's, action ftatements, and surveillsace requirr5nents for these valve In the event these valves fail to meet the operability criteria, j

i

,

_ _ _ _ _ _ _ _ _ _ . _ _ _

_ .

.

.

,

+

','

,

s: ,

.

)

'

,' '

'

1 .)

l<,

,

'

y

~

Specification 3.0.3 Action Statement mandates shutdown of- ]

p the plant."

l .-

l

-

.

.The safety evaluation did not discuss this aspect of Proposed

Change NPF-10/15-22 The inspectors observed'thet originally 3HV-4048 was. included

.in Technical Specification LCO 3.6.3, which specified

'

R

,

..

requirements for containment'isulation valve This 1.00' -l

[ required inoperbble valves to be restored to an operable ~

condition withi.n.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, or the reactor was' required to be-in l hot standby within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The license '

'subc:itted a proposed technical specification change request to L

"

delete the- the MFIVs from LCO 3.6.3, and the request was approved by NR < Administrative Controls '

L

'

'. Operations Division Procedure 50123-0-23 titled, " Control of System i

Alignments,'" specified the following methods for controlling system-l alignments:

Approved Operating Instructions

Work' Authorization

Abnornti Alignment and Evolution Form (attachment 2 to

'S0123-0-23)

The operating instructions and the Abnormal Alignment and Evolution

'

Forth both -require a review to ensure compliance with 10 CFR 50.59 as l . interpreted by the licensee. Abnormal system alignments controlled by a work authorization did not require a review to ensure-  ;

compliance with 10 CFR.50.5 Removal of equipment for maintenance did not require a temporary change to operating procedure Administrative Procedure 50123-VI-1.0.1 titled, " Documents -

Temporary Change Notices (TCNs)," specified the requirements for making changes to procedures and instructions. Attachmer.t 3 to the ,

'

procedure, form PF(123) 110 titled, " Temporary Change Notice," was i used to document the review and approval of changes that are made to i procedures and instructions.. Block 8(E) of this form currently !

states, "Does this change pose an unreviewed safety question per 10 CFR 50.59., i.e. , does it increase the probability of _ occurrence or the consequences of an accident; create the possibility o i different accident; or reduce the Tech. Spec. margin of safety?" l The 10 CFR 50.59 criterion regarding equipment malfunction was not included in this definition of unreviewed safety question on the Temporary Change Notice form, and reference to more comprehensive instructions for making these determinations also was not included. This condition was also applicable to the Abnormal Alignment and l

Evolution Form which is included as Attachment ' to 50123-0-2 _ = _ _ _ _ _ - -

- _ _ _ . ..

-

.

o . Licensee s Position i

-

During meetings and discussions with licensee representatives, the following positions pertaining to 10 CFR 50.59 and Technical Specifications were expressed:

The requirements of 10 CFR 50.59 are only applicable to actual changes whfch are made to plant configuration, such as design changes (i.e., the final configuration differs from that in the UFSAR upon completion of the act Wity). The requirements of 10 CFW 50.59 do not apply to maintenance activities unless warranted due to  :

special circumstances, such as a nrolonged outage of equipment due l to unavailability of part To impose 10 CFR 50.59 on each equipment outage for maintenance would appear to be an unreasonable burden, utd not within the intent of %e regulatio This ,

interpretation is consistent with the guidance provided in inspection module no. 3770 ;

Over the years, each procedure, abnormal valve lineup, and all mairdenance activities have been reviewed to ensure that all  ;

