IR 05000483/1998025
| ML20199D935 | |
| Person / Time | |
|---|---|
| Site: | Callaway  |
| Issue date: | 01/12/1998 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III) |
| To: | |
| Shared Package | |
| ML20199D924 | List: |
| References | |
| 50-483-98-25, NUDOCS 9901200257 | |
| Download: ML20199D935 (20) | |
Text
.
-. ~ -.. - -
. -. _ -.
.. - ~.
~.- -..
-
-
-
O k
F ENCLOSURE 2
,
U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
l i
Docket No.:
50-483 License No.:
NPF-30 Report No.:
50-483/98-25 Licensee:
Union Electric Company
,
I Facility:
Callaway Plant i
Location:
Junction Highway CC and Highway O l
Fulton, Missouri Dates:
November f 5 through December 26,1998
'
Inspectors:
D. G. Passehl, Senior Resident inspector F. L. Brush, Resident inspector j
Approved By:
David N. Graves, Acting Chief, Project Branch 8 l
r ATTACHMENT:
Supplemental Information
!
l:
i
!
L l
l
'
i h
K G
. -.
-
-.
.
-
.
_ - _ _.
__
.
.
EXECUTIVE SUMMARY Callaway Plant NRC Inspection Report 50-483/98-25 Operations The inspectors concluded that an operator's failure to recognize reactor power trending
above 100 percent power to the overpower rod stop setpoint, as indicated by the nuclear instruments, was a violation of Technical Specification 6.8.1.a. The operator was attentive to core thermal power and reactor coolant system temperature but missed the nuclear instruments. Corrective actions included revising procedures to allow xenon to stabilize prior to attaining full power, performing more frequent heat balance calculations, and conducting training. This nonrepetitive, licensee-identified and corrected violation is being treated as a noncited violation, consistent with Section Vll.B.1 of the NRC Enforcement Policy (Section O4.1).
Control room communications, briefings, supervisory control, and self-checking were
.
very good during the plant shutdown to Mode 3 for replacement of the containment
Cooler A fan motor (Section 04.2).
In violation of 10 CFR 50.59, the licensee made a de facto change to the facility as
.
described in Finaf Safety Analysis Report Section 6.3. Emergency operating procedure steps for transfer to cold leg recirculation did not agree with steps in Final Safety Analysis Report Table 6.3-8. The licensee did not evaluate and document the acceptability of the change to ensure that an unreviewed safety question did not exist.
<
The licensee changed the affected emergency operating procedure to match Table 6.3-8 after performing simulator scenarios and other evaluations. Also, the licensee initiated a change notice to correct discrepancies in other parts of Final Safety Analysis Report Section 6.3 (Section 08.1).
Maintenance l
!
There were multiple examples of a violation of Technical Specification surveillance
=
requirements as a result of the failure to perform surveillances of the inhibit function of the emergency diesel generators and subsequent plant mode changes made while relying on those surveillances. The licensee failed to perform these surveillances as a result of inadequate procedures. The licensee revised or developed procedures and successfully performed tne testing. This nonrepetitive, licensee-identified and corrected violation is being treated as a noncited violation, consistent with Section Vll.B.1 of the NRC Enforcement Policy (Section M8.1).
There were multiple examples of a violation of Technical Specification surveillance
.
requirements as a result of the failure to perform surveillances of the emergency diesel generators under specified initial conditions and subsequent plant mode changes made while relying on those surveidances. The licensee failed to perform these surveillances as a result of inadequate procedures. The licensee revised procedures and successfully performed the testing. The failure to test the emergency diesel generators
.
_ _ _ _
-
. _ _.
2-in accordance with Technical Specification a.8.1.1.2.g constitutes an additional example of the violation discussed in Section M8.1 and is not being cited separately (Section M8.2).
There were multiple examples of a violation of Technical Specification surveillance
.
requirements as a result of the failure to verify overlap between the Series 7300 process instrumentation and the solid state protection system and subsequent plant mode changes made while relying on those surveillances. The licensee failed to verify overlap as a result of inadequate system design. The licensee revised procedures and successfully performed the testing. The failure to verify proper overlap constitutes an additional example of Noncited Violation 50-483/98008-04 and is not being cited separately (Section M8.2).
Enaineerino Although a formal safety evaluation to revise the Final Safety Analysis Report through
=
Change Notice 98-067 was thorough, engineers failed to identify that a proposed setpoint change for refueling water storage tank level required revision to an operations department alarm response procedure. Control room operators identified the problem and stopped the setpoint change prior to its implementation. The licensee initiated corrective action (Section E1.1).
Plant Support
'
Overall, radiological protection personnel support of the containment entry to replace the
containment Cooler A fan motor was good. The radiological protection briefing was
thorough. The radiological hazards at the job site were fully explained. Health physics technicians accompanied workers in containment and ensured that personnel were aware of the dose levels in the work area (Section R4.1).
l Overall, the condition of security facilities and equipment was very good. The protected
.
area fence and vehicle barrier equipment was intact. All safeguards material was properly controlled. Security officers posted at various locations were alert. All security posts were properly staffed (Section S2.1).
_ _ _ _. _ _ _ _ _. _ _. - _ _ _ _. _. ~. -. _ _ _ _
__
_ _ _ _.. _ _ _ _ _ _ _ _ _ - _
_
>
.
