IR 05000458/1998013
| ML20155C994 | |
| Person / Time | |
|---|---|
| Site: | River Bend  |
| Issue date: | 10/27/1998 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML20155C989 | List: |
| References | |
| 50-458-98-13, NUDOCS 9811030077 | |
| Download: ML20155C994 (34) | |
Text
. . .. _ . - . - - - - - - - . ._ _ ..
.
.
ENCLOSURE l U.S. NUCLEAR REGULATORY COMMISSION I REGION IV l l
Docket No.: 50-458 License No.: NPF-47 Report No.: 50-458/98-13 Licensee: Entergy Operations, In l Facility: River Bend Station
.
Location: 5485 U.S. Highway 61 St. Francisville, Louisiana l
!
Dates: June 8-12, June 22-26, and August 24-28, with inoffice inspection through October 14,1998 Inspectors: L. E. Ellershaw, Senior Reactor inspector, Maintenance Branch J. E. Whittemore, Senior Reactor inspector, Maintenance Branch G. D. Replogle, Senior Resident inspector, Project Branch C Accompanied By: J. Cummins, Contractor, Beckman & Associates, In D. Prevatte, Contractor, Beckman & Associates, In Approved By: Dr. Dale A. Powers, Chief, Maintenance Branch Division of Reactor Safety
!
l ATTACHMENT: SupplementalInformation
l l
l
iW288LI 384 88L,
-
,
. . . . . . .- - ._ - _ - _- - - . . - - . _- .-. -
.
'
,
!
l 2-
,
EXECUTIVE SUMMARY
l
River Bend Station NRC Inspection Report 50-458/98-13 A corrective action program implementation team inspection was performed at the River Bend
,
Station from June 8 through August 28, with inoffice review until October 14,1998. The team l used NRC Inspection Procedure 40500 to evaluate the licensee's effectiveness in identifying, resolving, and preventing issues that could degrade the quality of plant operations or safety.
l
! Operations
! l
. Corrective action processes were well designed and effectively implemented
, (Section 01.1).
l l . Licensee event reports were of good quality. They provided clear description of events, i l the bases for determining the causes of the events, and the corrective actions to be I taken (Section 01.1). 1
. When an adverse condition was identified, the licensee's process for performing ,
operability determinations was comprehensive and provided sufficient justification l l l (Section O1.1).
. The procedure upgrade program had enhanced the licensee's procedures and had been a factor in reducing the procedure-related problems (Section 01.1).
. The condition review group screening and regular meeting process was effective in l properly determining the best approach to use in dispositioning condition reports (Section 01.1). i
- The recent quality assurance audits had been effective in the identification of specific and programmatic deficiencies within the corrective action program. (Section 07.3).
Maintenance j l
. Self-assessments were comprehensive and of appropriate scope and depth to meet l their objectives. The type and number of findings indicated the assessments were thorough and appropriately self critical (Section M7.1).
Epaineerina l-
. With some exceptions, engineering personnel were appropriately identifying problems j and resolving them in a timely manner. Those exceptions indicated that engineering personnel were not always providing complete, thorough, and technically appropriate resolutions (Section E1.1).
- . An apparent violation of Criterion 111 of Appendix B to 10 CFR Part 50 regarding the failure of design control measures to adequately verify or check that the safety-related
-
-- ____ _ ... _ _ __. . _ .m . _ _ . - . _ . _ _ _ . _ . ..-. _ ._ __ .__ _ _._ .___._.
.
.
- diesel generator control air instrument and controls systems remained functional during a loss-of-offsite-power event was identified (Section E1.1).
= An apparent violation of Technical Specification 3.8.1b regarding diesel generator inoperability was identified (Section E1.1).
- An apparent violation of Criterion XVI of Appendix B to 10 CFR Part 50 regarding a failure to document, report, and promptly correct a significant condition adverse to quality was identified (Section E1.1).
- An apparent violation of Criterion XI of Appendix B to 10 CFR Part 50 regarding a failure of preoperational and operational testing to assure that the diesel generators would !
perform satisfactorily in service was identified (Section E1.1).
- A noncited violation in accordance with Section Vil.b.1 of the NRC Enforcement Policy was identified regarding a failure to identify and properly translate design requirements of the control building chilled water system Pump 1D into the applicable surveillance test ;
procedure (Section E1.1). l
- All engineering personnel contacted displayed positive attitudes and solid commitment to nuclear safety and high standards of engineering (Section E1.1). )
. A questioning attitude, rigor, and attention to detail exhibited by some of the engineering work was less than desirable (Section E1.1).
l l l l
_
l
!
i
a
i
- - .- .- - . . - .- - - . - . . - - __
.
.
REPORT DETAILS
1. OPERATIONS l l
O1 Conduct of Operations l
01.1 Problem Identification and Resolution
'
l
a. Inspection Scope
(40500)
The team evaluated the effectiveness of the licensee's process for identifying, evaluating, and resolving problems in a timely manner. The team reviewed documents, interviewed personnel, and attended licensee meetings.
Documents reviewed by the team included procedures, condition reports, licensee event reports, self assessments, and operability and reportability determinations. The team also reviewed selected root-cause analyses associated with these documents.
The team analyzed the problems identified in the documents reviewed to determine the j licensee's effectiveness in performing:
.
Initialidentification and characterization of problems
.
Elevation of problems to proper level uf management for resolution
.
Root-cause analyses
.
Disposition of any operability /reportability issues
.
Implementation of appropriate corrective actions l
.
Evaluation of repetitive conditions I b.
Observations and Findinas b1.
Problem identification. Evaluation. and Resolution The primary vehicle the licensee used for the identification, evaluation, and resolution of l problems was Procedure RBNP-030," Initiation and Processing of Condition Reports,"
l Revision 12. This procedure prescibed the method for processing condition reports for the identification, documentation, notification, evaluation, correction and reporting of
- conditions, events, activities, and concerns that could adversel) affect, or that have the potential for adversely affecting, the safe, reliable, and efficient operation of River Bend l Station. Under the licensee's condition report process any individual could document a problem.
I b.2 Corrective Action Proaram Interaction With Other Lower-Tier Proarams The team reviewed the corrective action program interaction with other lower-tier programs that could result in corrective action. Team members also evaluated the performance of the licensee's condition review group.
l l
l
[
,.
- - . - .- .-.
- . _ - - .- - . . - _ _ -- - - _ - - - - - - - --
i
, 1
.
5-The team interviewed key personnel and/or reviewed site implementation procedures related to a sample of lower-tier programs that provided or resulted in corrective action f (e.g., measuring and test equipment identified out-of-tolerance conditions, radiological
!
deficiencies and exposures, event reporting, ecological monitoring, maintenance action items, and the stop work process). The team verified that these programs were strongly tied to the corrective action program by combinations of department procedure i requirements, department policy, or department management expectation.
According to Procedure RBNP-030, the condition review group responsibility was to:
-
Review and approve the in-house events assessment group suggested classification for each condition report;
.
Assign the condition report a final significance and classification; and
,
.
Determine the responsible manager, j t
i Therefore, an advantage of the process was that the responsible organization would j have the predetermined insight of the exact process steps and sequence required to '
address the issue.
The team observed a condition review group screening meeting and a regular condition l review group meeting on June 10 and 11,1998, respectively. The screening meeting j t was sponsored and facilitated by a representative from in-house events assessment.
l
! Also, in attendance were six representatives from maintenance, operations, radiation )
i protection, and system engineering. The attendees were supervisors, coordinators, or !
technical specialists. The seven personnel, including the facilitator, attending the meeting dispositioned 18 condition reports. The meeting lasted for approximately l 2-hours. The disposition action included determining the grade of the condition report l based on frequency and severity, and recommending a responsible department to assume ownership of the condition report and address the corrective action.
The condition review group meeting was et ' ducted the following day with all site departments represented by managers or superintendents. This meeting was again facilitated by an in-house events assessment representative, but chaired by the site duty manager. The plant manager was in attendance. The group dispositioned 17 condition reports as the screening group had determined that additional internal action was required for one of the condition reports reviewed the previous day, and did not forward it for condition review group action. The meeting lasted 30 minutes.
l The team found that the disposition decisions made during both meetings were I appropriate. The team determined that the condition review group process was effective for determining the severity level, frequency, and then arriving at a grade to n determine the specific path through the corrective action process. The screening l meeting was a good first call by experienced technical personnel and made the
! management decision process easier and quicker. During the meetings, there was obvious enthusiasm by participants to take on responsibility for dispositioning condition reports.
i l
,
l _
.,.
- - - .
- .
. - . - .
- - . - . - - - - - .
. ~ _ _ . - . . ._ - - .- - -
- l l
.
l
'
6- ,
l l
b.3 Condition Report Backloa The team reviewed the scope of the backlog and a sample of condition reports open l longer than 18 months. They also reviewed the open and closed action items integral to i' l the sampled reports and held several discussions with licensee representatives in order l to assess the significance of the backlog.
l I
Just prior to the inspection, a list dated April 30,1998, was provided to the NRC that identified condition report action items that had been opon longer than 18 months. The list contained 106 action items from 99 condition reports. The team requested a list of condition reports with the issues described that had been open for greater than 18 months. The licensee provided a list that described the issues for 233 open l condition reports. The total count of open condition reports was about 1100. The team further refined the second list to reveal that 52 of the 233 condition reports open longer i than 18 months were awaiting final quality assurance review, final management review, or both. This indicated to the team that 181 condition reports over 18-months old were open with about 100 open action items over 18-months old. The team, however, determined that the backlog of open condition reports was generally being effectively managed.