operations are performed in a prudent and safe manner. In eacn case, the activity is reviewed pursuant to the requirements of section 6 of the Techrdcal Specifications to ensure that the affected structure, system, or component is not changed from that described,in the UFSAR as a result of the activity. Although certefn of these activities inay be evaluated against 10 CFR 50.59 criteria for ar. unreviewed safety question, a summary of the evaluation has never been included in the annual reports to the Cynmission as changes; and to interpret such activities as changes under 10 CFR 50.59 constitutes a new and different application of the rul i The repairs that were completed on ADV 3HV-8419 and MFIV 3HV-4048 were maint$ nance activities, and a safety tvaluation pursuant to 30 CFR 50.59 was not require However, a safety evaluation was performed that satisfied Technical Specification requirements. In I the case of 3HV-8419, a safety evaluation was ccmpleted, ac required by the NCR, to address any changes that might occur as a result of the weld repai In the case of 3HV-4048, a safety evaluation was ,

completed to tddress the temporary modifications that were made to 1 the hydraulic pipin In both cases, system alignment was changed tetnpsrarily to support the clearance boundary. This was similar to what would be required during routine maintenance. The activities were conducted in 6 responsible manner and administrative controls were established to ensure that 3HV-4048 was returned to service  ;

within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, and that 3HV-8419 was retuyned to service within 7 i days after entry into Mode Technical Specification LCO 3.3.2 specified requirements for ESFAS instrumentation associated with 3HV-4048, aad removing 3HV-4048 fram

'

servica did not impair this LCO because the MFBV (3HV-4047) and the feedwater regulating bypass valve (3HV-1106) were still available to isolate feedwater to stearn generator E-088 during a CIAi er MSIS actuation. This LCO was never intended to apply to operability l

l __ - _ _ _ - . _ _ - _ _ - _ _ _ _ _ _ - _ _ - _ _ - _ _ _ _ _ _ - _ -

. _ . .

. _ _ _ _ _ - _ _ -_- . _ _ - . _ _ _ _ _ -

.

• *

a I

e' requirements for the actuated component The component identifications were for convenience in assessing acceptable time response of the ESFAS instrument channel "

Removir.g 3hT-4048 and 3HV-8419 from service did not increase the probability of equipment malfunction. In the case of 3HV-4048, the accident analysis assumed a single failure of the MFIV, and temporarily removing the valve from service did not increase the probability of equipment malfunction. In both instancer, limits were placed on the amount of time that the valves were allowed to be

$noperable such that the probability of an accident occurring while the valves were removed from service was within acceptable limits;  ; these units were c9nsistent with those previously established -

by NRR for sinitar equipment included in the technical  :

specificatiois '

"

The consequences of accidents previously analyzed in the UFSAR were aot increased when 3HV-8419 and 3H)/-4048 were reinoved from cervic ,

Only single failures were required to be considered in the UFSAR l accident analysis. Postulating add $tional failures with these valves temporarily removed from service would involve multiple failures and analysis of that conditico was not require n 10 CFR 50.36 defines the requirements for Technical Specification.

f It/ CFR 50.36(c)(2) reads in part. " Limiting conditions for operation 4 are the lowest functional capability or performance levels of equipment required for safe operation cf the fcci)ity." Since the NRC has reviewed and approved the unit's Technical Specifications, ,

and since the Technical Specifications do not include specific  !

operability requirements for 3HV-8419 and 3HV-4048, it must be I acceptable to remove these valves from service to perform i maint,enance without affecting safe operation of the facility. In j addition, removing 3HV-4048 and 3HV-8419 from operation was not j reportable under 10 CFR 50.72 end 10 CFR 50.7 i Regulatory Requirements Safety Evaluation Requirements l 10 CFR 50.59 requires the licensee to obtain Commi.ision approval prior to making changes in the facility or the procedures as 1 described in the safety analysis report, if the change involves a f cnange in the technical specifications or an unreviewed safety i questio CFR 50.59 defines en u'oreviewed safety question as follows:

"A proposed change, test, or experiment shall be deemed to favolve an unreviewed safety question (1) if the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evoluated in the safety analysis report may be increased; cr (2) if a possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may )

)

I

_ _________

l

- _ _ _ _ _ _ _ _ . _ ._

.

. .

.

q

. 13

I s

be created; or (3) if the margin of safety as defined in the '

basis for any technical specification is reduced."