.
Report Details Summarv of Plant Status The plant began the report period on November 16,1998, at 100 percent power. On November 29,1998, the licensee commenced a plant shutdown to Mode 3 to replace the fan motor for containment Cooler A. By December 3,1998, the licensee completed the replacement and returned the plant to 100 percent power.
j On December 5,1998, the licensee commenced a power reduction to 70 percent reactor power to repair a small crack on a socket weld on main feedwater Pump B suction vent Valve AEV0253. By December 6,1998, the licensee completed the weld repair and returned the plant to 100 percent power.
1. Operations
Conduct of Operations 01.1 General Comments (71707)
The inspectors conducted frequent reviews of ongoing plant operations. In general, the
!
conduct of operations was professional and safety-conscious. Plant status, operating i
problems, and work plans were appropriately addressed during daily turnover and plan-of-the-day meetings. Testing and maintenance activities requiring control room coordination were properly controlled. The inspectors observed several shift turnovers
without noting any problems.
l
Operational Status of Facilities and Equipment O2.1 Containment Cooler A Fan Motor Failure a.
Inspection Scope (71707)
The inspectors reviewed the licensee's activities associated with the failure of the fan motor on containment Cooler A. The inspectors' observations of the reactor shutdown to Mode 3 are discussed in Section 04.2.
b.
Observations and Findinos On November 27,1998, the breaker for containment Cooler A tripped, placing the plant in Technical Specification Action Statement 3.6.2.3.a, which required a plant shutdown if the cooler could not be returned to sen/ ice within 7 days. After troubleshooting, the
,
licensee determined that the fan motor on the cooler had failed.
i l
The licensee determined that replacement of the fan motor would require use of the
!
containment polar crane. The plant heavy loads analysis did not support use of the l
polar crane while operating in Modes 1 and 2. On November 29,1998, the licensee
,
1
__
_
,
..
_
_.__ _.. _ _
__m
. _.-.__ _ _ -.
___
..
_ _ _ _
_ _ _ _.
_
!
i 2-i commenced a plant shutdown to Mode 3 to replace the fan motor. By December 3, 1998, the licensee completed the replacement and returned the plant to 100 percent power.
,
O2.2 Review of Eauipment Taaouts (71707)
j The inspectors walked down portions of the following tagouts:
l Workman's Protection Assurance 29150 - Emergency Diesel Generator A, and
.
Workman's Protection Assurance 29125 - Essential Service Water Train A.
.
The inspectors did not identify any discrepancies. The tagouts were properly prepared and authorized. All tags were on the correct devices and the devices were in the position prescribed by the tags.
O2.3 Enaineered Safety Feature System Walkdowns (71707)
The inspectors walked down accessible portions of the following engineered safety l
features and vital systems:
Emergency Diesel Generator A, and
Essential Service Water Train A.
.
Equipment operability, material condition, and housekeeping were acceptable.
l
!
Operator Knowledge and Performance i
04.1 Overoower Rod Stoo a.
Inspection Scoce (71707)
On December 3,1998, after the licensee returned the plant to full power, following the replacement of the fan motor for containment Cooler A, an overpower rod stop annunciator was received for approximately 3 minutes. The annunciator setpoint was set at 103 percent power on one of four nuclear instrument channels.
The inspectors reviewed the event and the licensee's followup actions. The inspectors'
review included:
Procedure ODP-ZZ-00001, " Operations Department - Code of Conduct,"
.
,
l Revision 7; Procedure OSP-SE-00004, "NIS Power Range Heat Balance," Revision 15;
-
Procedure OTA-RL-RK065, Window if D, " Temperature Referencerremperature
-
-
}
Auctioneered High," Revision 3;
,
<
t
.
-. - - -. -. ~ -
... _.... _. -. -
. - -. - -.
. _ _ -
.. -. - -. -. -
I-3-
'
Procedure OTA-RL-RK082, Window 6:!A, " Power Range Over Power Rod Stop,"
.
Revision 3; Procedure OTG-ZZ-00004, " Power Operation," Revision 29;
.
Procedure OTN-BG-00002, " Reactor Makeup Control and Boron Thermal
.
Regeneration System," Revision 13; and
)
Suggestion-Occurrence-Solution Report 98-3909.
.
b.
-Observations and Findinas l
Operators received the overpower rod stop annunciator at 3:54 p.m. The plant had reached full power approximately 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> earlier. The afternoon shift had relieved the
'
watch at 2:49 p.m. There were no other evolutions in progress. Two reactor operators were working as a team to focus on reactor coolant system temperature control and thermal power.
To compensate for buildup of xenon, operators had been adding dilution water to the reactor coolant system to maintain actual system temperature close to reference temperature. From turnover, operators knew that the day shift crew added 5100 gallons
!
of dilution water by batch additions. Immediately upon taking the watch, the afternoon
!
crew performed two 100 gallon batch additions.
l'
l Because actual reactor coolant system temperature was oscillating a small amount
'
around the reference temperature, and causing related nuisance alarms, the reactor
)
l operators discussed starting a continuous dilution with the intent of decreasing the l
magnitude of the oscillations.
