ML14181A572
| ML14181A572 | |
| Person / Time | |
|---|---|
| Site: | Robinson  |
| Issue date: | 07/08/1994 |
| From: | Christensen H, Ogle C, William Orders NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| To: | |
| Shared Package | |
| ML14181A569 | List: |
| References | |
| 50-261-94-16, NUDOCS 9407290387 | |
| Download: ML14181A572 (22) | |
See also: IR 05000261/1994016
Text
pA REGu
UNITED STATES
o 0NUCLEAR
REGULATORY COMMISSION
REGION II
101 MARIETTA STREET, N.W., SUITE 2900
ATLANTA, GEORGIA 30323-0199
Report No.:
50-261/94-16
Licensee:
Carolina Power and Light Company
P. 0. Box 1551
Raleigh, NC 27602
Docket No.:
50-261
License No.: DPR-23
Facility Name: H. B. Robinson Unit 2
Inspection Conducted: May 22 - June 24, 1994
Lead Inspector: 9
4
- 7
O
.
rders Senior Resident Inspech r
4ate
Signed
Other Inspector:,--j2
.
. R. Ol, Resident Inspector
Date Signed
Approved by: j I 5C
?Il2
ff
H. D.Christensen, Chief
Date Signed
Reactor Projects Section 1A
Division of Reactor Projects
SUMMARY
Scope:
This routine, announced inspection was conducted in the areas of operational
safety verification, surveillance observation, maintenance observation, and
followup on previously identified items.
Results:
A violation was identified involving an inoperable CV water level indication,
paragraph 3.b; an Unresolved Item was identified involving an inoperable post
accident containment vent path, paragraph 3.c; an apparent violation was
identified involving inadequate corrective actions to the findings of a
contracted surveillance program review, paragraph 6.a; a second apparent
violation was identified involving inadequate testing of the control room
ventilation system, paragraph 6.b; and a third apparent violation was
identified involving inadequate corrective actions associated with an MSIV
design deficiency, paragraph 6.c.
9407290387 940711
ADOCK 05000261
0
REPORT DETAILS
1.
Persons Contacted
R. Barnett, Manager, Projects Management
S. Billings, Technical Aide, Regulatory Compliance
A. Carley, Manager, Site Communications
B. Clark, Manager, Maintenance
- T. Cleary, Manager, Mechanical Maintenance
- D. Crook, Senior Specialist, Regulatory Compliance
- W. Dorman, Manager, Corrective Action Program
J. Eaddy, Manager, Environmental and Radiation Support
- D. Gudger, Specialist Regulatory Affairs
S. Farmer, Manager, Engineering Programs, Technical Support
B. Harward, Manager, Engineering Site Support, Nuclear Engineering
Department
- M. Herrell, Acting Plant Manager
C. Hinnant, Vice President, Robinson Nuclear Project
- J. Kozyra, Project Specialists, Licensing/Regulatory Programs
- R. Krich, Manager, Regulatory Affairs
A. McCauley, Manager, Electrical Systems, Technical Support
- G. Miller, Manager, Robinson Engineering Support Section
- R. Moore, Acting Operations Manager
- P. Musser, Manager, Engineering/Nuclear Assessment Department
- D. Nelson, Acting Manager, Projects Management
M. Pearson, Plant General Manager
M. Scott, Manager, Reactor Systems, Technical Support
E. Shoemaker, Manager, Mechanical Systems, Technical Support
- R. Wehage, Robinson Engineering Support Section
D. Winters, Shift Supervisor, Operations
- L. Woods, Manager, Technical Support
Other licensee employees contacted included technicians, operators,
engineers, mechanics, security force members, and office personnel.
Acronyms and initialisms used throughout this report are listed in the
last paragraph.
2. Plant Status
The unit began the report period operating at 100 percent power, and
performed at power for the entire report period with no major
operational difficulties.
3. Operational Safety Verification (71707)
a.
General
The inspectors evaluated licensee activities to confirm that the
facility was being operated safely and in conformance with
regulatory requirements. These activities were confirmed by
direct observation, facility tours, interviews and discussions
with licensee personnel and management, verification of safety
system status, and review of facility records.
2
The inspectors reviewed shift logs, Operation's records, data
sheets, instrument traces, and records of equipment malfunctions
to verify equipment operability and compliance with TS. The
inspectors verified the staff was knowledgeable of plant
conditions, responded properly to alarms, adhered to procedures
and applicable administrative controls, cognizant of in-progress
surveillance and maintenance activities, and aware of inoperable
equipment status through work observations and discussions with
Operations staff members. The inspectors performed channel
verifications and reviewed component status and safety-related
parameters to verify conformance with TS.
Shift changes were
routinely observed, verifying that system status continuity was
maintained and that proper control room staffing existed. Access
to the control room was controlled and operations personnel
carried out their assigned duties in an effective manner. Control
room demeanor and communications were appropriate.
Plant tours were conducted to verify equipment operability, assess
the general condition of plant equipment, and to verify that
radiological controls, fire protection controls, physical
protection controls, and equipment tagging procedures were
properly implemented.
b.
Deenergized CV Water Level Instrument
At approximately 7:30 a.m. on May 26, 1994, during a review of CR
post-accident indicators, the inspectors observed that CV water
level as recorded on Channel 4 of stripchart recorder AR-100C, CV
Conditions Recorder, was indicating approximately -99 inches. The
inspectors questioned the shift supervisor on this reading since
the instrument typically indicates a small positive value for CV
water level.
