IR 05000413/1999002
| ML20207C910 | |
| Person / Time | |
|---|---|
| Site: | Catawba  |
| Issue date: | 05/20/1999 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| To: | |
| Shared Package | |
| ML20207C875 | List: |
| References | |
| 50-413-99-02, 50-413-99-2, 50-414-99-02, 50-414-99-2, NUDOCS 9906030147 | |
| Download: ML20207C910 (19) | |
Text
L L
s
,
%
i.
U.S. NUCLEAR REGULATORY COMMISSION REGION ll
. Docket Nos:
50-413, 50-414 l
License Nos:
50-413/99-02,50-414/99-02 l
l Licensee:
Duke Energy Corporation Facility:
Catawba Nuclear Station, Units 1 and 2 Location:
422 South Church Street Charlotte, NC 28242 Dates:
March 14 - April 24,1999 Inspectors:
D. Roberts, Senior Resident inspector R. Franovich, Resident inspector M. Giles, Resident inspector J. Coley, Reactor inspector (Section M8.1)
Approved by:
C. Ogle, Chief
. Reactor Projects Branch 1
-
Division of Reactor Projects
l
i l
Enclosure 9906030147 990520 PDR ADOCK 05000413
O PDR i
-
EXECUTIVE SUMMARY Catawba Nuclear Station, Units 1 and 2 NRC Inspection Report 50-413/99-02,50-414/99-02 This integrated inspection included aspects of licensee operations, maintenance, engineering, and plant support. The report covers a 6-week period of resident inspection; in addition, it includes the results of an announced inspection by one regionalinspector, [ Applicable template codes and the assessment for items inspected are provided below.)
Operations Unit 1 and Unit 2 entered Technical Specification 3.0.3 twice when both trains of the
-
control room area ventilation system intake valves closed. The repetitive spurious j
closures of control room ventilation intake valves raised concems about chlorine detector l
reliability and maintenance and troubleshooting practices. (Section 01.2; [2A,3A -
LER])
The licensee responded to multiple spurious component actuations with the appropriate
-
focus on plant safety. Root cause investigations were still ongoing at the end of the inspection period for the spurious chlorine detector alarms and related control room air intake isolations. (Section 01.2; [1 A - POS))
Control room operators missed several opportunities to identify the fact that refueling
-
water storage tank level instrumentation channels were inoperable and inappropriately placed in the tripped condition, in two cases, this discrepant condition was not detected during routine main control board walkdowns performed coincident with several shift turnovers. (Section E8.1; [1 A - NEG))
Maintenance A non-cited violation was identified for the licensee's failure to take adequate corrective
-
actions to resolve a Technical Specification discrepancy involving operational mode requirements for the control room ventilation system actuation logic. (Section M8.1; [4C, SC - NCV])
Enoineerino A non-cited violation was identified conceming the failure to take actions for out-of-
-
service refueling water storage tank level instrument channels as required by Technical Specification 3.3.2. This occurred on three separate occasions while performing j
modifications to replace the associated level transmitters. (Section E8.1; [1 A, 3A,4C -
NCV; 5A - POS])
. A non-cited violation was identified by the NRC for the licensee's failure to provide
-
adequate design control measures for the protective circuitry associated with the diesel generator low-low lubricating oil pressure trip circuitry. The licensee implemented minor modifications on both diesels in each unit to correct this discrepancy. (Section E8.2; [4A
- NCV])
Plant Succort j
Records indicated that individuals potentially falsified documents conceming fire watch
-
,
activities. The licensee's identification of the missed fire watches demonstrated a good
'
i
i
.
.
questioning attitude. The potential falsifications did not appear to involve licensee supervisory or management personnel. An unresolved item was opened pending further NRC review of this issue. (Section F4.1; [1C,3A-URl])
I
.
-,
'
i Report Details J
Summarv of Plant Status Unit 1 began the inspection period a! approximately 100 percent reactor power. On April 11,1999, operators commenced a Technical Specification (TS) required reactor shutdown after both trains of the control room area chilled water system (CRACWS) were declared l
inoperable due to excessive standby nuclear service water pond (SNSWP) temperatures. This issue affected both units. The shutdown was halted at 97 percent reactor power, after pond temperature had been returned to acceptable limits and one of the chilled water trains was determined not to be affected by the previous high temperature readings. The reactor was j
restored to 100 percent power later that evening. On April 19,1999, operators reduced reactor power to 95 percent to perform main steam safety valve testing. Following the testing, reactor
'
power remained at 95 percent until a unit shutdown was commenced on April 21,1999, in preparation for the End-Of-Cycle 11 refueling outage. The unit entered Modes 2,3, and 4 on April 22,1999, and was in cold shutdown (Mode 5) on April 23,1999. The unit remained in
,
Mode 5 through the end of the inspection period.
Unit 2 began the inspection period at approximately 100 percent power. On April 11,1999, operators commenced a reactor shutdown due to the CRACWS issue discussed above.
Reactor power was held at 97 percent as operators restored operability to both trains of the system. The unit was restored to 100 percent reactor power later that evening and remained at that level through the end of the inspection period.
