IR 05000387/1994017
| ML17158A494 | |
| Person / Time | |
|---|---|
| Site: | Susquehanna  |
| Issue date: | 09/22/1994 |
| From: | Eugene Kelly, Brian Mcdermott NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML17158A493 | List: |
| References | |
| 50-387-94-17, 50-388-94-17, NUDOCS 9410040039 | |
| Download: ML17158A494 (12) | |
Text
U. S.
NUCLEAR REGULATORY COMMISSION
REGION I
DOCKET/REPORT NOS.
LICENSEE:
FACILITY:
DATES:
50-387/94-17 50-388/94-18 Pennsylvania Power and Light Company (PP&L)
Allentown, Pennsylvania 18101 Susquehanna Steam Electric Station (SSES)
August 8 23, 1994 INSPECTOR:
rian
.
c ermot
,
eactor ng~neer Systems Section
. Division of Reactor Safety f i< '7W ate APPROVED BY:
ugene Systems Se y,
ie ion at Division of Reactor Safety SUMMARY:
The program and controls for preparation of design changes were found to be thorough.
The procedures for temporary modifications or "bypasses" provided good review guidance and safety assessment prior to both installation and removal.
Also, the safety significance of most bypasses reviewed was low.
Communications between the site and corporate engineering organizations were viewed as a strength.
Positive initiatives were observed in the establishment of design basis documents, and in the area of self improvement including the ongoing continuous process improvement program (CPIP), weekly system review and concerns meetings, and the Engineering Review Committee.
The independent Nuclear Safety Assessment Group (NSAG) continued to provide management with valuable insights on plant operations and maintenance.
94>00400S9 9409m PDR ADOCK 05000387
1.0 INSPECTION SCOPE DETAILS e
The objective of this inspection was to verify that changes and repairs to plant components and systems, which are described in the final safety analysis report (FSAR), were implemented per controlled administrative procedures.
This objective was accomplished by reviewing several modifications and engineering work items to evaluate engineering involvement and problem resolutions.
Other new and ongoing corporate engineering efforts, such as the establishment of design basis documents, were also assessed from a safety and performance perspective.
2.0 INSPECTION FINDINGS 2. 1 Safety-Related Design Changes And Plant Modifications (37550)
The control'f plant design and configuration is a fundamental part of the licensee's defense-in-depth strategy to assure nuclear safety.
The modification program provides the controls that are applied when changing plant design and configuration.
The processes for making such changes is described in NDAP-(A-1202, "Nuclear Department Modification Program,"
and controlled under the following programs:
Design Change Package (DCP)
Engineering Change Order (ECO)
Replacement Item Evaluation (RIE)
Setpoint Change Package (SCP)
Bypass (Temporary Modifications)
The determination of the appropriate modification type to use in response to requests for engineering action is based on the programmatic and technical attributes of each request.
However, the majority of modifications used to implement design changes for safety-related equipment are processed as DCPs.
DCPs are broken down into major and minor modifications based on the estimated cost of implementation.
The nuclear modifications functional area consists of the design modifications group (DHG) at the corporate office and the site modification group (SHG)
and modification installation groups (HIGs) located at Susquehanna Steam Electric Station (SSES).
The SMG is responsible for minor modifications and response to daily operational concerns.
The DMG, located at the corporate office, is focused on larger modifications and long term projects.
Irrespective of where modifications are developed, they are prepared under the same design, review, and approval process.
The installati'on of all modifications and the closeout of the work package is managed by the MIG.
The inspector reviewed a sample of the procedures used in the modification process, and the following completed modification '
2.1.1 DCP 93-3015, Replacement Of Notor-Operated Valve HV-255F012 This modification replaced the motor and actuator for the HPCI pump minimum flow bypass valve in the pump discharge line.
The changes were installed to ensure the valve has sufficient capability to meet the design basis thrust requirements established by the licensee's Generic Letter 89-10 program.
Included in this modification were replacement of the actuator, motor, yoke clamp, and stem nut.
In addition, the scope of the modification covered replacement of the supply circuit breaker, resetting of the breaker magnetic trip, installation of new thermal overload protection,and deletion of the switch compartment space heater.
The inspector reviewed the completed design package retrieved from the nuclear records department.
The package contained the required supporting documentation and was technically sound.