Based on the large dilution performed by the day shift crew, the operators on the afternoon crew determined that they would need to dilute a similar amount on the j
afternoon shift. The operators determined that,if the dilution flow averaged about
)
600 gallons per hour, it would approximate the amount added during the day shift. At
'
l approximately 2:55 p.m., the operators set the dilution flow at a constant 8 gallons per minute. Approximately 45 minutes later, operators stopped the dilution, observing that reactor coolant system temperature began an increasing trend.
Approximately 14 minutes after stopping dilution, the overpower rod stop annunciator was received. Upon receipt of the alarm, the reactor operator immediately inserted control Bank D rods six steps and added 20 gallons of boric acid to match reactor coolant system average temperature to reference temperature. Operators performed a heat balance calculation per Procedure OSP-SE-00004 to check the accuracy of the
<
nuclear instruments. The results revealed that power as indicated by the nuclear j!
instruments was as much as 1.5 percent higher than actual core power.
l The highest reactor coolant system average temperature achieved during the transient j
was approximately 590'F. The Technical Specification limit was 592.6*F. The nominal i
{
.
i
!
_
_-
_
-,.
_ _..
.
-. -.
.. -. _ - -. - - - -
- - -...- -. - - - -
-. -
-4-(reference) value was 588.4*F. The maximum thermal power reached during the transient was 3556.4 MW, which was below the licensed maximum thermal power limit of 3565 MW.
The inspectors reviewed heat balance data to verify compliance with Procedure OTG-ZZ-00004 requirements. The inspectors determined that the licensee performed heat balance calculations at the reactor power levels prescribed by Procedure OTG-ZZ-00004. The heat balance calculation performed prior to receipt of the overpower rod stop annunciator was performed several hours earlier at 5:33 a.m.
Those results revealed that power, as indicated by the nuclear instruments, was less than 1.0 percent higher than actual core power. Actual power was approximately 98 percent. The operators adjusted the nuclear instruments to reflect actual power.
The next heat balance calculation was due to be performed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> later.
l The licensee determined that the change in nuclear instrument readings from less than
!
1.0 percent higher than actual power to 1.5 percent higher than actual power was due to changes in xenon distribution and an increase in reactor coolant system average l
temperature.
The licensee conducted a detailed root cause investigation and determined the primary cause of this event to be operator error. Although the reactor operator had been properly focused on reactor coolant system temperature and thermal power as indicated on the plant computer, he did not notice that the safety-related nuclear inst.umentation indication had gone above 100 percent power.
The licensee instituted the immediate corrective actions described below.
l The licensee issued a night order limiting thermal power to 3540 MW until
.
l equilibrium xenon was reached. Increasing to full power was not to be performed unless approved by the emergency duty officer through the plant
'
manager.
The licensee required that heat balance calculations be completed each shift
.
(8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />) until equilibrium xenon was reached.
!
l The licensee initiated longer-term corrective actions that included the actions described below.
Revise Procedure OTG-ZZ-00004 to include xenon prediction and dilution
.
calculations.
Evaluate power escalation ramp rates, taking into account the predicted xenon
.
,
i distribution.
.l Evaluate dilution methods to establish a preferred method for load ramps.
.
j Train personnel on how temperature affects nuclear instruments.
.
i
,
. _ _
.
_ _. _ __.- _._ _.. _.__ _ _ ___._._ _ _ _ _ _ _ _._ _ _ _
l l
'
-5-l.
!
Incorporate the immediate corrective actions described above into plant
.
procedures.
Technical Specification 6.8.1.a requires, in part, that written procedures shall be implemented covering the applicable procedures recommended in Appendix A of Regulatory Guide 1.33, Revision 2, February 1978. Regulatory Guide 1.33, Revision 2, Appendix A, Section 1.b, includes, in part, administrative procedures for authorities and
!
responsibilities for safe operation. Administrative Procedure ODP-ZZ-00001, Step 3.5.11, states, in part, that the unit reactor operator's responsibilities include maintaining sensory perception of safety system monitoring instrumentation. The inspectors determined that the failure to recognize nuclear instrumentation increasing to l
the overpower rod stop setpoint was a violation. This nonrepetitive, licensee-identified and corrected violation is being treated as a noncited violation, consistent with Section Vll.B.1 of the NRC Enforcement Policy (50-483/98025-01).
!
l c.
Conclusions l
The inspectors concluded that an operator's failure to recognize reactor power trending above 100 percent power to the overpower rod stop setpoint, as indicated by the nuclear i
instruments, was a violation of Technical Specification 6.8.1.a. The operator was attentive to core thermal power and reactor coolant system temperature indications, but did not monitor the nuclear instruments. Corrective actions included revising procedures to allow xenon to stabilize prior to attaining full power, performing more frequent heat balance calculations, and conducting training. This nonrepetitive, licensee-identified and I
corrected violation is being treated as a noncited violation, consistent with
'
Section Vll.B.1 of the NRC Enforcement Policy.
O4.2 Observation of Peactor Shutdown to Mode 3 a.'
inspection Scope (71707)
The inspectors observed portions of the plant shutdown to Mode 3 for replacement of the containment Cooler A fan motor, b.
Observations and Findinos The inspectors observed very good communications within the control room and between control room and field personnel. With very few exceptions, licensee personnelimplemented three-way communications. Pre-evolution briefings were very thorough. Control room personnel exhibited very good supervisory control and used good self checking techniques when manipulating plant equipment.
c.