'
l. Operations
Conduct of Operations O1.1 General Comments (71707)
-
The inspectors conducted frequent control room tours to verify proper staffing, operator attentiveness and effective communications, and adherence to approved procedures.
The inspectors: (1) attended operations shift turnovers and site direction meetings to
maintain awareness of overall plant status and operations; (2) reviewed operator logs to verify operational safety and compliance with TS; (3) periodically reviewed instrumentation, computer indications, and safety system lineups, along with equipment removal and restoration tagouts, to assess system availability; (4) reviewed the TS Action item Log (TSAIL) books for both units daily for potential entries into limiting conditions for operation (LCO) action statements; (5) conducted plant tours to observe material condition and housekeeping; and (6) routinely reviewed Problem Identification Process reports (PIP) to ensure that potential safety concerns and equipment problems were resolved. The inspectors identified no major problems from the above reviews.
01.2 Prompt Onsite Response to Operational Events a.
Inspection Scope (93702)
The inspectors responded to and/or reviewed the circumstances associated with operational events during the period. The inspectors verified that plant personnel responded to the events in accordance with governing facility programs and procedures, verified that the plant was placed in a safe condition, and confirmed tha+. the licensee made the appropriate notifications to the NRC when required by 10 CFR Part 50.7 i
.
-
b.
Observations and Findinos Several operational events occurred during the period, including an unexpected increase in SNSWP temperature that resulted in operators declaring both trains of the CRACWS inoperable and commencing a TS-required dual unit shutdown; isolation of both trains of the control room area ventilation system (CRAVS) air intake valves; and the spurious operation of two pressurizer power operated relief valves (PORVs)in Unit 1. The first event is discussed in Section O2.1. The latter two events are described briefly in the following paragraphs.
Sourious Closure of Control Room Air intake Dampers On April 8,1999, at approximately 3:05 p.m. with both units in Mode 1, control room operators received the "HVAC Panel Trouble" and " Unit 2 Intake Hi Chlorine" alarms, due to a spurious high chlorine signal and subsequent closure of 2VC-6A (Unit 2 CRAVS filter inlet valve). Operators dispatched a maintenance technician to investigate this unexpected closure. Because the technician had completed a surveillance activity on 1VC-5B (Unit 1 CRAVS filter inlet valve) earlier that day, the technician mistakenly went to the chlorine detector for 1VC-5B and depressed its reset button The technician's actions, which were performed without a troubleshooting procedure, caused valve 1VC-
,
5B to close. With both of the valves simultaneously closed, both control room outside air intake ducts were isolated, which placed both units in TS 3.0.3. Control room operators
'
immediately reopened valve 1VC-5B and both units exited TS 3.0.3. The inspectors responded to the event and verified that valve 1VC-5B had been restored to its operable position. With the Unit 2 intake valve still closed, both units remained in a seven-day TS
,
LCO 3.7.10 Condition for having one CRAVS train inoperable. Licensee personnel
{
generated PIP 0-C99-1252 to document this unplanned TS entry and the human error associated with the event.
~
Both units entered TS 3.0.3 again on April 9,1999, at approximately 4:28 a.m., when 1VC-5B spuriously closed while the Unit 2 filter inlet valve,2VC-6A, was still closed following its spurious closure the day before. The units exited TS 3.0.3 when the Unit 2 air intake was restored approximately one hour later. The inspectors and licensee management were reviewing why valve 2VC-6A was allowed to remain closed for over 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> after its spurious closure. The inspectors were also reviewing why the licensee remained in TS 3.0.3 for an hour during the second event. These reviews had not been completed at the end of the inspection period.
Two additional unexpected closures of the CRAVS outside air intake valves have occurred because of spurious high chlorine signals since the two TS 3.0.3 entries discussed above in each case, only one train of CRAVS was affected, which placed both units in the less restrictive TS 3.7.10 Condition. The licensee indicated that there has been a history of spurious closures of these inlet valves documented over the past 10 - 12 years. In the recent past, the licensee has attributed the spurious high chlorine signals to dirt accumulation on a sensing electrode in the chlorine detectors. At the close of this inspection period, the licensee was still conducting a root cause investigation and developing long-term corrective actions for this problem.
After the second TS 3.0.3 entry, the inspectors observed performance of IP/0/A/3162/005, Revision 028, Control Room Ventilation System (VC) Chlorine l
.
-
..
Detectors, used to calibrate the chlorine detector associated with valve 1VC-58. No problems were identified with system performance during this maintenance activity.
'
The inspectors also inspected the chlorine detectors' material condition and found no apparent degradation that could be readily linked to the spurious closures. Based on the unplanned entries into TS 3.0.3, and the repetitive spurious closures affecting the CRAVS trains, the inspectors will continue their review of this item under associated Licensee Event Report (LER) 50-413/99-006, Control Room Ventilation System
{
Inoperable due to Spurious Closure of Intakes Resulting in an Entry into TS 3.0.3.
i Sourious Actuation of Two Unit 1 PORVs On April 9,1999, two Unit 1 pressurizer PORVs (1NC-328 and 1NC-36B) cycled open and closed intermittently while the unit was at full power. The inspectors responded to
,
the control room to determine if a reactor coolant system transient had ocurred and to
assess control room operators' response to the event. The inspectors interviewed control room operators and reviewed operator aid computer (OAC) data trends and alarm logs to determine the duration of the occurrence, operator response to the indications, and i
the impact to the plant.