The team reviewed the list of condition reports opened longer than 18 months and I selected a sample for detailed review. The following five condition report dispositions were delayed due to the issues noted below.
,
\
t l Condition Report CR-RBS-1993-0229 !
This condition report was initiated during 1993 in response to a surveflance stroke-test failure of Valve CCP-138-MOV, a containment isolation valve for the ncnessential component cooling water loop in the containment. The problem was identified as l
l binding in the va!ve disc guides and the actuator stem nut. These problems were l I
addressed and repaired at the first available opportunity, and the stroke time was restored. Howaver, the condition report remained open pending the completion of a planned unrelated modification to approximately 150 similar valve actuators. The l
planned modification resulted when the corrective action process allowed the addition of an unrelated action item to the condition report. The action item was to address the l
l plant-wide condition of motor-operator valve actuators not having torque switch bypass l capability. The team determined that the addition of this action 'em resulted in an l enhancement or improvement, which was not directly related to the originally identified ,
problem.
l Condition Report CR-RBS-1994-0178
,
This open condition report was initiated to document an identified deviation between the as-built plans and actual conditions in the field. A spent fuel pool filter assembly cap l
.
had been installed with hex-head bolt fasteners instead of socket head fasteners as
! depicted in the as-built documentation. Before the identified condition was corrected, an unrelated action item was added to the condition report. The added item required addressing a previously identified ALARA concern for the radiation dose received by I
.
-- .
..
- .
- - _ . ~ . - - .-.
- -. .. .
-.
.
.
.
!
l -7-personnel performing the periodic task of washing the filters. This item, which was considered to be an enhancement, was not related to the original reported condition,
! which had since been resolved.
! 1
! Condition Report CR-RBS-1994-1395 l l
,
This condition report was initiated on October 26,1994, upon failure, due to over l ranging, of the spent fuel pool cooling system pressure gauges. The licensee's analysis l indicated that the over ranging occurred because of the automatic purge cycling of the
'
system Process Radiation Monitors RE-19A and RE-198. Condition Report Action item l 1 was issued on January 30,1995, to perform a plant modification by removing the l process monitors from the system. This action item was eventually canceled. Action l
'
Item 2 was initiated in December 1996 to use the engineering request process to remove the monitors and this action item was closed to related Condition Report l
CR-RBS-1994-0908, for removing other monitors, Action item 25. Following this decision, Engineering Request 97-0296 was issued to isolate and abandon the monitors in place by April 30,1998. The April date was not met, but was extended to June 30, 1998. (This date was not going to be met, and the licensee had not decided on a new date). In light of a team observation that the only issue to be addressed by this condition report was the pressure gauge failure, the immediate corrective action was effectively performed when the monitors were valved out-of-service and tagged. The !
long-term corrective action necessary to. address the original concern was to disable, l isolate, and abandon the monitors, which could have been completed in a more timely 1 and efficient manner.
Condition Report CR-RBS-1995-0343 The condition report was opened on April 5,1995, when plant personnel identified 12 leads that had been improperly terminated on nonsafety-related air-conditioning l Unit 1HVS-ACU1B, which provided cooling to the auxiliary control building and the normal switchgear spaces. An evaluation of the condition revealed that as-built documents were not accurate. The corrective action was to identify any generic j implications, perform verification, and correct the drawings. Six other nonsafety-related l units with the same conditions were identified. The team found that a total of 21 action items had been developed to address the issue related to all seven units. Items 1-15
'
had been opened on December 7,1995, and closed between December 12,1995,and Ai gust 1,1996. Item 16 was a notification step. Items 17-21 were opened on April 28,
,
1998, and remained open with due dates near the end of 1998. The team determined
( that excessive time lapsed between the ciosure of items 1-15 on August 1,1996, and l the opening of Action items 17-21 on April 28,1998, and the implementation of
( corrective action had not been timely. According to licensee representatives, this l occurred because of low priority assigned to the correction of nonsafety-related l deficiencies.
!
< Condition Report CR-RBS-1996-0843
This condition report documented a general noncompliance of procedures related to foreign material exclusion requirements. Once the licensee determined that procedural
_ .
- _ . - .
-_- - - .
. - - . ~ _ - - .
- . . _ - - . - . ...
- l
~
l l
'
requirements were appropriate, corrective action was initiated to attain improved monitoring through training. Additional corrective action to train contractor and appropriate site personnel on requirements and expectations for controlling foreign material, was also initiated. Finally, a program for the counseling of personnel violating requirements was initiated. According to licensee representatives, the delay in closure was due to administering training to future contract personnel.
b.4 Licensee Event Reports ,
l The team evaluated 12 licensee event reports (identified in the attachment). These I licensee event reports provided a clesr description of the event, the basis for j determining the causes of the event, and the corrective actions to be taken. The licensee event report packages indicated to the team that licensee personnel had performed in-depth evaluations to determine the causes of the event. The team )
determined that the corrective actions for the licensee event reports reviewed had been completed or were being appropriately addressed.
j l
b.5 Operability Determinations and Evaluations The team noted that Procedure RBNP-078," Operability Determinations," Revision 3, provided processes and guidelines necessary to make operability decisions for systems or components with degraded and/or nonconforming conditions. Procedure RBNP-078 required an identified degraded and/or nonconforming condition to be documented on a condition report and a copy of the condition report to be promptly provided to the shift technical advisor or senior reactor operator in the main control room. The condition report process, as delineated in Procedure RBNP-030, required each condition report to be reviewed by appropriate personnel to determine if the reported condition caused the
, affected components or equipment to be inoperable and to take action, if necessary, to l place the plant in a safe condition. For those situations in which the operability of a system or component was not clearly apparent, an engineering evaluation was to be performed.
, The team found that the operability assessments and determinations were
!
comprehensive and contained sufficient justification to make the operability determinations. The team did not identify any problems with the operability process or with the operability determinations.
b.6 Procedures Uoarade Proaram The team noted that a procedures' upgrade program had been completed in 1996. The procedure upgrade program process resulted in the rewriting of the licensee's procedures in a standardized format. The procedures reviewed by the team were of good quality. The trending of condition reports indicated that problems related to, or caused by, procedures have decreased since the procedure upgrade program was i implemented. Licensee personnel provided the team with a trending graph showing the
'
nurnber of condition reports written between January 1995 and May 1998, which encompassed the time the old procedures were being replaced with upgraded l
.
.
- . _ . . . - - . - . . - . - .
- . - - , - - - . . . _ _ . - - - - - - .-- -
.
- procedures. The graph showed the number of condition reports written, which were coded as having written communications causal factors, was trending down.
c. Conclusions
The team found the licensee's corrective action processes to be well designed and generally offectively implemented. The licensee's threshold for identifying adverse conditions appeared to be appropriate and there appeared to be a willingness on the part of licensee personnel to write a condition report for any nonconforming or questionable event. The team found the condition reports reviewed to have been processed in accordance with requirements and the associated corrective actions were well documented.
The team concluded that the backlog of open condition reports was generally being appropriately managed for important corrective actions although there were about 21 ;
percent open over 18-months old, due to various contributing causes.
!
Based on a sample of lower-tier programs, the team concluded that the lower-tier i programs adequately linked to the corrective action process to enable proper corrective )
action. The condition review group screening and regular meeting process was effective in oroperly determining the best approach to use in dispositiong a condition
- repod.
The team noted that the licensee event reports reviewed were of good quality. The licensee's operability evaluations were comprehensive and contained sufficient justification.
The team concluded that the procedure upgrade program had enhanced the licensee's procedures and had been a factor in reducing the procedure related problems.
l Quality Assurance in Operations l
,
07.1 Review of Operations Department Assessments I
j
a. Inspection Scope
(40500)
The team reviewed the licensee's approach to self assessments through review of the methodology contained in the following documents, " Instruction for the Corporate Self-Assessment Process," Revision 5, Company Procedure OV-103,
" Corporate Self-Assessment Process," Revision 2, and Vice President Guidance
, Document VPGD-98-016," Assessment Results and Management of the AAA j (Audit / Assessment / Assist Recommendation) Database." The team also reviewed the i
last two completed self-assessment activities performed by the operations department
! during 1997, and discussed the corrective actions recommended in the self l assessments with appropriate licensee personnel. The team observed that two corporate assessments of operations were scheduled for performance during 1998.
- ._ - ._
.
.
- - - - -- _ .
,
l I.
l l
'
i I
l b.
Observations and Findinas The procedure, instruction, and guidance documents contained sufficient guidance to generate self assessments that should be probing, thorough, and comprehensive. The following two self assessments were reviewed:
.
River Bend Station Control Room Operations Work Sampling Study (completed ;
September 11,1997).
I This study was performed by the River Bend Station nuclear support department )
at the request of the Operations Department to determine how much time was being spent on different core work processes and to provide recommendations i for improvement of the control room operations. The report provided operations management with detailed information related to control room activities which could be used to make informed decisions for improving control room operations. i i l
.
River Bend Station Operations Trairiing Assessment (completed April 14,1997).
This assessment was conducted to evaluate specific aspects of the operations training program for overall effectiveness. This assessment was thorough and
,
provided 13 recommendations. The training department was tracking and/or l addressing each of the recommendations made in this report.