Following a licensee investigation, the inspectors
were informed that this reading was in error, as a result of Level
Indicator, LI-802, Channel II CV Water Level being turned off.
The inspectors were also advised that LI-802 had been re-energized
and the stripchart indicator returned to normal.
The inspectors
independently verified CV water level indication returned to
normal on a subsequent CR tour.
The inspectors reviewed the ACR generated in response to this
event, written RO and SCO statements regarding the operation of
LI-802, and the stripchart printout for AR-100C. Based on this
review, the inspectors concluded that LI-802 became inadvertently
deenergized following the performance of instrument checks
coincident with shift turnover. As a result of this
deenergization, the number of CV Level (Wide Range) instruments
which were operable fell below the 2 minimum channels operable
required by TS Table 3.5.-5, Instrumentation To Follow The Course
Of An Accident. (This TS table does permit operation with one
channel of CV Level (Wide Range) inoperable for 30 days prior to
submitting a special report to the NRC.)
This condition existed
for approximately an hour until questioned by the inspectors.
The
3
inspectors concluded that this entry into the 30-day LCO permitted
by TS Table 3.5.-5 was unrecognized by the shift as a result of
their not knowing the status of LI-802.
Technical Specification 6.5.1.1 Procedures, Tests, and Experiments
requires in part that written procedures be established,
implemented, and maintained, covering the activities recommended
in Appendix A of Regulatory Guide 1.33, Revision 2, 1978,
including procedures for safe operation of the facility.
Operations Management Manual Procedure, OMM-038, Operations
Organizational Responsibilities is provided to define and
delineate the duties and responsibilities of Unit 2 Operations
personnel.
OMM-038 requires that the Shift Supervisor, Senior
Control Operator, and Control Operators be aware of the status of
plant equipment.
On May 26, 1994, control room operators failed to detect that
Level Instrument, LI-802, Channel II, Containment Vessel Water
Level, a Technical Specification required instrument was
deenergized for approximately an hour. This condition went
unrecognized until a related display of CV water level was
questioned by the inspectors. This is identified as a violation,
VIO: 94-16-01, Inoperable CV Water Level Indication.
c.
Inoperable Post Accident Containment Vent Path
On May 31, 1994, during a routine tour of the BIT room, the
inspectors observed that the inlet and outlet dampers for the B
PACV filter were shut with clearance tags attached. The
inspectors questioned the shift supervisor on the operability of
the system given that the dampers blocked flow through the B train
PACV flowpath. Specifically, the inspectors were concerned that
access to these dampers would be restricted following a LOCA due
to prohibitive radiation levels from adjacent piping in the BIT
room which would contain post-recirculation sump fluid.
Later that day, the clearance tags were removed, the dampers were
returned to the open position, and the PACV flowpath was returned
to service.
On June 8, 1994, the inspectors were advised that potential
radiation exposures would not have precluded restoring the system
when required following a LOCA. Based on times obtained to
restore the dampers during trial runs and calculated radiation
levels 30 days after a LOCA, the licensee stated that the train
could be returned to service with an exposure of about 150 mRem.
Investigation pertaining to the cause of this event continues at
the end of this report period.
4
This item will be tracked as an Unresolved Item pending the
conclusion of that investigation, URI: 94-16-02, Inoperable Post
Accident Containment Vent Path.
4.
Maintenance Observation (62703)
a.
General
The inspectors observed safety-related maintenance activities on
systems and components to ascertain that these activities were
conducted in accordance with TS, approved procedures, and
appropriate industry codes and standards. The inspectors
determined that these activities did not violate LCOs and that
required redundant components were operable. The inspectors
verified that required administrative, material, testing,
radiological, and fire prevention controls were adhered to. In
particular, the inspectors observed/reviewed the following
maintenance activities detailed below:
WR/JO 94-AIBC1
Replace EDG A.Control Side Exhaust Manifolds
WR/JO 94-AIBDI
Replace EDG A Opposite Control Side Exhaust
WR/JO 94-AGTR1
Remove Shipping Covers From A EDG
No violations or deviations were identified.
5.
Surveillance Observation (61726)
The inspectors observed certain safety-related surveillance activities
on systems and components to ascertain that these activities were
conducted in accordance with license requirements. For the surveillance
test procedures listed below, testing was accomplished by qualified
personnel in accordance with an approved test procedure, test
instrumentation was properly calibrated, and the tests conformed to TS
requirements. Upon test completion, the inspectors verified the
recorded test data was complete, accurate, test discrepancies were
properly documented and rectified, and the systems were properly
returned to service. Specifically, the inspectors witnessed/reviewed
portions of the following test activities:
OST-409
Emergency Diesels (Rapid Speed Start) (B EDG
Only)
No violations or deviations were identified.
5
6.
Licensee Action on Previous Findings (92701, 90702)
a.
Enercon Study
Introduction
URI 94-04-02 documents inspectors' concerns associated with 18
potential surveillance test deficiencies identified by Enercon
Services, Inc., in a TS surveillance program review completed
June 30, 1992. The inspectors' concerns centered on two issues.
First, the failure of the licensee to take corrective action
immediately after the deficiencies were identified, and second,
the possibility that TS required surveillance were not performed
properly as a result of inadequate surveillance procedures. The
following discussion will review the historical background
associated with the Enercon Study, provide an overview of the 18
issues identified by Enercon, and briefly review the disposition
of these items by the licensee.
Background
LER 90-005, identified a failure to test RPS logic in accordance
with TS requirements. Based on similar previous occurrences
dating back to 1984, this deficiency was captured by VIO 90-11-01
as Failure To Take Adequate Corrective Action To Preclude
Repetition Of Inadequate Procedures Involving TS Required Tests.