The inspectors determined that the PORVs cycled open at 11:30 a.m, on April 9,1999, and remained open for approximately 1.5 seconds. They closed for approximately 4.5 seconds, then reopened for approximately 1 second. The control room log indicated that seven control room annunciators alarmed, indicating that pressurizer pressure alarm limits had been reached and PORVs had opened. The operator at the controls (OATC)
i directed test technicians to terminate a Unit 1 Channel 4 pressurizer pressure calibration l
that was in progress at the time the incident occurred. The calibration was halted, and the OATC looked at the controls for the pressurizer PORVs to determine the valves'
positions. At thet point in time, control board displays indicated that all pressurizer PORVs were closed. Control room operators immediately entered abnormal procedure
"
AP/1/A/5500/11, Revision 14, Pressurizer Pressure Anomalies, Case 1 for Pressurizer Pressure Decreasing, and exited the procedure one hour later at 12:32 p.m. The licensee considered the PORVs operable after verifying that they were closed and using engineering judgement that the valves' protective functions (to lift on high reactor coolant system pressure) were not impacted by the spurious actuations. The inspectors noted that the acoustics and tailpipe temperature indicctions returned to normal, indicating that the valves had indeed closed. Subsequent reactor coolant system leak calculations indicated that no valve seat damage ocurred during the incident. The inspectors concluded that the control room operators responded to the event promptly and appropriately, and that impact to the plant was minimal.
The inspectors reviewed an OAC trend of the four pressurizer pressure channels at the time of the occurrence and determined that pressurizer pressure fell to a minimum of approximately 2200 pounds per square inch gauge (psig), which was well above the low pressurizer pressure setpoint for safety injection initiation (1845 psig). The inspectors also noted that the four pressure channels were indicating normal values just prior to the PORV actuations and concluded that the PORVs had not responded to a spurious high pressure indication.
The licensee's troubleshooting efforts indicated that, although there was no evidence of card failure, a Channel 2 bistable card (C6-434 NAL card) was the most likely
i
.
.
{
I component to cause the PORVs to cycle simultaneously. Channel 4 pressurizer j
pressure instrument loop testing was ongoing at the time of the actuations; however, the j
PORVs were selected to Channel 2 for control functions. Thus, the licensee ruled out j
the testing activities as a cause. The inspectors independently reviewed this issue and concur with the licensee's assessment. The bistable card was replaced and sent to a lab at the McGuire Nuclear Station for a failure analysis. As a precaution. the licensee selected the PORVs to Channel 4 for control functions subsequent to the event. At the close of the period, the PORVs had not spuriously actuated since this occurrence.
c.
Conclusions The inspectors concluded that the licensee responded to the multiple spurious component actuations with the appropriate focus on plant safety. The repetitive spurious closures of control room ventilation intake valves raised concerns about chlorine detector reliability and maintenance and troubleshooting practices. Root cause investigations were still ongoing at the end of the inspection period for the spurious chlorine detector alarms and related control room air intake isolations.
O2 Operational Status of Facilities and Equipment O2.1 Dual-Unit Shutdown Commenced due to CRACWS Beina Declared inoperable after Unexpected increase in SNSWP Temperature a.
Inspection Scope (71707.93702)
The inspectors reviewed the circumstances associated with a dual-unit shutdown that was commenced when operators declared both trains of CRACWS inoperable after SNSWP temperatures exceeded an administrative limit imposed in an operable-but-degraded (OBD) evaluation, b.
Observations and Findinas Two redundant trains of CRACWS are provided to ensure that both normal and emergency cooling are supplied to the control room and control room area. Both of the redundant trains provide cooling to a common area affecting both Catawba units. The CRACWS chiller packages are served by the nuclear service water (RN) system, for which temperature restrictions are provided in TS Surveillance Requirement (SR) 3.7.9.2. According to the TS Bases, the TS temperature limit of 91.5 degrees Fahrenheit (F) for the SNSWP (the assured water supply), is based on the need to minimize peak containment pressure during certain design basis accidents. The TS 3.7.9 Bases also makes a reference to a continuous, maximum RN system supply temperature of 100 degrees F in order to maintain long-term equipment qualification of safety-related components required to mitigate an accident, although no specific references are made to the safety-related components the system serves.
Engineering personnelimposed a more restrictive administrative SNSWP temperature limit after CRACWS chiller performance testing in January and February 1999 revealed degraded heat transfer capacities for both trains due to biological fouling (i.e., asiatic clams). Engineering personnel determined that the chilled water system was OBD and proposed an administrative limit of 70 degrees F for the SNSWP in order to maintain both trains of the CRACWS capable of adequately cooling the control room comple.
.
The 70-degree limit would ensure, during an event after the RN system is aligned to the SNSWP, that the subsequent temperature increase to the SNSWF and RN system would not result in temperatures exceeding maximum assumed long-term values for i
maintaining the control room habitable.
