ML15118A189
| ML15118A189 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 03/10/1997 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II) |
| To: | |
| Shared Package | |
| ML15118A185 | List: |
| References | |
| 50-269-96-20, 50-270-96-20, 50-287-96-20, NUDOCS 9703280016 | |
| Download: ML15118A189 (44) | |
See also: IR 05000269/1996020
Text
U.S. NUCLEAR REGULATORY COMMISSION
REGION II
Docket Nos:
50-269, 50-270, 50-287, 72-04
License Nos:
DPR-38, DPR-47, DPR-55, SNM-2503
Report No:
50-269/96-20. 50-270/96-20, 50-287/96-20
Licensee:
Duke Power Company
Facility:
Oconee Nuclear Station, Units 1, .2
& 3
Location:
7812B Rochester Highway
Seneca, SC 29672
Dates:
December 29, 1996 - February 8. 1997
Inspectors:
M. Scott. Senior Resident Inspector
G. Humphrey, Resident Inspector
N. Salgado, Resident Inspector
D. Billings, Resident Inspector
W. Holland, Reactor Inspector (Section E1.1)
P. Fillion, Reactor Inspector (Section El. 1)
N. Merriweather, Reactor Inspector (Section E2.4)
C. Rapp, Reactor Inspector (Section E2.5)
Approved by:
C. Casto, Chief, Projects Branch 1
Division of Reactor Projects
9703280016 970310
PDR ADOCK- 05000269
Enclosure 2
G
EXECUTIVE SUMMARY
Oconee Nuclear Station, Units 1, 2 & 3
NRC Inspection Report 50-269/96-20,
50-270/96-20. 50-287/96-20
This integrated inspection included aspects of licensee operations,
engineering, maintenance, and plant support. The report covers a six-week
period of resident inspection; in addition, it includes the results of
announced inspections by four-regional reactor inspectors.
Operations.
The Unit 2 return to power was well controlled and planned, with
very few problems encountered. (Section 01.2)
With Unit 3 in cold shutdown, a short duration diversion of water
occurred from the Reactor Coolant System (RCS) to the Borated
Water Storage tank (BWST) due to Valve 3LP-40, a Low Pressure
Injection (LPI) pump test line valve, being in the wrong position.
Operations personnel acted promptly to stop the event. An
Unresolved Item (URI) was identified to further evaluate this loss
.of RCS inventory. A post event review resulted in re
hydrostatically testing the subject valve-and associated piping at
a higher value. This was considered an engineering weakness
involving modification review and approval.
(Sections 01.3 and
E1.3)
0
With Unit 2 at power, LPI Valve 2LP-18 became potentially
hydraulically locked, causing the licensee to enter a Technical
Specification (TS) Limiting Condition for Operation (LCO) on the
2B LPI train.. The valve was subsequently tested and found
operable. Integration of corrective actions was considered a
weakness for this event. (Sections 01.3 and E2.2)
A URI was identified regarding a potential past operability issue
on the Standby Shutdown Facility (SSF) pressurizer heater level
control. (Section 02.2)
Unit 3 refueling activities were adequately performed with care
and attention to detail. (Section 04.1)
The Emergency Power and Engineered Safeguards Functional Test
classroom and simulator training provided to the B-Shift operators
was thorough, presented clearly, and professionally. The
operators participated in the training with a focused and
questioning attitude. (Section 05.1)
A violation was identified regarding an Operations Procedure not
being placed on Administrative Hold to prevent its use prior to
being changed. This was a major factor in the September 24, .1996,
Unit 2 water hammer event. Unrelated secondary piping code
Enclosure 2
2.
deficiencies identified and corrected by the licensee after -the
Unit 2 water hammer event were identified as a Non-Cited Violation
with respect to 10 CFR 50.59. (Section 08.1)
Maintenance
0
Maintenance and Surveillance activities such as the Unit 1 heater
drain work, complex Unit 3 Emergency Core Cooling System (ECCS)
flow test, complex Unit 3 Low Pressure Service Water (LPSW) pump
surveillance, and Unit 2 rod drop test, were thoroughly and
professionally completed. (Section M1.1)
The i-nspectors reviewed a recent nonsafety-related motor failure.
Questions regarding possible broader implications on safety
related equipment are being tracked by an Inspector Followup Ithm.
(Section M2.1)
Engineering
0 .Integrated
testing of the Oconee emergency power system was
satisfactorily accomplished in accordance with the approved test
procedure. Deficiencies identified during testing were, or will
be resolved in-accordance with the licensee's problem
investigation process. Control of all test activities was good.
Positive obse'rvations were made relating to test briefings,
control room briefings, and communication/coordination of test
evolutions. (Section E1.1)
Based on a review of the nonsafety-related and safety-related fuse
programs, the licensee had adequately addressed the resolution of
fuse failures. (Section E1.2)
A violation was identified because the licensee did not have a
programmatic material condition Reactor Building (RB) closeout
procedure. The lack of a procedure (organized program) resulted
in a poor understanding of RB material condition. Accordingly, a
URI was identified concerning past operability of the RB
recirculation flow path. (Section E1.4)
0
The licensee made a.concerted effort in addressing the issues of
Generic Letter (GL) 96-06 as it relates to the Oconee design
basis. Their long-term GL response .concerning RB penetration over
pressurization and water hammer is scheduled for issue by April 15
and August 1, 1997, .respectively. (Section E2.1)
Although some water/steam hammers were noted during the Unit 2
startup, the licensee's efforts were effective in minimizing this
problem. The modified moisture separator reheater.drain system
automated controls performed well and eliminated the need for
manual operation of the associated valves .with the unit operating
Enclosure 2
3
at power. This -reduced the potential personnel hazards involved
with secondary plant operation. (Section E2.3)
Design controls for the Operator Aid Computer (0AC) and Main Steam
Line Break (MSLB) modifications on.Unit 3.were adequate. Overall
engineering performance on these modifications-was considered good
even though a significant number of Variation Notices (VNs) had
been issued against the OAC modification. (Section E2.4)
The 10 CFR 50.59 Unit 3 Integrated Control System (ICS)
modification installation procedures were considered to be
adequate. In response to.traceability concerns with respect to
translation of ICS functional requirements into software
specifications, the licensee implemented independent contractor
assessments and took appropriate corrective action. Initial
concerns regarding formal software configuration management
controls were adequately addressed by the licensee through the
inclusion of ICS software in the engineering calculation control
program. Also adequately addressed were initial concerns over the
ICS Unreviewed Safety Question (USQ) evaluation; software
development, and verification and validating (V&V) process.
Further followup inspection of the ICS test plan and plant testi-ng
will be conducted under an IFI.
Enclosure 2
Report Details
Summary of Plant Status
Unit 1, which had been shutdown in early October 1996 for secondary piping
inspections and water hammer modifications, remained shutdown for the entire
reporting period.
Unit 2 returned to power operations on February 3. 1997, after an extended
shutdown that resulted from a heater drain line rupture that occurred on
September 24, 1996. The unit continued to operate at power throughout the
remainder of the reporting period.
Unit 3. which had been shutdown in early October 1996 for secondary piping
inspections and water hammer modifications, remained in refueling mode
throughout the entire reporting period.
Review of UFSAR Commitments
While performing inspections discussed in this report, the inspectors reviewed
the applicable portions of the Updated Final Safety Analysis Report (UFSAR)
that related to the areas inspected. The inspectors verified that the UFSAR
wording was consistent with the observed plant practices, procedures, and/or
parameters.
I. Operations
01
Conduct of Operations
01.1 General Comments- (71707)
Using Inspection Procedure 71707, the inspectors conducted frequent
reviews of ongoing plant Operations. In general, the conduct of
operations was professional and safety-conscious; specific events and
noteworthy observations are detailed in the sections below.
01.2
Unit 2 Startup
.a. Inspection Scope (93702, 71707)
The inspectors observed major portions of the Unit 2 startup and power
ascension activities. Unit 2 returnedto power operation on February 3,
1997.
b. Observations and Findings
The inspectors were present in Unit 2 for major critical evolutions,
including system lineups, main turbine generator (MTG) latching, and
reactor power ascension. Observed plant system lineups were found to be
adequate. Effective pre-job briefs were presented to the Operations and
support staff prior to each major plant status change. Satisfactory rod
Enclosure 2
2
drop testing was observed as discussed in Section M1.1. Observation of
the approach to criticality was found to be adequate. MTG
synchronization was delayed slightly: the synchronizing breaker PCB 23
did not immediately latch the MTG to the grid.on the first several
tries, but after some minor tuning of switchyard to MTG voltage, it
subsequently latched. The Number 4 intercept valve was slow to respond
to an open signal requiring the replacement of an electronic card.in its
control circuits. The licensee's engineering department had
instrumented the secondary heater drains and was present to monitor the
startup of the .secondary plant (discussed in Section E2.3).