In their September 21, 1990, supplemental response to the
violation, the licensee outlined their three-phase program to
prevent recurrences of additional inadequate surveillance testing
or TS non-compliance. Phase 3 of this program included an in
depth procedural verification of TS Table 4.1-1, Minimum
Frequencies For Checks, Calibrations, And Tests Of Instruments.
Enercon Services, Inc. was the contractor assigned to perform this
review. The project procedure for Enercon's review required that
significant inadequacies in surveillance test procedures be
documented on STP Review Deficiency Forms.
(Alternate procedures
were implemented for inadequacies characterized as immediate
safety concerns and for deficiencies of an administrative nature.)
Eighteen such STP review deficiency forms were provided in the
June 30, 1992, project final report.
In late December 1993 or early January 1994, the inspectors became
aware of and reviewed the Enercon report while researching an
unrelated deficiency in-containment spray system actuation
testing. On January 6, 1994, the inspectors questioned plant
management on the implication of the following statement contained
in the conclusions section of the final Enercon report:
"An important finding that came out of the Table 4.1-1
review was that many deficiencies that had been previously
attributed to Table 4.1-1, and in particular, Item 27, Logic
Channel Testing, were more appropriately associated with
6
other TS, such as Table 4.8-1 or SR 4.6.1.2 and other system
surveillance, because of the structure of the RNP TS. The
test circuitry that was found to be most often not
adequately tested, deals with ESFAS actuation circuitry.
Therefore, while there is high confidence that deficiencies
associated with required testing for Table 4.1-1 have been
identified and can be corrected, the overall acceptability
of the surveillance testing program is unknown until these
other TS surveillance, which have known problems, have had a
comprehensive review. Without an evaluation of the
procedures associated with these system-type surveillance,
additional failures to adequately comply with the TS SR
[surveillance requirements] are likely."
Following this questioning, the licensee instituted a detailed
review of the 18 Enercon deficiencies. Of the eighteen items, two
were considered reportable by the licensee and were the subject of
LER 94-001 dated March 7, 1994. The technical aspects of the LER
related to these two items are discussed below.
An April 15, 1994, supplement to the LER reviewed the failure of
the plant organization to promptly disposition the 1992 Enercon
report. The LER concluded that this failure was "...the result of
the lack of management oversight for the overall project."
The
supplemental LER notes that no plans or schedules were established
to track resolution of the 18 items nor was a methodology in place
to resolve differing views of the technical adequacy of the 18
items.
On June 29, 1994, during the exit interview for this inspection
report, the inspectors were advised by the licensee that the
Enercon report issues had also been raised independently by the
plant staff as a part of the restart readiness review. The
inspectors did not independently verify this statement. However,
based on the intensive review of backlog issues conducted by the
licensee coincident with startup on the early 1994 timeframe, the
inspectors concluded that this assertion was plausible.
Enercon Study Results
The following eighteen items were identified as surveillance test
procedure review deficiencies by the Enercon study:
1.
HBR does not utilize a master surveillance scheduling
system.
2.
The power supplies of the protection instrument
channels are not tested.
3.
Indicators on which channel checks are performed are
not listed.
7
4.
The test procedures used to satisfy TS channel
calibration requirements in general do not ensure
adequate overlap from sensor to actuating device.
5.
Incorporation of span and zero shift compensation due
to high static pressure could not be verified.
6.
Disagreement exists between MMM-006, Calibration
Program and the vendor technical manual on the
accuracy for Rosemount transmitters used to measure
reactor coolant flow.
7.
Channel calibrations do not include provisions to
check alarms.
8.
An overall program that contains or addresses
instrument setpoint calculations could not be found.
9.
The procedure used to calibrate the overpressure
protection system does not include the actuation of
the PORV solenoids.
10.
Inadequate functional testing and calibration of CV
wide range pressure instruments.
11.
Inadequate functional testing and calibration of CV
wide range level instruments.
12.
There is no functional testing performed on a monthly
basis on the 4kV undervoltage circuits as required by
TS.
13.
A difference exists between various documents
regarding the correct time delay for the 4kV
undervoltage time delay.
14.
Channel checks or channel functional tests were not
being performed on AFW flow indicators as required by
TS.
15.
Portions of TS required surveillance of the boric acid
makeup flow channel and RVLIS are performed using
vendor technical manuals instead of station
procedures.
16.
The logic associated with the IR block, low setpoint
power range block and P-10 is not tested until 75
percent power is reached.
[A situation could result
during a shutdown following an aborted startup in
which reliance was required on protection circuitry
that had not been tested.]
8
17.
Continuity checks on Engineered Safeguard equipment
specified in TS Bases 4.5 are not being performed.
18.
The recorder for power range detectors, the radiation
monitor recorder, and incore thermocouple recorder are
not being calibrated. [R.G. 1.97 concern]
IR 94-04 documents a previous inspection by a Region II based
specialist of the licensee's review and corrective actions
associated with these items. That inspection report, dated
March 22, 1994, concluded that the licensee had addressed these
issues in a satisfactory manner for restart.
Following that inspection effort, the licensee conducted a
reportability evaluation of the eighteen Enercon items. That
evaluation documented the licensee's technical interpretation of
the 18 items; outlined corrective action taken where deemed
necessary; and evaluated the reportability of the items. The
disposition of the items ranged from dismissing the concern due to
a lack of technical merit to revising plant procedures in order to
correct the identified deficiency.