The licensee has implemented these requirements, and the requirements of Section 6 of the Technicel Specifications for Administrative Controls, by requiring a safety et'aluation to be !

performed for each of the following:

proposed' facility changes (PFCs)

• temporary facility modifications (TFMs)

• repair and accept-as-is nonconformance report (NCR)

dispositions procedures, instructions, and changes thereto

• system alignments and plant evolutions not specified by operating instructions or work authorization requests (WARS) Technical Specifications, LCO 3.3.2 (see paragraph 4.c. ).

k Reporting Requi_rements The licensee is required to make notifications in accordance with 10 j CFR 50.72(b)(2)(iii)(0) which states, "...the licensee shall notify the NRC as soon as practical and in all cases, within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of the occurrence of the any of the following:

"(iii) Ary event or condition that alene could have prevented the fulfillinent of the safety function of structures or systems that are needed to:

"(A) Shut down the reactor and maintain it in a safe l shutdown condition, t

"(C) Control the release of radioactive material, or

"(D) Mitigate the consequences of an accident."

The licensec is required to submit written reports in accordance I'

with 10 CFR 50.73(a)(2)(i)(B) and 10 CFR 50.73(a)(2)(v)(D) which state that the licensee ". ..shall submit a Licensee Event Report ,

(LER) for tny event of the type described in this paragraph within i 30 days af ter the discovery of the event. . . .

"(2) The licensee shall report:

"(i)(B) Any operation or condition prohibited Dy the plant's Technical Specifications; or

"(v) Any event or condition that alune could have 3 prevented the fulfillment of the safety function of j

structures or rystems that are needed to-i i

'

"(A) Shut down the reactor and maintain it in a safe j shutdown condition, l

L______--_-__

_ _ _ _ _

-

p

.

.- .,

g I

"(C) C-ontrol the release of radioactive material; or

"(D) Hitigate the (. consequences of an accident." Findings and Conclusions Based on the safety analyses provided in the UFdAR and the NRC staff's i Safety Evaluation Report, the following are apparent: Both the atmospheric dump valves and the main feedwater isolation valves cre required for safe operation of the reacter. Licensee review of the ADVs was described in the letters from H. L. Richter to 9. Katz and H. E. Morgan dated July 15, 1982, and from K. Baskin to J. G. Haynes dated August 25, 1982, wherein the licensee j rctognized that the ADVs were required for safe shutdown of the '

reactor plan The licensee intends to propose changes to the technical specifications to incorporate LCOs for these valves, Although the MFIVs were removed from the containment isolation valves listed in Technical Specification 3.6.3, the required operation of the valves was maintained in the Technical Specification LCO 3.3.2. Since no specific action is prescribed in l the event a valve is inoperable, LCO 3.0.3 becomes applicabl l Therefore, since MFIV 3HV-4048 was incperable (unable te close within 10.9 seconds)-for a period of time in excess of seven hours with the reactor in Mode 1, continued operation of the reactor when the valve was inoperable beyond 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> was a potential violation of Technical Specification LCO 3 0.3 (87-25-01). With regard to 10 CFR 50.59-i (1) Removal of the atmospheric dump valve from service while the {

reactor was in modes 3 and 2 increased the probability of 1 malfunction of equipment importa'nt to safety. The reactor l system was designed so that redundant equipment was available j to ensure safe shutdown capability via the atplospheric dump valves. Removal of one of the two valves increases the 'l probability of equipment malfunction; i.e., with two valves in service the equipment will continue to be able to perform the intended r.afety function in the event of failure of one of i the valves. However, with one valve out of service a f malfunction of the remaining valve will result in loss of the (

safety function of the syste Also, the consequences of an accident previously analyzed in the UFSAR may be increased if a steam generator suffers a tube rupture while the atmospheric dump valve on the unaffected }

steam generator is out of servire in that the unaffected steam generater may not be available to commence cooldown after 30 minutes as assumed in the UFSAR accident analyses, as shown by the following scenario:  :

During a steam generator tube rupture (SGTR) with concurrent loss of power, the UFSAR assumed that the ADV

!

