IR 05000382/1997014

Insp Rept 50-382/97-14 on 970707-25.Violations Noted.Major Areas Inspected:Maint & Engineering

ML20210R540
Person / Time
Site:	Waterford
Issue date:	08/27/1997
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV)
To:
Shared Package
ML20210R504	List: IR 05000382/1997014 ML20210R500 ML20210R523
References
50-382-97-14, NUDOCS 9709030152
Download: ML20210R540 (26)

Text

___-_ -___- ___-- ____ - ____ _-

, .

.

ENClES_U_BER U.S. NUCLEAR REGULATORY COMMISSION l REGION IV Docket No.: 50 382 License No.: NPF-38 Report No.: 50 382/97 14 l Licensee: Entergy Opere.tions, In Facility: Waterford Steam Electric Station, Unit 3 Location: Hwy.18

' Killona, Louisiana I J

Dates: July 7-25,1997 Inspector: Linda J. Smith, Reactor Inspector. Engineering Branch >

Approved By: Chris A. VanDenburgh, Chief. Engineering Branch

) Division of Reactor Safety ATTACHMENT: Supplemental Information i

9709030152 970827 PDR ADOCK 05000382-G PDR Y

, _ _ _ __-- _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _-

'

IAhle_oLCRaltatt E X EC U T IV E S U M M A R Y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ill ll. Main (enance................................................... 1 l MB Miscellaneous Maintenance issues ........................... 1 M8.1 (Closed) Licenseo Event Report 50-38 2/93 005 . . . . . . . . . . . . . 1 MB.2 (Closed) Violation 5 0 3 8 2 /9 3 2 5-01 . . . . . . . . . . . . . . . . . . . . . . 'l s M8.3 (Closed) Licensee Event Report 50 38 2/9 5-003 . . . . . . . . . . . . . 3 l

'

Ill. Engineering ._...................................... ........... 3 E8 Miscellaneous Engineering issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 E (Closed) Inspection Followup Item 50 382/9325 03 . . . . . . . . . . 3 E8.2 (Open) Unresolved item 50 382/96202 02 ................ 3 EB.3 (Closed) Unresolved item 50 382/96202 14 ............... 3 EB.4 (Open) Violation 5 0 3 8 2/9 710 0 2 . . . . . . . . . . . . . . . . . . . . . . . 8 E8.5 (Closed) Unresolved item 50 382/9710 03 ............... 11-E8.6 (Open) Violation 50-3 8 2/9 710 04 . . . . . . . . . . . . . . . . . . . . . . 14 E8.7 (Closed) Inspection Followup item 50-382/9710 05 . . . . . . . . . 15 V. M a n ag e me nt M e e ting s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 X 1 Exit Meeting Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

ii

= - _ .

_

,

u .

.. - .

_ _ - _ - - _ _ _ _ - - _ .

_. . _ _ _ - _ _ . __ .__ __________ - _- _ - -

.

'

.

EXECUTIVILSMMMARY Waterford Steam Electric Station, Unit 3 NRC Inspection Report 50-382/97 14

l

!

On July 7 25,1997, one NRC inspector conducted an inspection to followup issues previously identified in other inspection report Maintenan * The inspector closed one violation and two licensee event reports. The licensee's corrective actions were acceptable (Sections M8.1, M8.2 and M8.3).

Ennineerina

• The inspector closed two inspection followup items (Sections E8.1 and E8.7).

• One unresolved item was determined to involve three examples of a violation of 10 CFR 50.71(e). Two of the examples were minor, The third example was more significant and involved a failure to accurately define required emergency feedwater flow rates in the Technical Specification basis section and the Updated Final Safety Analysis Report (Section E8.3).

• Licensee initial action for Violation 50-382/9710-02 was reviewed. The violation identified that the licensee had performed an inadequate 10 CFR 50.59 evaluation to sccept a reduction in the license basis limits for the amount of diesti generator fuel cil stored in the diesel generator fuel oil storage tanks. While the licensee had not formally responded to Violation 50 382/9710-02, the licensee had performed a second 10 CFR 50.59 evaluation, which was found to not fully consider the existing license basis. This violation remains open (Section E8.4).

One unresolved item was determined to be a third example of previously cited Violation, 50 382/9710 04. During Refueling Outage 7, the licensee f ailed to adequately demonstrate that loads supplied via contactors load shed and sequence as required by Technical Specification Surveillance Requirement 4.8.1.1. However, the most recent testing performed during Refueling Outage 8 did adequately imp'ement this surveillance requirement (Sections E8,5 and E8.6).

iii I

____

1*

.

l Regott Details Egmmary of Plant Status The Waterford 3 Steam Electric Station was in Refueling Outage 8 during this inspectio ll.MplattnaDEt M8 Miscellaneous Maintenance issues M8.1 IClosed) Licensee Event Reoort 50 382/93 005: Shutdown cooling isolation valve i motor pinion gear keys were not staked as require Backaround During followup of a similar event at Cooper Nuclear Station the licensee discovered that the motor pinion gear key was not staked on shutdown cooling Valves SI 407A and SI 4070 as specified in Limitorque Maintenance Update 891. According to Limitorque, if the key is not staked, it can slide out of position, thus, allowing the motor to run free while not transmitting any torque to the gearing or the valve ste However; in both cases, the licensee noted that the key had not slid out of positio The licenseo staked the motor pinion gear key on each valv The licensee determined that the ccndition was caused by inadequate field procedures When the update from Limitorque was received the licensee had

updated the technical manual but not the field procedures. The licensee committed to updats the current field procedure j-The licensee believed the error occurred during a period when the valve maintenance procedures were being rewritten and reformatted. The licensee committed to review all of the updates which were received during the procedure transition to ensure they were appropriately incorporated. The licensee documented'

completion'of this review in an inter office memorandum, insoector Followuo The inspector reviewed Limitorque Maintenance Update 891 and the field procedures to determine if they had been updated to address motor pinion gear key staking. The inspector found that the licenses had included kev staking instructions i,. Procedure ME-007 008, " Motor Operated Valve," Revision 10, Change 2. In addition, the licensee had included a key staking inspection in .