This reportability evaluation concluded that Item 9 (inadequate
calibration of overpressure protection system) and Item 12 (lack
of monthly functional testing of the 4kV undervoltage devices)
were reportable. On March 7, 1994, these items were reported in
LER 94-001.
This report was made pursuant to 10 CFR 50.73 (a)(2)
(i)(B) as a condition prohibited by TS, since surveillance
requirements were not fully complied with and the associated TS
actions were not taken within the allowed time interval.
The
inspectors reviewed the LER and technical documentation associated
with these issues.
Item 9 of the Enercon study dealt with the failure to adequately
test the PORV actuation circuitry during monthly testing. The
concern centered on shortcomings in the licensee's surveillance
procedure which prevented testing the entire loop. The Enercon
report identified that the circuitry from bi-stables PC-502 and
PC-503 through auxiliary panel relays and permissive switches to
the associated solenoids was not tested. LER 94-001 acknowledged
this concern and outlined the corrective actions taken to resolve
this issue. These included a verification of the circuit
continuity and a modification to the surveillance test. The
inspectors noted from a review of Maintenance Surveillance Test,
MST-007, Reactor Coolant Low-Temperature Overpressure Protection
System Test (Monthly) that the procedure had been revised to
incorporate a measurement of voltage immediately upstream of the
test switch once bistables PC-502 or PC-503 had been actuated. In
their reportability evaluation for this item, the licensee also
took credit for the performance of Operations Surveillance Test,
OST-703, ISI Primary Side Valve Test Cold Shutdown Greater Than 48
Hours, as testing the circuit from test switch to the PORV
9
solenoids. These two items were evaluated by the licensee as
providing the supplemental testing required to verify the entire
PORV actuation circuitry thereby resolving the Enercon concern.
On June 28, 1994, the inspectors questioned the licensee's
resolution of this issue. Specifically, the inspectors were
concerned that no post-MST-007 verification of the test switch
continuity was conducted. The inspectors noted that with the
energize to actuate design of the PORV circuitry, an undetected
interruption in the PORV's actuation circuit at the test switch
following testing could render the valves inoperable. Similar
concerns had been identified by the licensee previously for the
energize to actuate containment spray system logic. The inspectors
will monitor the licensee's resolution of this issue.
Item 12 of the Enercon study dealt with the failure of the
licensee to conduct a functional test of the 4kV undervoltage
device on a monthly basis. These devices provide an anticipatory
trip signal when an undervoltage condition is sensed on the RCP
busses. These trips are the subject of line item 8 in TS Table
4.1-1. This failure was attributed by Enercon to a
misinterpretation by the licensee of a note contained on the
remarks section of TS Table 4.1-1, Minimum Frequencies For Checks,
Calibrations, and Tests Of Instrument Channels. This note, in the
4kV undervoltage section of the table, specifies "Reactor
Protection circuits only."
As documented in the Enercon report,
this had been previously interpreted to imply that only the logic
portion of the circuit was to be tested at the frequencies
specified in the TS table. LER 94-001 documents the licensee's
subsequent reevaluation of this note. Following this revised
interpretation, Special Procedure, SP-1294, Testing of 4kV
Undervoltage Trip Only For The Input To The Reactor Protection
Circuitry, was developed and successfully performed on January 30,
1994. The inspectors reviewed SP-1294 and have no further
questions on Item 12 of the Enercon report.
On June 14, 1994, the licensee recognized that potentially non
conservative values existed for the actual high steam flow ESF
setpoints.
Item 5 of TS Table 3.5-1, Engineered Safety Feature
System Initiation Instrument Setting Limits, requires that these
setpoints be less than or equal to 40 percent of full steam flow
below 20 percent power and less than or equal to 110 percent of
full steam flow at 100 percent power. It was recognized by the
licensee during the turbine first stage pressure channel accuracy
and scaling calculation, calculation RNP-I/Inst-1045, that the
actual setpoint exceeded the TS limit of 110 percent rated flow by
1.5 percent at 100 percent power. This incorrect setpoint
occurred as a result of changes made to the high steam flow
bistable setpoints based on measured steam flows in lieu of the
analytical limits used in the Updated FSAR. This change was
justified in Engineering Evaluation 87-201 in order to reduce the
occurrence of previously experienced steam flow instrument channel
activations observed during cold weather. The inspectors were
10
advised that the turbine first stage pressure accuracy calculation
during which this error was uncovered was part of the instrument
setpoint calculation effort.
Item 8 of the Enercon study identified as a deficiency, the lack
of an overall program that contained or addressed the instrument
setpoint calculations. The study recommended that a program be
developed to address instrument setpoint calculations. The
inspectors noted that while a Plant Improvement Request for a
setpoint methodology study was approved in 1989, work in earnest
on the program did not begin until January 1994. This occurred
following the detailed review of the Enercon report in January
1994 and on the heels of several other high visibility instrument
calibration issues at the HBR facility in 1993. The inspectors
also noted that this setpoint effort was initiated approximately
18 months after the June 1992 Enercon recommendations for such a
study.
Conclusions
The inspectors concluded that the licensee failed to take adequate
corrective action in a timely fashion to potential TS deficiencies
identified by Enercon in June of 1992. The failure of the
licensee to move forward on these issues after they were initially
identified, resulted in a delay of almost 18 months in resolving
deficiencies in the implementation of two TS required
surveillances.
Furthermore, the delay in implementing the
Enercon recommended setpoint study (a need identified internally
by CP&L in 1989) postponed recognition and resolution of
improperly set ESF high steam flow bistable setpoints.