After the MTG had been latched, the inspectors observed the operators
valve-in extraction steam to the "B"
heaters. The valving caused no
waterhammers. Extraction steam Valve HPE-36 did not immediately work
and required repair by Instrument and Electrical (I&E) personnel.
Additionally, several heater water level gages on Panels 2SA 10 and 11
did not work well and were also identified by Operations for repai.r.
c.
Conclusions
The Unit 2 return to-power was controlled and very few'problems were
encountered. The inspectors found the level of control and planning
during the complex startup to be appropriate.
02
Operational Status-of Facilities and Equipment
02.1 Engineered Safety Feature System Walkdowns (71707,71750)
The inspectors used Inspection Procedure 71707 to walkdown accessible
portions of the following safety-related systems:
Keowee Hydro Station
Units 1, 2, and 3 Reactor Building's (RBs)
0
Units 1 and 2 Emergen cy Core Cooling System (ECCS) pump areas
0
Unit 2 High Pressure Injection (HPI) System
- Unit 3 Spent Fuel Pool Area
Units 1 and 2 Pipe Penetration Rooms
Equipment operability, material condition, and housekeeping were
acceptable in most cases.
During normal daily tours, the inspector
identified some poor housekeeping conditions in the Unit 3 spent fuel
pool area. The inspector informed Maintenance management of the poor
housekeeping conditions-and the potential for foreign material entering.
the pool.
The licensee's Management sensitivity to foreign material,
exclusion (FME) is high, and the poor housekeeping conditions were
appropriately addressed in a prompt manner.
During this period, the inspectors toured Units 1, 2, and 3 RBs. As.
discussed in Section E1.4. several significant conditions related to
Enclosure 2
3
tape, RTV, paint, and-insulation were identified during the inspectors'
tour of the Unit 2 RB.-
Aside from these significant conditions, the
inspectors found and reported to the licensee 112 additional items that
were minor in nature. Overall, aside from the several significant
conditions that the licensee had to evaluate, the inspectors found -the
three RBs in good mechanical condition. Unit 3 RB material condition
was preliminarily reviewed by the residents while the other two RBs were
inspected after the licensee had performed their maintenance closeout
inspections prior to unit startup.
02.2 Standby Shutdown Facility (SSF) Pressurizer Heaters
a. Inspection Scope
On January 20, 1997, the licensee identified a problem which indicated
that the pressurizer heaters controlled from the SSF could be uncovered
prior to actuation of the low pressurizer level cutoff. The inspector
reviewed the licensee's Problem Investigation Problem (PIP) report 0
097-0273 which described the problem and associated corrective actions.
b. Observations and Findings
A revision of SSF Pressurizer level instrument uncertainty Calculation
OSC-2746. SSF Pressurizer Level Loop Instrument Accuracy Calculations
LT-72,. indicated that the SSF pressurizer heaters could be uncovered
before the low level cutoff was actuated. The low level cutoff is
provided to remove power from the.heaters before they are uncovered to
prevent possible burnout of the heaters. The current setpoint for the
low level cutoff is 105 inches of Water decreasing. The licensee's
immediate corrective actions required the recalibration of SSF
pressurizer level instrument loops for SSF operating conditions.
Calibration procedure IP/O/A/0370/002C. Standby Shutdown Facility RCS
Pressurizer Level and Pressurizer Pressure, was revised to incorporate
the correct calibration range for SSF Pressurizer Level Loops 1,2,3 . .
RCLTOO72.
The Unit 1, Unit 2, and Unit .3
recalibrations were completed
via Work Orders (WO) 97006889. 97006874, and 97006868, respectively.
The licensee was performing a past operability review. This issue will
be identified as Unresolved Item (URI) 50-269,270,287/96-20-01. $SF Past
Operability, pending completion and review of the licensee's evaluation.
c. Conclusion
The licensee identified that the pressurizer heaters could be uncovered
on a low level if operated from the SSF. Recalibration of instrument
loops corrected.this deficiency. There were no present operability
concerns based on the Units' status. The licensee was performing a past
operability evaluation at the close of the inspection.
.
Enclosure 2
4
04
Operator Knowledge and Performance
04.1 Unit 3 Refueling Activities (60710)
a. Inspection Scope
The inspectors observed, in part, all phases of the Unit 3 refueling.
b. Observations and Findings
The inspectors observed fuel movement in the RB, fuel movement tracking
efforts, refueling cavity and Spent Fuel Pool (SFP) FME practices.
These efforts were found to be adequate and in accordance with
Maintenance Procedure MP/0/A/1500/009, Defueling - Refueling Procedure.
The operators and maintenance personnel performing the evolutions were
attentive to detail and methodical in their actions. The refueling
cavity and SFP water had good clarity, thus facilitating an effective
work effort.
c. Conclusions
Observed Unit 3 refueling activities were adequately performed with.care
and attention to detail.
05
Operator Training and Qualification
05.1 Emergency Power and Engineered Safeguards Functional Test Training
a. Inspection Scope (61701)
The inspectors attended the licensed operator classroom and simulator
training for TT/O/A/0610/025, Emergency Power and Engineered Safeguards
Functional Test. (Section E1.1 addresses actual test performance.)
b. Observations and Findings
The- licensee provided "just in time training," for the B-shift licensed
operators. The terminal objective of the training was to enable the B
Shift to perform Test TT/0/A/0610/025. On December 29, 1996, the
licensee provided the classroom training which encompassed the overall
purpose of the testing, described the six individual tests associated
with Test TT/0/A/0610/025, and contingencies. On December 30, 1996, B
shift was provided simulator training on Test TT/0/A/0610/025. The
training was separated into three separate sections, Unit 1, Unit 2, and
Unit 3. Each section went through Test TT/0/A/0610/025 step-by-step on
the simulator as it applied to their respective unit. The operators
identified a few procedural discrepancies, and procedure changes were
initiated appropriately.
.
.Enclosure
2
5
c. Conclusions
The inspectors concluded that the classroom and simulator training
provided to the B-Shift operators was thorough, presented clearly.,and
professionally. The operators participated in the training with a
focused and questioning attitude.
08
Miscellaneous Operations Issues (92901)
08.1 (Closed) Apparent Violation (EEI) 50-270/96-17-08:
Failure To Use
Procedure Administrative Hold
(Closed) EEI 50-269,270.287/96-17-01: Failure To Complete A Written
Safety Evaluation Of Secondary Plant Piping Not In Accordance With The
Piping Code Referenced In The FSAR
Inspection Report 50-269.270.287/96-17 (dated January 27. 1997)
identified two apparent violations which were being considered for
escalated enforcement action in accordance with the "General Statement
of Policy and Procedures for NRC Enforcement Actions" (Enforcement
Policy), NUREG-1600. Having concluded that a predecisional enforcement
conference was not necessary to assist NRC in its deliberations, the
apparent violations are administratively closed and the disposition of
the associated violations is addressed below.
The first apparent violation (EEI 50-270/96-17-08) involved a Moisture
Separator Reheater Operations Procedure (OP/2/A/1106/14) that.was not
placed on "Administrative Hold" to prevent its use prior to being
changed.
This was a major factor in the September 24, 1996. Unit 2
water hammer event.
The failure to follow Nuclear Station Directive
(NSD)
703.12, Revision 14, Administrative Hold Of Procedures, is a
violation of Technical Specification 6.4.1 and is identified as
Violation 50-270/96-20-06, Failure To Use Procedure Administrative .Hold.
The circumstances surrounding this violation are described in.detail in
Inspection Report 50-269,270,287/96-17.
Also addressed in detail in Inspection Report 50-269,270,287/96-17. the
second apparent violation (EEI 50-269,270.287/96-17-01) concerned a
number of examples where secondary plant piping did not-meet the piping
code referenced in the Final Safety Analysis Report (FSAR) and the
failure to provide a written safety evaluation for this condition.
Viewed as original construction errors with minimal nuclear safety
related significance, this past programmatic failure to meet 10 CFR
50.59 does not involve a current performance issue nor does it have a
current impact. Accordingly, the NRC concluded that this failure to.
comply with 10 CFR 50.59 represents a licensee-identified and corrected
violation. In accordance with-Section VII.B.1 of the NRC Enforcement
Policy, this violation is dispositioned as a non-cited violation (NCV)
50-269,270,287/96-20-07. Failure To Complete A Written Safety Evaluation
Of Secondary Plant Piping Not In Accordance With The Piping Code
0
Referenced In
The FSAR.
Enclosure 2
- .
6
II.