'
l c.
_C_gnclusions l The team found sufficient guidance to generate self assessments that should be l probing, thorough, and comprehensive. The reviewed self assessments were thorough and provided detailed information which could be used to make informed decisions for improvement.
07.2 Industry Events Analysis Proaram a.
Insoection Scoce (40500)
The team assessed the licensee's program for processing, evaluating, and taking appropriate action to industry events. The inspectors discussed the licensee's industry Events Analysis Program with licensee personnel and reviewed related documents.
l b.
Observation and Findinas l
l Procedure RBNP 62," River Bend Industry Events and Analysis Program," Revision 5, provided guidance for conducting the Industry Events Analysis Program at River Bend Station.
l
._ . _ _ _ _ _ _ _ _ . _ _ . _ _ . _ _ _ _ _ . _ _ .
_ _ _ _ _
= j
.
l
The team found that the licensee's response to each of the events reviewed was appropriate. Based on this review, the team determined that the licensee had implemented appropriate programs for processing, evaluating and taking necessary actions in response to industry events.
,
c.
' Conclusions .
The team determined that the licensee had implemented an adequate program for processing industry event information including taking appropriate actions for those events that were applicable to River Bend Station.
i 07.3 Quality Assurance Audits and Surveillances i a.
Inspection Scoce (40500)
The team reviewed the three quality assurance audits that were conducted during the current systematic assessment of licensee performance period and a selection of quality assurance surveillances identified in the attachment related to the corrective action process. The trending of surveillance observations was also reviewed.
b.
Observations and Findinas b.1 Corrective Action Proaram l i
The licensee's practice was to conduct a programmatic audit of the corrective action I program biennially and effectiveness audits semiannually, except when the biennial l audit was performed. Therefore, an audit would be performed on the corrective action l t program about every 6 months. Programmatic Audit 97-02-1-CANC was conducted in l February 1997, and resulted in the issue of nine condition reports to correct specific and
- programmatic daficiencies identified during the audit. The team determined that the most significant issues identified in the audit were
l .
failure to assure the facility review committee review of condition reports that identified potential hazards to nuclear safety;
.
inconsistent implementation of human performance applicability for condition reports; and untimely disposition of certain condition reports causing delays in the
~
j- -
implementation of corrective action.
The condition report to address untimely disposition remained open.
- Effectiveness Audits 97-01-1-CANC and 98-01-1-CANC conducted July 1997, and
.
January 1998, respectively, identified programmatic findings. A total of six condition
!
reports were issued to correct the deficiencies identified in these audits. The significant i.
- programmatic findings in these audits were noted to question:
i.
!
- . - - - .
.
l
.
Management accountability for assuring corrective action program compliance;
.
Adequacy of the reviews to identify potential hazards to nuclear safety;
- Adequacy of root-cause determinations for nonsignificant condition reports;
.
Adequacy of the completion of corrective action items; and,
.
Availability of controls within the corrective action process to assure the maintenance of the licensing and design bases.
All three of the audits identified specific and programmatic issues. The team observed that the smaller scope effectiveness audits were as effective at identifying programmatic l
,
issues as the programmatic audit. The most recent effectiveness audit (98-011-CANC) ,
l was noted to have been the most effective in the identification of programmatic issues.
l l
The team noted that the findings and observations from the leviewed surveillances were !
relevant to the corrective action program. Further review revealed that most findings I and observations were very low significance, but were pertinent to performance of the corrective action process. The team inquired if the collective information from quality assurance surveillances was used to improve the performance of site programs.
Licensee representatives demonstrated an electronic mor'itoring program that was just becoming available. The observation trending program required the coding of i observations with a code in common use at all Entergy nuclear facilities, and similar to the industry data base coding system. The coded surveillance findings and observations were then placed in a data base where they could be extensively trended l l and graphed. It was also noted that any employee could submit observations to be !
coded and loaded into the data base. The team determined that this was an effective I method of identifying and trending generic implications or findings of low significance j from quality assurance surveillances, or from other sources.
l
c. Conclusions
!
The recent quality assurance audits were effective in the identification of specific and programmatic deficiencies within the corrective action program. Entergy had established an electronic trending program that was in common use at all Entergy sites, which provided an effective method of identifying and trending generic implications or findings of low significance from quality assurance surveillances or from other sources, i
f i
j
_ _ _ _ _ _ _ - . _ _ _ _ . . _ . . _ -_. - _..._ __
'.
l l
.
II. M AINTEN ANCE l M7 Quality Assurance in Maintenance Activities l
, l
! M7,1 Problem Identification and Resolution l
a. Inspection Scope
(40500)l l
,
The team evaluated maintenance department self assessments to determine if maintenance department personnel were appropriately identifying problems and implementing timely corrective actions.
! b.
Observations and Findinas '
l l
The team reviewed the licensee's self assessment activities related to the maintenance I department, placing special emphasis on the conclusions and implementation of {
corrective actions identified in the self assessments. Self assessments reviewed were, '
, " River Bend Maintenance and Measuring and Test Equipment (M&TE) Assessment," !
l Audit 97-02-I-Maint/M&TE; " River Bend Station Maintenance and Measuring and Test
! Equipment Programs Combined Assessment / Audit," performed April 27 - May 7,1998; and " River Bend Station Work Management Assessment," performed April 27 - May 7, 1998.
The team determined that for the self assessments reviewed, the objectives, the criteria, and the self-assessment activities were clearly stated. The self assessment team members had an appropriate mix of talent and came from different disciplines and areas, including areas outside River Bend Station. Based on the condition reports l written during the self assessments and the recommendations made in the self
! assessments, the team concluded that they were thoroughly performed and that the self-assessment findings were appropriately self critical.
c. Conclusions
!
'
The self assessments reviewed were comprehensive and of appropriate scope and depth to meet the objectives of the self assessments. The type and number of findings l Indicated the self assessments were thorough and appropriately self critical.
l Ill. ENGINEERING E1 Conduct of Engineering 1-E1.1 Problem identification and Resolution a. inspection Scope (40500)
, ,
!
,
a
..
. ~ .
. _.
- _ _.
_- - - - - .- - .
.
.
l The inspectors evaluated whether engineering department personnel were appropriately identifying problems and implementing timely corrective actions. The review included condition reports, licensee event reports, maintenance action items, and temporcry alterations.
b. Observations and Findinas b.1 Diesel Generators Dependence on Nonsafety Control Air i On January 14,1998, a Division 11 emergency diesel generator failed the air-start system quarterly valve Operability Surveillance Test STP-309-6308. This test had been
, pedormed in conjunction with emergency diesel generator (EDG) Operability l
!
Surveillance Test STP-309-0202. The cause of the failure was the lifting and sticking l
open of Relief Valve EGA-RV5B on the rear air bank at about 15 minutes into the test at a pressure of approximately 240 psig when the nominal set pressure was 275 psig.
Condition Report CR-RBS-1998-0044 (dated January 14,1998) documented this failure and described how the stuck open relief valve depressurized the accumulator to i
approximately 135 psig, at which point the decision was made to manually shut down the EDG before control air was lost.
l The team's review of this condition report fostered questions concerning the starting l
air system design and the apparent dependence of the Division I and II EDGs on control air during operation after engine start. It was revealed that, indeed, the l engines were dependent on control air (60 psig normal operating pressure), and that a primary component necessary to satisfy this dependence, the starting air compressors, was nonsafety-related, nonseismically qualified, and non-1E powered.
These conditions appeared contrary to the Updated Safety Analysis Report (USAR),
Sections 7.1.2.4.2 and 8.3.1.1.3.6.1.1, which state that all safety-related instrumentation and control equipment are designed to remain functional during accident conditions, and all necessary auxiliaries directly associated with each standby diesel generator unit are powered from their associated standby buses, respectively. This constitutes an apparent violation of Criterion 111 of Appendix B to 10 CFR Part 50, in that, since November 1985, design control measures did not adequately verify or check that the safety-related diesel generator control air instrument and controls systems remained functional during a loss-of-offsite-power event. Specifically, design control measures did l not ensure that the system was provided with a long term supply ,f safety-related l
'
pressurized air, which was necessary for the continued operation of the diesel generators in response to an extended loss of offsite power (i.e., the air compressors were nonsafety-related and were not powered by a safety-related bus). While the diesel generator starting air receivers provided pressurized air to the control air system, this l was not a specified safety function of the starting air system. The starting air system air l receiver pressure would, in less than one day, bleed to less than the minimum pressure required to maintain all parts of the control air instrument and controls system logic functional. At less than 120 psig, the non-essential diesel generator trips would no
, longer be bypassed and at less than 45 psig the diesel generators would automatically shutdown (50-458-9813-01).
l l
. . _ . _ _ __ . _ . _ .
.._ _ _ _ _ _ _ .
.
.
Another design feature potentially contrary to the safety-related requirements for this system was a 0.5 in compressor unloader line connecting each nonseismically qualified air compressor with its associated accumulator. These lines contained 0.125 in orifices that would limit pressure decay to approximately 3 psig per minute at normal system operating pressure (235 psig to 250 psig)in the event of a seismic-induced failure.
Although this was described in USAR, Section 9.5.6.2.1, and there was an in-line isolation valve, there was no intimation in the USAR that such a leak was a potential threat to the EDGs continued operating ability, the only threat discussed was to its ability s to start.