10 CFR 50 Appendix B, Criterion XVI, Corrective Action, requires
in part that measures be established to assure that conditions
adverse to quality, such as failures, malfunctions, defective
material and equipment, are promptly identified and corrected.
On June 30, 1992, the licensee failed to promptly act upon 18
potential deficiencies identified by Enercon. Subsequent review
of these issues in January 1994 revealed deficiencies in the
implementation of two TS required surveillances. Furthermore, in
June 1994, during the conduct of a setpoint calculation study
recommended by the Enercon study, ESF high steam flow bistable
setpoints in excess of TS limits were discovered.
This is identified as an apparent violation, VIO 94-16-03, Failure
To Take Adequate Corrective Action To Potential Technical
Specification Deficiencies Identified By Enercon In June 1992.
b.
Control Room Ventilation Testing Deficiencies
Introduction
Unresolved Item 94-15-05, Control Room Ventilation System
Operability documented inspector concerns pertaining to the
licensee's testing methodology associated with determining the
ability of the control room ventilation system to maintain the
control room envelope at a positive pressure with respect to all
adjacent areas during an accident. At the end of that report
period, investigation pertaining to the testing methodology, the
past operability of the system, and the associated safety
significance were continuing.
The following delineates the
results of the analysis.
Background
During an inspection which ended on May 6, 1994, the results of
which are documented in Inspection Report 94-14, a Region II
inspector questioned the licensee's testing methodology associated
with confirming the ability of the control room ventilation system
to maintain the control room at a positive pressure with respect
to all adjacent areas during an accident. The inspector noted
that previous testing assessed the system's ability to maintain a
positive pressure relative to the outside atmosphere, but did not
verify the system's ability to maintain a positive pressure in the
control room envelope with respect to adjoining plant spaces,
which is a design basis function.
This departure from the test
methodology as described in the UFSAR, was identified to the
licensee as an apparent Deviation. The resident inspectors
questioned the system's ability to perform its intended safety
function, given the apparent inadequate scope of system testing.
The Plant Manager directed his staff to perform the testing
necessary to determine system operability.
On the afternoon of May 6, 1994, the control room ventilation
system was tested in the emergency pressurization mode to
determine if the system could produce and maintain a positive
pressure relative to adjacent areas.
The testing revealed that
the control room could only be pressurized to a pressure
approximately equal to an adjacent electrical equipment room, the
Hagan Room. By modifying the system's air flow balance, the
licensee was successful in creating a positive pressure between
the control room and the Hagan room, as well as all other adjacent
areas.
On the following day, an auxiliary building exhaust fan was turned
off to support ongoing auxiliary building ventilation flow balance
efforts. This resulted in another electrical equipment room
adjacent to the control room, the E/E2 room, going to a pressure
higher than that in the control room.
This pressure appeared to
be greater than the maximum pressure differential attainable by
12
the control room ventilation system when in the emergency
pressurization mode, based on the previous day's testing. It was
concluded that in the past, the E1/E2 room would have been at a
positive pressure with respect to the control room during certain
accident scenarios. The licensee restarted the auxiliary building
exhaust fan, and declared the control room ventilation system
inoperable until the issue could be resolved.
After assessing the system configuration, the licensee de
energized the auxiliary building supply fan which created a large
negative pressure in the auxiliary building. This resolved the
immediate concern relative to differential pressure between the
E1/E2 room and the control room. Subsequently, the licensee
restarted the auxiliary building supply fan after applicable
procedures were modified to de-energize the auxiliary building
supply fan during certain accident scenarios.
At the end of report period 94-15, the control room ventilation
system had been balanced to maintain the control room at a
positive pressure with respect to adjacent areas during accident
scenarios.
The licensee's evaluation concluded that this event was caused by
a failure to adequately understand and incorporate the licensing
basis for the system into the system's surveillance test program.
The licensee's proposed corrective actions include revision of the
appropriate plant procedures to ensure conservative testing.
Event Details
As previously stated, on May 7, 1994, Unit 2 was operating at 100
percent power. Auxiliary building ventilation system flow
balancing was in progress in an area containing emergency buses El
and E2 (i.e., E1/E2 Room).
This room is located in the auxiliary
building and is below the control room with a common floor/
ceiling. When the E1/E2 room exhaust fan, HVE-7 was secured for
the flow balancing activities, the air pressure increased in the
immediate area and several rooms adjacent to the control room,
including a room containing the reactor protection and control
analog instrumentation relay racks, the Hagan Room. Licensee
analysis determined that, under certain accident conditions, HVE-7
would stop operating and that the non safety-related supply fan,
HVS-1, could not be relied upon to stop. Therefore, under such
conditions, the air pressure in these rooms could become more
positive than the control room air pressure. This is contrary to
the licensing basis of the plant, which states that the control
room envelope is to be maintained under a positive differential
pressure with respect to adjacent areas during the emergency
pressurization mode of operation.
The licensee concluded that the E1/E2 room pressure had exceeded
the control room post accident pressure, and that an unanalyzed
13
condition existed. Accordingly on May 7, 1994, at 3:56 p.m. the
NRC was notified via the Emergency Notification System of this
condition pursuant to 10 CFR 50.72(b)(1)(ii). The immediate
corrective actions taken were to re-start HVE-7, which resulted in
a pressure reduction in the E1/E2 Room, until additional
administrative controls could be put in place.