Conclusions The inspectors concluded that control room communications, briefings, supervisory control, and self-checking were very good during the plant shutdown to Mode 3 for replacement of the containment Cooler A fan motor.
-
i i
!
!
-6-
)
Miscellaneous Operations issues (92901)
l 08.1 LClosed) Unresolved item 50-483/98008-01: emergency operating procedure response time discrepancy for transferring from emergency core cooling system injection to cold leg recirculation, The inspectors' review included:
Annunciator Response Procedure OTA-RL-RK047, " Windows 47A through 47F,"
.
Revision 5; Calculations BN-16, Revision 0 and M-BN 20, Revision 1 Addendum 2;
.
Emergency Operating Procedure E-1," Loss of Reactor or Secondary Coolant,"
.
Revision 182; Emergency Operating Procedure ES-1.3, " Transfer to Cold Leg Recirculation,"
'
.
Revisions 0 through 1 A2; Final Safety Analysis Report Change Notice 98-067;
.
Final Safety Analysis Report Table 6.2.2-4, " Spray injection Phase Duration;"
)
a Final Safety Analysis Report Table 6.3-8, " Sequence of Changeover Operation
.
from injection to Recirculation;"
Final Safety Analysis Report Table 6.3-11, " Refueling Water Storage Tank
.
l Outflow (Large Break) - No Failures;"
l Final Safety Analysis Report Table 6.3-12, " Refueling Water Storage Tank
.
Outflow (Large Break) - Worst Single Failure;" and l
Suggestion-Occurrence-Solution Report 98-1577.
.
Final Safety Analysis Report Table 6.3-12 described the time required to realign the emergency core cooling systems from the refueling water storage tank to the containment sumps following a large break loss-of-coolant-accident. The realignment l
involved the automatic switchover of the suction path for the residual heat removal pumps to the containment sump upon receipt of the refueling water storage tank low-low-1 level alarm (36 percent). Remote operator actions were required to complete the alignment. Final Safety Analysis Report Table 6.3-8 described these operator actions.
The inspectors noted a discrepancy between the required operator actions identified in
'
Table 6.3-8 and Emergency Operating Procedure ES-1.3, Revision 1 A1.
Procedure ES-1,3 required the realignment to be performed upon receipt of the
,
a
___
- _ - ____ _ - _ _____
_____
7-refueling water storage tank low-low-1 level alarm. However, Table 6.3-8 stated that operator actions would be performed before receipt of the refueling water storage tank low-low-1 level alarm.
The licensee agreed with the inspectors conclusions and initiated Suggestion-Occurrence-Solution Report 98-1577. The licensee also stated that there was no provision in the generic emergency response 9ddelines, supplied by the reactor vendor, to realign component cooling water prior to receipt of the refueling water storage tank low-low-1 level alarm. The inspectors verified that the licensee's emergency operating procedures appropriately reflected the guidance in the generic guidelines.
The licensee performed several loss-of-coolant accident scenarios on the plant simulator to validate Final Safety Analysis Report Table 6.3-12. Operators were able to complete the changeover from injection to recirculation, including realigning component cooling water, prior to the refueling water storage tank empty alarm (5.6 percent). The empty alarm was the point at which net positive suction head to the emergency core cooling system pumps and containment spray pumps was marginal.
Procedure OTA-RL-RK047, Window 47A, " Refueling Water Storage Tank Empty Alarm," Revision 5, directs operators to stop any of these pumps taking a suction on the refueling water storage tank. The lowest level reached in the refueling water storage tank was 18 percent at the completion of the changeover to recirculation.
Operators also demonstrated, on the simulator, that Procedure ES-1.3 could be successfully performed, starting with level in the refueling water storage tank at 36 percent. Operators performed the entire procedure before reaching the refueling water storage tank low-low-2 level alarm (11.1 percent).
On May 5,1998, the licensee changed Emergency Operating Procedure E-1 to match the sequence of steps in Final Safety Analysis Report Table 6.3-8. Procedure E-1, Step 14, " Check if Transfer to Cold Leg Recirculation is Required," now states that if refueling water storage tank level was above the low-low-1 level alarm, then operators would realign component cooling water to the residual heat removal heat exchangers and stop cooling water to the spent fuel pool heat exchangers. Procedure ES-1.3 remained unchanged.
.
The inspectors reviewed prior revisions to Procedure ES-1.3 to determine if changes were made that increased the time required for operators to complete the emergency core cooling system switchover as described in Final Safety Analysis Report Section 6.3. One change (Temporary Change Notice 92-1011) was to verify that the residual heat removal pump room coolers are running. This was a plant-specific
Individual Plant Examination concern (Section 6 Table 6-1). Another change was to l
monitor spent fuel pool temperature and restore cooling within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (Temporary Change Notice 91-00184).
Other notes were added for radiation criteria for adverse containment and monitoring of emergency action levels (Revision 1 AO). The licensee performed a safety evaluation screening for each of the changes and determined that none were unreviewed safety r
. -. _.
_
._
--
-
. _
questions. The inspectors agreed with the licensee's determination. The inspectors also determined that none of the additions added appreciable time to the changeover.