Appropriate consideration was given to overall implications for equipment directly and indirectly effected by the modification.
Prior to installation, an engineering hold was placed on this package because of questions regarding increased actuator weight.
After calculations confirmed that the changes in piping stress, support loads and valve accelerations were within code allowable values, the hold order was released.
The safety evaluation was thorough and well documented.
The inspector noted that this DCP had been prepared using the recently completed HPCI system design basis document.
The depth of information provided in this document was reflected in the safety evaluation, and resulted in a thorough assessment of the impact on safety.
2.1.2 DCP 93-3067A(B), Decreased Time Delay For LPCI Throttle Valve Operation The SSES individual plant evaluation (IPE) analysis, NPE-91-001, postulates an anticipated transient without scram (ATWS), combined with a high pressure coolant injection (HPCI) failure.
In this scenario, the reactor must be manually depressurized, below the shutoff head of the low pressure coolant injection'(LPCI) system, to inject water into the vessel and recover level in accordance with the emergency operating procedures (EOPs).
The IPE analysis assumes a successful injection of boron by the standby liquid control system, and that the rapid injection of cold LPCI water flushes boron away from the core.
This would result in a power excursion and possible fuel failure.
The IPE analysis concludes that control of LPCI injection flow into the core, within 80 seconds of a LPCI injection signal, is required to recover from the event and avoid possible fuel damage.
Each LPCI injection flow path contains two valves in a series, the inboard F015A(B) and the inboard F017A(B).
The F015 valves are normally closed and opened automatically on a LPCI initiation signal (when the low reactor pressure permissive is satisfied)
and the F017s are normally open throttle valves that also receive an open signal on LPCI initiation.
The design bases of the F017 valves are to fully open when LPCI is automatically initiated and to close, either totally or partially, for long term, post-LOCA recovery as required to control the system's flow rate.
In the original plant design, a
minute time delay relay was used to seal in the valve opening logic.
This ensured the LPCI valves would travel to the full open position, allowing full design flow for a large break LOCA.
As a result of the seal in, operator
.3 action to throttle flow using the F017A(B) valve is not possible until after the 5 minute delay.
To enhance the operators'bility to cope with the IPE ATWS/HPCI failure scenario, this modification was designed to decrease the time delay to 45 seconds.
The inspector reviewed the overall DCP package, design inputs and considerations, and safety evaluation for this modification.
The package. was complete and contained the information and approvals required by procedure.
The design inputs and considerations package reflected a sound review of the design basis information, and included updated information requested from General Electric.
The'afety evaluation appropriately considered the impact of this modification on all aspects of the equipment, and the consequences of the modification on interfacing systems.
The inspector concluded that this modification had been appropriately evaluated and that the modification, in response to the IPE, was a strength.
2.2 Temporary Modifications The program for control of temporary modifications, known as
"bypasses" at SSES, is described in NDAP-gA-0484, "Nuclear Department Bypass Control Program."
This procedure establishes controls to ensure operator awareness, conformance with design intent, and operability.
The controls are intended to ensure preservation of plant safety, reliability, and configuration control.
The inspector reviewed the procedure and the bypasses listed below.
Old B
asses Removed Durin Last Outa e
2-93-013 1-93-032 1-93-029 Bypass Anti-Collision Siren On Reactor Building Crane Temporary Use Of Non-g Molded Case Circuit Breaker Mechanical Gags For RBCW Containment Isolation Valves Current B
asses 1-94-015 2-93-016 1-94-016 Bypass Plunger Switch For Vacuum Breaker Indication Temporary Pulsation Damper For DG Fuel Oil Booster Pump Temporary Temperature Indication For RWCU Penetration Room and RHR Pump Room In Control Room The inspector noted that the appropriate review and approvals were complete for each Bypass, and that independent verification of installation and removal was performed.
Equipment functional and technical specification related testing was performed as required following installation of bypasses, and after their removal.
The bypass installation form provided an effective means of verifying that all elements of the necessary reviews were complete, and that approval for implementation was granted.
On a semiannual basis, Nuclear Systems Engineering evaluates installed bypasses.
A justification is developed for keeping installed bypasses greater than 6 months old and plans for removal are established.
The semiannual review also confirms the in-plant locations of the required tagging.