!
The team's review also revealed that this was not the first time this system's dasign had been questioned by the NRC. On November 14,1989, EDG 1 A experienced a failure due to a faulty engine bearing high temperature detector that subsequently dumped the control air pressure In response to a report to the NRC on the incident, two dor:umented telephone conversations ensued between the licensee and the NRC (Office of Nuclear Reactor Regulation)in which the NRC expressed concern with the
'
dependence of the EDGs on control air for operation and requested a supplemental report on this concern. In the first conversation, the licensee alluded to a possible d
modification, but no evidence was found of a relevant modification or the requested supplemental report. This and the failed open relief valve incident described above were two opportunities to correct an inadequate condition on these units that were
! missed by the licensee.
Further, Technical Specification 3.8.1b requires that three diesel generators shall be operable while in Modes 1,2, and 3. Technical Specification 1.1 states that a system or component is considered operable when all necessary auxiliary equipment required for the system or component to perform its safety function are also capable of performing their related safety functions. Thus, since Ncvember 1985 to the time of this inspection, the Division I and ll EDGs were apparently inoperable during periods of operation in Modes 1,2, and 3, in that the respective control air instrument and controls systems, required for the EDGs to perform their safety functions, were not designed to remain functional during accident conditions. This constitutes an apparent violation of Technical Specification 3.8.1b (50-458/9813-02). In addition, the team learned that the Division lli EDG may have been out-of-service for a period of time greater than the time allowed by the technical specifications with the Division I and ll EDGs apparently inoperable.
The safety function of the control air system for these EDGs during emergency operation was to bypass most of the trips that were functionalin the nonemergency mode of operation as described in USAR, Section 8.3.1.1.4.1. These trips included generator over current, reverse power, loss of field, ground over current, extreme high jacket water temperature, high bearing temperature, extreme low jacket water pressure, high crankcase pressure, low turbo charger oil pressure, high vibration, high lube oil temperature, and low lube oil pressure. Trips not bypassed included over-speed, generator differential relay, and manual trip. However, with loss of accumulator air pressure, at 120 psig decreasing, this safety-related bypass function is deactivated, and in the range of 40 to 60 psig decreasing, the units would shut down, not necessarily in a manner that would assure the integrity of the units or the attached loads. In fact,
_.~.
. _ _ . .
.__ _ _ _ ._ _ _ _ _ . .
!
.
l
.
! -16-l Annunciator Procedure 1EGS-PNL3A/E-4 was issued December 1987, to address loss
! of control air. The procedure stated,"If the diesel generator control air pressure l decreases to less than 45 psig numerous pressure switches and valve operators would l actuate resulting in illogical responses from the diesel generator control system. DO l NOT operate the diesel with less than normal control air pressure." The procedure ,
! required that the EDG be shutdown and provided steps to accomplish that task. These I procedural requirements are still in effect, except that the procedure was revised to l allow continued operation of the EDG if it was needed for safety. This appeared to )
clearly demonstrate that the licensee understood that, between 1987 and 1990, there ,
t
'
was no reasonable assurance that the EDGs would be operable if control air was lost.
i The then-EDG system engineer stated that he was aware that control air could be lost during a loss-of-offsite-power event.
In the initial response to this concern, the licensee re presentatives maintained that such dependence was acceptable based on compensatcry operator actions described in System Operating Procedure SOP-0053, " Standby Diesel Generator and Auxiliaries,"
Revision 17, and Abnormal Operating Procedure AOP-0004, " Loss of Offsite Power,"
Revision 15. These procedures required an operator to be dispatched to the local EDG control panels for any automatic start, and if the unit was required for emergency operation for more than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, and neither air compressor was available, to connect bottled air. The connection hardware was located in the control room, and the bottled air was located outside the maintenance shop. The licensee established these procedural controls in 1990. The procedures, however, did not provide detailed l instructions regarding the installation of the air bottles and associated hardware. The licensee had not established other controls to ensure that the evolution could be accomplished and did not administratively control the number of air cylinders onsite to ensure that sufficient air was available. Further, the licensee had not determined the amount of air that might be necessary in response to such an event. The licensee assumed that air cylinders were available and could be used, if necessary. No evaluation was performed to determine whether or not the problem with long-term availability of control air required additional corrective actions. The team considered this a significant condition adverse to quality, in that, the licensee was dependent on operator action and nonsafety-related air bottles to ensure EDG operability when responding to a design basis accident. No credit for these actions and air bottles was specified in USAR, Chapter 15, accidents. As such, the reliance on these additional actions was not reviewed and approved by NRC. This constitutes an apparent violation of Criterion XVI of Appendix B to 10 CFR Part 50, which requires that conditions adverse to quality be documented, reported, and promptly corrected (50-482/9813-03).
During 1991, NRC issued Generic Letter 91-18. It provided specific guidance with respect to taking credit for operator action in lieu of automatic action. The generic letter specified that this approach is only acceptable if technical specifications can be met and only for a short period of time, until corrective measures can be taken. The licensee failed to address the noted operator actions within the context of the generic letter.
l' On January 20,1995, the licensee issued Operations Policy 19,
" Restoration / Maintenance of System / Component Operability Through Use of Manual i Action in Place of Automatic Action." This policy provided specific directions associated
!
- .
_- .-.
.
_ - _ .
-_ .
. _ . -- _ -.
.
.
with the guidance previously issued in Ge.1eric Letter 91-18. While the document provided appropriate guidance, licensee personnel did not recognize that operator actions would be required to maintain the operability of the EDGs.
On November 10,1997, the NRC issued Information Notice 97-78, " Crediting of Operator Actions in Place of Automatic Actions and Modifications of Operator Actions, including Response Times." This notice alerted licensees to instances where licensees had inappropriately taken credit for operator action in lieu of automatic action. The licensee addressed the information notice by initiating an action item that only required l enhancement of procedures that address operability evaluations. The team considered this a missed opportunity to identify the problem.
To support their initial response to the concern, the licensee performed a walkthrough drill on June 25,1998, to verify the ability to perform the procedure-specified activities to ,
install air bottles for EDG sustained operation without control air. The first two attempts l to connect the air bottles failed due to the fittings not being properly matched and, as a I result, approximately 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> were required before the hookup was completed. This prompted the licensee to change the staging location of the fittings to the Division ill diesel generator room and to locate four air bottles outside each Division I and l Division ll EDG room. Condition Report CR-RBS-1998-0799 was generated to I document the failure to perform the air bottle hookup in the procedural required time.
After the appropriate materials were staged and personnel were trained, the time to complete the process was reduced to approximately 1.0 hour0 days <br />0 hours <br />0 weeks <br />0 months <br /> as demonstrated by reperformance of the procedure.
Technical Specification Surveillance Requirement SR 3.8.3.4 stated the minimum receiver pressure as 160 psig, and the associated bases stated that this value was to assure that the EDGs were capable of ". . . at least one emergency DG start attempt above the air pressure interlock (the same as the trip bypass deactivation pressure,120 psig) . . without recharging its start receiver (s)." This last phrase implied that the units were also capable of operating independent of their air compressors. However, after one start, the receivers would be at or near 120 psig and, therefore, no further pressure decay could be tolerated without risking deactivation of the trip bypass, thereby rendering the units outside their licensing basis quoted above from the USAR.
Additionally, Procedure STP-309-6304,"Div 1 EDG Forward Bank Air Start System Quarterly Valve Operability Test," Revision 9, which typified the applicable accumulator pressure decay surveillance test procedures, allowed up to 0.5 psig per minute pressure decay. Additionally, review of surveillance-generated test data since late 1996 revealed numerous cases where leakage of these accumulators had been in excess of even this value.
The licensee committed ( in the USAR) to Regulatory Guide 1.68, " Initial Test Programs for Water-Cooled Nuclear Power Plants," Revision 2. The regulatory guide states that preoperational tests should demonstrate that systems and components will operate in accordance with the design in all operating modes and throughout the full design operating range, and that testing should include verification of the proper functioning of instrumentation and controls. In addition, surveillance requirement 3.8.1.13 in Technical Specification 3.6.1 requires, with respect to operational testing, verification
.- . -- - .
. . - - __ - - - - _ .
_
_ - - . - - --
!
i
.
l that each EDG can operate continuously for a 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> once per 18 months. The surveillance requirement bases states that Regulatory Guide 1.108 requires l demonstration once per 18 months that the diesel generators can start and run ;
l continuously at fullload capability for an interval of not less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Regulatory i l Guide 1.108," Periodic Testing of Diesel Generator Units Used as Onsite Electrical l Power Systems at Nuclear Power Plants," Revision 1, states that the testing of the
! diesel generator unit should simulate, where practicable, the parameters of operation l and environments that would be expected if actual demand were to be placed on the l system. It is clear that both preoperational and operational testing of the Division l l and II EDGs were not adequate to assure that the diesel generators, including the l control air instrument and controls system, would perform satisfactorily in service. The l testing did not verify the proper functioning of the diesel generator control air instrument l and controls. The testing was conducted with nonsafety-related power supplied to the '
l diesel generator starting system air compressors which fed air to the diesel generator l control air instrument and controls. Under the actual safety-related design configuration l and modes, no power would be a"silable to the compressors; therefore providing power i
'
,
to the compressors during the testing masked a design flaw in the control air instrument l and controls system. The design failed to ensure that the system was provided with a long-term source of pressurized control air. This constitutes an apparent violation of Criterion XI of Appendix B to 10 CFR Part 50 (50-482/9813-04).