During development of Suggestion-Occurrence-Solution Report 98-1577, the licensee identified that no documentation existed to support the containment spray injection phase duration times included in Final Safety Analysis Report Table 6.2.2-4. The licensee performed Calculations BN-16 and M-BN-20, Revision 1, Addendum 2, to support or revise the numerical values in Final Safety Analysis Report Section 6.3. The licensee initiated Final Safety Analysis Repert Change Notice 98-067 to incorporate the changes. In addition, the licensee was contbluing the effort to validate statements in the Final Safety Analysis Report against actud plant configuration, design documents, and procedures through the Final Safety Analysis Report Review Project.
The inspectors considered the discrepancy between Final Safety Analysis Report Table 6.3-8 and Emergency Operating Procedure ES-1.3 to be a de facto change to the facility as described in the Final Safety Analysis Report. As such, the licensee was required by 10 CFR 50.59 to evaluate and document the acceptability of the change to l
ensure that an unreviewed safety question did not exist. The inspectors considered the
acceptance of this de facto change a violation of 10 CFR 50.59 (50-483/98025-02; EA l
98-544).
l The licensee changed the affected emergency operating procedure to match Table 6.3-8 af ter performing simulator scenarios and other evaluations. Also, the l
licensee initiated a change notice to correct discrepancies in other parts of Final Safety l
Analysis Report Section 6.3.
11_ Maintenance M1 Conduct of Maintenance M1.1 General Comments - Maintenance a.
Inspection Scope (62707)
The inspectors observed or reviewed portions of the following work activities:
Work Authorization W188516 - Repack Reactor Water Makeup to Auxiliary
=
Building Supply Header isolation Valve BLV0032; l
i Work Authorization W201525 - Replace Containment Cooler A Fan Motor;
'
.
Work Authorization P606488 - Inspect and Clean Emergency Diesel Generator A
.
Intercooler Heat Exchanger; Work Authorization W187360 - Repair Oil Leaks at Cam Covers on Emergency
.
,
Diesel Generator A:
_ _. -. - _.... - -.
. -. _..
.
-.. -
_-...-.
_.
.- -..._ _. - --
-9-Work Authorization P613826 - Perform Brush inspection and Tension Check on
.
Emergency Diesel Generator A; l
Work Authorization P606471 - Inspect and Clean Emergency Diesel Generator A l
.
Jacket Water Heat Exchanger; and Work Authorization P606477 -Inspect and Clean Emergency Diesel Generator A
.
.
l Lube Oil Heat Exchanger, j
b.
Observations and Findinas l
The inspectors identified no substantive concerns. All work observed was performed
!
with the work packages present and in active use. The inspectors frequently observed
supervisors and system engineers monitoring job progress, and quality control personnel were present when required.
i M1.2 General Comments - Surveillance a.
Insoection Scope (61726)
The inspectors observed or reviewed all or portions of the following test activities:
Test Procedure OSP-GT-00002, " Mini-Purge Cumulative Time,"
Revision 3, and Test Procedure OSP-NB-00001," Class 1E Electrical Source Verification,"
.
Revision 8.
b.
Observations and Findinos The surveillance testing was conducted satisfactorily in accordance with the licensee's approved programs and the Technical Specifications.
M2 Maintenance and Material Condition of Facilities and Equipment M2.1 Review of Material Condition Durina Plant Tours a.
inspection Scope (62707)
!
l With the plant in Mode 3, the inspectors performed a containment tour to evaluate plant
[
material condition.
.
!
,_
-..
-.
-
. - _ _ _ _
.. -.
- _
.. - - - - -. - -
- _ -. -. - -. - _. _. -.-.- -
.
.
-10-J b.
Observations and Findinas-t Overall, the material condition of the containment was very good. The inspectors
,
observed a small amount of debris, which the licensee personnel promptly removed.
The inspectors observed minor boric acid leakage which the licensee had previously
identified and scheduled for cleaning.
>
M8 Miscellaneous Maintenance issues (92902)
q M8.1 (Closed) Licensee Event Report 50-483/97-005-02: failure to test the ability of the load shed and emergency load sequencer circuits to inhibit the nonsequencer automatic start signals of the component cooling water, essential service water, and motor-driven auxiliary feedwater pumps.
On September 4,1997, the licensee discovered that contacts in the load shed and emergency load sequencer circuit that inhibit the autostart signals of certain pumps were not being tested as required by Technical Specification 4.8.1.1.2.g.2. The affected pumps were the component cooling water, the essential service water, and the motor-driven auxiliary feedwater pumps. The licensee identified this issue during reviews mandated by Generic Letter 96-01, " Testing of Safety-Related Logic Circuits."
The contacts and associated relays that inhibit the autostart of the affected pumps were part of the loading logic for the emergency diesel generatore, The inhibit function develops in the load shed and emergency load sequencer logic to prevent out-of-sequence loading of the pumps onto the emergency diesel generators.
The licensee considered the failure to test the inhibit function as a failure to perform certain Technical Specification surveillances. The licensee determined that the surveillances in question were:
Technical Specification 4.8.1.1.2.g.(2).(c).(2) verifies that a loss-of-offsite power
=
signal energizes the auto-connected shutdown loads through the shutdown sequencer; i
'
Technical Specification 4.8.1.1.2.g.(3).(d) - verifies on a safety injection signal
=
without loss of offsite power that each emergency diesel generator autostarts and the offsite power source energizes the autoconnected (accident) loads through the loss-of-coolant-accident sequencer; and Technical Specification 4.8.4.1.2.g.(4).(d) - verifies on a safety injection signal
-
that each emergency diesel generator autostarts and energizes the emergency busses with permanently conr.ected loads within 12 seconds and energizes the autoconnected emergency (accident) loads through the loss-of-coolant-accident sequencer.