Maintenance
M1
Conduct of Maintenance
M1.1 General Comments
a. Inspection Scope (62707,61726,60710)
The inspectors .observed all or portions of the following maintenance.
activities:
PT/2/A/0600/14
Emergency Feedwater Pump Suction From Hotwell
Test
OP/2/A/1106/02
Enclosure 3.4, Feedwater Cleanup Valve
Checklist; Enclosure 3.3, Condensate
Recirculation Valve Checklist
TT/3/A/0610/25B
Hydraulic Flow.Functional Test
PT/0/A/0750/011
Defueling/Refueling Activities
MP/0/A/1500/009
Defueling/Refueli.ng Procedure
Reset./Verify Setpoint of Timers LC 1X5
Reset/Verify El-LK-1X6 Setpoint Timer
Install Minor Modification ONOE-9067, Pressure
Locking Relief for 3LP-2
OP/2/A/1104/01 .
Verifying Operability of Core Flood Check-Valves
PT/2/A/0152/07
Core Flood Valves Stroke at Hot Shutdown
.PT/2/A/0150/15D
Intersystem Loss of Coolant Accident (LOCA) Leak
Test
MP/O/A/1720/010
System/Component Hydrostatic Test Controlling
Procedure
1C LPI Pump Motor, MP/0/A/3009/017, Visual PM
Inspection and Electrical Motor Tests
IC Low Pressure Service Water (LPSW) Pump Motor,
MP/0/A/3009/017. Visual PM Inspection and
Electrical Motor'Tests
- .Enclosure
2
7
2A Component Cooling (CC) Pump Motor.
MP/0/A/3009/017, Visual PM Inspection and
Electrical Motor Tests
LPSW Lines for the 2B2 RCP Coolers
and 97009878
PT/0/A/0300/01
Control Rod Drive Trip Time Test
Modify Heater Drain system
PM Relays in Compartment 1TD-9 (HPI-C)
IP/1/A/4980/051A Westinghouse Type CO-5. CO-6, CO-7, and CO-11
Relay Test
0
Replace Branch Connection Heater Drain (HD)
System
IP/0/B/0275/011B. Heater Drain Moisture Separator Drain Tank Level
Calibration
PT/2/A/0204/07
Reactor Building Spray Pump Test
Unit-1 Reactor Protection System (RPS) Channel A
and Functional Test
0
Troubleshooting and/or Corrective Maintenance,
1FDW-380 - 1B FWP
b. Observations and Findings
On January 7. the inspectors observed satisfactory performance of
TT/3/A/0610/25B, Hydraulic Flow Functional Test. Unit 3 was defueled
and in a refueling outage. The purpose of the test was to determine
ECCS borated source flow characteristic response during close to actual,
but simulated. LOCA conditions. Using the BWST and Let Down Storage
Tank (LDST) as the suction source, the ECCS pumps flowed to the
refueling cvity. The tank levels, LDST pressure, and flows were
closely monitored. The pumps were stopped prior to any problems being
encountered (BWST reached approximately 30 feet, LDST reached 20 inches,
and LDST pressure was 6.5 psig). At the time of the inspection, the
licensee had yet to complete test data analysis, which should provide
more accurate plant operation information. The test was well controlled
and properly documented.
On January 19, the licensee satisfactorily completed a Unit 3 complex
surveillance test in accordance'with PT/3/A/0251/23, Low Pressure
Service Water System Flow Test. During the test, two condenser
circulating water pumps were run to establish circulation flow and then
Enclosure 2
8
secured. Siphon circulation maintained flow for the rest of the test.
The LPSW pumps on Unit 3 took suction from the siphon circulation flow
as required to complete the test. During test performance, operations
and engineering demonstrated good command and control over the test.
The inspectors observed the satisfactory Unit 2 rod drop test that was
conducted in accordance with PT/0/A/0300/01, Control Rod Drive Trip Time
Test. The slowest rod drop time was 1.387 seconds which was below the
administrative limit of 1.4 seconds. The TS time limit was 1.66
seconds.
c. Conclusion
In general, the inspectors-found the work and testing performed during
observed maintenance activities to be professional and thorough. All
work observed was performed with the work package present and in active
use. Technicians were experienced and knowledgeable of their assigned
tasks. The inspectors frequently observed-supervisors and system
engineers monitoring job progress. Quality control personnel were
present when required by procedure. When applicable, appropriate
radiation control measures .were in place.
M2
Maintenance and Material condition-of Facility and Equipment
M2.1 Inspection Scope 1B RCW Motor (62707)
a. Inspection Scope
The inspectors investigated information regarding the safety-felated
pump motor program and recent occurrences at the site.including the
failure of the 1B Raw Coolant Water (RCW) motor.
b: Observations and Findings
On January 5. during preparations for the fifth Emergency Safeguards
(ES) test discussed in Section E1.1, the nonsafety-related lB RCW pump
motor tripped prior to test initiation. The motor was not a load for
the test and was evaluated later. The motor was determined to have a.
short to ground, indicating winding failure. The inspector observed the
failed windings of the disassembled motor, noting both the burned
windings at the six o'clock location on one end of the stator and heavy
dirt buildup in the general interior of the motor, particularly on the
lower winding coils. The motor had no cooling port entry filter. Per
discussions with the licensee,. one of the other RCW motors had recently
failed. At the request of the inspector and in conjunction with the
system engineer's efforts, PIP 5-97-0205 was generated on the motor
failure.
A motor repair vendor provided a Written report evaluating the motor's
"as-found" condition. In part, the report read as follows:
Enclosure 2
"There was extensive dust and debris concentrated on the stator
windings as a result of cooling air flow through the motor....
There was no sign of single phasing or a low voltage situation....
Other coils in the winding had good color and did not show any
evidence of thermal breakdown.....Cause of failure: it appears the
dust and debris accumulated in the 6:00 position, abrasives in the
debris (sand, grit, etc) eroded away the varnish which protected
and supported the copper conductors. The bare copper wires either
shorted to each other or arced to ground once sufficient debris
and/or moisture collected at the damaged.area. Other coil's showed
signs of damaged varnish coating; however, no failure had yet
occurred at these spots (also at the 6:00 position but.at other
side of iron) [opposite end of stator iron winding support ring].
Preventive action: this is a an open construction motor.... This
open construction allowEs] for dust and moisture to enter the
motor freely. The motor should be, at a minimum, blown out with
dry compressed air whenever a significant amount of debris
collects on the winding. Keep abrasive dust from entering the.air
intakes if possible. Use internal motor heaters to keep
winding[s] warm during periods of non-use. This-will prevent
condensation from collecting on the windings."
All the 4160 volt safety-related (S-R) motors are also without
ventilation filters. These motors are generally located in confined
rooms-with their own ventilation systems. Over the 30 year life of the
plant there has been cleaning, painting, insulation removal, and other,
activities that have generated debris around all of the S-R motors. The
exception were the LPSW pump motors which were not in confined spaces.
- The LPSW motors are located on the turbine building basement floor in a
generally well maintained large industrial area that is subject .to
routine cleaning and debris producing work. -The
RCW motors are located
in areas adjacent to the LPSW pump motors.
- During mid-December 1996, the residents identified that.debris generated
by welding, grinding, and general construction activity of the three
unit outages was present in the area around the operating Unit 1 and
.-
Unit 2 LPSW pumps. The motor intake grills were observed.to have some
debris encrusted upon them. There was debris around the Unit 3 pumps,
but they were not operating (fuel was removed from the reactor vessel at
the time). The licensee responded to the immediate concern by cleaning
areas around the pumps and changing the Operations round sheets to have
the non-licensed operators not only walkdown the area but also inspect
the motor intake grills. The licensee also generated PIP 0-96-2478.
The inspector asked for and received loaded motor stator and bearing
temperature data that indicated that the motors were not under heat
duress during the recent ES testing. At the time, the turbine building
temperatures were cooler than when at power. However, as indicated
above, the dirt seen in'the RCW motor was primarily concentrated at the
Enclosure 2
.
10
six o'clock position and probably would not contribute to motor over
heating.
The residents reviewed the licensee's motor Preventive Maintenance (PM)
program. The program did not routinely clean the ventilation ducting or
windings of the unfiltered motors. The licensee recently initiated a
motor PM to perform testing of selected safety-related motors in
accordance with MP/0/A/3009/017, Visual PM Inspection and Electrical
Motor Tests, dated January 9, 1997. The procedure includes a visual
check of the exterior of the assembled motors. Previously, the licensee
only performed voltage to ground checks on motors. The licensee's
current program, which ascribes to the guidance provided by an Electric
Power Research Institute (EPRI) document (Electric Motor Predictive and
Preventive Maintenance Guide), is more comprehensive. The electrical
checks, such as the Insulation Resistance and Polarization Index (PI)'
tests performed by the above procedure, are indicated to be trendable
information in Table 4-1 of the document. However, these tests are
stated to provide basic information if the insulation is clean and dry
(page 5-3 of the guidance document). Page 4-2 of the guidance did not
reflect the above information in that it stated that the PI test is a
good test for determining the overall condition of the insulation.
Again, these new electrical tests have just been recently initiated and
iterative information is not available. The inspectors had observed
some recent testing and understood that for the first test performance,
the motors appeared'to have acceptable initial test values.