During subsequent flow balancing activities, the resident
inspectors raised questions concerning the amount of outside air
makeup going into the control room. The licensee determined that
during a system alignment to support auxiliary building
ventilation flow balancing (i.e., HVS-1 and HVE-7 secured), a
negative pressure in the room which contains the control room
ventilation system equipment had been developed, and due to
outside air makeup fan housing in-leakage, the outside air makeup
to the control room had indeed increased to approximately 420
cubic feet per minute (CFM), which is beyond Technical
Specification (TS) section 4.15 limit of 400 CFM. The exact
amount of air increase could not be positively determined.
However, to compensate for this concern, the outside air makeup
was adjusted and reduced to 340 CFM.
Analysis Of Event
This event was caused by the licensee's failure to adequately
understand and incorporate the system's licensing basis into the
system surveillance test program. Further, the control room
ventilation system design was incomplete, in that it did not
consider all auxiliary building ventilation system lineups and the
effects of these line-ups on the control room ventilation system.
The existing control room ventilation system was installed via a
modification during 1991.
The post-modification system test
demonstrated that the system design requirements were met in that
the system could reproduce and maintain a positive pressure in the
control room with respect to all adjacent areas. However,
periodic Operations Surveillance Test Procedure, OST-750, intended
to satisfy the requirements of Technical Specification (TS) 4.15,
does not ensure a positive pressure is maintained with respect to
areas adjacent to the control room other than the outside, as
committed to in the Updated Final Safety Analysis Report (UFSAR).
Therefore, the ability of the system to perform its intended
function during the emergency pressurization mode of operation has
not been demonstrated since post-modification acceptance testing
in 1991.
The licensee's evaluation of the event indicated that the minimal
testing required by TS had been performed, but the control room
ventilation system testing committed to in the UFSAR had not been
incorporated into the surveillance testing program. Specifically,
the UFSAR states that the control room envelope is to be
maintained under a positive differential pressure with respect to
14
adjacent areas during the emergency pressurization mode of
operation. The UFSAR further states, that periodic testing is
required to demonstrate that the control room can be pressurized
to a minimum of 1/8 inch of water gage with respect to the
outdoors and during normal operation, the system will be
periodically tested to demonstrate that a positive pressure can be
maintained in the control room. The licensee's testing
methodology does not test the control room envelope with respect
to adjacent areas, nor does it contain an acceptance criteria of
1/8 inch of water gage pressure with respect to the outdoors.
The licensee's analysis also indicated that under certain accident
conditions, with specific equipment failure assumptions, the
control room could have been at a pressure less positive than
adjacent area pressures. This scenario could have potentially
resulted in a release of contaminated materials into the control
room envelope. However, calculations have been performed
demonstrating that plant operators would have up to one hour to
secure HVS-1 without radiation dose limits per the General
Criterion 19 of Appendix A to 10 CFR 50 being exceeded.
Accordingly, the licensee concluded that operating in this
condition had minimal effect on plant safety.
Corrective Actions
On May 8, 1994, exhaust fan HVE-7 and the supply fan HVS-1 were
secured, and the areas considered adjacent to the control room,
were verified to be at a pressure condition less than that of the
control room when the control room ventilation system was operated
in the emergency pressurization mode. Plant operating procedures
and emergency operating procedures were revised to place operating
restrictions on HVS-1.
In addition, the licensee plans to revise
Procedure EST-023 to reflect the testing requirements as specified
in the TS and the UFSAR.
Conclusions
Technical Specification 3.15.1 requires that during all modes of
plant operation, except cold shutdown, the Control Room Air
Conditioning System shall be operable with two trains of active
safety-related components and the shared safety-related passive
components.
10 CFR 50 Appendix B Criterion XI requires that a test program be
established to demonstrate that structures, systems, and
components will perform satisfactorily in service. Implicit in
this criterion is the requirement that the testing demonstrate the
ability of safety related components to perform their intended
safety function under design basis conditions.
Sections 6.4 and 9.4.2 of the Updated Final Safety Analysis Report
defines the intended safety function of the Control Room Air
15
Conditioning System to be, in part, the ability to maintain the
control room under a positive pressure with respect to adjacent
areas and the outdoors when the system is operated in the
emergency pressurization mode.
The test program established by the licensee to demonstrate that
the control room air ventilation system would perform it's
intended safety function was inadequate in that it did not ensure
that the system could produce and maintain a positive pressure in
the control room with respect to areas adjacent to the control
room and the outdoors.
On May 7, 1994, with the plant operating at 100 percent power,
licensee testing to confirm the operability of the control room
ventilation system revealed that pressure in a room adjacent to
the control room exceeded the control room pressure that would
exist during the emergency pressurization mode of operation. This
indicates that the system may have been incapable of performing
it's intended safety function since the system was installed in
1991.
This is an apparent violation, 94-16-04, Inadequate Control Room
Ventilation Testing Program.
c.
Inadequate Corrective Action To MSIV Design Deficiency
Unresolved Item 94-04-01, documented the resident inspectors'
concerns pertaining to inadequacies associated with MSIV testing
and design. The inspectors' primary concerns focused on the
licensee's failure to identify and correct a design deficiency in
the MSIV air accumulator volume, which resulted in the failure of
the valves to meet the TS required five second closure time and
the licensee's failure to comprehensively evaluate and act upon
available operating experience information including an
Information Notice (IN) incorporating H. B. Robinson as an
example, concerning the air accumulator design deficiency. The
issue was left open pending the completion of a licensee team
evaluation of the issue.
Event Summary
On January 29, 1994, the unit was in hot shutdown conditions.
During main steam isolation valve (MSIV) operability testing, all
three MSIVs were declared inoperable when they failed to meet the
Technical Specification (TS) required closure time.