__ _
. _ _ _
.. -,
- _. _
.
-..
-
.
_ - - _ _. _ - -. - _. - _ - - -.. - - -. -.
-1 1 -
-
The shutdown sequencer activates following the detection of undervoltage on the 4160 Volt Class 1E busses. The loss-of-coolant-accident sequencer activates on a safety injection signal.
I
The licensee determined the cause of the failure to test the inhibit function to be
[
inadequate test procedures. The licensee revised the normal surveillance testing
procedures to ensure proper testing would be performed every 18 months during refueling outages.
Although Technical Specification 4.8.1.1.2.g stated that the testing be performed "At least once per 18 months, during shutdown," the licensee determined that testing of the sequencers could be performed at-power without any detrimental effects.
Subsequently, the licensee successfully performed the testing. The ramifications of performing this testing on-line versus shutdown was dispositioned in NRC Inspection Report 50-483/98-22.
The inspectors determined that the failure to perform the testing of the inhibit function resulted in the emergency diesel generators exceeding the allowed outage times.
Technical Specification 4.0.3 states, in part, that the failure to perform a surveillance requirement within the allowed surveillance interval shall constitute noncompliance with the operability requirements for a Limiting Condition for Operation.
Technical Specification 4.0.4 states, in part, that entry into an operational mode or other specified condition shall not be made unless the surveillance requirement (s) associated with the Limiting Condition for Operation have been performed within the stated surveillance interval.
,
Technical Specification Section 3.0.4 requires, in part, that entry into an operational mode shall not be rhade unless the conditions for the Limiting Conditions for Operation are met.
Technical Specification 3.8.1.1.b required that two separate and independent emergency diesel generators be operable in Modes 1,2,3, and 4.
The inspectors concluded that there were multiple examples of a violation of Technical Specification surveillance requirements as a result of the failure to perform surveillances l
of the inhibit function of the emergency diesel generators and subsequent plant mode i
changes made while relying on those surveillances. The licensee failed to perform
these surveillances as a result of inadequate procedures. The licensee revised or developed procedures and successfully performed the testing. This nonrepetitive, licensee-identified and corrected violation is being treated as a noncited violation, consistent with Section Vll.B.1 of the NRC Enforcement Policy (50-483/98025-03).
l
!
!
.
-
.-.._
. _ _ _ _. _
. _ _ _ _ _. _ _
__
_ _ _ _._ _. _ _ _ _ _
_
.
k
.
-12-
,
M8.2 (Closed) Licensee Event Report 50-483/97-005-03: missed Technical Specification surveillance due to inadequate test procedure and plant design.
,
This licensee event report documented two issues. One involved verbatim compliance with Technical Specification 4.8.1.1.2.g.8. The other involved verification of overlap
,
between Series 7300 process instrumentation and the solid state protection system.
The licensee identified these issues during reviews mandated by Gene ic Letter 96-01, l
" Testing of Safety-Related Logic Circuits."
~
Verbatim Technical Specification 4.8.1.1.2.a.8 Compliance On September 17,1997, the licensee determined that Technical Specification 4.8.1.1.2.g.8 was not being properly implemented. The Technical Specification stated, " Verifying that with the diesel generator operating in.a test mode, j
connected to its bus, a simulated safety injection signal overrides the test inode by:
(1) returning the diesel generator to standby operation, and (2) automatically energizing
,
'
the emergency loads with offsite power."
The licensee determined that the testing was actually initiated with the diesel generator i
shut down and disconnected from its bus, with the diesel generator output breaker closed in the test position. Although the testing was not performed with the initial j
conditions specified, the licensee determined that the existing procedures tested all applicable circuits and equipment by overlap. However, because the procedures did not direct performance of the test with the initial conditions specified, the licensee determined that verbatim compliance was not achieved.
T.% licensee determined the cause to be inadequate surveillance test procedures.
Orignally, the licensee tested both emergency diesel generator trains were tested with tM coract initial conditions by one procedure. On March 28,1985, the licensee split the orign,a! procedure into two procedures:
ISP-SA-2413A, " Diesel Generator and Sequencer Testing (Train A)," Revision 0;
and l
l ISP-SA-24138, " Diesel Generator and Sequencer Testing (Train B)," Revision 0.
.
These two procedures had numerous changes with the intent to optimize diesel generator testing. The licensee determined that the initial conditions were incorrectly changed with the new procedures. On March 25,1998, the licensee revised the procedures (Revision 10) to perform the test under the correct initial conditions. The inspectors identified no concerns.
Technical Specification 4.8.1.1.2.g stated that the testing be performed "At least once l
per 18 months, during shutdown." Although there were no past operability concerns, the
inspectors determined that the failure to perform surveillance tests with the correct initial conditions resulted in the emergency diesel generators exceeding the allowed outage
,
i times.
4 l
l
,
.
.
-
-
-
.-
-
.
-
-.
-13-l Technical Specification 4.0.3 states, in part, that the failure to perform a surveillance requirement within the allowed surveillance interval shall constitute noncompliance with 1'
the operability requirements for a Limiting Condition for Operation.
i
.