The inspector noted that procedures and prints affected by bypasses are documented on the installation form, with references to procedure change approval forms (PCAFs).
However, when equipment release forms (ERFs)
were used to document operability
considerations (or prohibitions on changing operating modes),
no reference was provided, and the documentation was not maintained with the closed packages.
For active bypasses, the installation form, safety evaluation, and any related ERFs are easily accessible in the control room.
Based on this review, the inspector concluded that bypasses at SSES were well controlled and implemented in accordance with the governing procedures.
The safety significance of each bypass was carefully reviewed prior to both the installation and removal of the bypass.
In each case. reviewed, the temporary modification had only minor safety significance, and demonstrated that the licensee was maintaining an appropriate threshold for bypasses.
2.3 Engineering Support Of On-site Activities The engineering deficiency report (EDR) progr'am was established to ensure that engineering deficiencies are identified and resolved in a manner that ensures safe operation of the plant.
Critical elements in the process are the timely determinations of operability and reportability.
Administrative Procedure NDAP-RA-0740, "Engineering Deficiency Reports," describes this deficiency control mechanism.
2.3.1 EDR 94-046, HPCI Operation During Design-Basis Small Break Accident On August ll, 1994, the Nuclear Technology group generated an engineering deficiency report (EDR) following a review of a planned (but not yet implemented) modification to remove the high pressure coolant injection (HPCI)
system pump suction auto transfer logic.
The proposed modification (DCP 93-3070) is derived from the IPE, and intended to improve mitigation strategies in a fast-paced high power ATWS scenario.
The licensee's intent to perform this modification was described iri a January ll, 1993, letter to the NRC.
A Priority 1 (highest priority) EDR,94-046, was initiated by engineers reviewing the safety evaluation for the HPCI system logic change.
The EDR separately questioned the current ability of the HPCI system to fulfill its design basis function during a small break loss of coolant accident (LOCA)
coincident with a loss of offsite power (LOOP).
EDR 94-046 addresses a specific a small break LOCA scenario coincident with a LOOP.
For this event, the emergency operating procedures (EOPs) instruct operators to bypass the HPCI suction transfer logic (using bypass jumpers in accordance with Procedure ES152-002) to prevent an automatic transfer from the condensate storage tank (CST) to the suppression pool on high suppression pool water level.
This guidance is consistent with the BWR Owners Group emergency procedure guidelines (EPGs),
which are aimed at HPCI journal bearing lubrication and water quality considerations.
However, the normal (nonsafety grade)
method of suppression pool letdown would not be available in a LOOP, and would therefore continue to increase.
The EDR not only encompasses the proposed modification but also questions existing EOPs in that, if suppression pool level exceeds 26 feet and the HPCI system subsequently trips (for an unrelated reason),
the turbine exhaust line could potentially backfill with suppression pool water.
Any subsequent decrease in reactor water level would then cause an automatic restart of the
HPCI system.
Because the turbine exhaust line was not designed to withstand a
system start with water in the piping, such a restart will cause backpressures that may result in either water-hammer or rupture disc events.
A May 1994 GE Service Information Letter, No. 580, informed utilities of the potential consequences of a HPCI system start with water in the turbine exhaust line.
Therefore, EDR 94-046 postulates that this scenario could occur before.reactor pressure decreases below that required for low pressure ECCS.
On August 19, 1994, the licensee determined that HPCI system operability was unaffected, and that no reportable conditions existed.
This decision was based principally on the fact that current procedures direct that suppression pool water level be recovered (in a LOOP condition) using the safety grade residual heat removal (RHR) system in the suppression pool cooling mode, in conjunction with emergency support procedures to direct water to the liquid radwaste system.
Although the inspector considered the initial issuance of the EDR a strength, prompt communication with "key individuals" and managers at the site was not apparent.
With respect to the ensuing communications between corporate and site personnel, Procedure NDAP-gA-0740 requires a "heads up" notification to
.
key personnel for urgent EDRs.
A Priority I EDR, by definition, describes a
potential deficiency of significant safety impact.
There have been, historically, relatively few such EDRs generated by the licensee.
The timely notification of key personnel, including the system engineer, provides an opportunity for site management and staff to assist in the resolution of deficiencies.