This administrative restriction was implemented via Nuclear Site Directive (NSD) 203, Operability, Revision 11, Appendix E, Operability Notification Forn, in which engineering personnel communicated the recommended method for detecting adverse SNSWP temperatures. The recommendation was to implement a modification changing the OAC high temperature alarm setpoints as follows: (1) the HI limit setpoint for SNSWP temperature to 67 degrees F; (2) the HI-HI setpoint to 70 degrees F; and (3) the RN essential header temperature HI limit to 85 degrees. However, only one of these setpoint changes, item (3), was implemented. Additionally, engineering personnel had i
proposed and operations personnel approved an expiration date of April 1,1999, for the OBD condition, at which time actions would need to be taken to restore the system to fully operable or perform additional evaluations to support continued operation. In late
March, engineering and operations personnel extended the OBD expiration date to May 15,1999, on the premise that the SNSWP temperature was not expected to exceed 70 degrees F before the end of May based on 1998 data.
On April 11,1999, at approximately 8:20 p.m. with both Units operating in Mode 1, operators declared both trains of the CRACWS inoperable and entered TS 3.0.3 after they realized that the SNSWP temperature had exceeded 70 degrees F. According to the inspectors' review of OAC computer point trend data, the SNSWP had actually exceeded this temperature at approximately 2:45 p.m. that aftemoon. Operators did not realize it until after shift tumover (between 6:00 and 7:00 p.m.) when the oncoming crew members were reviewing current OBD conditions and related compensatory actions.
According to operations personnel, there were no activated alarms or procedures prompting a periodic check of the pond temperature that could have identified the adverse condition earlier. At the time of discovery, operators initially believed that the
'
temperature restriction only applied to the B train CRACWS because the OBD paperwork did not reference the A train. However, discussions with engineering personnellater revealed that the condition applied to both. At 9:21 p.m., operators commenced a dual-unit shutdown as required by TS 3.0.3 with both trains of CRACWS declared inoperable.
At approximately 9:30 p.m., operators stopped the power reduction with both units at approximately 97 percent power when: (1) they reduced SNSWP temperature to below 70 degrees F after realigning the system to allow water from Lake Wylie to be discharged into the pond, and (2) engineering verbally provided an analysis that supported declaring the B train chiller operable up to a pond temperature of 72 degrees F (maximum actual pond temperature was 71.5 degrees). After exiting TS 3.0.3,
. operators returned both units to full power operation.. Engineering later provided (and the Plant Operations Review Committee approved) a written analysis raising the pond temperature limit for B train to 77.5 degrees F. Ultimately, plant personnel flushed and cleaned the A train chiller package and it was declared fully operable (with no further administrative temperature restrictions on the SNSWP).
The licensee concluded that the entry into TS 3.0.3 was not required based on the subsequent analysis that allowed the B train to be considered operable up to 77.5 degrees, a temperature that was not exceeded. Therefore, this item was not required to
l
.
.
be reported to the NRC under 10 CFR Part 50.73. However, the licensee appropriately notified the NRC per 10 CFR Part 50.72 when it commenced the TS-related shutdown.
,
The inspectors were concerned that, even though the 70-degree value was later determined to be a conservative limit, the SNSWP temperature exceeded laat limit nearly six hours before operators took action to enter TS 3.0.3. The inspectors considered this to be related to: (1) the absence of alarms (control room or local)
signaling the high temperature condition; (2) the lack of surveillance procedures that would have required operators to periodically check the temperature against the administrative limit; and (3) the failure to include a reference in the OBD paperwork to the applicability of the temperature limit on A train as determined from the February 1999 test results. Licensee personnel also made note of these issues in a preliminary review of this event, which is discussed in PIP 0-C99-1265.
The inspectors were informed that the OBD condition was a recurring problem, in that the biological fouling rate increases during the fall and winter months when the chillers'
loads are reduced. The licensee stated that chiller cleaning activities have been historically timed to eliminate tha OBD condition during the spring and summer months,
when temperatures are higher. The inspectors were concerned that the licensee's TS limit for SNSWP temperature may not be conservative enough to maintain system operability for the safety-related CRACWS. The inspectors informed licensee management of this concern who indicated that they would include this aspect in their review of the event.
Further inspector followup is warranted to review historical data related to the chillers'
performance tests, follow the licensee's actions to address the recurring nature of the chiller fouling that led to this event and to review why the OAC alarms were not reset as planned. This will be tracked under inspector Followup Item (IFI) 50-413,414/99-02-01:
Control Room Area Chiller Package Operable-But-Degraded Condition and Service Water Pond Temperature impact.
c.
Conclusions An inspector followup item was identi5ed related to a potentially recurring biological fouling problem associated with the CRACWS chiller condensers.
Miscellaneous Operations issues (92901)
08.1 (Closed) IFl 50-413.414/97-07-02: Boron Dilution Mitigation System Reliability Resolution
-
This item was opened to assess the licensee's progress toward improving the reliability
. of the boron dilution mitigation system (BDMS). Because system failures incurred additional workload in the control room, the licensee decided in 1997 to add the system to the Top Equipment Problem Resolution (TEPR) program for resolution. The inspectors discussed current systern health with engineering personnel and concluded that, although the system remains on the TEPR list, improvements have been made to the system to enhance its performance. Specifically, cabling associated with all. trains of BDMS has been replaced to reduce the impact of noise on the system and minimize false alarms. Unit 1 B train and both Unit 2 trains have been performing acceptably, although reliability problems still exist on Unit 1 A train. The licensee suspects that a pair
"
..
of filter capacitors associated with this train are shorted and plans to replace them. The inspectors concluded that the licensee's attention to this system and efforts to improve its performance have been appropriate. The system will remain in the licensee's TEPR program until performance measures effectively demonstrate acceptable system health.