The licensee subsequently determined that previous MSIV testing
had not demonstrated MSIV operability. This condition was caused
by the licensee's failure to correct an MSIV design deficiency. A
modification was implemented on February 7, 1994 to correct this
design deficiency, and all three valves were subsequently declared
16
Event Details
On January 29, 1994, the unit was in hot shutdown conditions at
normal operating temperature and pressure. During post
maintenance testing following removal, testing, and re
installation of the "A" Main Steam Isolation Valve control
solenoid, the MSIV failed to close within five seconds with non
safety-related instrument air supplied to the valve actuator.
Technical Specification (TS) 3.4.1.e states that the reactor shall
not be heated above 350 degrees F unless the MSIVs are operable
and capable of closing in five seconds or less. TS 4.7.1 states
that the MSIVs are tested at each refueling interval to verify
closure time of five seconds or less, and that the valves are
tested at no flow and at no load conditions. On January 30, 1994,
at 10:23 p.m., the "C" MSIV was tested to verify its capability to
close within five seconds after receiving a close signal at no
flow and at no load conditions. This MSIV also failed to meet the
stroke time requirements. As a result of the "A" and "C" MSIVs
failing to meet stroke time requirements, the "B" MSIV was tes
and it also exceeded the five second requirement. It should bv
noted, that this testing was performed with non-safety related
instrument air supplied to the valves.
Because the stroke times the three valves were in excess of five
seconds, the valves were declared inoperable in accordance with TS 3.4.1.e, and each valve was secured in its closed position in
accordance with the action statement of TS 3.6.3 for an inoperable
containment isolation valve. Subsequent testing determined that
with instrument air isolated to the MSIV actuators (i.e., only the
safety-related MSIV air accumulators providing the actuating
motive force), all three valves required in excess of five seconds
to close.
On April 25, 1994, following a review of the completed root cause
investigation of the MSIV failures, the licensee determined that
the previous practice of testing the MSIVs with instrument air
valved in, did not demonstrate valve operability. Review of
historical test data identified that MSIV testing was performed in
this configuration (i.e., with instrument air valved in) from 1984
to 1994. As a result, the capability of the MSIVs to perform
their design function had not been demonstrated since 1984.
Background Information
During November 1984, the NRC conducted an inspection of MSIV
testing. This inspection resulted in a Notice of Violation (NOV)
84-44-02 which stated that, contrary to American Society of
Mechanical Engineers (ASME) Code requirements invoked by TS 4.0.1.a, the MSIVs, as "fail-safe" valves were not being tested by
"observing the operation of the valves upon loss of actuator
power."
NRC Inspection Report 84-44 interpreted the requirement
as meaning that the MSIVs should be tested without use of
17
instrument air as the source of actuator power since instrument
air is a non-safety grade system.
On January 8, 1985, the MSIVs were tested under Special Procedure
SP-647, "Main Steam Isolation Valve Operability Test," with steam
line pressure at approximately 980 psig, no pressure differential
across the valve, and with instrument air isolated. The safety
related MSIV air accumulators provided the only motive force to
close the valves during the test. Although the valves closed, the
test did not confirm that closure times were within five seconds
since the valve stroke times were not measured. Conclusions from
the testing were that all three MSIVs closed, but drifted open
within ten minutes because accumulator pressure alone could not
keep the valves closed with no differential pressure across the
valve. To compensate for this concern, a temporary nitrogen
source was added to the valve actuators to provide the additional
motive force to keep the valves closed in the event of a loss of
instrument air.
The licensee's response to NOV 84-44-02 on March 8, 1985, stated
that the Procedure OST-702, "ISI Secondary Side Valve Test," was
intended to meet the ASME Section XI Code requirements. The
response further stated that the test was performed at cold
shutdown conditions, and that Procedure OST-501, "Main Steam
Isolation Valve (Refueling)," satisfied the operability
requirements of TS 4.7 (i.e., MSIV closure within five seconds) at
hot, no load conditions. At that time, no changes to Procedure
OST-501 were considered necessary. This response summarized the
results of the January 8, 1985, test and stated that a bottled
nitrogen backup to the MSIV actuators had been provided on an
interim basis to ensure adequate pressure is available to close
the valves within the safety analysis assumption for steam
generator tube rupture. The temporary nitrogen backup was removed
during 1986 by modification M-882. This modification also
installed a redundant solenoid in the closing side of the actuator
vent path, preventing the motive closing air from being vented off
of the actuator. However, post modification testing did not
ensure the valves would close within five seconds.
Analysis of Event
This condition was caused by the licensee's failure to correct a
design deficiency resulting in the failure of the valves to meet
the TS required five second closure time. Further, testing the
MSIVs with instrument air supplied to the actuators masked the
fact that the accumulators were not sufficiently sized to close
the valves within five seconds under hot, no load conditions.
Previous licensee analyses and reviews of changes to MSIV testing
procedures did not address the inconsistency between the Updated
Final Safety Analysis Report (UFSAR) statement that the instrument
air system is not required to function during accident conditions,
18
and the previous reliance on instrument air to meet TS required
closure time.
Contributing factors for this condition were inadequate post
modification test procedures for modification M-882 to demonstrate
MSIV operability, and the failure to evaluate and act upon
available operating experience information including an
Information Notice (IN)
concerning the air accumulator design
deficiency.