The NDAP suggests that an initial, undocumented operability judgement should be formulated within one business day, a documented operability recommendation within 7 working days, and approval of the final operability determination within 2 day's of the recommendation.
In the case of EDR 94-046, the inspector concluded that the licensee satisfactorily complied with the NDAP in question, although the site learned of the EDR on the seventh day of the process.
Nuclear Systems Engineering (NSE) at the site contributed to the resolution of the issue by determining that the EOPs provide a method of recovery for this scenario.
Currently, the licensee is evaluating process improvements regarding timely communication of EDRs.
The inspector had additional questions regarding the technical resolution of this issue.
PP&L had not yet determined if other accident scenarios for either the HPCI or RCIC systems are similarly affected by EOP guidance (Procedure ES152-002)
to bypass automatic suction transfer logic on high suppression pool water level.
Since it is not clear that the BWR Owners Group evaluated this scenario when justifying the generic guidance in the EPGs, the licensee plans to present this issue for discussion at the next BWR Owners Group meeting.
Modification DCP93-3070, scheduled to be implemented in the spring 1995 Unit I outage, is on hold until EDR 94-046 questions are resolved by the license.4 Design Basis Documentation The inspector reviewed PP&L's means for maintaining information that identifies the specific functions to be performed by a structure, system, or component, and the specific values or range of values chosen for controlling parameters as reference bounds for design.
This review was performed to verify that information is maintained in accordance with the original plant design.
Design basis information for structures, systems, and components is contained within many documents, including the operating license and its associated
'onditions, the updated final safety analysis report (UFSAR), technical specifications (TS)
and bases, written NRC safety evaluations and correspondence referenced therein, PP&L correspondence submitted to the NRC in support of the approved license, and TS amendments or source documents in the UFSAR.
Plant modifications under consideration also require an evaluation of the effect on existing design bases for the proposed change to ensure that appropriate design margins and safety system functionality are maintained, and that unnecessary challenges to safety systems are avoided.
At the time of this inspection, seven design basis-documents (DBDs) had been completed, nine were under development, and 10 others were in the planning stage.
The pilot DBD was written for the HPCI system by PP8L, in conjunction with General Electric, to serve as the model for subsequent DBDs.
The document is designed as a single, controlled source of 'information that-collates all design bases for a particular system.
The DBD consists of functional descriptions of the equipment (or topical area),
references to all supporting documentation, and a design basis validation report.
PP8L currently has an effort underway to computerize the DBDs in an effort to make the supporting documentation readily available.
The system will provide plant and corporate engineers on-line capability to retrieve DBDs, their references, and applicable controlled drawings.
The initial scope of the DBD project identified a total of 75 possible DBDs, however, not all of the identified systems, structures, and components were safety-related.
The licensee is currently prioritizing the schedule for completing the remaining DBDs based on safety significance and the probability that the system would be modified.
The licensee provided the inspector an on-line demonstration of the computer system and a detailed discussion of the DBD content.
The inspector concluded that this project was an excellent initiative.
The creation of these DBDs is establishing a controlled and accessible source of information for developing plant modifications, safety evaluations, operability determinations, and reportability evaluations.
2.5 Procedure Change Review Requirements The inspector reviewed the required scope of the procedure change review process, and whether special qualifications were necessary or required.
Procedure NDAP-(A-0003, "Procedure Change Process,"
specifies the requirements for expedited procedure changes.
A temporary procedure change is initiated by
filling out a procedure change approval form (PCAF).
The change must be temporary in nature, and not change the original intent of the procedure.
The PCAF is then reviewed by a person qualified to review the original procedure.
For operations procedures, this is an operator qualified to perform the activity or a member of the operations support staff.
For engineering procedures, this would be an engineer qualified to perform the activity or a member of the systems engineering staff. 'his is consistent with Procedures NDAP-gA-0003 and OPS-4, Section 6.2;3, which specifies that document changes be reviewed by the same organization that performed the original review and approval.
In addition, both OPS-4 and ANSI N18.7-1976/ANS-3.2 specify that reviewers shall have access to pertinent background information upon which to base their approval, and shall have adequate understanding of requirements and the intent of the original procedure.
Thus, after a procedure change is initiated, a reviewer not familiar with the original procedure should review the entire procedure to ensure that it provides the best possible instructions for the performance of the work involved.