.

i the maintenance procedures for Limitorque Model SMB-000 motor operators, for Limitorque Model SMB 00 motor operators, and for Limitorque Models SMB-0 through_ SMB-4T motor operators. The inspector determined these corrective actions were adequat >

'

_a__ - .. == =

_ _ .__ _ __ _ _.___ _ _ _. _ _ -... _ _ _ _ _ _ _ . _

, *

i

.

M8.2 IClosed) Vig1011pn1Q 382/9325 011 Failure to follow corrective action program requirements for safety valve setpoint deviation ,

llKk9t0und

From December 1986 to June 1992 the licensee repeatedly failed to initiate nonconformance condition identifications for the pressurizer safety valves and the main steam safety valves when their as found lif t set pressure doviations exceeded

the toleren ;es specified in the Technical Specifications.

The licensee determined the root cause was personnel error, because the  ;

administrative procedure for identifying nonconforming conditions was not followe '

As a contributing cause, they noted that the setpoint test procedures included instructions for taking corrective action, which resulted in the engineer's belief that no further documentation was necessary.

<

The licensee committed to initiate condition reports to document the past out of-

,

tolerance conditions for the pressurizer safety valves and the main steam safety i valves. Licenstae personnel committed to review their corrective action program to identify any necessary anhancements, including an evaluation of their reportability ,

detenninations, it was additionally committed to revise the setpoint test procedures to reflect necessary enhancements and to review other surveillance test procedures for possible inclusion of corrective action program enhancernent inspector Followuo The inspector found that the licensee initiated Condition Reports 93 52 and 53 on May 12,1993, to document the out-of tolerance history for the rnain steam line l code safety valves and tl.a pressurizer safety valves. Initially, the licensee concluded both of these conditions were not reportable based on their determination that the safety function would have been fulfilled. The inspector noted that the licensee subsequently changed their reportability policy. In November of 1993, the licensee found that the pt ssurizer code safety valves were out of tolerance and initiated Condition Report 93 259. The licensee reported this condition in Licensee l

Event Report 93-00 The inspector reviewed administrative procedures and the site directives related to l the correctivo action program. The inspector noted that the current program clearly l

requires that a condition report be initiated whenever any safety related component fails to meet a surveillance or post modification test acceptance criteria. The inspector also noted that the licensee initiated Condition Report 95 0485 and l

'

Licensee Event Report 50 382/95-003 as required in 1995 for similar condition The inspector determined that the licensee had adequately corrected their implementation of the corrective action program.

,

2 l

. _

.. _ _ _ _ _ _, - - _ ,_ _ _ _ , _ . .- __ __ _ _ --_

.

'

M8.3 1C19m1) Licensee Event Report 50 3H2/95 003: As found pressurizer safety valve hit set pressures out of toleranc As discussed in Section M8.2, Waterford 3 has experienced several past instances of pressurizer safety valve as found lift set pressure deviations being out of-tolerance. The licensee reported that they identified the cause of these failures in Licensee Event 50 382/93 009. The licensee reported that use of the jack and lap

!

process during installation of the valves caused the out of tolerance condition. For l all subsequent installations, the licensee required that the safety valve setpoints be checked with live steam after installation to ent,ure the jack and lap process had not l adversely affected the setpoint. However, the corrective actions described in Licensee Event Report 50 382/93 009 had not been fully implemented at the time i of this event, because this was the licensee's first opportunity for these valves to i be tested under the revised procedure. The inspector noted that the NRC had l reviewed the planned corrective actions for Licensee Event Report 50 382/93 009 l

'

in NRC Inspection Report 50 382/94 26 and found them to be acceptable. The inspector concluded no new issues were revealed by this licensee event repor Ill. E091 Hitdag E8 Miscellaneous Engineering issues E (Closed) Insoection Followun item 50 382'9325-03: Evaluation of the corrosion monitoring program for the component cooling water heat exchanger The NRC had determined that the fiber optic inspection of the component cooling water heat exchangers, performed dt ring Refueling Outage 3, did not provide sufficient information to conclusively assess the corrosion rates for these heat exchangers. At the time of NRC Inspection 50 382/9325 03, the licensee was instalkng Design Change 3311, " Corrosion Rate Monitoring of CCW and ACCW Heat Exchangers A &B," which was intended to provide corrosion moriitoring for these heat exchanger During this inspection, the inspector reviewed commitment management documentation provided by the licensce, which stated that Design Change 3311 was inttalled, but found to have additional design problems. Subsequently, the licensee installed an additiona' modification to correct sample stream deficiencie These actions were considered appropriat E8.2 (Onen) Unresolved item 50 382/96202 02: Component cooling water to dry cooling tower piping could exceed design pressur The scope of this unresolved item was increased to include a review for Updated Final Safety Analysis Report discrepancies as describod in Section E8.3 belo E8.3 (Closed) Unresolved item 50-382/96202 14: Discrepancies identified during review of the Updated Final Safety Analysis Repor o I-

.

RKkWAVnd l

In NRC Inspection Report 50 382/96 202, the NRC team identified nine discrepancies in the Updated Final Safety Analysis Report. The team concluded that in severalinstances the actual design values were inconsistent with those stated in the Updated Final Safety Analysis Report and the report was not revised in accordance with 10 CFR 50.71(el requirements. The team noted that these weaknesses were being evaluated through the licensee's conditica report process.

l 10 CFR 50.71(c) requires that licensees file corrections to their safety analysis report 6 months af ter each refueling outage. The revisions must reflect all changes up to a maximum of 0 months prior to the date of filing. The licensee stated that their last update war May of 1990. Therefore, design changes initiated in 1990 would not be required to be included in the Updated Final Safety Analysis Report until the next update, which is currently scheduled for November of 1997, in accordance with 10 CFR 50.34 and 1.) CFR 50.36 the Technical Specification Basis Section is part of the Final Safety Analysis Report. Therefore,10 CFR 50.71(o) applies to the Technical Specification Bases Sectio Insnector Followun The inspector interviewed licensee personnel, reviewed the r~lerenced Updated Final Safety Analysis Report section, and reviewed corrective action documentation i to confirm all technical issues were being tracked to resolution and to identify l violations of 10 CFR 50.71(e). The issues and the results of the inspector's findings are listed belo Component Cooling Water Pump Motor Capacity The NRC team noted that Final Safety Analysis Report Table 9.21, " Design Data i For The Component Cooling Water Cystem and Auxiliary Component Cooling Water System Component," Sheet 1 of 5 showed component cooling water system pump motor capacity as 3000 horsepower instead of 300 horsepower. The licensee agreed. They determined this was a typographical error and stated that they had hitiated License Document Change 9717 o correct this discrepancy. This is one example of a violation of 10 CFR 50.71(e) (60 382/9714 01). '