The EPRI document gives further guidance on visual inspections. The
document indicates "that the decision to dismantle a motor for
inspection was expensive and-disruptive. The decision should be
evaluated based on the analysis of trendable.tests [the inspectors
assumed a number of iterative tests], any abnormal noise or odor,
unexplained operation of protective relays, and industry experience with
similar motors.... However, in certain cases, visual inspection
[disassembled] is an accepted means of evaluating physical condition of
stator windings, rotor windings, and magnetic cores."
In the case of
the LPSW pump motors, the argument could be made that the RCW motor was
a similar motor in that it was in the same environment, about the same
inservice time, and in similar continuous service.
Given the implication this failure has on safety-related equipment,. the
inspector will continue to pursue the issue with the licensee. .This
issue shall be tracked as Inspector Followup Item (IFI) 50
269.270.287/96-20-02, Unfiltered Motors.
c. Conclusions
Receht failure of the 1B RCW motor was due to its in service
environment. The licensee did a thorough evaluation of the specific
failure. However, the inspector will continue to pursue implications of
this failure with the licensee.
Enclosure 2
III. Engineering
El
Conduct of Engineering
E1.1
Integrated Emergency Power Supply Electrical Testing
a. Inspection Scope (61701)
a.1 Background.
On September 19, 1996, NRC met with Duke Power Company (DPC) to discuss
proposed integrated testing of the Oconee emergency electrical
distribution system. DPC's described tests that were to be conducted .in
late 1998 or early 1999. These tests were .conceptually described in a
DPC submittal dated October 31, 1996.
On September 24. 1996, a drain line rupture event on a Unit 2 reheater
drain line resulted in DPC's decision to shutdown all three Oconee
units. NRC sent a letter to DPC on October 18, 1996, requesting that
the licensee review the possibility of performing electrical system
tests during the three unit outage. On November 21, 1996. DPC stated in
a letter to the NRC their intentions to perform.a one-time, integrated
emergency power engineered safeguards functional test as described in
the October 31, 1996, letter.
On December 3, 1996, the NRC sent a letter to .DPC requesting information
about special considerations wi.th respect to shutdown risks during the
performance of the functional tests. Information on DPC considerations
relating to control of reactor pressure, reactor coolant temperature,
reactor vessel water level, shutdown margin, and contingencies was
requested. On December 11, 1996, (with supplements dated December 17,
19. and 26) DPC requested amendments to the Oconee Technical
Specifications (TS) to address their determination that an unreviewed
safety question existed in that the testing exceeded that which was
described in the Final Safety Analysis Report (FSAR).
On January 2, 1997, the NRC issued Amendment Nos. 220, 220, and 217 to
the TS of Oconee Units 1, 2, and 3, respectively. The amendments
concluded the FSAR change which referenced the submittal describing the.
electrical system functional tests was acceptable. Testing of the
Oconee emergency electrical distribution system in accordance with test
Procedure TT/O/A/0610/025, Emergency Power and Engineered Safeguards
Functional Test, commenced after receipt of the TS amendments.
a.2 Test Inspection
The inspectors observed licensee test activities for the six tests which
were conducted in accordance with test Procedure TT/O/A/0610/025.
Inspectors monitored test activities from both control rooms, the Keowee
Hydro Station, Lee Turbine Units, and other selected locations in the
Enclosure 2
12
plant. Licensee pre- and post-test briefings were also monitored.
Licensee personnel provided daily debriefs to the inspectors regarding
disposition of deficiencies identified during testing.
Tests were designed to demonstrate a critical or worst case scenario
related to performance of the electrical systems. Monitoring and
recording instrumentation was installed at points throughout the
electrical and mechanical systems to allow sufficient verification of
correct system performance.. Each test involved the simulation of a loss
of offsite power with specific acceptance criteria defined in the
procedure.
b. Observations and Findings
b.1 Test Objectives
Major test objectives were to demonstrate the ability of the Oconee
emergency power system to accept loads in six different loss of coolant
accident/loss of offsite power (LOCA/LOOP) or LOOP scenarios; to
accumulate data for post-test engineering analysis of the emergency
-power.system performance; and to demonstrate the ability of the
Engineering Safeguards equipment to operate in four different LOCA/LOOP
scenarios. The six test scenarios involved:
Block loading of three unit LOOP loads-onto the Keowee underground
power supply from Keowee standby condition (Test 1)
Block loading of three unit LOOP loads onto the Keowee~overhead
power supply after Keowee load rejection and switchyard isolation
(Test 2)
Block loading one unit LOCA and one unit LOOP loads onto-the
Keowee underground power supply from Keowee standby condition
(Test 3)
Block loading one unit LOCA and one unit LOOP loads onto the
Keowee underground power supply simultaneously after.a Keowee load
rejection (Test 4)
Block loading single unit LOCA followed by two unit LOOP loads
onto the Keowee underground power supply after a Keowee load
rejection (Test 5)
Block loading single unit LOCA followed by two unit LOOP loads
onto a Lee combustion turbine power supply (Test 6)
For each of the tests, inspectors walked down.the 4.16 KV safety-related
switchgear and selected 600V switchgear immediately before the test to
verify circuit breaker positions, protective relay status, and power
monitoring instrumentation. During the tests, the inspectors observed
Enclosure 2
- II13
breaker operations and voltmeters. The inspectors determined that-the
testing described above.was conducted in accordance with the licensee's
test procedure.
b.2 Conduct of Testing
Test Preparation Activities
Refer to Section 05.1.
Pre/Post-Test Briefings
Prior to ea-ch test, the licensee conducted pre-test briefings for all
personnel involved in testing. Pre-test briefings were conducted by a
manager specifically assigned oversight of testing and the test
coordinator for each test. The manager emphasized nuclear safety as the
primary focal point of his portion of the brief. The test coordinator
emphasized test evolution control and communications: The coordinator
exhibited a questioning attitude to assure all present understood the
test, their responsibilities, and duties. The inspectors considered the
pre-briefs conducted prior to each test to be thorough and they
appropriately emphasized nuclear safety.
After completion of each test, a post-test brief was conducted by the
test coordinator with all personnel involved in the test. These briefs.
focused on data acquisition results, test acceptance criteria, lessons
learned, necessity for procedure changes prior to continuing, equipment
repairs, and other concerns. Again, a questioning attitude was
.
demonstrated by the test coordinator to assure that all who participated
in the test identified any concerns so that appropriate resolution of
issues would be accomplished prior to test-resumption. The inspectors
considered the test post-briefs to be thorough and they appropriately
addressed issues requiring resolution prior to continuation of testing.
Control Room Activities
The inspectors monitored testing activities from the Unit .1/2 control
room and the Unit 3 control room.' The test coordinator was located in
the Unit 1/2 control room for all testing. The inspectors noted during
the first test, that the Unit 1/2 control room activity and response to
annunciation after test initiation could have been improved. Unit 1/2
control room activity and response to annunciation for subsequent
testing was improved. Command and control in both control rooms during
all testing was good. Control room briefi-ngs for the Operations crew
were conducted by the Operations Shift Manager prior to each test'
initiation. These briefings were good and focused on Nuclear Safety and
the appropriate response by operators in the .event of equipment
problems. Operators were observed while performing-test.steps. Good,
communication/coordination/verification techniques were noted. The test
coordinator maintained good control of all test evolutions. The
Enclosure 2
14
inspectors concluded testing activities conducted in the Unit 1/2 and
Unit 3 control rooms were good and operators maintained appropriate
focus on nuclear safety at all times.
Keowee Hydro/Lee Combustion Turbine (CT) Units' Activities
The inspectors observed activities in the Keowee Hydro Units (KHU)
control room (CR) during the performance-of TT/O/A/0610/025. The KHUs
met the acceptance criteria for all six tests. The inspector did not
identify any abnormal operation or annunciation in the KHU CR during the
performance of TT/0/A/0610/025. Activities in the CR were adequately
controlled by the Keowee operat.ors. Continuous communications with the.
Oconee test coordinator were established without any problems. The
Keowee operator and several other key KHU personnel attended the pre-job
briefings and.post job briefings. There were no issues raised by KHU
operators.during the post job briefings.
The inspectors witnessed the startup and operation of the 6C Gas Turbine
at the Lee Steam Station for the block loading of an Oconee single unit
LOCA followed by two unit LOOP loads during the sixth part of
TT/O/A/0610/025.. The activity was accomplished in accordance with the
Lee Steam Station Procedure. Emergency Power or Backup.Power to Oconee.
and no deficiencies were noted.
Other Plant Testing Activities
At the switchgear locations, inspectors observed that the pre-test
alignments were according to the procedure. Inspectors also observed
that.monitoring and recording instruments were installed per-the
procedure. This instrumehtation recorded current, voltage and power.
The inspectors observed that buses were re-energized at times consistent
with the expected system performance, and there'were no unexpected
voltage excursions that could be seen from observing the voltmeters.