A reviewer familiar with the original procedure may only review the change.
The purpose of this review is to ensure that the change is safe to implement, and that the intent of the original procedure is not altered.
The inspector concluded that appropriate guidance regarding the scope of review necessary for procedure change approval is available, and that the onus for determining the appropriate review scope resides with both the reviewer and the supervisor.
Based on discussion with licensee personnel, the inspector concluded that expectations regarding the scope of review for a given change were consistent with the procedural guidance.
2.6 Self-Assessment of Engineering Activities Nuclear Safet Assessment Grou NSAG The NSAG provides independent safety engineering oversight SSES.
The group is staffed by a minimum of two qualified individuals in Allentown and three individuals at the site.
The group is independent of the plant line organization, and the group reports to the Senior Vice President - Nuclear, and possesses the abilities, experience, and authority to perform quality technical reviews of plant operations.
The NSAG provides senior management with daily reports on plant status, periodic reviews of performance for the Operations and Haintenance Departments, and an annual summary assessment.
Independent evaluations and reports are generated as the result of planned surveillances, in response to plant events or reported deficiencies, and upon request from management.
The inspector reviewed a sample of NSAG reports and concluded that their assessments and recommendations reflected a detailed review of the issues, and provided management with good suggestions for program enhancements and corrective actions.
Observations made during NSAG surveillances are assessed for discernable trends; examples identified included the reduction of "in hand use" of operating procedures, improved work package preparation, and an
increased number of sealed-in plant alarms over the last three years.
The NSAG emphasized continued concern regarding status control (i.e., plant configuration) in the annual summary assessment, dated February 25, 1994, stating that it is "the most important operational issue facing SSES."
The inspector concluded that the NSAG continues to provide management with valuable insights on plant operations and maintenance.
The inspector also noted that, in the past, the NSAG has reviewed engineering activities only in response to specific deficiencies.
During this inspection, the NSAG was conducting an investigation into the LPCI check valve failures that occurred following modifications (Reference NRC Inspection Reports 50-387/94-11 and 50-388/94-12).
Although a root cause investigation by the functional unit was in progress, management requested that NSAG perform an independent evaluation of the event.
The inspector considered this a positive initiative, making good use of the independent safety engineering group.
It was also prudent considering the potential safety significance of the event.
The check valve problem was the most significant example of recent problems that have occurred following modification work and the return of equipment to service.
En ineerin Review Committee The engineering review committee (ERC)
was established as an oversight committee to focus on the quality of the department's engineering activities and on the processes, procedures, and organizational interfaces having an impact on that quality.
NDAP-(A-0007, "Engineering Review Committee,"
describes the charter of the ERC, and establishes responsibilities and authorities.
The ERC provides a management level review of engineering activities intended to detect potential nuclear safety hazards or significant decrements in the engineering organization performance.
Detailed review of certain topics and problems identified by the ERC are turned over to subcommittees for evaluation.
Following the detailed review of an issue, the subcommittees present summary assessments for the ERC.
Based on discussion with corporate engineering personnel, the inspector concluded that ERC involvement in procedure approval and modification reviews affords engineering management an effective means of communicating expectations, assessing performance, and providing guidance.
The inspector considered the ERC a strength in the area of management oversight of engineering activities.
3.0 NANAGEHENT MEETINGS The scope and purpose of the inspection were discussed at an entrance meeting conducted on August 8, 1994.
During the course of the inspection, the findings were discussed periodically with the licensee representatives.
An exit was conducted by telephone on August 23, at which time the preliminary findings were summarized and conclusions were presented.
Additional discussions occurred on September
between PP&L and NRC managers at the Allentown corporate office, specifically regarding the HPCI system swapover logic and EDR 94-046 (see Section 2.3. 1).
Additional inspections will be needed to more fully understand the basis of
the proposed modification and other similarly affected systems.
The licensee acknowledged the findings and conclusions, with no exceptions taken.
Further, the bases for the conclusions did not involve proprietary information, nor was any such information discussed or expected to be included as part of the written inspection report.
The persons listed below participated in the exit phone call:
J. Miltenberger, Hanager, Nuclear Safety Assessment R. Saccone, Supervisor, Design and Drafting Group R. Sgarro, Senior Project Engineer - Licensing