Component Cooling Water System As found Flow Rates Low The NRC team noted that component cooling water system as found flow rates for components, such as Containment Spray Pump B, Shutdown Heat Exchanger A, and Containment Fan Cooler B were lower than the values listed in the Final Safety Analysis Report Table 9.2 3. The licensee stated that Condition Report 96-0955 was. written at the time the flow rates were identified and addressed this

..__ _ _ _ . _

h

_ _ _ _ - - _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ -__ _ __ _ __ _ - __ __- _ _

.

nonconforming condition. As a part of the resolution for Condition Report 96 0955, the licensee had determined the heat exchangers were still capable of performing their accident functio The component cooling water system as found few rate degradation was reviewed in detail in NRC Intpection Report 50 382/97 03, A related Notice of Violation was issued in Enforcement Action 97 099 to identify design control, test control and corrective action ir, sues. However, at, stated in the background section, conditions identified during after May of 1996 would be included in the next scheduled safety analysis report update. The inspector determined that a violation of 10 CFR 50.71(e) did not occur, Component Cooling Water to Containment Fan Cooler Piping Could Exceed Design Pressure The NRC team noted that Final Safety Analy6is Report, Table 9.21, stated that the design pressure for the component cooling water system piping was 125 psi However, the licensee had identified that the containment fan cooler piping not exposed to containment pressure (i.e., the portion between the outside containment isolation valve and the containment penetration) could experience a pressure of 165 pSig if the containment fan cooler was isolated and was relying on the thermal relief velves for protectio P The licensee stated that on June 11,1997, they had rerated the affected piping to 200 psig and initiated Licensee Document Change Request 97 207 to correct the Updated Fi,'el Safety Analysis Repor identified this condition on Condition ReportThe licensee stated that they had init 96 1555. Since the condition report was not initiated until 1996, the licensee was noi required to make this update until the next scheduled safety analysis report update, The inspector concluded that a violation of 10 CFR 50,711e) did not occur, Component Cooling Water to Dry Cooling Tower Pip!ng Could Exceed Design Pressure The NRC team noted that Final Safety Analysis Report, Table 9,2-8, stated that the dry coolin9 tower tube side design pressure was 125 psig, but the licensee's architect / engineer calculation dated February 6,1989, determined that the pressure in the dry cooling tower manifold could be as high as 144 psig when the component cooling water system pump .. operating under low flow condition The inspector noted that the associated technicel issue was being followed as Unresolved item 50 382/96202-02, which was sti.I open. The NRC plans to review this matter further during a future inspection to determine whether or not a violation of 10 CFR 50.71(e) occurre _ _

m----ym -m-n- - -_. m -

.

.. .

.

.

.

Uriprotected Dry Cooling Towers The NRC team noted that Final Safety Analysis Report Section 9.2 stated that 60 percent of the dry cooling towers were protected from multiple tornado missiles and that this was sufficient to remove hot shutdown heat loads. However, several conduits and cables were not protected from tornado missiles. On October 10,1996, the licensee initiated Condition Report 96 1591 to address this issu NRC inspection of this nonconforming condition was described in Section E8.6 of NRC Inspection Report 50 382/97 10. The NRC cited a corrective action violation, because the licensee had prior opportunities to correct those deficiencies. The inspector determined the appropriate violation had besa issued and that an additional citation for a violation of 10 CFR 50.71(e) violation was not warranted.

'

Auxiliary Component Cooling Water System As.Found Flow Rates Low The NRC team identified that the Final Safety Analysis Report Table 9.21 stated that the auxiliary component cooling water system flow rate was 5000 gpm, but the Train B actual flow was 4500 gpm as shown in Procedure STP 0014732, Revision O. The licenses stated that Conoition Report 96 0543, dated April 10, 1996, addressed this nonconforming condition. The licensee reported the condition in Licenseo Event Report 50 382/96-00 The inspector noted that the corrective action plans for Condition Report 96-0543 included an action to review flow rates (; gainst the Updated Final Safety Analysis Report and initiate needed changes. Based on the date of the condition report and the licensee's plans to update the Safety Analysis Report, the inspector concluded that a violation of 10 CFR 50.71(e) did not occu NRC inspection of the associated technical issues will be conducted during closure of Licensee Event Report 50-382/96 007 and related Inspection Followup item 50 382/96202 01, incorrect Circuit Breaker Numbers The NRC team noted that Final Safety Analysis Report pays 8.12 had incorrect numbers for circuit breakers connecting the swing AB bus to the A or B bus. The licensee determined this was a typographical error and initiated License Document Change Request 97 0073 to correct the discrepancy. This is the second example of a violation of 10 CFR 50.71(e) (50 382/9710-01).

,. .

. . _ _ _ .

-

,

'

.

.

Incorrect Emergency Diesel Generator Load Table The NRC team noted Final Safety Analysis Report, Table 8.31, did not agree with licensee's Calculations MN(Q) 9 9 and EC E90 006. This issue was reviewed in detailin Section E8.2 of NRC inspection Report 50-382/97 10. The NRC cited a design control violation related to an inadequate design interface between the f mechanical and the electrical design organizations. The electrical organization was i

responsible for making the safety analysis report updates after they updated their calculations. The inspector concluded that the appropriate violation had been issued and that an additional citation for a 10 CFR 50.71(e) violation was not warranted.