The inspectors also reviewed the system's performance with respect to 10 CFR 50.65 (the maintenance rule). Based upon the licensee's most recent system health report, one maintenance preventable functional failure has occurred in the last 24 months. The licensee's criterion for effective system performance is no more than two maintenance preventable functional failures within a two-year period. System performance is therefore acceptable relative to the maintenance rule. Based on the improvements noted to present and plans to address remaining problems with Unit 1 A train BDMS in the current refueling outage, this item is closed.
11. Maintenance
.
M1 Conduct of Maintenance M1.1 General Comments on the Conduct of Maintenance and Surveillance Activities (62707.
61726)
The inspectors observed all or portions of the following maintenance and surveillance activities:
PT/2/A/4250/003C, Revision 58, Turbine Driven Auxiliary Feedwater Pump #2
-
Performance Test IP/0/A/3162/005, Revision 28, Control Room Ventilation System (VC) Chlorine
-
Detectors
'
PT/2/A4200/005B, Revision 33, Safety injection Pump 2B Performance Test
-
PT/1/A/4200/013D, Revision 41, ND Valve inservice Test (QU)
-
IP/1/A/3010/006A, Revision 19, Main Feedwater (CF) System Doghouse Water
-
LevelInstrumentation
The inspectors identified minor discrepancies during the safety injection pump performance test and the doghouse water level instrumentation test. These items were provided to the licensee for resolution. Other than these observations, maintenance and surveillance activities were conducted with proper adherence to procedures and appropriate adherence to equipment calibration and radiation protection requirements.
'
M8 Miscellaneous Maintenance issues (92902)
M8.1 (Closed) LER 413/98-004: Missed Technical Specification Surveillance on Control Room Area Ventilation System Actuation Instrumentation
'
On February 16,1998, the licensee determined that literal compliance with TS 3/4.3.2 (Engineering Safety Features Actuation System instrumentation) had not been met in the
i
-
..
past. The minimum channels operable requirement of TS Table 3.3-3 and the I
surveillance requirements for item 11a of TS Table 4.3-2 had not been met for Modes 5 and 6. Item 11a governs control room area ventilation operation, automatic actuation logic and actuation relays. These TS requirements were erroneous in that, while they literally stated applicability in all modes, they should only have been applicable in j
Modes 1 through 4. The root cause of this event was attributed to inccrrect mode specification requirements in the affected TS. The only relationship between automatic actuation of the CRAVS and the Engineered Safety Features Actuation System (ESFAS)
is through safety injection initiation. If a safety injection occurs, an automatic start of the non-running CRAVS train will occur. The ESFAS requirements for safety injection initiation are correctly specified in TS as being applicable in Modes 1 through 4 in functional Unit 11c. A TS interpretation was written by the licensee in 1991, which addressed the fact that the mode requirements for the automatic actuation logic and actuation relays in functional Unit 11a conflicted with the mode requirements for the safety injection initiation function in functional Unit 11c. On February 16,1998, during a review of plant procedures in support of the Catawba conversion to the improved TS, the licensee realized that the TS interpretation guidance was not consistent with the literal l
requirements of the TS and the interpretation was deleted. The proper course of action was taken in 1998 to process a license amendment request to change the mode j
requirements for the automatic actuation logic and actuation relays to Modes 1 through 4. The licensee submitted their license amendment request to NRC on April 20,1998.
NRC approval was granted via Amendment No.167 to Facility Operating License NPF-
]
35 and Amendment No.159 to Facility Operating License No. NPF-52 in a letter dated July 9,1998.
The licensee's corrective actions in 1991 were not totally effective. The failure to process an amendment correcting the TS requirement at that time is considered a violation of 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Actions. This Severity Level IV violation is being treated as a Non-Cited Violation (NCV), consistent with Appendix C of the NRC Enforcement Policy. This violation is in the licensee's corrective action program
'
as PIP 0-C98-0612. It is identified as NCV 50-413,414/99-02-02: Failure to Take Corrective Actions to Revise TS Requirements for CRAVS Actuation Logic Testing. This LER is closed.
Ill. Enaineerina
i E8 Miscellaneous Engineering issues (92903)
E8.1 (Closed) LER 50-413/99-001: Inoperable Refueling Water Storage Tank Level Channels Results in Operation Outside of the Design Basis This item addressed three occurrences in which plant conditions were degraded when inoperable refueling water storage tank (FWST) level instrument channels were in the tripped condition instead of the required bypassed condition for time periods exceeding that allowed by TS. These TS non-compliances occurred while level transmitter replacement modifications were in progress. This issue affected both units and was previously discussed in NRC Inspection Report 50-413,414/99-01.
Upon review of the LER, the inspectors concluded that the actual safety significance of this event was minimal; however, the potential safety significance could have been high
_
.