Technical Specification 4.0.4 states, in part, that entry into an operational mode or other
!
specified condition shall not be made unless the surveillance requirement (s) associated with the Limiting Condition for Operation have been performed within the stated surveillance interval.
l Technical Specification Section 3.0.4 requires, in part, that entry into an operational l
mode shall not be made unless the conditions for the Limiting Conditions for Operation
,
are met.
l l
Technical Specification 3.8.1.1.b required that two separate and independent i
emergency diesel generators be operable in Modes 1,2,3, and 4.
l l
The inspectors concluded that there were multiple examples of a violation of Technical Specification surveillance requirements as a result of the failure to perform surveillances of the emergency diesel generators under the specified initial conditions and subsequent plant mode changes made while relying on those surveillances. The
!
- licensee failed to perform these surveillances as a result of inadequate procedures. The licensee revised procedures and successfully performed the testing. The failure to test
-
the emergency diesel generators in accordance with Technical Specification 4.8.1.1.2.g
constitutes an additional examp;e of Violation 50-483/98025-03 and is not being cited
!-
separately.
'
Verification of Overlap Between Series 7300 Process Instrumentation and the Solid
!
State Protection System i
On September 22,1997, the licensee determined that surveillance procedures were i
performed without observing bistable lights change state as required. This omission applied to analog channel operation tests of the engineered safety features actuation
!
system and reactor trip system. Failure to observe a change in state of the light meant that the licensee could not verify proper overlap between the Series 7300 process instrumentation and the solid state protection system. The licensee determined this to be a deviation from Technical Specifications 4.3.1.1 and 4.3.2.1.
i The licensee determined the cause to be inadequate system design. Plant design does not accommodate an observation of status light change for all plant conditions. The licensee revised applicable test procedures to ensure complete overlap testing. The inspectors identified no concerns.
The licensee reported a similar instance of f ailure to verify proper overlap by observing a
,
!
status light change in Licensee Event Report 97005-00 (see NRC Inspection
!
Report 50-483/98-08). As with Licensee Event Report 97005-00, the licensee identified this current event as a result of Generic Letter 90-01 reviews.
l
i i
,
_
, _ _.
-
- - -
,_ _.
-
._.
_.
_
__
_
.
-14-Technical Specification 4.0.3 states, in part, that the failure to perform a surveillance requirement within the allowed surveillance interval shall constitute noncompliance with the operability requirements for a Limiting Condition for Operation.
Technical Specification 4.0.4 states, in part, that entry into an operational mode or other specified condition shall not be made unless the surveillance requirement (s) associated with the Limiting Condition for Operation have been performed within the stated surveillance interval.
Technical Specification Section 3.0.4 requires, in part, that entry into an operational mode shall not be made unless the conditions for the Limiting Conditions for Operation are met.
Technical Specification 3.3.1 required that reactor trip instrumentation channels and interlocks of Table 3.3-1 be operable in the stated modes.
Technical Specification 3.3.2 required that engineered safety features actuation system instrumentation channels and interlocks shall be operable in the stated modes.
The inspectors concluded that there were multiple examples of a violation of Technical Specification surveillance requirements as a result of the failure to verify overlap between the Series 7300 process instrumentation and the solid state protection system and subsequent plant mode changes made while relying on those surveillances. The licensee failed to verify overlap as a result of inadequate system design. The licensee revised procedures and successfully performed the testing. The failure to verify proper overlap constitutes an additional example of Noncited Violation 50-483/98008-04 and is not being cited separately.
j Ill. Enaineerina A.
Conduct of Engineering E1.1 Review of Modification Packaaes a.
Inspection Scope (37551)
l The inspectors reviewed Request for Resolution 19025A, " Document Basis for Spray Duration Times in Final Safety Analysis Report," and associated formal safety evaluation.
b.
Observations and Findinas The licensee initiated the Request for Resolution because no documentation was found
,
to support the containment spray injection phase duration times discussed in Final
!
.
-
'
-15-I Safety Analysis Report Table 6.2.2-4, " Spray injection Phase Duration." The licensee
discovered this during development of Suggestion-Occurrence-Solution Report 98-1577 (see Section O8.1).
The licensee performed a formal safety evaluation to support changes to the Final Safety Analysis Report per Change Notice 98-067. The inspectors' review determined
,
'
that the formal safety evaluation was thorough. The licensee determined that there was not an unreviewed safety question.
l The inspectors reviewed the impact on plant procedures. As a result of the request for
'
resolution, the licensee identified the need to raise the refueling water storage tank low-low-2 level alarm setpoint 3 inches. On November 19,1998, instrument and control j
personnel went to the control room to implement the setpoint change.
Prior to the change, plant operators noticed that action to update the associated annunciator alarm procedure had not been taken. Shift supervision directed that the setpoint change be postponed. Engineering personnelidentified that an action item to update the procedure was not initiated when the Request for Resolution was being developed. The inspectors determined this to be a weakness. The licensee initiated Suggestion-Occurrence-Solution Report 98-3856.
c.
Conclusions The inspectors concluded that, although a formal safety evaluation to revise the Final Sa?ety Analysis Report through Change Notice 98-067 was thorough, engineers failed to identify that a proposed setpoint change for refueling water storage tank level required revision to an operations department alarm response procedure. Control room operators identified the problem and stopped the setpoint change prior to its implementation. The licensee initiated corrective action.