I Inaccurate Emergency Feedwater System Flow Rates The NRC team noted Final Safety Analysis Report, Section 10.4.9.2, stated that the motor driven emergency feedwater pump flows were 700 gpm, but the licensee's revised Calculation EC-M96-004 showed that the ca!culated flows were 015 op This issue was discussed in detailin NRC Inspection Report 50 382/9/10 in l

Sections E8.4 and EB.S. Technical Specification Bases, Section 3/4.7.1.2, stated that each electric driven emergency feedwater pump was capable of delivering a total feedwater flow of 350 gpm at a pressure of 1163 psig to the entrance of the steam generators. The licensee had determined that the basic section should have read that each electric-driven emergency feedwater pump was capable of delivering a total flow of 350 gpm at a pressure of 1163 psig at the discharge of the pump. The licensee stated that the pumps could meet this flow requirement. Section 10.4.9.2 discusses a flow of 700 gpm, but does not discuss the associated pressure. The licensee maintained that the original license basis was always for the two electric-driven pumps to be able to provide a total of 700 gpm at 1163 psig at the discharge of the pump The licensee identified the Technical Specification Basis discrepancy on August 4, 1995, during an emergency feedwater self assessment, and had initiated Condition Report 95-0656. In addition to this inaccuracy and lack of clarity in the safety analysis report, the licensee also identified technical weaknesses with the calculation for determining the correct emergency feedwater flow requirement Rather than updating the Technical Specification Basis or clarifying the Updated Final Safety Analysis Report during the May 1996 update, the licensee deferred the correction until af ter the reanalysis was complete. -The licensee's reanalysis determined that the emergency feedwater system was sized correctly for long term decay test remova The inspector determined that the f ailure, since original licensing, to accurately describe the license basis flow and pressure requirernents for the emergency feedwater pump in the Technical Specification Basis section is the third example of a violation of 10 CFR 50.71(e) (50 382/9714-01). However, as discussed in NRC Inspection Report 50-382/97 10, the licensee subsequently docketed their plan and-schedule for submitting the necessary revisions to license basis document .

________ _

l *

.

Note: The technical aspects of the analysis weaknesses were reviewed in NRC Inspection Reports 50 382/96 202 and 50-382/9710. A related design control violation was cited in NM Inspection Report 50 382/97 1 Conclusion The NRC team identified two minor examples of a violation of 10 CFR 50.71(e) and one more significant example related to emergency feedwater pump flow requirements. The licensee had identified that the Technical Specification basis section did not accurately describe the basis for emergency feedwater flow requirements on August 4,1995, but did not include the correction in '5e May 1990 update (50 382/9714-01). The inspector determined that the cor sctive actirns taken and planned for this violation were sufficient. As a result no further rest,onse will be required for this violatio E8.4 (Open) Violation 50-382/9710-02: Inadequate evaluation pursuant to 10 CFR 50.59, " Changes, Tests, and Experiments," related to change in commitment for omergency diesel generator fuel oil volum Backaround in NRC Inspection Report 50 382/97 10, the inspector had determined that the licensee's 10 CFR 50.59 written safety evaluation for the change to the Final Safety Analysis Report, which removed the commitment to maintain a 10 percent margin, was inadequate. The safety evaluation did not address the reduction in required fuel oil storage margin and the associated increase in probability that the emergency diesel generator would run out of fuel before 7 days because of uncertainties associated with the time-dependent load calculation. As a result, the safety evaluation did not provide an adequate basis that the change did not involve an unreviewed safety question. The failure to provide this basis was a violation of 10 CFR 50.5 At the time of this followup inspection, the licensee had not provided a formal response to the violation. However, the licensee had implemented some corrective action. The licensee completed Calculation EC-E90 006, " Emergency Diesel Generator Loading and Fuel Oil Consumption," Revision 2, Change 12, to demonstrate availability of the required 10 percent margin under restricted circumstances and performed a safety evaluation for the change pursuant to 10 CFR 50.59. The licensee also prepared a licenso document change request to update their final safety analysis with the changed assumption Inspector Followun The inspector reviewed the safety evaluation for Calculation EC-E90-006,

" Emergency Diesel Generator Loading and Fuel Oil Consumption," Revision 2, Change 12. The inspector found that the licensee was able to demonstrate the availability of the required 10 percent margin by making new analysis assumption When only one emergency diesel generator was available, the licensee credited

,

.

.

capacity in the opposite fuel oil storage train. When two diesel generators were available, the licensee credited load management directed by the Technical Support Center to meet the 10 percent margin requiremen The inspector reviewed both the Final Safety Analysis Report and the Safety Evaluation Report written at the time of initiallicensing, and the current Updated Final Safety Analysis Report, to determine the acceptability of this change in assumptions. The inspector found that the assumptions in the 10 CFR 50.59 safety evaluation were not consistent with the design bases of the syster., described in the referenced documents. Use of fuel from the opposite fuel oil storage train to meet minimum requirements conflicted with the original design base Specifically, the inspector found that the new assumptions were not consistent with the licensed design bases, in the design bases section of the Final Safety Analysis Report issued at licensing, and the current Updated Final Safety Analysis Report, the licensee had claimed:

"The Diesel Generator Fuel Oil Storage and Transfer System is designed to:

a) provide oil storage capacity in each storage tank for seven days operation of one diesel generator to meet the engineered safety feature load requiiements following a loss of offsite power and a design basis accident, b)

maintain fuel supply to at least one diesel engine assuming a single active or passive failure."

As discussed in NRC Inspection Report 50 382/9710, the inspector noted that each fuel oil storage tank had less than a full 7 day supply of diesel fuel, in addition, the inspector noted that a passive f ailure of one tank or the nearest manual discharge valve would result in less than a 7 day supply being available to the running diesel from the design source, in the system description section, the licensee reiterated their commitment to provide two completely redundant trains and their commitment that the capacity of each diesel oil storage tank is sufficient for 7 days operation of one emergency diesel generator with the loading shown in Table 8.3 ,

in the safety evaluation section of the Final Safety Analysis Report and the Updated Final Safety Analysis Report, the licensee had claimed:

"The Diesel Generator Fuel Oil Storage and Transfer System provides two independent sources of diesel oil supply. Physical and electrical separation of components assure that the system can withstand a single failure. Tanks, pumps and piping are so arranged that the malfunction or failure of either active or passive components in one train will not impair the ability of the other train to function . . . A f ailure modes and effects analysis is provided in Table 9.5 2."

i _ - _ , . _ ,,- _ _ _ --

. . . - . . .