9 given a limited set of conditions. With one FWST level channelin the tripped condition, the logic associated with the automatic swapover of the emergency core cooling system (ECCS) components suction supply from the FWST to the containment sump was changed from a two-out-of four logic to a one-out-of-three logic. A spurious failure of another FWST level channel in conjunction with a safety injection (SI) signal would cause the ECCS pumps to automatically swapover to the containment sump with the potential of having an inadequate containment sump volume available for continued ECCS operation. This condition could cause the ECCS pumps to fail.
A probabilistic risk analysis was performed by the licensee and its results were reviewed by the NRC staff. The NRC staff identified no discrepancies; therefore supporting the conclusion that this event had minimal actual safety consequences to the plant.
From a TS review, the inspectors determined that the only other instrumentation I
channels that are required to be placed in the bypassed condition when taken out of
'
service were the reactor protection system containment pressure instrument channels.
The inspectors reviewed completed work tasks and TSAIL entries involving the containment pressure channels to verify TS compliance. No discrepancies were identified in the TSAIL entries. The review of the completed work tasks did not identify any instances where inoperable pressure channels were inappropriately placed in the tripped condition.
l The inspectors were concerned that control room operators did not identify the TS non-compliances earlier. Specifically, the indications available in the control room should have prompted control room operators, particularly during shift turnovers, to question why the FWST levelinstrument channels were in the tripped condition instead of the bypassed condition for extended periods of time. A questioning attitude, such as that
'
exhibited by the operator who identified the condition on February 15,1999, could have facilitated a further review of TS requirements and compliance might have been
achieved earlier. This was communicated to licensee management who indicated that
-
the responsibility for ensuring configuration control for TS compliance normally lies with the work control center (WCC) licensed operators. The inspectors determined that a
communication error likely prevented the WCC operators from identifying the problem.
]
The inspectors also concluded that control room operators share that responsibility and j
that they missed several opportunities to identify the condition earlier.
The inspectors concluded that this issue was significant, in that the licensee did not
!
comply with the required actions for having an FWST levelinstrument channel
)
inoperable for greater than 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. Technical Specification 3.3.2 requires the unit to be placed in hot standby within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and in cold shutdown within 42 hours4.861111e-4 days <br />0.0117 hours <br />6.944444e-5 weeks <br />1.5981e-5 months <br /> with an
inoperable channel of FWST level instrumentation not in the bypassed condition for i
greater than six hours. This TS non-compliance occurred twice on Unit 1 (channels 2 and 3), and once on Unit 2 (channel 1). The licensee's failure to restore the channels to j
operable or be in hot standby within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> constituted a violation of TS 3.3.2. This Severity Level IV violation is being treated as an NCV, consistent with Appendix C of the NRC Enforcement Policy. This violation is in the licensee's corractive action program as
PIP 1-C99-0597. It is identified as NCV 50-413,414/99-02-03: TS 3.3.2 Non-Compliance i
Due To FWST Level Instrumentation inoperable in Excess of Required Action
!
Completion Time Limits. This LER is close.
E8.2 (Closed) Inspector Followuo item (IFI) 50-413.414/97-300-03: Verification of Units 1 and 2 Emergency Diesel Generator Low-Low Lubricating Oil Trip Circuitry with Design This IFl involved a problem in the emergency diesel generator (EDG) loss-of-lubricating-oil low-low pressure trip logic circuitry. During a plant simulator exercise in which the 1 A EDG failed on low-low lubricating oil pressure, NRC license examiners observed that, after shutting itself off, the 1 A EDG automatically restarted, reloaded, and subsequently tripped again on low-low lubricating oil pressure a total of five times. Pending additional NRC review of this observation, this was identified as an IFl.
The inspectors reviewed applicable UFSAR design basis documentation, PIP 0-C97-4240, Elective Minor Modification CNCE-61379, various electrical wiring diagrams, and associated maintenance work orders to understand this issue and assess the licensee's resolution of this problem.
The licensee performed an engineering review and determined that the EDG low-low lubricating oil pressure trip did not function as described in the Updated Final Safety Analysis Report (UFSAR). Specifically, if a loss of offsite power occurred, and a low-low lubricating oil pressure trip of the EDG occurred, the sequencer would automatically reset and generate another EDG start signal. When the sequencer resets, the seal-in for the low-low lubricating oil pressure trip would drop out allowing the EDG to again restart (after a time delay) followed by another low-low lubricating oil pressure trip. Section 8.3.1.1.3.4 of the UFSAR indicates that the low-low lubricating oil pressure trip of the EDG is designed to prevent or limit damage to the EDG. These automatic, repetitive starts with low-low lubricating oil pressure are not consistent with this statement. The inspectors were also informed that this was a longstanding discrepancy present since initial licensing.
Minor modification CNCE-61379 and CNCE-61380, for Unit 1 and Unit 2 respectively, were initiated to correct this discrepant condition. These modifications consisted of
'
installing a normally closed contact block to the "Overspeed Reset" pushbutton to modify the existing circuitry, inspectors verified by reviewing completed work order packages that modifications have been made to all four station EDGs. Inspectors also reviewed the required functional testing for these modifications and found it to be adequate.