The inspector noted that the licensee had test engineers and technicians
stationed at the switchgear locations. The inspectors noted that these
engineers and technicians were experienced in performing testing. The
inspectors concluded that observed test activities were conducted in a
good manner.
b.3 Test Results
Test Procedure TT/O/A/0610/025, Emergency Power And Engineered
Safeguards Functional-Test, provided acceptance criteria for each test
as follows:
Test 1 - Both Keowee Units.emergency start from simulated LOOP
actuation. The Keowee underground power supply unit obtains rated
speed and voltage less than or equal to 23 seconds after emergency
start actuation. Each Oconee unit automatically transfers-to
receive power from the Keowee underground power suppl.y.
The
- ..
Enclosure 2
15
connected 4 KV motors and. 600V component cooling pump LOOP loads
start, accelerate, and continue to.operate until secured.
Test 2 - Both Keowee Units emergency start from simulated LOOP
actuation. The Keowee overhead power supply unit separates from
the system grid on emergency start actuation. The switchyard
isolation logic properly isolates the Yellow bus from the system
grid. The connected 4 KV motors and 600V component cooling pump
LOOP loads start, accelerate, and-continue to operate until
secured.
Test 3 - Both Keowee Units emergency start on engineered
safeguards actuation. Oconee Units 1 and 3 automatically load
shed and transfer to receive power from the standby bus. The
Keowee underground power supply unit accepts load at reduced
voltage and frequency. Connected Unit 3 4KV motor and 600V LOCA
loads start, accelerate, and continue to operate until secured.
The connected non-load shed loads are-energized following the
transfer to the standby bus. All ES 'actuated Motor Operated
Valves (MOVs) operate to their ES position. LPI flow is greater
than or equal to 2800 GPM per pump in less than or equal to 48
seconds. The licensee revised their test-procedure to start the
underground Keowee unit without pre-lube on its lower bearing;
this provided a more realistic start configuration for the unit.
The start time for the affected unit was not affected.
Test 4 - Both Keowee Units emergency start on engineered
safeguards actuation. Oconee Units 1 and 3 automatically transfer
to receive power from the standby bus. The Keowee Unit
underground power supply Air Circuit Breakers (ACBs) open on
emergency start actuation. Connected Unit 3 4KV motor and 600V
LOCA loads start, accelerate, and continue to operate until
secured. The connected non-load shed loads are energized.
following the transfer to the standby bus. All ES actuated MOVs*
operate to their ES position. LPI flow is greater than or equal
to 2800 GPM per pump in less than or equal to 48 seconds.
Test 5 - Both Keowee Units emergency start on engineered.
safeguards actuation. The Keowee Unit underground power supply
ACBs open on emergency start actuation. Each Oconee unit
automatically transfers to receive power from the standby bus.
Connected Unit 3 KV motor.and 600V LOCA loads start, accelerate,
and continue to operate until secured. The connected hon-load
shed loads are energized following the transfer to the standby
bus. All ES actuated MOVs operate to their ES position. LPI flow
is greater than-or equal to 2800 GPM per pump in less than or
equal to 48 seconds.
Test 6 - Each Oconee Unit automatically transfers to receive power
from-the standby bus energized by a Lee CT. Connected Unit 3 4KV'
Enclosure 2
16
motor and 600V LOCA loads start, accelerate, and continue to
operate until secured. The connected non-load shed loads are
energized following the transfer to the standby bus. All ES
actuated MOVs operate to their ES position. LPI flow is greater
than or equal to 2800 GPM per pump in less than or equal to 48
seconds.
The inspectors monitoring the test were able to observe that the
generators, control circuits, key valves, large motors, and pumps met
the specific acceptance criteria during the tests. The licensee, during
each test, verified and. recorded whether any overcurrent devices had
actuated. Status of the overcurrent devices was an indicator that
adequate voltage was provided throughout the system, and factored into
the decisions to proceed with the next test segment. The licensee .
reviewed test results after each test was conducted and concluded that
test acceptance criteria was met. The inspectors reviewed available
data after each test and independently determined acceptance criteria
was met. The licensee will be providing a test report to the NRC after
all data is reviewed and validated.
b.4 Deficiencies Identified During Testing Requiring Further Disposition
Blown fuse in control circuit for 3A CC pump
During performance of Test 1, the licensee recorded that nonsafety
related Component Cooling pump 3A was not running. This was a test
anomaly in the sense that this pump was not.load shed, and should have
run after re-energization of the bus. This pump was powered by a 60-hp
motor fed from a motor control center. Trouble-shooting identified that
the fuse on the secondary side of the control power transformer had
blown. The fuse that had blown was rated 3-amp, and was.a Gould Shawmut
style OT. Persons doing the trouble-shooting noted that the Control
Fuse Replacement List indicated a 4-amp Bussman style FRN fuse for .this
particular model and size of motor controller, and therefore they
replaced. the.blown OT-3 with an FRN-4.
PIP 3-097-0040 was written to evaluate this potential fuse control
problem. As part of the PIP evaluation, the control circuit fuses for
the six Component Cooling pumps were -inspected. Each control circuit
had two primary fuses and one secondary fuse. A total of seventeen
fuses were inspected, twelve primary and five secondary. The PIP stated
that one secondary fuse was a 3-amp NON style fuse by Bussmann Co. and
four secondary fuses were 6-amp NON fuses. The Control Fuse Replacement
List recommended Bussmann Co. time-delay, dual-element fuses. The OT
and NON fuses were non-time-delay fuses, and therefore, were suspected
of being incorrect for the application. After review of the time
current characteristics of the'OT-3 and NON-3 fuses (which were very
similar) as compared to the inrush current of the contactors in the CC
pump circuits, the inspectors noted that these fuses may have been too
fast acting for the application. A review of work requests for the CC
Enclosure 2
17
pumps indicated that-the OT-3 fuse in the 3A Component Cooling pump
circuit blew, and had been replaced in July 1994. The primary side
fuses in the CC pump control circuits were acceptable for the
application.
The licensee was continuing to evaluate the above information and
ramifications with regard to the overall fuse control program for
nonsafety-related circuits and system loading in relation to test
results. The licensee stated that control over safety-related fuses was
not in question, because they had just completed a program of field and
design verification for all the safety-related fuses. The determination
by the licensee was that total system loading remained sufficient to
meet test objectives. Section E1.2 further addresses this issue.
Overload relays trip reactor building cooling units
The safety-related reactor building cooling units (RBCUs) are driven by
two-speed motors. When the control switch is placed in high speed mode,
the motor starts in low speed, runs for about 25 seconds-(timer set
point) then transitions to high speed. A three second time delay is
inserted between de-energizing the low speed contactor.and energizing
the high speed contactor. An Engineered Safeguards (ES) signal
overrides th.is control sequence. Upon an ES signal, the RBCUs run in
slow speed with the thermal overload relays bypassed.
Pre-test alignment required two RBCUs per unit to be running in high
speed. During.Tests.1 through 5, one RBCU tripped on overload, and
during Test 6, two RBCUs tripped on overload. The 1B RBCU tripped
during Test 5. The IC RBCU tripped during Tests 3, 4 and 6. The 2A
RBCU tripped .during Tests 1 and 2. PIP 2-097-0044 was written to
evaluate this situation as a test anomaly.
Trouble-shooting; monitoring instrumentation data, observation., and
evaluation led the licensee to the following cause for these trips.
Following a LOOP, when power was restored to a previously running RBCU,
the cooldown period for the high speed thermal overload relays was about
61 seconds maximum (28 seconds due to the control timers plus the LOOP
time of not more than 33 seconds). When the still hot high speed
thermal overload relays were subjected to starting inrush current.into
the high speed winding, they were very close to tripping. Thermal
overshoot phenomenon caused tripping a few seconds after current had
returned to normal running current.
The inspectors reviewed the relevant elementary diagrams to confirm
operation of the control circuit. -The inspectors concluded that the
safety significance of the high speed overloads tripping on the RBCUs
during the test did .not affect test results. This was based on the fact
that the safety-related function of the RBCUs was to run in low speed
with the. overloads bypassed. In other modes of operation, the motor
windings should be protected by the combination Of control'timers and.
Enclosure 2
18
thermal overload relays.
Since the RBCUs did start and run for a brief
period, their load was present during critical times from an electrical
systems performance perspective.
c. Conclusions
The inspectors concluded that integrated testing of the Oconee emergency
power system was satisfactorily accomplished in accordance with the
licensee's test procedure and that deficiencies identified during
testing were, or'will be.resolved in accordance with the licensee's
problem investigation process. Control of all test activities was good.
Positive observations were made relating to test briefings, control room
briefings, and communication/coordination of test evolutions.