E.

i in the f ailure modes and effects analysis from these documents, the licensee had

,

' analyzed that failure of one fuel oil storage tank was acceptable, because of the redundant storage tank with a 7 day supply available. As stated above, these claims were no longer true. The licensee had proposed a revision to the Updated Final Safety Analysis Report to describe their proposed method for compliance with ANS 59.51/ ANSI N1951976, " Fuel Oil Systems for Emergency Diesel

! Generators." However, their proposed revision did not chaage their commitments to full redundancy or to full capacity storage tanks described abov The inspector also found that the NRC staff relied on the full redundancy of the two fuel oil storage systems when they accepted the initial design, in the NRC Safety Evaluation Report, which accepted the initial design, the NRC staff had found the j initial design acceptable with respect to General Design Criterion 17 based on '

redundancy. The NRC had noted in the Safety Evaluation Report that, l

"Eech diesel engine fuel oil storage and transfer system is independent and physically separated from the other system supplying the redundant diesel generator. A single failure within any one of the two systems will affect only the associated diesel generator. Therefore, the requirements for GDC 17 as related to the capability of the fuel oil system to meet independence and redundancy criteria are met."

The inspector concluded that the revised design assumptions were not consistent with the original licensing basis. Further, the licensee did not identify in the 10 CFR 50.59 evaluation that they had introduced the possibility of a different type of malfunction. Now a malfunction of the tank discharge valve or a broken line on one train would affect the other train. Previously a malfunction on one train would

,

not have affected the other trai The inspector reviewed the licensee's current emergency diesel generator fuel oil calculation, Calculation EC-E90-006, " Emergency Diesel Generator Loading and Fuel Oil Consumption," Revision 2, Change 12, which was the subject of the 10 CFR 50.59 evaluation. Based on this review, the inspector determined that the

.

current Technical Specification value for the minimum fuel oil storage tank level did not meet the intent of the bases section of the Technical Snecifintions. As discussed in NRC Inspection Report 50 382/97 10, the licensee had committed in the Technical Specification Bases section and in earlier licensing documents to determine the minimum fuel oil storage tank volume using the methods described in ANS-59.51/ ANSI N1951976, " Fuel Oil Systems for Emergency Diesel Generators."

The current Technical Specification minimum specified volume is 38,760 gallons of fuel, which is equivalent to 38,000.4 usable gallons. The calculation indicated that a worst case 7 day supply of fuel oil would be equal to 42,608.5 usable gallon The licensee stated that this calculation included conservatisms, and the actual required value is probably closer, although not less than, the Technical Specification valu ,

-- .

.

. . . .. .. ..

l .

O The licensee subsequently initiated Condition Report 96-1836 to identify that Technical Specification value for the minimum value in the fuel oil storage tanks was nonconservative with respect to the calculation. The inspector noted that the condition report stated that deviation from this commitment is a nonconforming condition that does not constitute inoperability of the emergency diesel generators provided the fuel oil storage tank volume of Limiting Condition for Operation 3.8.1.1

or 3.8.1.2 is met. The inspector interviewed the Director of Licensing and found that this statement was intended to be applicable until Mode 1, while they were developing the appropriate compensatory measures. At Mode 1, the licenseo planned to establish administrative controls on the auxiliary boiler fuel oil storage tanks so that in addition to the Technical Specification limiting condition for operation limits, the full 7-day supply of fuel oil, i.e., 42,608.5 usable gallons, I

would be available to support emergency diesel generator operability, in correspondence dated July 15,1997, the licensee notified the NRC that the fuel oil storage limit in the Technical Specifications was nonconservative with respect to their commitment for calculating the 7 day requirement. The correspondence described compensatory measures for this nonconforming condition which included both measures to ensure adequate oil supply on site and proposed license amendments. The inspector reviewed the licensee's compensatory measures and interviewed personnel. The inspector determined that the liconsee now intended to establish fuel oil availability comparable to the current license basis commitments, i,0., fully independent fuel oil supply systems with a minimum total capacity calculated in accordance with ANSI N19 Conclusion The inspector initially found that the licensee was stillin violation of 10 CFR 50.59 and, therefore, had not corrected Violation 50 382/9710-02. Subsequently, the licensee withdrew their proposal to modify the license basis without formal NRC staff review. While the inspector was on site, the licensee initiated a condition report, which identified their nonconservative Technical Specification and developed acceptable compensatory measures for the nonconforming condition. The NRC considered that since the violation response had not been formally submitted, this violation would remain ope E8.5 (Closed) Unresolved item 50-382/9710 03: Adequacy of 18 month Technical Specification integrated tests to verify load shedding from the emergency buses and load sequencing onto the emergency buses where loads are supplied through clectrical contactors, and the adequacy of dieselloading and fuel oil consumption calculations to ensure that untested electrical contactor loads were properly considered in the calculation Backaround in NRC Inspection Report 50-382/96 202, the NRC team had identified that the licensee was not verifying all nonemergency 480V ac loads on safety-related buses shed and sequenced as required. The licensee asserted that they were only

,

- _ _ _ - _ __----- . .

.

.

.

M requi.ed to verify that devices shed by the loss-of-offsite power or loss-of offsite power /nfety injection actuation signal sequencer relays, were in fact deenergize The NRC team did not agree with this position.

-

In NRC Inspection Report 50 382/97-10, the inspector confirmed that the b

-

contactors were designed to open upon loss-of holding voltage. Subsequently, the

napector determined that contactors in circuits, which do not automaticaily restart

, when power was restored to the motor control center, did not have to be verified.