I l
b.2 Inadeauate Chilled Water Pump Inservice Test Procedure Maintenance Action Item 312568 dated August 4,1997, described the resetting of the j impeller clearances on Control Building Chilled Water Pump 1D and the subsequent retesting to establish new ASME Code Section XI inservice test reference performance values. Degrading performance had necessitated resetting the clearances.
The team observed that in determining the minimum acceptable performance for the
! pump in Surveillance Test Procedure STP-410-6312 M, the licensee had applied the l 10 percent degradation from the reference value allowed by ASME Code Section XI without regard to the minimum performance required to meet the system's design basis j requirements. The team noted that the design-basis-required minimum performance l was greater th:c, the minimum allowed by the surveillance test procedure. The chilled water system design requirements were identified in Calculation G13.18.2.2*04-0A, "HVK System Hydraulic Calculation," dated April 1988. The calculation identified the total system resistance as 129.7 feet (56.15 psid pressure differential) at a flow rate of 330 gpm. The surveillance test procedure performance requirements (reference values)were 54.6 psid at 351 gpm, which correlates to 56.15 psid at 330 gpm. The surveillance test procedure acceptance criteria, which were below the pump design basis, allowed a reduction to 50.9 psid at 351 gpm, which correlates to 52.6 psid at 330 gpm. Correlation was determined by using the Control Building Chilled Water Pump 1D pump curve.
Since this pump rebaselining was required because it had degraded to
,
what-was-thought-to-be a marginal condition, the licensee engineers were asked to provide data on the actual performance of this pump prior to its adjustment. The data
'
,
f revealed that of 37 times this pump had been tested since 1989, it had failed to meet its minimum design basis performance value 27 times. Further, the data showed that the
,
- ,
___ .____ _ _ ~ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
.
.
l -19- l pump's performance was less than the control building chiller design flow rate at the required design pressure differential (e.g.,330 gpm at 56.15 psid) on 21 occasions from ,
September 1992 through May 1997. After the rebaselining of the pump, the test data j showed acceptable pump performance.
j i
l Licensee personnelinitiated Condition Report CR-RBS-1998-0769 on June 18,1998, to
! document the above conditions. Engineering personnel determined that the equipment
! remained operable in that the control building chillers would have provided the required l cooling capacity to maintain ambient conditions in the areas they served in the event a l loss-of-coolant-accident occurred. Based on performance tests conducted on Chilled l Water Pump 1D between June 1992 and April 1998, engineering determined that the l worst-case condition occurred on December 18,1993, when the test data showed a flow l rate of 200 gpm at 56.15 psid. Licensee personnel provided test data documented in a 1 letter from the chiller manufacturer (United Technologies-Carrier Corporation), dated April 26,1988, which showed that the rated capacity of the chillers was 189 tons at a flow rate of 303 gpm at 56.15 psid, and 67.5 degrees F/52.5 degrees F entering / leaving chilled water temperatures.
l Engineering personnel determined that the maximum required cooling capacity during a l worst-case loss-of-coolant-accident would be 141.6 tons, based on computations which j
- showed that the entering chilled water temperature would be slightly higher (70 degrees i F) and the leaving chilled water would be 52.5 degrees F. An evaluation performed by the manufacturer showed that with reduced chilled water flow of 200 gpm at a l
,
conservative entering water temperature of 70 degrees F, a cooling capacity of 145.8 tons would be provided. Therefore, the available cooling capacity of the chiller is not affected by the worst case reduction in chilled water flow. Since the equipment was capable of performing its safety function, no condition existed that was prohibited by the technical specifications or that was outside the design basis.
It appeared that limnsee engineers failed to translate the design requirements for the Control Building Chilled Water Pump 1D into Surveillance Test Procedure STP-410-6312, until Revision 9 was issued on June 26,1998. This failure allowed the pump to degrade to a condition that was less than the system design basis flow rate and pressure differential criteria. The pump's performance characteristics became acceptable af ter the pump was rebaselined in July 1997, even
< though the surveillance test procedure continued to contain the wrong acceptance
! criteria. This failure to properly translate design requirements was a violation of Criterion til of Appendix B to 10 CFR Part 50. However, it should be noted that in mid-1997, the l
licensee had initiated a program to re-examine the design basis performance
- requirements of all safety related pumps compared to the current inservice test j procedure acceptance criteria. The contractor selected to execute this program had begun in late May 1998, and had independently identified the Chilled Water Pump 1D test acceptance criteria discrepancy; however, the program had not yet identified the occasions on which the pump had degraded below the system design requirements. The l target date for program completion was the end of October 1998. As of August 28,
! 1998, the contractor had completed evaluation of 13 of the 25 safety-related pumps with no additional discrepancies identified. Therefore, this licensee-identified and corrected
!
!
L
!
!
i.
! 1
,.
i l
!
20-violation is being treated as a noncited violation, consistent with Section Vll.B.1 of the NRC Enforcement Policy (50-458/9813-05).
It should also be noted that the need to assure that inservice test acceptance criteria accounted for minimum design basis performance requirements had been promulgated to licensees on at least two occasions. NUREG-1482, " Guidelines for Inservice Testing at Nuclear Power Plants," dated April 1995, in Section 5.6, " Operability Limits of Pumps,"
cautioned that, "[o]perability limits of pumps must always meet, or be consistent with, licensing basis assumptions in a plant's safety analysis." This was further addressed in the NRC's response to Comment 5-3 in this document, which stated that, "[i]f specific plant limits are more conservative [than the Section XI limits), they are the absolute limits for meeting the licensing basis of the plant . . " Additionally, NRC Information Notice 97-90, "Use of Nonconservative Acceptance Criteria in Safety-Related Pump Surveillance Tests," dated December 30,1997, was devoted specifically and entirely to this concern.
b.3 Containment Airlock Valve Condition Report Dispositioned inadeauatelv i
l Condition Report CR-RBS-1997-0054 documented a discovery of a contaiament airlock j ball valve stem locking nut that did not have full thread engagement. The condition report resolution determined that the stem nut was required only for valve gear alignment i during installation, and seal compression was not required to seal the valve. It l concluded, therefore, that the stem nut was inctalled in accordance with the vendor's l instructions, that the condition was not a nonconformance, and no further action was !
! required.
, The team reviewed this condition report and the pertinent detailed documents
- (Vendor Manual VDT-T966-0100 and Drawings 0219.711-056-064, Revisions H, and
!
0219.711-056-073, Revision C). Although, as described in the condition report resolution, the valves did employ a backseated desian whereby internal pressure increased ". . . the sealing ability of the inside stem seal . . . ." the design did not rely on this feature to establich and maintain the primary sealing of the stem. In order to assure that this primary seal was property established, Step 11 of the vendor manual assembly instructions stated "[t]ighton stem nut (Pc. 4) until a definite compression of the stem l seals is detected."
The actual valves installed on the airlock were somewhat different from the valve
! described in the vendor manual in that they employed a gear segment for operation l instead of an operating handle (Drawing 219.711-056-073). As described in the i condition report resolution, this gear segment required alignment, and the stem nut was given the added function of providing that alignment. However, the original function of t seal compression was still required. The valve was, therefore, redesigned to add l Belleville washers on top of the gland seal ring to provide the required seal compression over a range of nut adjustment. Therefore, contrary to the condition report resolution, the gear alignment was not the only function of the stem nut,its position and, therefore,its engagements were also important to assure adequate load on the belleville washers and hence on the seal. It was not clear from any of the above-discussed documents what the
{
l l
- _ . - .
.---. - .- - -._. - ---._.- - - ....- - _ . - - - .
.
.s
.
l
)
i
'
extent of that range was, or if the required washer compression was achieved with the stem nut not fully engaged.
,
A second opportunity to discover this discrepancy was missed when Engineering
! Request ER-97-0376 was generated. This engineering request addressed only the strength of the threads when not fully engaged and not the requirement to assure the belleville washers were compressed.
In order to assure that the actual installation was adequate, the team reviewed the work instruction used to install the operator gear segment. In spite of the inadequate condition report resolution, it appeared from the work instruction that the required compression of l
the belleville washers should have been achieved.
The team's review also revealed an error in the depiction of the seal area of the valve j
'
body on licensee Drawing 219.711-056-073, Revision C. This minor error and the condition report discrepancy described above were documented on Condition Report CR-RBS-1998-0727.
l l
Although no actual discrepancy was identified in the valve hardware installation, this finding was an example of inadequate engineering resciution of identified problems.
(
b.4 Proposed Removal of Steam Tunnel Hiah Temoerature Main Steam isolation Valve (MSlV) Trio L
The team reviewed Temporary Alteration 95-0012, dated September 21,1995, and the l
l alteration extension dated October G,1997. The original alteration was to provide l annunciation in the control room when a problem developed with the " temporary" air-l conditioning units installed in the steam tunnel. These " temporary" air-conditioning units l provided the additional cooling that was found to be required to maintain the steam tunnel temperatures below the setpoint for the high steam tunnel temperature trip of the i MSIVs during normal operation. The purpose of this extension was to provide additional
'
time for the temporary alteration to remain installed until a modification to remove this MSIV trip function could be installed (projected for 1998).