E1.2 Fuse Control Program (37551)
Inspection Scope
The inspector reviewed the method which the licensee utilizes to address
fuse failures. The inspection effort incTuded reviewing the licensee's
Maintenance Directive 4.4.12, Preliminary Engineering Support Program on
Observations *and Findings
Maintenance Directive 4.4.12 establishes guidelines for the replacement
of fuses once a failure occurs. A root cause evaluation is to be
conducted by engineering once a failed fuse is identified unless the
fuse failed because of a true overcurrent condition. The licensee will
be revising Maintenance Directive 4.4.12 to include Drawing OEE-36A,
Control Fuse Replacement List, which identifies.fuses which should be
used in Motor Control Centers, and to make reference to generating PIPs
as necessary. The licensee is developing an engineering support program
on fuses which should be completed in the near future.
The licensee recently completed-a configuration control inspection,
which has been going on since 1991, on all safety-related electrical
cabinets. In part, the inspection included removing fuses and verifying
that the fuses were the correct size and manufacturer. The inspector
accompanied the licensee on their final inspection of the last two
electrical cabinets. No discrepancies were identified during this stage
of the inspection. At this time, the licensee does not anticipate
performing inspections of nonsafety-related electrical cabinets.
Nonsafety-related fuse problems are to be resolved via Maintenance
Directive 4.4.12.
The inspector reviewed past and present PIPs involving fuses. The
licensee has identified several fuse issues and has appropriately
addressed them. The only significant issue is'already addressed as
Unresolved Item (URI) 269,270,287/96-17-03, RBCU Operability Concerns
- .Enclosure
2
19
Due to Wrong Type Fuse In Control Circuit. Regarding unit restart, the
correct fuses were subsequently installed in Units 1, 2, and 3 under WOs
97008569. 96006532, and 96101374, respectively. As there is no present
RBCU fuse operability concern, the URI will be addressed by an NRC
Regional inspector at a later date.
Conclusions
The inspector concluded that the licensee's fuse control programs
adequately address the resolution of.fuse failures.
E1.3 Inadvertent Draindown of the Unit 3 RCS (37551).
a. Inspection Scope
The inspector reviewed the actions taken by the licensee with respect to
the February 1.'1997, inadvertent diversion of water from the Unit 3 RCS
to the Borated Water Storage Tank (BWST). The inspector reviewed the
recovery actions, control board indications, operator logs, and computer
trends. At the time, Unit 3 had completed refueling, the reactor head
was installed, the RCS was at atmospheric pressure (primary hand holds
were open on the Once Though Steam Generators (OTSG)
-and three CRD' vents
were open), and there was very little decay heat '(outage length greater
than 120 days).
b. Observations and Findings
The Unit 3 LPI system is a dual train system used to remove decay'heat
from the reactor fuel. It takes a suction from the bottom of one of the
two RCS hot legs and discharges through two separate heat exchangers,
where the RCS fluid is cooled, and then returned to the RCS via two
separate discharge paths. There is a branch off-each injection train
for pump testing that leads to a common line to the BWST. These branch
test lines, which contain isolation Valves 3LP-40 (3A LPI Header Test
Line Valve) and 3LP-41 (3B LPI Header Test Line Valve), discharge to the
BWST via a common line through isolation Valve 3LP-42 (Return to the
BWST).
On February 1..1997, at approximately-7:00 p.m., a primary Non-Licensed
Operator (NLO) was dispatched to open Valve 3LP-42 for a visual leakage
inspection (VT-2) of the welds downstream of 3LP-40.This line had
recently been.modified per Minor Modifications ONOE-8857, ONOE-8859,
ONOE-8860. and ONOE-8953. Valves 3LP-40 and 3LP-42 had been replaced
and the associated piping reconfigured as described above.
At 7:55 p.m., on February 1, 1997, a control room operator observed RCS
level at approximately 22 inches on reactor vessel level indicator LT-5,
and decreasing. (Just prior to Valve 3LP-42 being opened, reactor
vessel level was stable at 80 inches on LT-5.)
The operators
immediately started makeup to the RCS and closed 3LP-14.("B" Injection
Enclosure 2
20
Train LPI Cooler Discharge Valve). From the time that level was.
observed to be dropping until the operators closed 3LP-14, approximately
three minutes past. The operators reviewed the actions in Abnormal
Procedure AP/3/A/1700/26 Case "C", Loss of Decay Heat Removal.
During
the event, RCS level decreased to 18 inches (as indicated by LT-5) with
make-up to the RCS in progress. Later, the licensee calculated that
actual RCS level never decreased to less than 50 inches (the LT-5 level
indication was incorrect due to the rapid RCS pressure decrease caused
by the loss of inventory). -Approximately 4000 gallons in five minutes
were added by the operators to the RCS. to return level to normal (80
inches on LT-5).
Decay heat removal was not lost during the event. The
licensee notified the NRC resident inspector at approximately 10:45 p.m
as.a courtesy and the inspector promptly responded to the site (11:15
p.m.).
The control room subsequently contacted the NLO to close 3LP-42.
Investigation identified that Valve 3LP-40 was open. Operations
personnel attempted to close the valve, turning the valve operator in
the clockwise direction. Investigation further revealed the.valve
operated in the reverse.direction (clockwise to open, counterclockwise
to close). Although Valves 3LP-40 and 42 were bought at the same time,
under the same purchase order and specification, Valve 3LP-42 was
clockwise to close. The licensee initiated PIP 3-097-0439 and initiated
. an Event Investigation Team to evaluate the event.
The licensee is investigating the procurement, installation, and test
requirements of Valve 3LP-40, as well as attendant modification details.
The NRC will review: the results of the licensee's team; valve
- modification functional test requirements; modification piping pressure
requirements: valve receipt inspection requirements: valve vendor
- requirements: and other germane aspects. The issues associated .with
this event will be tracked as URI 50-287/96-20-03. Loss of RCS
- Inventory.
Following the draining event, the licensee realized that the piping
pressure rating and drawings had not been updated. This resulted in
requiring a hydrostatic test of the modified piping at.approximately 650
psig in lieu of the original test pressure (i.e., head pressure of the
BWST). Licensee review and approval of the modification failed to
identify the preferred.change in piping class and pressure rating.prior
to implementing the modification. This is recognized as an engineering
- weakness.
c. Conclusions
Shift personnel acted promptly and conservatively to stop the event and
identify the cause of the loss of RCS inventory. An engineering
weakness involving modification review and approval was identified.
Pending further review,'this event is being addressed as an URI.
Enclosure 2
21
E1.4 Unit 2 Reactor Building Material Condition
a. Inspection Scope (37551, 92903, 92902. 92901. 71707)
The inspectors reviewed reactor building (RB) closeout issues during the
inspection period. Several material condition items were identified.
b. Observations and Findings
During this period, the inspectors evaluated the licensee's close-out of
the RBs, particularly the Unit 2 RB as it was prepared.to return to
power .operation.
Reflective of the fact that the licensee had no proceduralized RB
closeout, a number of conditions were encountered by the residents that
required technical evaluation by the licensee. Tape, loose paint, and
insulation without supporting documentation were found in significant
quantities in various locations in the Unit 2 RB. These were of concern
due to the requirements of 10 CFR 50.46 to ensure long-term cooling.
Until canceled on April 16, 1996, the licensee had a Quality Assurance
walkdown procedure (Procedure QAD-1 Nuclear Inspection Program.
Housekeeping Inspection) that included the RB, but it was limited in
nature and was only performed after a refueling outage. It was not
scheduled to be performed after this protracted Unit 2 forced outage.
After the inspectors had identified a number of discrepant items in the
Unit 2 RB, QA and maintenance did perform a more complete material
condition closeout inspection.. Much tape, paint. and insulation were
removed from the Unit 2 RB, and later in the Unit .1
RB (Unit 3 exhibited
similar conditions, but was still in its refueling .outage and not ready
for closeout). Operations had a section.in their startup procedure
(OP/2/A/1102/01 Enclosure 4.8. Reactor Building Checklist at Hot
Shutdown) that required them to walkdown the RB. There was not a pre
startup material condition inspection requirement in that procedure.
Licensee RB closeout had been performed on an on-the-job performance
basis by the RB maintenance coordinator with no clear implementing
procedure guidance. Standard licensee RB material policy was to replace
like for like on an as needed basis. The material condition instruction
for the site (NSD 104. Housekeeping.Material Condition, and Foreign
Material Exclusion) did not specifically address the RB. Power
Chemistry Materials Guide Program, SDQA Plan "D", did not address
insulations and tape used in the RBs. There were specific coatings
identified for use in the RB,.but the licensee had yet to schedule
maintenance of the deteriorating liner coating conditions found in the
Unit 2 RB prior to the December 1996 NRC tours.
As required by 10 CFR 50 Appendix B, Criterion V. quality related
activities must be prescribed by procedure.. The licensee did not have.a
procedure to ensure the RBs were returned to proper material
configuration prior to power operation. This is identified as Violation
Enclosure 2
22
(VIO) 50-269,270,287/96-20-04, Failure to Have RB Material Condition
Closeout Procedure.