Il This was based on the f act that the on/off capability of the contactor was

_ demonurated every time a load was energized or de-energized. However, the inspector notd that some circuits were designe such that the contactor will automatically re energize. This type of load would either have to be r?nservatively included in the load calculation as being restored when power is restored to t.he motor control center or verified as sequencing on with the correct load bloc Since the last inspection, the licensee had revised the test procedures which were used to implement Technical Specificaticn Surveillance Requirement 4.8.1.1.2.e and

" the emergency diesel generator loading and fuel consumption calculation. The licensee stated that they had conservatively included testing for contactor supplied loads in the new test procedures, in addition, the licent se had completed a substantial portion of their test reviews to ensure that related cor": erns in Generic Letter 96-01, " Testing of SHaty Related Logic Circuits," were addressed. They

_

planned to complete all of the required testing prior to entering Mode jnspector Folicwuo The inspector interviewed personnel. In addition, the inspector reviewed Procedure OP-903-116, " Train B Integrated Emergency Diesel Generater/ Engineering Safety Features Test,' ~1evision 3, which was used in the !ast refueling outage to

-

implement Technical Specification Surveillance Requirement 4.8.1.1.2.e. The

-

r inspector reviewed Procedure OP-903-116, " Train B Integrated Emergency Diesel Generator / Engineering Safety Features Test," Revision 5, ano WA 01160909,

, which were used during this refueling outage to implement Technical Specification Surveillance Requirement 4.8.1.1.2.e. The inspector reviewed Calculation EC-E90-006, "EDG Loading and Fuel Oil Consumption," Revision 2, Change 12. The inspector reviewed related electrical drawings with emphasis on those associated with 480 V Motor Control Centers 3B311 S,38315-S. The inspector reviewed the licensee's list of items still open from their Generic

-

Letter 96-01 review. The inspector also reviewed portions of the completed test

, data packages related to safety injection with a loss of offsite power which were l performed on June 19-20,199 Past Testing Practices The inspector identified loads, which were supplied through electrical contectors, sequenced through the load sequencer not included in Procedure OP-903116,

" Train B Integrated Emergency Diesel Generator /Enginectina Safety Features Test,"

Revision 3, as required. For example, power to Solid State Uninterrur x% Power

[ 12

, _ , , , . _ , _ . . . - _ _

_ - _ _ _ ____-____- _ - -- - - -- --

.

.

Supply 3MD-S was sequenced on following a safety injection actuation coincident with a loss-of offsite power. The failure to confirm that this load shed and properly sequenced back on is another example of the previourly identified violation of Technical Specification 4.8.1.1.2e (i.e., Violation 50-382/9710-04). The license 9 committed to address this issue in their response to the previously cited violatio Current Testing Practices With some minor exceptions, the inspector found documentation that Technical Spccification Surveillance Requirement 4.8.1.1.2.e was satisfied during this refueling outage and that the analysis accurately modeled load sequencing.

, As an exception, the inspector identified that data for one dry cooling tower f an

_; y was not included in the final data package The licensee was able to retrieve the

[i ?

data from the computer archives and attach it to the data package. The incpector interviewed test personnel involved and determined that the missing data point was

,

'

identified during testing and the data was similariy retrieved. However, the addenda sheet was inadvertently omitted from the final package when it was submitted to records.

) The inspector noted that the licensee verified the sequencer relays and the major loads timed correctly, but the procedure did not specifically require personnel to verify that small loads cycle on with the correct ioad block. The inspector identified one smallload, which did not sequence on the correct block, in accordance with the analysis, Control Room Emergency Filter Unit B was designed to sequence on with Load Block 4; however, the actual test results would indicate that the load cycled on with Load Block 5, which is conservative. The licensee believed this delay was caused by a damper interlock. They planned to confirm the cause of the 10-second delay, in addition, the inspector noted that the load block nomenclature used in the analysis was different than used in the procedure, which was confusing. For example, the Sequencer Relay S6X loads Load Block 7 in the procedure, but this is referred to as Load Block Sa in the analysi The inspector also noted that, while evidence of actualload shedding was clearly included in the test data package, load shed verification was not always clearly documented in the procedure. The licensee p' ined to correct these procedure weaknesses with the next procedure revisio Conclusion Sased on a rev;ew of the availablo data, the inspector concluded that sufficient testing had been performed to demonstrate compliance with Techaical Specification Surveillance Requirement 4.8.1.1.2.e with respect to loads supplied through electrical contactors. Past licensee testing practices in this area were in violation of

_ _ _ _ _ .

. .. .. .. .. . .

. .. . _ _

.

-Technical Specification 4. 1.1.2.e, but the licensee had taken appropriate corrective action to ensure sufficient testing during this outage. The lic' isee planned further procedure improvements, which were needed to clearly define L verification and acceptance criteria requirement E8.6' (Open) Viol.tbn 50 382/9710-04- Failure to establish surveillance tests to meet the requirements o' Technical Specifications 4.8.1.1. ,

'

As discussed in Section E8.5, the inspector identified one additional example of -

this violation, related to contactor testing. The following is a review of the licensee's corrective actions for the two examples, which were previously identified in NRC inspection Report 50-382/96-202 and cited in NRC Inspection Report 50-382/97-1 Backoround in NRC Inspection Report 50 382/96 202, the NRC team had identified that the licensee had not verified that all_of the nonsafety related loads on Switchbaard 3A32, a potentially large load of plant heaters and motors, shed following a loss-of offsite power. The team observed that Procedure OP403-028,

" Pressurizer Heater Emergency Power Supply Functional Test," Revision 3,

,- deenergized Switchboard 3A32.and stated that allloads would be deenergized, but l

- did not require observation or verifbation that some of the loads were deenergized as stated. The licensee revised Procedure OP-903 028 to address this issue and reperformed the testing, in NRC Inspection Report 50-382/96-202, the NRC team had identified that the licensee had not included Air Handling Units AH 3 (Shutdown Heat Exchanger A Cooler) and AH 24 (CCW Heat Exchanger A Coolerk which were shed and re-energized by a loss of_ offsite power or a loss of offsite power / safety injection

~

actuation signal, in the integrated test. The licensee revised and reperformed Procedures OP-903115 and -116, " Train A (R] Integrated Emergency Diesel

= Generator / Engineering Safety Features Test," to address this issue, insoector Followuo The inspector interviewed personnnl and reviewed Train B procedures, calculations, drawings and test documentation to determine the status of the licensee's corrective action for this violation. See Section E8,5 for a detailed list of the documents that were reviewed. In addition, the inspector reviewed Procedure OP 903-028, " Pressurizer Heater Emergency Power Supply Functional Test," Revision 4 Violation Corrective Action The_ inspector found that the licensee had satisf actorily revised Procedure OP 903-028 to ensure the pressurizer heater loads were verified to be shed. The inspector sampled Train B documentation and determined that

.14 k . -

_ . ..