In 1985, an analysis was received from another utility that their
MSIVs would fail to close if instrument air was not utilized as an
additional motive force. The utility implemented a modification
to increase the accumulator volume to ensure required closure
times of the MSIVs with instrument air isolated. NRC Information
Notice 85-84, "Inadequate Inservice Testing of Main Steam
Isolation Valves," referenced ASME Section XI, and stated that
reliance should not be placed on non-safety related systems (e.g.,
instrument air) to mitigate the consequences of an accident. It
should be noted that Robinson was one of the plants discussed in
the Notice. As a result, modification M-882 was implemented to
ensure an adequate pressure source was available for closure of
the MSIV's. During the development of this modification, the
plant staff assumed that the accumulators would have sufficient
volume to close the MSIVs if a solenoid valve was added to the
vent path to prevent venting of the accumulator air. However, as
stated above, the post-modification testing did not verify
acceptable closure times.
TS 3.4.1.e states that the reactor shall not be heated above 350
degrees F unless the main steam stop valves (i.e., MSIVs) are
operable and capable of closing in five seconds or less. TS 4.7.1
states that the MSIVs are tested at each refueling interval to
verify closure time of five seconds or less, and that the valves
are tested at no flow and at no load conditions. While not
specifically required, the licensee has interpreted that this
testing should be at maximum steam pressure, with instrument air
isolated. Since MSIV testing was not consistently performed under
these condition from 1984-1994, MSIV operability was not
demonstrated.
Preliminary licensee analysis indicated that under certain
postulated accident conditions failure of a MSIV to close within
five seconds could have resulted in a release of radioactive
material that exceeds 10 CFR Part 100 limits.
Corrective Actions
On February 7, 1994, additional MSIV Accumulator tanks were
installed to provide an increased volume of compressed air to
assist MSIV closure within the required five second time period.
- 0
'9
Following completion of this modification and subsequent post
modification testing, all three valves were declared operable.
Procedure OST-501 is to be conducted with the plant in hot
shutdown condition with the main steam header warmed and
pressurized. The procedure establishes a no flow condition
downstream of the MSIVs and is to be performed with instrument air
isolated.
Procedure OST-702 was revised to allow hot testing of the MSIVs by
including sections to establish a no flow condition downstream of
the MSIVs and isolation of instrument air during the MSIV
operability portion of the test.
The licensee stated that the Design Basis Document for the Main
Steam System will be revised to include references to the
licensing basis for the system and supporting calculations and
studies that define the details of expected MSIV performance.
The licensee also stated that the UFSAR will be revised to ensure
that it correctly characterizes the accident mitigation
requirements for the MSIVs.
Conclusions
10 CFR 50 Appendix B Criterion XI requires that a test program be
established to demonstrate that structures, systems, and
components will perform satisfactorily in service. Implicit in
this criterion is the requirement that the testing demonstrate the
ability of safety related components to perform their intended
safety function under design basis conditions.
The licensee's testing program failed to demonstrate the
capability of the main steam isolation valves (MSIVs) to perform
their intended safety function of steam generator isolation within
five seconds. This failure included:
Failure to test the MSIVs while in hot shutdown condition
between June 1992 and January 1994.
Failure to test the MSIVs with instrument air (a non-safety
related system) isolated while in hot shutdown between
January 1985 and January 1994.
Failure to verify the integrity of the MSIV accumulators and
their associated piping between January 1985 and January
1994.
10 CFR 50 Appendix B, Criterion III, Design Control, requires in
part that design control measures be implemented to ensure that
systems/components are capable of performing their intended safety
function, such as by design reviews or suitable testing programs.
20
The licensee's design control measures, as they pertain to the
main steam isolation valves, were inadequate, in that in January
1994, with the reactor in hot shutdown condition, the licensee
determined that the valves were incapable of closing in the
required time and/or remaining closed if instrument air, a non
safety related system, was isolated from the valve actuators.
This constitutes an Apparent Violation 94-16-05, Inadequate
Corrective Action Concerning MSIV Accumulator Volume.
9.
Exit Interview (71701)
The inspection scope and findings were summarized on June 27, 1994, with
those persons indicated in paragraph 1. The inspectors described the
areas inspected and discussed in detail the inspection findings listed
below and in the summary. Dissenting comments were not received from
the licensee. The licensee did not identify as proprietary any of the
materials provided to or reviewed by the inspectors during this
inspection.
Item Number
Description/Reference Paragraph
VIO: 94-16-01
Inoperable CV Water Level Indication
URI: 94-16-02
Inoperable Post Accident Containment Vent Path
Apparent Violation:
Inadequate Corrective Action to Potential TS
94-16-03
Deficiencies Identified By Enercon
Apparent Violation:
Inadequate Control Room Ventilation Testing
94-16-04
Program
Apparent Violation:
Inadequate Corrective Action Concerning MSIV
94-16-05
Accumulator Volume
10.
List of Acronyms and Initialisms
BIT
Boron Injection Tank
CR
Control Room
CV
Containment Vessel
Engineered Safety Feature
Engineered Safety Feature Actuation System
Final Safety Analysis Report
HBR
H. B. Robinson
IR
Intermediate Range
LER
Licensee Event Report
LCO
Limiting Condition of Operation
Level Indicator
Loss Of Coolant Accident
PACV
Post Accident Containment Vent
21
MMM
Maintenance Management Manual
OMM
Operations Management Manual
OST
Operations Surveillance Test
Power Operated Relief Valve
Reactor Coolant Pump
Robinson Nuclear Plant
Reactor Operator
SCO
Senior Control Operator
SR
Surveillance Requirement
Surveillance Test Procedure
TS
Technical Specification
Unresolved Item
Violation