Although the team detected no concern with the temporary modification itself, the team was concerned with the planned removal (funding approved by MIL 95-093) of the high steam tunnel temperature MSIV trip function described in the temperature alteration.
The purpose of this trip function was to detect steam line breaks outside containment and provide the necessary isolation, as described in USAR, Sections 7.3.1.1.2, " Containment and Reactor Vessel iso'.ation Control System (CRVICS)" and 6.2.4.3.7, "Conformance to NUREG 0737, Itern ll.E.4.2 - Containment isolation Dependability." The licensee
,
considered that this trip function was not necessary because the MSIVs would trip on
! main steam line high flow for such an incident, and the risk associated with inadvertent high temperature trips with the current design outweighed the risk of removal of this trip
- function. However, it appeared from conversations with licensee engineers that many l important factors associated with these risks and resolution options had not been
!.
adequately considered, even conceptually. The following were examples:
t
' - , - . - --
,.
, ..
, . , _ . . < , ,- , . . , , - , -
-
.
-
l
.
.
The steam tunnel temperature trips were intended to detect a leak as small as approximately 25 gpm; the steam line high flow trip, on the other hand, which would be the next level of detection if the temperature trips were removed, would provide isolation when only steam flow exceeded 140 percent of normal full flow, or in the range of 4.2E6 lb per hour, almost four orders of magnitude highor.
.
The offsite and control room doses for steam line break outside ccntainment described in the USAR, Chapter 15, were based on the steam that would be released, at a flow rate in the steam line significantly in excess of 140 percent normal flow (the ultimate flow capacity of the steam line restricting venturis) for a worst-case double-ended guillotine break for a duration equal to the time between the break and the closing of the MSIVs (in the range of 10 seconds total). On the cther hand,if the high temperature trips were removed, large breaks could exist at flows just below the high flow trip point for extended periods until the operators went through the procedural responses to the steam tunnel high temperature alarm - pctentially a matter of minutes rather than seconds, with the resultant potentialincrease in offsite and control room doses beyond the current design / licensing basis.
.
Reactor power excursions and challenges to core limits that could result from l
extended time at excessive main steam flow rates that could be allowed by large l steam line breaks that generated less than 140 percent flow without the high temperature trip.
.
Little consideration appeared to have been given to reducing the risk of spurious MSIV trips by redesigning the high temperature detection instrumentation instead of removing the trip circuitry.
Although no modification package had been approved at the time of the inspection, this project had progressed to the point of funding approval, and was scheduled for completion in 1998, indicating a high level of engineering and management commitment.
However, the team considered that the level of technical evaluation had been inadequate considering the progress of the modification process, and this was an example of an inappropriate resolution to an identified problem, b.5 Auxiliary Buildina Heatina Ventilation and Coolina (HVAC) Air-to-Water Cooler Monitorina The team reviewed Condition Report CR-RBS-1997-0081, dated , anuary 28,1997, concerning the tested capability of safety-related unit room Cooler HVR-UC6 being less than design. In this condition it was calculated that the room temperature could exceed the Technical Requirements Manual, Section 3.7.10, limit of 122 degrees F for nonaccident conditions. As a result of this review, the team identified additional general concerns with the licensee's program for monitoring the performance of safety-related HVAC room coolers.
Generic Letter 83-13," Service Water System Problems Affecting Safety-Related Equipment," dis:ussed that licensees should establish a testing program to verify the performance of all safety-related heat exchangers. A licensee letter, RBG-34558, to the NRC, dated March 1,1991, described its intent to monitor the performance of the
__ _ . . _ _ _ _ .
. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _._.___ _ _ _ ___ _ _
.
!^
.
l l auxiliary building HVAC safety-related heat exchangers by daily monitoring of the !
temperatures of the spaces cooled by these heat exchangers, as required by the l' technical specifications (later replaced by the technical requirements manual), in lieu of testing.
The 'eam's review of the licensee's response letter identified statements supporting the licen ee's position that did not appear to be consistent with actual conditions or design basis requirements. For instance, the letter stated that "[a] review of the historical area l
temperatures for these spaces [8 of 11 safety-related spaces] reveals that the temperatures are all well below the maximum design temperatures. The remaining three l
unit coolers serve safety-related pump rooms where the pump is not normally in operation. However, these pumps are operated on a periodic basis for testing. During
! this testing, temperatures in these areas also remain well below their maximum temperature. The operation of the safety related pumps represent the heat load that would be present after an accident . . . This monitoring of temperatures during operation
,
of equipment representing post accident heat loads serves as a functional performance l test of the auxiliary building unit coolers."
The first sentence implied that for 8 of 11 of the room coolers, the accident heat load would not increase over the normal heat load and, therefore, monitoring of normal operating temperatures would be indicative of the ability to remain below the design basis temperature for accident conditions. However, this statement did not address that under design basis accident conditions the normal building HVAC system, that provided fresh outside air and exhausted hot air from these rooms, thereby providing a large portion of the normal room cooling, would not be in operation. It also did not account for the fact that under design basis accident conditions, the service water that provided cooling for the room coolers would be at its design basis maximum temperature, considerably above its normal operating temperature and, therefore, the unit coolers would be capable of
! removing considerably less heat than under normal conditions.
l The next four sentences provided the same basic position for the three coolers in the safety-related pump rooms, with the added position that the heat load during pump testing represented the design basis heat load. This also was incorrect because during l accident conditions the rooms would experience rather substantial additional heat loads from the accident-generated hot water being circulated through the large pipes in the rooms, heat that is not present during testing. Additionally, since these piping heat loads duri. g accidents were not taken into account here, it calls into question if such loads were properly accounted for in the other eight rooms.
Therefore, due to the facts that the cooling capacities for the rooms are less during design basis accidents than during normal operation, and the heat loads would be more during accidents, the final conclusion of the licensee's letter that, "[t]his monitoring of
,
temperatures during operation of equipment representing post accident heat loads
'
serves as a functional performance test of the auxiliary building unit coolers," was not l valid unless there was analytical basis that correlated normal and accident conditions and
- accounted for the differences in heat loads and cooling capabilities. The licensee's
- representative was asked to provide this basis; however, none could be provided.
.
,
'
-- -- - .
- .- . -
.
-- -..
- - - .
l l
l- 1 l
l The team was also informed that, in spite of the position stated in the letter, the licensee had performed testing on four of the unit coolers (i.e., HVR UC5 in 1995 and 1996; HVR-UC6 in 1995,1996, and 1997; HVR-UC7 in 1995 and 1997; and HVR-UC9 in 1995 and 1997). This testing, however, was not sufficient to meet the guidance identified in Generic Letter 89-13, which addressed testing all auxiliary building unit coolers. Once all had been tested, then periodic testing on a sampling basis was to l be performed at least once per fuel cycle.
l In response to this issue pertaining to the licensee's performance monitoring of the auxiliary building HVAC coolers in lieu of testing, the licensee generated Condition l Report CR-RBS-1998-0794 on June 24,1998. A number of corrective action items were l developed, including submittal of a new response to NRC describing how Recommendation ll in Generic Letter 89-13 is being, or will be, complied with. The team identified this issue as an Inspection Followup item pending additional NRC inspection (50-458/9813-06).
b.6 Hiah Pressure Core Sorav Relief Valve Bellows Leakaae Evaluation On May 29,1997, high pressure core spray Relief Valve E22-RVF035 was found to be leaking at a rate of approximately 2 gpm. Since this valve was part of the containment boundary, Technical Specification Action Statements 3.6.1.1.A and B were entered, Condition Report CR-RBS-1997-0804 was generated, and the valve was replaced.
Subsequently, on June 16,1997, Calculation G13.18.9.5*047-1C, " Dose Consequences of a DBA LOCA Including Liquid Leakage from E22-RVF035 and Crediting Present LLRT Results," was generated to determine the past operability /reportability of the as-found condition.
The licensee calculated the containment leakage rate at the time of discovery of the leaking valve as follows:
1. The 10 CFR Part 50, Appendix J, containment localleakage rate Type B and C testing results from the time of the last Type A integrated leak rate test (1992) j were totaled. This value was subtracted from the 1992 Type A test rest.Its to I obtain the "other" leakage (i.e., leakage through paths other than those tested by the Type B and C tests).
2. This "other" leakage value (assumed to remain constant until the then-current time) was added to the then-current Type B and C test running total to obtain a ,
then-current total containment leakage rate without the contribution from the relief valve leak.
3. This value was used to calculate the design basis accident offsite thyroid dose (the most limiting dose) at that time.
4. The additional dose contributed by the relief valve leak was then added to obtain i the total calculated offsite dose at the time of discovery.
= - - _ - - - - - _ . - - - - - _ . .
. - - - . _ _ - - - - - - .
.
.
.
The team questioned this methodology as follows:
l 1. The unstated assumption that the "other" leakage would remain constant from l 1992 until 1997, when the leaky relief valve was discovered, was not necessarily
'
valid and was unsubstantiated.
.