_ _ _ _ _ _ _ _ _ _ _ _

l

.

• *

i on the-intect steam generator was available to perform reactor plant cooldown (UFSAR Table 16.6-7). Emergency Operating Instruction 5023-12-4 titled, " Steam Generator l Tube Rupture,'? also specified reactor plant cooldown using the ADV on the intact steam generator. If the ADV on the intact steam generator is not available during the event, the other ADV would be required to cooldown the reactor plant and the offsite release of radioactive materials would be increased from that assumed in the UFSA (2) Although a safety * valuation was completed for the hydraulic piping modification, this did not adequately address continued plant operation while the safety function of 3HV-4048 was .

defeated. As a result, the following considerations were riot I addressed:

,

I (a) During the period when the MFIV was blocked open, the probability that the main feedwater isolation system for that steam generator would malfunction during a CIAS or i HSIS was increased for the same reasons as discussed above

'

relating tc the ADVs. This condition left the feedvater penetration for steam generator E-088 susceptible to either a single failure of the MFBV (3HV-4047) or a single failure of the feedwater regulating bypass valve (3HV-1106) to clos (b) While 3HV-4048 was blocked open, the consequences of an MSLB inside containment may have been increased since the !

assumptions used in the accident analysis were not valid during this condition- I

)

For the postulated single failure of one train of j containment cooling. the MFIV could not c1nse as '

assumed in the UFSA i For the postulated single failure of a main steam I isolation valve, the MFIV could not close as assumed l in the UFSA j j

During a single failure of either the MFBV or the i feedwater regulating bypass valve, the MFIV could not I close as assumed in the UFSA j Blocking 3HV-4046 in the upen position constituted an abnermal alignment of the feedwater system. This abnormal ;

alignment was authorized by WAR 3-8701723 for the April 10 1

, repair activity, and by WAR 3-8702017 for the April 24 4 repair activity.

(  ;

(3) The licensee's administrative controls specifying control of i abnormal system alignments by work authorization did not ;

J appear to require a review to assure 50.59 criteria are I edequately addressed (paragraph 5.a). I

\ l

,

I l l J

_ _- _ . _ _ , _ . . . . - _ - _ _ - .___ -_ _- __-_______ - - - -_ . _ _ .

~ -

o . <-  :.

.

/

-

(4) The administrative procedure setting forth the elements of-50.59 evaluation related to unreviewed safety question for temporary changes to procedures did not include-the aspect of equipment malfunction (paragraph 5.b).

The applicability of 10 CFR 50.59 to the maintenance activities en 3HV-8419 erd 3HV-t048 is an uiiresolved item pending additional NRC review (87-25-02). , The administrative control exercised durfng the ruaintenance of the above mentioned valves appeared to be prudent and consistent with'

removal of similar equipment pursuant to technical specification 4

'

requirement Operation of the reactor with.the MSIV and ADV nut cf' Service'may be reportable to the NRC pursuant to 50.72(b)(2)(iii), ,

50.73(a)(2)(1)(B) and 50.73(a)(2)(v)(D). Failure to make th(se reports is a potential violation (87-25-03). Exit Meetloa Exit meetings were conducted on August 14 and August 28, 1987, with the licensee representatives identified in paragraph 1. The inspectors suminarized the inspection scope and findings as described in this .veport and specifically confirmed the licensee's position'as set forth in paragraph 6 of this repor ,-

..

I h

. _ _ _ _ _ - _ _ _ _ _ . _ - - _ - - - - - _ _ _ - - . _ . _ _ _ _ _ . - _ - __ _ . . - _ . , _ _ _ _ _ _ _ ._ _ _ _ _ _ ,

b

.

4 &

'

g'

,

I ~

< .

..

.:t

@

f, m

.-

i

$3 4 (

O LD"

.!j 5)5 -

i

.v? gd t, ; e

~

-

t.. :

i