. ..

.

the licensee had satisf actorily revised Procedure OP 903116 to verify that the following loads correctly shed and started on their corresponding load sequencer block: Shutdown Heat Exchanger B room cooler and Component Cooling Water Heat Exchanger B room cooler. The liccnsee noted that Control Room Heater EHC-34 and Switchgear Room Heater EHC-36 could not sequence on without their associated fana because of an airflow interlock. The inspector verified that the licensee had satisfactorily verified the heater loads shed and that the associated fans shed and sequenced on the correct load block. The inspector determined that the licensee had taken appropriate corrective action for the cited violatio Conctusion The inspector conclut 9d the licensee had implemented satisf actory corrective actions for this violation. This violation remains open pending review of the licensee's formal violation response.

l l E8.7 (Closed) Insoection Followuo item 50-3d2/9710-05: Review of the licensee's feedwater line break !icense basi Backaround In NRC Inspection Report 50-382/96-202, the NRC team identified that Calculation EC-M96-00*, " Design Basis Reconstitution for EFW Flow Rate,"

Revision A, had not been analyzed for a feedwater break accident where a loss-of-offsite power did not occur as required by 10 CFR Part 50, Appendix A, General Design Criteria 34, " Residual Heat Removal."

In NRC Inspection Report 50-382/97-10, the NRC cited this failure as a design control violation and reviewed analysis and corrective action documentation associated with the issue. During that inspection, the inspector identified concerns rWated to the feedwater line break licenso basi *

Had the licensee adequately incorporated the results of a main steam safety valve setpoint sensitivity study into the Updated Final Safety Analysis Report?

Were the new thermal hydraulic modeling assumptirns used by the licensee to predict emergency feedwater flow requirements consistent with the current license basis?

Did the licensee's new analysis for emergency feedwater flow requirements still predict that no operat"* anons would be required in the first 30 minutes as discussed in the Update D al Safety Analysis Report?

i

_ _ _ _ _ _ _ _ _

- - _ _ _ _ _ - _ _ _ _ - -

.-

Insoe a tor FollowuD The inspector interviewed licensee personnel, reviewed applicable sections of the Updated Final Safety Analysis Report and reviewed the licerise's completed calculation to determine emergency feedwater flow requirement The inspector found that the licensee had adequately incorporated the results of the main steam safety valve sensitivity study into the Updated Final Safety Analysis Repor The licensee stated that the emergency feedwater flow requiremente calcu'ation was prepared with more reasonable assumptions, which better predict long term

[ decay heat removal requirements, but do not predict reactor pressure as

conservatively as the safety analysis. The licensee stated that the analysis l described in the Updated Final Safety Analysis report was intended only to predict peak reactor pressure. The licensee noted that the analysis being discussed in the Updated Final Safety Analysis Report was prepared with unrealistic modeling assumptions which were included to ensure that reactor pressure was conservatively modeled. The licensee also noted that the results of the safety analysis are only reported fnr the first 50 seconds, which is before emergency feedwater reaches the steam generator. The inspector determined that it was appropriate to use different modeling assumptions to predict emergency feedwater flow requirements, which is a long-term phenomen in a related issue, the inspector found that the licensee's calculation for emergency feedwater flow requirements predicted that in some circumstances operator action would be required within 25 minutes of event initiation. The inspector was initially concerned that this conflicted with the Updated Final Safety Analysis Report Section 15.2.2.5.3.3, "[ Loss of Normal Feedwater Flow) Results," which reported the results of safety analysis to determine peak reactor pressur Section 15.2.2.5.3.3 stated thet operator action would not be required for 30 minute The licensee noted that the calculation to determine emergency feedwater flow requirements was prepared for a different purpose and with different design assumptions than the safet/ analysis to determine peak reactor pressure. They stated that Section 15.2.2.5.3.3 still accurately reflected the results of the safety analysis to determine peak reactor pressure for a feedwater line brea The inspector noted that the standard review plan for the feedwater line break accident only asked licensee's to address operator actions required in let.s than 10 minutes. Considering the change from 30 minutes to 25 minutes was outside the criteria used by the staff to evaluate the accident response and considering the licensee's position that the emergency feedwater flow requirement analysis is not being described in Updated Safety Analysis Report Section 15.2.2.5.3.3, the inspector determined no further followup was require i

F,

.

V. Mananoment Meetinns X1 Exit Meetina Summaly l

'

On Ju!y 25,1997, the inspector conducted an exit interview with the licensee personnel listed in Attachment 1. The licensee acknowledged the findings, which were presente The licensee's comments were evaluated and incorporated into the inspection repor I l

r

.

L -

_

fo _-

.

. . :-

ATTACHMENT SUPPLEMENTAL INFORMATION PARTIAL LIST OF PERSONS CONTACTED Licensee l 'G. Cesare, Licensing Engineer

[

'

E. Ewing, Director, Nuclear Safety and Regulatory Affairs T. Gaudet, Manager, Licensing J. Holr an,- Manager, Safety Analysis D; Matthews, Specialist, Licensing-

'L. Rushing, Manager, Mechanical Civil Design D. Vinci, Manager, Plant Engineering,-

A. Wrape, Director, Design Engineering -

INSPECTION PROCEDURES USED 92903 Engineering - Followup

-

ITEMS OPENED. CLOSED, AND DISCUSSED Oceae /9714-01 - VIO Two minor examples of a failure to update the safet)

analysis report and a third more significant f ailure to update the Technical Specification Bases Section related to emergency feedwa* flow rates (Section 8.3).

Closed 50-382/93-005 LER Shutdown cooling isolation valve motor-pinion gear keys were not staked as required (Section M8.1).