2. The 1992 Type B and C test results represented the maximum pathway leakage
!
at that time, i.e., the leakage of the worst leaking barrier (the inboard barrier or l the outboard barrier) at each penetration. On the other hand, the Type A integrated test results represented the minimum pathway leakage, since the Type A test was performed with most of the penetration valves (both inboard and outboard) closed, and the leakage was through both the mir'imum and maximum leaking valves in series. (Those valves that were open were in closed systems with essentially zero leakage.) Therefore, the Type B and C test results total was somewhat higher than the actual leakage through these penetrations for the Type A test, which yielded a lower-than-actual "other" leakage when it was subtracted from the Type A results. Since this lower-than-actual"other" was used to calculate the totalleakage rate at the time of discovery of the leaky relief valve,
,
the calculated total leakage was less than the actual leakage, and the resultant l
calculated dose was, therefore, non-conservative. Since the calculated dose was only approximately 1 Rem below the 300 Rem regulatory limit, this discrepancy alone could have caused this limit to be exceeded.
The offsite thyroid dose (the most limiting accident dose) was calculated at 298.9 Rem.
While this was higher than the licensing basis value at the time (290 Rem from USAR Table 15.6 7), the licensee evaluated the calculated dose against the regulatory limit i from 10 CFR Part 100 (300 Rem) and deemed the containment operable.
The team identified these issues to licensee personnel, and expressed concern that this l demonstrated a lack of rigor and conservatism in calculating the effects of discrepant conditions. Licensee engineering personnel conducted further review and concluded that the methodology used to estimate overall containment leakage was reasonable; however, a more rigorous justification for the methodology used should have been provided, and additional conservatisms should have been quantified. Engineering personnel also noted that the methodology used in Calculation G13.18.9.5*047-1C is now obsolete due to NRC's approval (License Amendment 98) of the methodology used in Penetration Valve Leakage Control System LOCA Dose Calculetion G13.18.9.5*051.
This most recent calculation confirmed appropriate margin existed.
b.7 Hiah Pressure Core Sorav Unit Cooler Fan Hub Fatiaue Analysis Errors
- Since 1989, some failures had been experienced on the hubs of fans used throughout the plant in safety related and nonsafety-related applications. Condition Report CR-RBS-1995-0887 addressed the failure in 1995 of a 2985 style fan hub in the safety-related high pressure core spray room Cooler HVR-UC5 and identified
!
__
. . _ _ _ _ _ _ _ _ _ _ _ _ .
~._ _ _ _ _ _ _ . _ _ _ _ _ _ . _ _ _ _
.
l l'
!.
the qualified life of this style hub as one operating cycle, which ended for this fan at Refueling Outage RF-7, Condition Report CR-RBS-1997-1261,. which was generated on August 21,1997, identified that the qualified life for this hub had expired, evaluated the operability of that condition, and extended the qualified life to the end of j 1997. As of January 9,1998, the hub still had not been replaced and Condition l Report CR-RBS-1998-0023 was generated to document that condition, and the hub was replaced.
The team reviewed these documents and a metallurgical evaluation that was part of Condition Report CR-RBS-1997-1231. This evaluation was, in effect, a fatigue analysis of the fan hub, and it was used as or e of the inputs for evaluating the hub's qualified life.
The team discovered that this analysis contained nonvalid assumptions that rendered its l
results essentially invalid because of the following:
i i a item 4 in the analysis stated that the alternating stresses in the hub were due to a i speed fluctuation of
- 5 percent, but no mechanism was stated for how the speed could fluctuate this amount. When this was discussed with the analysis author, he stated that the fan manufacturer's load-versus-speed curve showed a speed
,
reduction of 5 percent or 180 rpm at 100 percent load from 3600 rpm at 0 percent l load. However, this assumption was not valid as the source of the cyclical load since the fan operated at essentially constant load and hence constant speed.
.
The frequency of the alternating stress was assumed to be once per revolution, but no basis could be provided for this assumption. This, together with the first assumption, would mean that the speed of the machine would have to fluctuate I
'
5 percent with each revolution. Both assumptions had no valid basis.
i By chance, the analysis-predicted life for the hub fell in the range of actual failure data, although the few data points and wide scatter made accurate failure prediction infeasible.
Proximity of the analytically predicted life to some of tha failure data increased the author's confidence that the analysis was valid. However, this confidence failed to take
,
into account that a virtually infinite number of hypothetical combinations of cyclical l loading and frequency, such as the ones used, could produce similar results without
! representing accurate behavior of the hub's loading.
Although no violation or negative outcome resulted from the errors in this analysis, it represented a lack of attention to detail and rigor in engineering practice.
c. Conclusions
While all engineering personnel contacted displayed positive attitudes and solid I commitment to nuclear safety and high standards of engineering, the team concluded that the questioning attitude, rigor and attention to detail exhibited by some of the
!
l f
.
-
. r 1 -, .-....r., _.
_ . , , ,.
- -
__ _ _ _ . . _.
__ _ _ . _ _ . . _ _ _ _ . _ . . _ . _ . . _ .
_ . _ _ _ _ . _ _ . _ . _ . . _ .
! .
- l l
l -27-l l
l engineering work reviewed were less than desirable. While the above findings
! demonstrated that engineering was not consistent regarding problem identification, or timely resolution, or providing complete, thorough, and technically appropriate resolutions, the team concluded that engineering, in general, was appropriately identifying problems and implementing timely corrective actions.
l An apparent violation of Criterion ill of Appendix B to 10 CFR Part 50 regarding the I failure of design control measures to adequately verify or check that the safety-related diesel generator control air instrument and controls systems remained functional during a loss-of-offsite-power event was identified.
l l An apparent violation of Technical Specification 3.8.1b regarding diesel generator l inoperability was identified.
- An apparent violation of Criterion XVI of Appendix B to 10 CFR Part 50 regarding a
'
failure to document, report, and promptly correct a significant condition adverse to quality was identified.
An apparent violation of Criterion XI of Appendix B to 10 CFR Part 50 regarding a failure i of preoperational and operational testing to assure that the diesel generators would perform satisfactorily in service was identified.
A noncited violation in accordance with Section Vll.b.1 of the NRC Enforcement Policy was identified regarding a failure to identify and properly translate design requirements of the control building chilled water system and Pump 1D into the applicable surveillance
, test procedure.
!
V. Manaaement Meetinas
! v1 Exit Meeting Summary
!
The team discussed the progress of the inspection on a daily basis and presented the inspections results to members of licensee management at the conclusion of the onsite inspection on August 27,1998. Subsequently, inoffice inspection was continued until l October 14,1998, and a telephonic exit was held to discuss the enforcement findings from the inspection. The licensee's representatives acknowledged the findings presented.
The team asked the licensee's staff and management whether any materials examined I during the inspection should be considered proprietary. No proprietary information was
'
identified.
l l
.
._.
_ _ _ . _ _._ .
_ _ _ . . _ _ _ _ . _ _ _ _ _
.
.1 ATTACHMENT
l l
SUPPLEMENTAL INFORMATION
l
PARTIAL LIST OF PERSONS CONTACTED !
Licensee l
- J. Anderson, Quality Assurance Lead Auditor
- L. Ballard, Supervisor, Quality Assurance
,
- K. Bankston, Quality Assurance Lead Auditor
- M. Bellamy, Director, Site Support
- R. Brian, Manager, Design Engineering ,
- O. Bulich, Superintendent, Plant Engineering '
- P. Campbell, Technical Assistant :
- M. Davis, Supervisor, Radiation Protection l
- M. Dietrich, Technical Assistant to the Vice President
- D. Dormady, Manager, Plant Engineering
- R. Edington, Vice President
l
'
- C. Forpahl, Supervisor, Engineering Programs
- J. Fowler, Manager, Quality Assurance
- D. Gilley, Supervisor, System Engineering
l
- H. Goodman, Supervisor, Reactor Engineering
- T. Hoffman, Supervisor, Component Design
l.
- T. Hildebrandt, Manager, Maintenance i
- R. King, Director, Nuclear Safety and Regulatory Affairs J
- V. Kico, Acting Manager, Quality Assurance ,
I
- D. Lorfing, Supervisor, Nuclear Safety and Regulatory Affairs
1. Malik, Supervisor, In-House Events Analysis
- J. Mead, Supervisor, Plant Engineering
- D. Mims, General Manager, Plant Operations
- D. Myers, Senior Licensing Specialist
- W. O'Malley, Manager, Operations
l
- P. O'Neil, Technical Specialist, Nuclear Safety and Regulatory Affairs
L
- D. Pace, Director, Engineering
- P. Sicard, Manager, Safety and Engineering Analysis i
NRC
l
- N. Garrett, Resident inspector
.
INSPECTION PROCEDURE USED
IP 40500 Effectiveness of Licensee Controls in Identifying, Resolving, and Preventing
Problems
,
- - . - - - - .
.-. . - , .
_ _. . _ m ._._.. . _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ . _ _ _ _ _ . - _ _ _ . _
.
'
.
.
-2-
i ITEMS OPENED
l Ooened
i
l 50-458/9813-01 eel An apparent violation of Criterion lll of Appendix B to 10 CFR Part 50 regarding the failure of design control
l measures to adequately verify or check that the safety-
l related diesel generator control air instrument and controls
j systems remained functional during a loss-of offsite-power
event was identified.
50-458/9813-02 eel Apparent violation of Technical Specification 3.8.1b
l regarding diesel generator inoperability.
l 50-458/9813-03 eel Apparent violation of Criterion XVI of Appendix B to 10 CFR Part 50 regarding a failure to document, report, and
promptly correct a significant condition adverse to quality.
l
l 50-458/9813-04 eel Apparent violation of Criterion XI of Appendix B to Part 50 l
l regarding a failure of preoperational and operational testing j
to assure that the diesel generators would perform l
satisfactorily in service. l
,. l
!