IV. Plant Support R1 Radiological Protection and Chemistry Controls l
'
R1.1 General Comments (71750)
The inspectors observed health physics personnel, including supervisors, routinely touring the radiologically controlled areas. Licensee personnel working in radiologically controlled areas exhibited good radiation worker practices.
Contaminated areas and high radiation areas were properly posted. Area surveys posted outside rooms in the auxiliary building were current. The inspectors checked a
!
sample of doors, required to be locked for the purpose of radiation protection, and found
no problems.
!
f
-
.
---
_
_
.
_
_
_
_.. _
_
... _ _ _.___ _.__._ _ ___. _. _ _. _.
_ _. _ _ _ _. _ _.. _. _.. _
l-16-R4.1 Reactor Buildina Entry at Mode 3 a.
Insoection Scope (71750)
The inspectors attended a radiological protection briefing and observed health physics i
technicians' coverage of a containment entry at Mode 3 to replace containment Cooler A fan motor.
b.
Observations and Findinqs Overall, radiological protection personnel support of containment entry to replace the containment Cooler A fan motor was good. The radiological protection briefing was thorough. The radiological hazards at the job site were fully explained. Health physics technicians accompanied workers in containment and ensured that personnel were aware of the dose levels in the work area.
S2 Status of Security Facilities and Equipment S2.1 Review of the Condition of Security Facilities and Eauioment a.
Inspection Scope (71750)
,
,
l The inspectors toured the protected area fence, main access facility, central alarm station, secondary alarm station, and other security facilities.
b.
Observations and Findinas Overall, the condition of security facilities and equipment was very good. The protected area fence and vehicle barrier equipment was intact. All safeguards material was properly controlled. Security officers posted at various locations were alert. All secunty posts were properly staffed.
V. Manacement Meeting X1 Exit Meeting Summary The exit meeting was conducted on December 22,1998. The lict.asee did not express a position on any of the findings in the report.
The inspectors asked the licensee whether any materials examined during the inspection should be considered proprietary. No proprietary inf armation was identified.
t
!
_ _ _
_
_
._
._
. _.
_.
_ _ _ _ _ _ _. _. _.
_. _ _..
__.
.
.
ATTACHMENT SUPPLEMENTAL lNFORMATION
,
PARTIAL LIST OF PERSONS CONTACTED i
Licensee
,
D. G. Cornwell, General Supervisor, Electrical Maintenance J. V. Laux, Manager Quality Assurance D. W. Neterer, Assistant Superintendent, Operations J. T. Patterson, Shift Supervisor, Operations J. R. Peevy, Manager, Emergency Preparedness / Organizational Support M. A. Reidmeyer, Engineer, Quality Assurance Regulatory Support
R. R. Roselius, Superintendent, Radiation Protection and Chemistry
,
'
M. E. Taylor, Assistant Manager, Work Control
!
W. A. Witt, Assistant Manager, Callaway Plant
,
!
INSPECTION PROCEDURES USED
'
37551 Onsite Engineering 61726 Surveillance Observations 62707 Maintenance Observations 71707 Plant Operations t
71750 Plant Support Activities
92700-Onsite Followup of Written Reports of Nonroutine Events at Power Reactor Facilities 92901 Followup - Plant Operations 92902 Followup - Maintenance ITEMS OPENED. CLOSED. AND DISCUSSED Ooened 98025-01 NCV Operator failure to observe nuclear instrumentation trending
<
to overpower rod stop setpoint (Section 04.1)
,
!
98025-02 VIO Emergency operating procedure steps for transfer to cold leg recirculation did not agree with Final Safety Analysis Report (Section 08.1)
t i
. _ _ _.. _
_ -. _ _ _ _ __ _ _.___._..
.. _. _ _ _ _. _ _ _ _ _ _.,.. = _ _ _ _ _ _ _
!
P
>
!
,
s 2-I l
'
l 98025-03 NCV Failure to perform emergency diesel generator surveillance L
tests (Sections M8.1 and M8.2)
!
Closed l
98025-01 NCV Operator failure to observe nuclear instrumentation trending l
to overpower rod stop setpoint (Section 04.1)
98025-02 VIO Emergency operating procedure steps for transfer to cold leg j
'
recirculation did not agree with Final Safety Analysis Report (Section 08.1)
98008-01 URI Emergency operating procedure steps for transfer to cold leg recirculation did not agree with Final Safety Analysis Report
'
(Section 08.1)
l 97005-02 LER Failure to test the ability of the load shed and emergency load sequencer circuits to inhibit the nonsequencer autostart
!
signals of the component cooling water, essential service j
water, and motor driven auxiliary feedwater pumps I
(Section M8.1)
98025-03 NCV Failure to perform emergency diesel generator surveillance tests (Sections M8.1 and M8.2)
97005-03 LER Missed Technical Specification surveillance due to inadequate test procedure and plant design (Section M8.2)
j~
t Discussed 98008-04 NCV Failure to properly test pressurizer pressure Permissive P-11
(Section M8.2)
l 97005-00 LER Inadequate surveillance of pressurizer pressure interlock j
(Section M8.2)
l l
,
I
,