During the inspection period, the licensee removed material from the
Unit 2 RB to ensure a recirculation flow path during emergency
conditions and due to the fact that for certain fibrous insulation and
tape present in the RB there was no clear specification for its use.
The inspectors questioned the acceptability of the licensee's evaluation
for past RB recirculation operability (OSC-6827, Rev 0, Oconee Nuclear
Station Units 1, 2. and 3 Emergency Sump Operability Evaluation, dated
January 24, 1997). At the end of the inspection period, the licensee
was re-evaluating past operability conditions for the RBs.
Until this
re-evaluation can -be completed by the licensee and it can be
appropriately reviewed by the NRC, this item is identified as URI 50
269,270.287/96-20-05, Past Operability of RB Recirculation Flow Path.
c. Conclusions
A violation was identified because the licensee did not have a
programmatic material condition RB closeout procedure.
The lack of a
procedure (organized program) resulted in a poor understanding of RB
material condition and past operability RB recirculation flow path ,
concerns. Pending further inspection, this issue is being addressed as
an URI.
E2
Engineering Support of Facilities and Equipment (71707, 37550, 37551,
92903, 40500)
E2.1 Generic Letter (GL) 96-06, Assurance of Equipment Operability and
Containment Integrity During Design Basis Conditions
a. Inspection Scope
The resident inspectors were involved with review of GL 96-06 related
site activities, observed operational and plant changes that emerged,
and attended Plant Operational Review Committee meetings on the subject
prior to restart.
b. Observations and Findings
Based on their review of the plant design basis and equipment history
with regard to the GL issues,'the licensee took actions to ensure the
units met the intent of the GL prior to restart. The licensee's-actions
were as follows:
-
performed a safety-related systems water hammer modeling study to
the extent necessary to comply with the GL and provide short-term
actions for re-start
Enclosure 2
23
made a 10 CFR 50.72 report on January 24 regarding a technical
issue discovered during the above modelling
-
made plant configurational changes to mitigate possible
operational problems for issues discussed in the GL
-
issued a response to the GL by the date specified (January 28)
The licensee had made two configurational changes to Unit 2 prior to its
restart. Similar changes are expected for the other units prior to
their restart. The changes were as follows:
The auxiliary fan coolers in the RB were drained and isolated.
This prevented any potential water hammer in the LPSW system
during certain accident conditions discovered in the above
modelling. Although the computer model identified potential water
hammer in this piping, historically, the licensee had no visual
evidence of water hammer nor was it observed during the recent ES
testing (an engineer.had been stationed by the potentially'
affected piping during tests on January 2 - 6).
-
Several pipe runs between-valves in the RB could be susceptible to
overpressurization during certain accident conditions. These
piping runs were partially drained to allow for water expansion
during heating in postulated accidents.
c. Conclusions
- The licensee made a concerted effort in addressing the issues of GL'96
06 as it relates to the Oconee design basis. Their long-term GL
response concerning RB penetration over pressurization and water hammer
is scheduled for issue by April 15 and August 1, 1997, respectively.
E2.2 2LP-18 Pressure Locking Issue
a. Inspection Scope
.
- The
inspectors reviewed the licensee's actions in relation to an
operability issue associated with Unit 2 containment isolation Valve
95-1440 that had been generated by the licensee regarding this issue,
and then observed the licensee's activities to resolve the operability
concern.
b. Observations and Findings
The licensee was performing PT/2/A/0150/15B, Intersystem LOCA Leak Test,
on January 31, 1997, on the LPI piping. This test.verified that the RCS.
check valves properly seated. At the beginning of the test for check
Valve 2CF-13, the system pressure was indicated to be 830 psig on
Enclosure 2
24
pressure indicator 2LPIPG1043. This meant that the RCS side check valve
had not fully seated and that the section of piping between the RCS
check valve and LPI isolation Valve 2LP-18 was pressurized to existing
RCS pressure. In accordance with the test procedure, the pressure was
then bled off to approximately 300 psig. The RCS check valve
subsequently seated. At-the time the technician read the 830 psig, his
procedure did not address higher pressures in the line and he did not
recognize that system pressure could have pressurized the valve bonnet
and the area between the valve's double disc; thereby hydraulically
locking the valve and making it unable to open.
On-February 3, 1997. the engineers associated with the test realized the
potential significance of the high pressure during the test relative to
the subject double-disc valve. Based on the evaluation in PIP 97-0487
on February 5, 1997, Operations declared the affected train of LPI
inoperable and entered a 72-hour Limiting Condition for Operation (LCO)
per TS 4.5.1.2.1.
Procedure TT/2/A/0150/046, Functional Verification Procedure for 2LP-18,
was generated and approved to stroke the valve and eliminate any
possibility of a pressure binding issue and to assureoperability of the
valve. The valve was successfully stroked on February 6, 1997, per the
approved procedure and the valve/system was declared operable before the
LCO expired. The inspectors were present for the stroke test.
Generic Letter (GL) 95-07, Pressure Locking And Thermal Binding Of
Safety-Related Power-Operated Gate Valves, was issued in 1995 by the NRC
to address the issue of valve pressure locking and to alert the licensee
of the potential thermal hydraulic locking of certain double disc .
valves.
This problem was captured in PIP 95-1440 by the licensee. The
corrective .action for the PIP had already modified the Unit 3 LP-17 and
18 valves and had the Unit 1 and 2 valves scheduled for modification
during their next refueling -outage.
The licensee initiated intersystem LOCA surveillance PT/2/A/150/15B on
January 31, 1997. When PIP 95-1440 was evaluated to have the subject
valves (2LP-17 and 2LP-18) modified to prevent pressure locking, the
surveillance was not modified to recognize the potential impact when the
RCS check valves failed to reseat above a critical pressure for the
subject valves.
c. Conclusions
Once the licensee identified the pressure-locking potential associated
with 2LP-'18, their efforts were appropriate. However, the intersystem
LOCA surveillance had not been modified to recognize the potential
impact when the RCS check valves failed to reseat above a critical
pressure for Valves 2LP-17 and 2LP-18. This indicated a.weakness in
-the
operating experience and PIP-data base integration into the testing
program.
Enclosure 2
25
E.2.3 Testing of Unit 2 Moisture Separator Reheater (MSR) Drain System
Modifications
a. Inspection Scope
The Unit 2 MSR drain system experienced a pipe rupture on September 24,
1996. Prior to the Unit 2 restart, the inspectors reviewed the test
procedures and activities related to testing the MSR drain system (NS.M
ON-22941 discussed in Inspection Report 96-17). Also, during power
escalation and steam admission to the secondary piping, the residents
were oh hand to observe the licensee's test efforts,.as well as the
modification's impact on secondary plant piping and its operation.
b. Observations and Findings
The inspectors reviewed the MSR drain system modification test
procedures prior to Unit 2 restart and found them to be adequate.
Implemented during startup of the Unit 2 modified MSR drain system,
these procedures were utilized to evaluate the automated MSR drain
system controls during main turbine generator (MTG) warmup, startup, and
power ascension to 30 percent of plant rated ca-pacity, as well as to
monitor the drain system for water hammers or other affects that could
be damaging to plant equipment or personnel.
During the period between reactor startup and power ascension, no
personnel were required to enter the potentially hazardous secondary
areas for valving operations. The modifications had eliminated the need
for general personnel entry. Additionally, until-new welds.and the
modification performance could be evaluated, licensee management had
clear controls to prevent inadvertent.entry into the potentially
hazardous areas.
For observation purposes, engineers were posted at safe locations around
the potentially hazardous areas. The licensee's engineers were
positioned throughout the plant during the startup to monitor plant
performance and document any disturbances identified. Additionally,
,remote cameras were placed in three locations for monitoring.
The test procedures utilized were as follows:
- TT/2/B/0271/011, Controlling Procedure for NSM ON-22941, 2MS-112
and 2MS-173 Controls and.,Heater Drain Upgrade Post Modification
Testing. The purpose of this procedure was to monitor and.
document the performance of the secondary testing activities, to
provide engineering oversight, and to provide a means of
evaluating performance of the modified equipment.
- TT/2/B/0271/012, Controlling Procedure For NSM ON-22941 for
Testing and Tuning the Moore Controllers Associated With 2MS-112,
Enclosure 2
26
2MS-173, 2HD-92, 2HD-95, 2HD-37, and 2HD-52. This procedure
tracked changes in the input/output signals of the new automated
Moore secondary valve controllers, provided instructions for data
collection, and ensured proper controller tuning during plant
startup and operation.
The MTG was taken off its turning gear with. the reactor at 15 percent
power and was brought to the operating speed of 1800 rpm on February 3,
1997. When the MTG was connected to the electrical grid at 10:06 p.m.,
somewater/steam hammers were noted at the first and second stage heater
drain tanks and associated piping. Approximately 5 to 6 water/steam
hammers with associated side to side pipe movement of about 3 to 5
inches in one plane (6 to 10 inches total swing) were observed over
approximately a five minute period.