50-458/9813-05 NCV Failure to translate correct design requirements into a
surveillance test procedure. l
50-458/9813-06 IFl Review of licensee's new response to NRC describing how
Recommendation ll of Generic Letter 89-13 would be
implemented.
I
- DOCUMENTS REVIEWED
i
! Calculations
G13.18.14.1 *025-0 Demonstrate That Containment Integrity Was Intact With
E22*RVF035 Leaking 2.9 GPM, June 18,1997
G13.18.9.5*047-1C Dose Consequences of a DBA LOCA Including Liquid Leakage
from E22 RVF035 and Crediting Present LLRT Results, June 16,
l
i 1997
G13.18.9.5*051-0A DBA-LOCA Dose Calculation with MS PLCS Operational, July 29,
,
1997
I
~
i
f
_._ _
_.
.
,
.
-3-
l
Temocrary Alterations I
96-003 Reconfigure Delta T Interlock Bypass Switch Annunciator
96-012 injection Valve, Low Pressure Test Permissive Annunciators 1
96-020 Installation of DRS Motor in HVC-ACU2B l
96-025 Removal of SLCS Heat Trace Capability and Annunciator Function l
97-005 Remove WCS-RV139 and Install Blind l
008 Standby Cooling Tower Temporary Cleanup l
97-018 C11-FCVD012A/B Changes for Reactor Recirc. Seal Purge Flow
Licensee Event Reports
97-001-00 Manual Reactor Scram on Lowering Vessel Water Level Due to Cut Cable,
Revision 0, June 5,1997
97-002-01 Through-Wall Linear Indication in a Weld on a Reactor Recirculation Vent Valve,
Revision 1, October 27,1997
97-002-00 Through-Wall Linear Indication in a Weld on a Reactor Recirculation Vent Valve,
Revision 0, June 4,1997
97-003-00 Relay Failure Resulting in a High Pressure Core Spray Pump Breaker Trip During
Testing, Revision 0, August 21,1997
97-004-00 Inadequate Surveillance of the Division til Battery Due to Calculation Error,
Revision 0, August 25,1997
97-005-00 Reactor Scram Due To a Failure of a Connector to the Electrical Trip Solenoid Valve,
Revision 0, September 22,1997
97-006-00 Unplanned Mode Change During Initial Test of New Alternate Decay Heat Removal
Function Due to inadequate Average Coolant Temperature Monitoring, Revision 0,
October 14,1997
l 97-007-00 Cracked Emergency Diesel Generator Valve Adjusting Screw Assembly Swivel Pads,
!
Revision 0, October 23,1997
008-00 Inadvertent Closure of Residual Heat Removal Shutdown Cooling Inboard Isolation
Valve Due to Less Than Adequate Administrative Controls, Revision 0, November 13,
1997
l
t
_. _ _ . _ _ . . _ _ _ . _ _ _ _ _ . _ . ~ . - _ _ _ . . _ _ . _ ___
l*
It ,
. l
l
l
-4-
97-009-00 Inadequate Pressure Test Performances Due to Pressurizing Through Check Valves,
Revision 0, November 17,1997
97-010-00 High Pressure Core Spray Minimum Flow Valve Discovered in Closed Position i
Apparently Due to Air in Transmitter Sensing Lines, Revision 0, December 11,1997 i
l
9C-001-00 Flow Rate Through the Standby Gas Treatment System Filter Assembly Units Found
to be Higher Than the Design Flow Rate, Revision 0, May 18,1998
l- 98-002-00 Failure of Two Trains of Annulus Mixing to Start Due to Independent Failures,
i
Revision 0, May 26,1998
Quality Assurance Audits
j. 97-01 1-CANC, Corrective Action, Effectiveness Audit
97-02-1-CANC, Corrective Action, Programmatic Audit
l
'
98-01-1-CANC, Corrective Action, Effectiveness Audit
I
Ooerability Determinations
! 98-0405
- 98-0585
98-0691
98-0706
l
Maintenance Action items
311115 312568 314139 314993 316074 i
311204 313567 314140 315028 316086
311433 313888 314320 315086 316432 ;
'
311581 313902 314697 315356 316673
311614 313967 314707 315947 316712
311662 313979 314872 316065 l
2355
i
NRC Information Notices
l- 97-51 Problems Experienced With Loading and Unloading Spent Nuclear Fuel Storage and
l Transportation Casks
97-64 Potential Problems Associated with Loss of Electrical Power in Certain Teletherapy Units
l 97 90 Use of Nonconservative Acceptance Criteria in Safety Related Pump Surveillance Tests
i
, ... - .
. . -
- ---
e l
,
t.
.
5- j
'
!
l 98 02 Nuclear Power Plant Cold Weather Problems and Protective Measures
l
98-04 1997 Enforcement Sanctions for Deliberate Violations of NRC Employee Protection
i Requirements
i
!
Procedures Reviewed
l-
ADM-0023 Conduct of Maintenance
l
ADM-0028 Corrective Maintenance, Revision 17
ADM-0031 Temporary Alterations, Revision 8A
AOP-0004 Loss of Offsite Power, Revision 15
CMP-9267 Heat Exchanger Repairs, Revision 4
EDP-AA-30 Evaluation of Repair and Use-As-Is Dispositions on Condition Reports,
Revision 6
ESP-8-008 Conduct of National Pollutant Discharge Elimination System Monitoring,
Revision 8A
OAl 2.1 Audit Process, Revision 16
OAl-2.3 Performance and Reporting QA Surveillance of Plant Activities,
Revision 11 '
OAP 1.9 initiation and Processing of Stop Work Activities, Revision 8
..
R PL-012 Corrective Action Program, Revision 01
RBNP-62 River Bend Industry Events and Analysis Program, Revision 5.
RBNP-004 Event Notification and Reporting, Revision 11
RBNP-022 Root Cause Analysis Program, Revision 4A
RBNP-030 Initiation and Processing of Condition Reports, Revision 12
RBNP-035 Hazardous Material Emergency Response Pian, Revision 10A
!
l RBNP-057 10 CFR 50.59 License Basis Reviews and Environmental Evaluations,
I
Revision 7 and Revision 6
! RBNP-078 - Operability Determinations, Revision 3
=v'- -
w ,9w +wyypvrv rw w w w w iY w ,
.. = . . - - . . - .. .- - -_ . - - _ . - - _ ~ . - -.-. - -- .-. . . -
- I
I
l l
6-
RHP-0017 Calculation of Internal Dose, Revision 7
! SOP-0053 Standby Diesel Generator and Auxiliaries (Sys # 309), Revision 17
STP 257-0602 Standby Gas Treatment System Train B Drawdown Test, Revision 3
l STP 257-3601 Inservice Testing of Standby Gas Treatment Filtration System, Revision 5
l
l STP-309-6304 Div I EDG Forward Bank Air Start System Quarterly Valve Operability
l Test, Revision 9
CFR 50.59 Review Program Guidelines, Revision 0
Quality Assurance Surveillances
2009
704005
707002
707006
708002
710021
Self Assessment Reports
Operations Department, Configuration Control Evaluation, First Quarter 1998
River Bend Station Operations Training Assessment; April 14,1997
River Bend Maintenance and M&TE Audit / Assessment; March 27,1997
River Bend Station Maintenance and Measuring and Test Equipment Programs Combined
Assessment / Audit; May 26,1998
River Bend Station Work Management Combined Assessment / Audit; June 3,1998
Other Documents Reviewed
219.711-056-065, Mechanism Sub-Assembly #2, Reactor & Outer Door, Revision H
EGA-194, Standby Diesel Generator Starting Air System Isometric
219.711 056-073, % Model "S' 3-Way 90*,150#-600# Socket Weld Ball Valve, Revision C
l Entergy Root Cause Analysis Desk Guide, Revision 1
Operating Experience Statement of Action, OE\lN\9790.SA1, January 8,1998
l
-e
e
7-
Operating Experience Statement of Action, OE\lN\9727.SA1, September 19,1997
River Bend Station Letter RBF1-97-0027, Response to Generic Letter 96-06, January 28,1997
River Bend Station Letter RBG-34,558 to USNRC, March 1,1991
Systematic Assessment of Licensee Performance Report, River Bend Station,50 458/97 99,
March 3,1997
Technical Specification 3.6.4.1.4, Standby Gas Treatment Drawdown Surveillance Testing
Requirements
Technical Specification 3.6, Containment Systems and Bases
! Technical Specification Surveillance Requirement 3.8.3.4, Diesel Generator
l
'
USAR 6.5, Fission Product Removal and Control Systems
USAR, Section 6.2.4.3.7, Conformance to NUREG 0737, item II.E.4.2 - Containment Isolation y
Dependability )
USAR, Section 7.3.1.1.2, Containment and Reactor Vessel isolation Control System (CRVICS)
USAR, Section 15.6.5.5.2, (LOCA] Fission Product Transport to the Environment
USAR, Section 8.3.1.1.4.1, Standby Diesel Generators
USAR, Section 9.5.6.2.1, Standby Diesel Generators
l.
USAR Table 6.2-40, Containment Isolation Provisions for Fluid Lines
i USAR Table 15.6 7, Loss-of-Coolant Accident (Design Basis Analysis) Radiological Effects
l
l
i
!- j
'
]
i-
.
i .
1