Discussions with training personnel indicated that this modification has also been installed on the simulator.
I The inspectors addressed the regulatory significance of this long-standing UFSAR
discrepancy and concluded that it represented inadequate design control, in that measures were not established to ensure that the low-low lubricating oil pressure tnp l
logic would function as described in the UFSAR. The design of the diesel trip logic would i
not function to protect the EDG in the event of low-low lubricating oil pressure if a loss of l
offsite power occurred. The safety significance of this issue was mitigated by the fact I
that, if the diesel was unavailable because of a low-low lubricating oil pressure trip, this I
would constitute the assumed single failure that the plant's design basis incorporates into its accident analysis. During an event, redundancy would be provided by the opposite train EDG and the components it serves. However, this discrepancy did affect safety-l related logic circuitry designed to protect the diesel. The failure to provide adequate
{
design control measures for the low-low lubricating oil pressure trip logic is considered a violation of 10 CFR Part 50, Appendix B, Criterion lil, Design Control. Tnis Severity
Level IV violation is being treated as an NCV, consistent with Appendix C of the NRC i
)
.
11 Enforcement Policy. This violation is in the licensee's corrective action program as PlP 0-C97-4240. It is identified as NCV 50-413,414/99-02-04: Failure to Provide Adequate Design Control Measures for Emergency Diesel Generator Low-Low Lube Oil Pressure Trip Circuitry. This IFl is closed.
IV. Plant Support
F4.
Fire Protection Staff Knowledge and Performance F4.1 Fire Watches Not Performed Bv Contractor Personnel As Reauired a.
Inspection Scope (71750)
The inspectors reviewed the circumstances associated with the licensee's identification of several missed fire watch patrols for which responsible contractor personnel signed plant logs indicating successful completion.
b.
Observations and Findinos Due to degraded fire barriers in Units 1 and 2 that were identified in 1998, ongoing fire watch patrols have been required to maintain compliance with UFSAR Selected Licensee Commitments, Section 16.9, Auxiliary Systems - Fire Protection System; subsection 16.9.5, Fire Barrier Penetrations. The remedial action for Subsection 16.9.5 states with one or more fire barrier penetrations and/or sealing devices inoperable, within one hour establish a continuous fire watch on at least one side of the affected penetration, or verify the operability of fire detectors on at least one side of the inoperable penetration and establish an hourly fire watch patrol. The fire watch patrols are required until the fire barrier repairs are completed. The licensee has planned this repair effort to be completed in late 1999.
"
On March 29,1999, the licensee discovered that hourly fire watch patrols were not being performed in some plant areas. Problem Investigation Process report 0-C99-1118 documented the licensee's findings. The licensee had assigned the fire watch duties to a different contractor earlier in March 1999, and four contracted individuals were responsible for performing the fire watches on a rotating basis. The fire watch patrol consisted of performing an hourly tour through 22 plant areas to verify that no fire existed. Some of these areas were secured by controlled access doors (CAD), which provided a computerized security record of personnel entering and exiting the area.
Security records for the two and one-half week period prior to March 29,1999, indicated that some of the fire watches could not have been performed by the individuals who had
)
signed the fire watch log as having completed the watches. This suggested that the
'
. individuals intentionally falsified plant records by documenting the completion of the required watches without actually having performed them.
Records indicated that the frequency with which the four individuals signed the fire watch log without entering the areas varied between them. The number of potentially falsified fire watch patrols indicated by the licensee's review of security records was possibly non-conservative, since some areas requiring fire watches were not secured by doors provided with CAD system records of personnel access. The licensee questioned the individuals about the fire watches; the individuals contended that they did perform the
c
.
.
patrols and suggested that the security CAD system was faulty. Three of the vendor employees were ultimately terminated by their employer for willfully falsifying Duke company records. The fourth employee was not terminateo but received a letter of reprimand.
In an effort to evaluate the previous contractor's performance of fire watch patrols prior to mid-March 1999, the licensee reviewed security records on four individuals employed by that company who were responsible for similar fire watch tours. It was identified that between January 1,1999, and February 28,1999, one CAD-secured area had not been accessed while the fire-watch documentation had been signed to indicate completion.
The licensee determined this was not a case of willful falsification.
To assess the quality of routine work practices requiring log-keeping and/or frequent access to certain plant areas, the licensee's safety review group performed an inspection of multiple tasks performed by various work groups. The NRC inspectors reviewed the scope of this inspection effort and concluded that the number and type of work tasks inspected was comprehensive. This inspection was completed and no deficiencies were identified. To ensure that fire watch tours are completed satisfactorily in the future, licensee personnel indicated that current vendor employees' supervisors would be reviewing access records for CAD-secured areas on a regular basis to verify personnel entry.
The licensee did not consider these missed fire watches to be reportable. Based on their current policy, only breakdowns in the fire watch program require a formal report be submitted to the NRC. The licensee decided that this was not a breakdown in the fire protection program, because they concluded that adequate training and pre-job briefings had been given to the vendor employees on their fire watch responsibilities. The licensee considered this issue to be a human performance problem specific to the individuals involved.
The inspectors considered the significance of the missed fire watches to be mitigated by the fact that no evidence of fires existed in the affected areas during the two and one-half week period. Additionally, other fire detection systems were available during this period.