50-382/9325-01 VIO - Failure to . identify and initiate a condition report for pressurizer and main steam safety. valves exceeding their technical specification tolerances (Section M8.2).

50-382/9325 03- IFI Review the results of the corrosion monitoring program for the component cooling. water heat exchanger-(Section

-

E8.1 ) .

50-382/95 003 LER Pressurizer Safety Valve Setpoints found out of tolerance (Section M8.3).

)

1-

/

.

_ _ _ _ _ _ _ _ _

[e_

d e

50-382/96202-14 URI Multiple Updated Final Safety Analysis Report Discrepancies (Section 58.3).

50-382/9710-03 URI 18 month Technical Specification Surveillance integrated tests don't verify load shedding from the emergency buses and load sequencing onto the emergency buses where loads are supplied through electrical contactors (Section Eb.5).

50-382/9710-05- IFl Determine if the Final Safety Analysis Report coi ains a l description of the bounding analysis for a feedw-iter line break (Section E8.7).

50 382/9714-01 VIO Two minor examples of a failure to update the safety l- analysis report and a third more significant failur6 to update the Technica! Specification Bases Section related to ,

emergency feedwater flow rates (Section 8.3).

Discussed 50 382/96202-02 URI Component cooling water to dry cooling tower piping could exceed design pressure (Section E8.2).

50 382/9710-02 VIO Inadequate safety evaluation of proposed change in commitment for emergency diesel generator fuel oil volume (Section E8.4).

50-382/9710-04 VIO Failure to establish surveillance tests to meet the requirements of Technical Specifications 4.8.1.1. (Sections E8.5 and E8.6).

DOCUMENTS REVIEWJD License Document Change Requests Number Title A,2 proval Date 97-0073 Correct Typographical 10/7/96 Errors on Page 8.1-2-97-0174 Change CCW Motor 4/18/97 Horsepower from 3000 to 300

'97 0201 Design Basis Calculations 5/24/97 For The Ultimate Heat Sink

L

.. __ -. . _ _ _ .

!

.

Licensee Event Reoorts Number Title 50-382/93-005 Motor Pinion Gear Keys for SDC Valves Not Staked Due to inadequate " acedure 50-382/93-009 PSV Setpoints Found Out of Tolerance Due to Errors introduced When Establishing Setpoints i

Calculations Number Title .P; vision EC-S97-016 WSES Analysis of 575 gpm Revision 0 EFW flow of FWLB & LOCV Events with the inclusion RCP Heat Drawinas Number Title Revision 4 G-160 Flow Diagram Component Revision 8 i Closed Cooling Water System Procedures and instructions Number Title Revision Maintenance Procedure Limitorque Motor Operator Revision 2, Change 2 ME-004-010 Maintenance for SMB-000 Valves Maintenance Procedure Limitorque Motor Operator Revision 2 Change 2 ME-004-011 Maintenance for SMB-0 through SMB-4T Valves Maintenance Procedure Limitorque Motor Operator Revision 0

'

ME-004-015 Maintenance for SMB-00 Valves Maintenance Procedure Motor Operated Valve Revision 10, Change 2 ME-007-008 Maintenance Procedure Pressurizer Safety Valve Revision 5 MM-007-004 Test Maintenance Procedure Main Steam Safety Valve Revision 5, Change 3 MM-007-015 Test

( , . .

!

.

System Operating Component Cooling Water Revision 11 Procedure OP-002-003 Administrative Procedure Condition Identification Revision 12 UNT-005-002 Site Procedure N Corrective Action Revision 5 W2.501 Site Directive N Operability! Qualification Revision 1 W4.101 Confirmation Process Surveillance Proceduto OP- Train B Integrated Revision 3 903-116 Emergency Diesel Generator / Engineering Safety Features Tert Surveillance Procedure OP- Train B Integrated Revision 5 903-116 Emergency Diesel Generator / Engineering i

Safety Features Test WA#01160909 Train B supplement Condition Reoorts and NonconformanceJvalua. lions Number Title initiation Dtite CR-93-052 During the "in situ" 5/12/93 Trevitesting of main steam safety valves, some of the as-found lift settings were greater than i 1 %

tolerance allowed by the Technical Specification CR-93-053 During the offsite testing of 5/12/93 pressurizer safety valves, some of the as-received lift settings were greater than i 1 % tolerance allowed by the Technical Specification CR-93-259 During off site testing of 11/17/93 pressurizer safety valve

"as-found" lift settings out of tolerance

,

,_ _ _ _ __

_ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ - _ _ _ _

fo

?

,

CR-95 0485 During off site testing of 6/13/95 pressurizer safety valve

"as-found" lif t settings out of tolerance CR-95 0656 incorrect Technical 8/4/95 Specification Basis CR 96-0543 Incorrectly Positioned 4/10/96 CC/ACC Throttle Valves CR 96 0955 CCW Train A flow test data 10/10/95 did not meet acceptance criteria CR 96-1555 CCW to Containment Fan 10/4/96 Cooler piping can exceed design pressure CR 96-1586 Failure to Update Electrica! 10/9/96 Calculations When l Mechanical Loading is Changed CR-96-1591 Conduit for Ultimate Heat 10/10/96 l Sink Valves Not Fully

} Protected from Tornado Generated Missiles CR-97-1836 Failure Meet ANSI Standard 7/14/97 N195, " Fuel Oil Systems for Standby Diesel Generators" Mscellaneous Number Title Revision Limitorque Maintenance Motor Pinion Gear Update 89-1 Installation Generic Letter 96-06 Assurance of Eqeipment September 30,1996 Operability and Containment Integrity During Design-Basis Accident Conditions

k

_ _ - _ _ _ - _ _ _ _ _ _ -

, .

.

,

Memoranda W3F1-97 0017 Assurance of Equipment January 28,1997 (Gaudet to NRC Document Operability and I Control Desk) Containtnent htegrity During Design Bar's Accident Conditions Memoranda W3F197-0192 Deviation From ANSI N195 (Dugger to NRC Document Control Desk)

Commitment Llosure IR 93-25 Section 3.13 October 13,1994 Verification Form A21056 l

l I

!

-

, , _ _