The potential falsification of documents appeared to be limited to low-level employees and did not involve any supervisory personnel. The inspectors also considered the licensee's actions to identify this problem to be commendable.
Pending further review by the NRC to address the potential falsification issues, this item will be identified as Unresolved item (URI) 50-413,414/99-02-05: Missed Hourly Fire Watch Patrols.
.
c.
Conclusions Records indicated that individuals potentially falsified documents concerning fire watch activities. The licensee's identification of the missed fire watches demonstrated a good questioning attitude. The potential document falsifications did not appear to involve licensee supervisory or management personnel. An unresolved item was opened to further track the NRC's review of this issu.
p..
..
...
'
V, Mananoment Meetinas X1 Exit Meeting Summary l
The inspector presented the inspection results to members of licensee management at the conclusion of the inspection on May 3,1999. The licensee acknowledged the findings presented. No proprietary information was identifed.
PARTIAL LIST OF PERSONS CONTACTED l
Licensee
,
R. Beagles, Safety Assurance Manager M. Boyle, Radiation Protection Manager S. Bradshaw, Safety Assurance Manager G. Gilbert, Regulatory Compliance Manager R. Glover, Operations Superintendent P. Herran, Engineering Manager R. Jones, Station Manager
. G. Peterson, Catawba Site Vice-President F. Smith, Chemistry Manager R. Parker, Maintenance Manager INSPECTION PROCEDURES USED
'IP 37551:
Onsite Engineering l-IP 61726:
Surveillance IP 62707:
Maintenance Observation
'
IP 71707:
Plant Operations IP 71750:
Plant Support Activities IP 92901: -
Followup - Operations IP 92902:
Followup - Maintenance IP 92903:
Followup-Engineering IP 93702:
Prompt Onsite Response to Events at Operating Power Reactors
,
ITEMS OPENED, CLOSED, AND DISCUSSED
.
Opened
!
50 413,414/99-02-01
- IFl
, Control Room Area Chiller Package Operable-But-Degraded Condition and Service Water Pond Temperature Impact (Section O2.1)
'50-413,414/99-02-02 NCV Failure to Take Corrective Actions to Revise TS Requirements for CRAVS Actuation Logic Testing (Section M8.1)
l
f
.
e
50-413,414/99-02-03 NCV TS 3.3.2 Non-Compliance Due To FWST Level Instrumentation Inoperable in Excess Of Required Action Completion Time Limits (Section E8.1)
50-413,414/99-02-04 NCV Failure to Provide Adequate Design Control Measures for Emergency Diesel Generator Low-Low Lube Oil Pressure Trip Circuitry (Section E8.2)
50413,414/99-02-05 URI Missed Hourly Fire Watch Patrols (Section F4.1)
50-413/99-006 LER
- Control Room Ventilation System inoperable due to Spurious Closure of Intakes Resulting in an Entry into TS 3.0.3 (Section O2.1)
Closed 50-413,414/97-07-02 IFl Boron Dilution Mitigation System Reliability Resolution (Section 08.1)
l 50-413/98-004 LER Missed Technical Specification Surveillance on j
Control Room Area Ventilation System Actuation Instrumentation (Section M8.1)
'
50-413/99-001 LER inoperable Refueling Water Storage Tank Level j
Channels Results in Operation Outside of the i
Design Basis (Section E8.1)
50-413,414/97-300-03 IFl Verification of Units 1 and 2 Emergency Diesel i
Generator Low-Low Lubricating Oil Trip Circuitry with Design (Section E8.2)
'
LIST OF ACRONYMS USED BDMS
-
Boron Dilution Mitigation System CAD
-
Controlled Access Doors CF
-
Main Feedwater CFR Code of Federal Regulations
-
CRACWS
-
Control Room Area Chilled Water System CRAVS Control Room Area Ventilation System
-
EA Enforcement Action
-
ECCS Emergency Core Cooling System
-
EDG Emergency Diesel Generator
-
ESFAS Engineered Safety Feature Actuation System
-
F
-
Fahrenheit FWST
-
Refueling Water Storage Tank HVAC Heating, Ventilation, and Air Conditioning
-
IFl
-
Inspector Followup item LCO Limiting Conditions for Operation
-
LER Licensee Event Report
-
-
Non-Cited Violation
r:
-
.
,
15'
NRC Nuclear Regulatory Commission
-
NSD Nuclear Site Directive OAC Operator Aid Computer
-
OATC Operator at the Controls
-
OBD Operable But Degraded
-
PlP Problem Investigation Process
-
PORV Power Operated Relief Valve
'
-
PSIG Pounds Per Square Inch Gauge
'
-
RN Nuclear Service Water
-
SI Safety injection
-
SNSWP Standby Nuclear Service Water Pond
-
SR Surveillance Requirement
-
TEPR Top Equipment Problem Resolution
]
-
TS Technical Specification
!
-
,
l TSAll Technical Specification Action item Log
-
UFSAR Updated Final Safety Analysis Report
-
,
URI Unresolved item
-
.VC Control Room Area Ventilation System
-
WCC Work Control Center
-
l l
l l
.
.
l