There was no damage to piping or
hangers identified as a result of the water/steam hammers. The hangers
for the second stage heater drain tanks and associated piping had been
modified during the plant outage to eliminate rigid mounted hangers and
to support the heater string piping with a more floating type of support
system that allowed more flexibility and energy dissipation: This new
flexibility appeared to minimize the impact of steam/Water hammers to
the system.
c. Conclusions
Although some water/steam hammers were noted.during plant startup, the
licensee's efforts were effective in minimizing this problem. The
modified MSR drain system automated controls performed well and
eliminated the need for manual operation of the associated valves with
the unit operating at power: This reduced the potential personnel
hazards involved with secondary plant operation.
E.2.4 Design Changes and Plant Modifications
a. Scope
The inspector reviewed engineering activities associated with the design
and implementation of two Unit 3 electrical Nuclear Station
Modifications (NSMs) to determine if the.design controls and
installation practices were consistent with the 'guidance of the
licensee's implementing procedure NSD-301, Nuclear Station,
Modifications, Revision 10: licensee c'ommitments; and NRC regulatory
requirements.
b. Observations and Findings
The NSMs reviewed are as follows:
NSM-32962, "Replace Operator Aid Computer"
NSM-32873; "Modify MFDW Control on MSLB"
Enclosure 2
27
The inspector reviewed the theory and assumptions for the nuclear
station modifications and 10 CFR 50.59 Safety Evaluation for the changes
and determined that they were adequately reviewed/evaluated and that no
unreviewed safety questions were identified.
Nuclear Station Modification NSM-32962
This NSM provided for replacing the existing nonsafety-related Honeywell
Operator Aid Computer (OAC) on Unit 3 with an open architecture, data
acquisition system that can utilize commercially available components.
The field installation work on Unit 3 OAC replacement-was over 90
percent complete. The new OAC installation involved rewiring
approximately 1200 analog inputs and 2000 digital inputs from the
existing OAC. The inspector found that the new OAC equipment was
installed in existing analog and digital input cabinets utilizing
terminal strip racks and swing arm devices that were fabricated to
accommodate installation of the new equipment. Some of the cabinets had
been removed because they were no longer needed with -the new equipment.
The terminal strip racks and connectors were pre-assembled, wired and
tested in special trailers that had been setup specifically to. support
the 0AC modifications. This reduced the required installation time in
the field.
The inspector observed that the field routed cables were
labeled, neatly bundled and terminated on the terminal blocks.
The
licensee had approximately 200 data points that had been temporarily
wired to the Honeywell 45000 0AC to support the outage. These 200
points still remained to be rewired to the new 0AC. The licensee
indicated that a significant amount of testing remained to be completed,
including startup testing. Although the OAC is a nonsafety-related
system, it interfaces with safety-related systems such as the Inadequate
Core Cooling Monitor (ICCM).
The inspector examined some of the details
associated with these interfaces and found them to be acceptable.
The licensee had initiated 26 Variation Notices (VNs) for'this
modification. The inspector reviewed the first 24 VNs issued and
confirmed that they had been properly reviewed and approved. The
inspector found that one PIP had been issued because of a design wiring
error which resulted in a breaker tripping.in the plant when the circuit
was energized. A VN was issued to correct the wiring problem. This was
one of the 24 VNs reviewed by the inspector.
The inspector expressed a concern to the lead engineer that 24 VNs
appeared to be a significant number of VNs against one NSM. The lead
engineer indicated that the number of VNs was not excessive considering
the fact that the modificafion involved over 3200 separate data inputs
and several hundred drawings. The inspector considered the licensoees
explanation to have some merit. The inspector found that the licensee
routinely critiques engineering and craft performance on modifications.
The number of VNs is one area that is normally assessed to judge quality
of design. Based on this information the inspector had no further
Enclosure 2
28
concerns regarding the-number of VNs issued. The inspector concluded
that design controls for the GAC modification were adequate.
Nuclear Station Modification NSM 32873
This NSM provided for the addition of safety-related -circuitry to detect
and mitigate a Main Steam Line Break (MSLB) on Unit 3. Similar
modifications had been implemented on Units 1 and 2. This modification
was .implemented,to resolve a safety issue involving the potential of
over pressurizing the containment during a MSLB inside containment
without operator action. This safety issue resulted from the licensee's
reanalysis .of the FSAR Chapter 15 MSLB transi.ent.
By letter dated June 14, 1995, the licensee provided NRC a supplemental
response to IE Bulletin 80.-04 in which they outlined the design basis
for the MSLB modifications. This submittal states that the associated
pressure transmitters, logic, and control circuitry installed by this
modification for mitigation of a MSLB will be safety-related, redundant
and single failure proof. It further states that the ma-in-feedwater
(MFW) equipment.being controlled by the new circuitry is nonsafety
related and is not single failure proof. This modification is being
implemented as an enhancement to the plant's mitigation.strategy for
MSLB. The inspector reviewed the Engineering Completion Notice (ECN)
and 50.59 Safety Evaluation for the changes and determined that they
were adequately reviewed and evaluated. No unreviewed safety questions
were identified. The inspector examined the redundant solenoid valves
that were installed in the control.air supply line for the Main and
Startup FDW Control valves. The inspector also examined the termination
cabinets 'housing the signal isolators, current switches, time.delay
relays, and power supplies. In the control room the inspector examined
the control room MSLB Train A and B Enable/Disable switch and manual
initiate pushbutton. The inspector concluded that the.modification was
being implemented on Unit 3 in accordance with the above licensee
commitments.
The inspector reviewed the two post modification critiques that had been
performed by the project manager after completion of the Units 1 and 2
MSLB modifications. The critiques evaluated the quality of the NSM by
examining scope changes,.major procedure changes,..variation notices, and
PIPs. The inspector found that the lessons learned from the Unit 1
modification had been factored in the planning for the Unit 2
modification and that this resulted in a reduction of craft hours, major
procedure changes, variation notices, and PIPs. However, a wiring error
occurred during the Unit 2 Modification that was not detected until
after post modification testing was completed. This resulted from an
inadequate post modification test procedure. This problem was
documented on a PIP .and corrective action was taken to address this
concern in the Unit 3 modification test plan.
.
Enclosure 2
29
On January 17, 1997, the licensee issued a Selected Licensee Commitment
(SLC) which requires operable MSLB detection, feedwater isolation
circuitry and main feedwater control valves to protect against
containment over pressurization during a MSLB inside containment. -The
licensee indicated that a TS Change request would be submitted later to
address the MSLB circuitry.
c. Conclusion
The inspector concluded that the design controls for the OAC and MSLB
modifications on Unit 3 were adequate. Overall engineering performance
on these modifications was considered good even though a significant
number of VNs had been issued against the OAC NSM.
E2.5 Unit 3 Integrated Control System (ICS) Modification (37550)
Background
The inspectors reviewed the licensee's quality.assurance measures
related to the ICS modification that was implemented on-Unit 3 during
the present refueling outage. The inspectors reviewed the modification
status, installation procedures, post-modificati-on test plan,
translation of system functional requirements into software, software
configuration management; software validation and verification (V&V),
and the 50.59 safety evaluation. The ICS system was classified as
important to safety, but not safety-related. Applicable regulatory
requirements were provided by 10 CFR 50.59. Specific inspection scope,
observations, findings, and conclusions are addressed in Sections
E2.5i-v.
i. ICS Installation Procedures and Post Modification Test Plan
a. Inspection Scope
The inspectors reviewed the installation procedures to determine if the
installation impacted unit safe shutdown conditions. The post
modification test plan was reviewed to assess the extent of system
function verification.
b. Observations and Findings
The procedures for installation of the modification were completed and
approved. Procedure 50.59 evaluations were adequate. The new ICS
control modules and wiring were available for installation. The
completion of the modification 50.59 evaluation was the primary obstacle
delaying modification installation. The unit was defueled during the
outage; therefore, *no potential impact on safe shutdown conditions
existed.
Enclosure 2
30
The post modification test plan was comprehensive: however, the test
plan relied mainly on testing conducted on the verification and
validation (V&V) simulator. Only a limited subset of these transients
were planned for actual plant testing at reduced plant conditions.. One
limitation of the V&V simulator was the inability to test the Stator
Coolant Runback function. The post modification test plan did not
include this function for actual plant testing.
Several ICS functions were not appropriate for actual plant testing,
including Asymmetric Rod Runback and.Loss of Four RCP's. The licensee
stated that the V&V simulator would demonstrate these functions and
point-to-point wiring checks during installation would be sufficient to
assure operability. However, t-he V&V simulator used software modeled
for Unit 1 configuration modified with Unit 3 response characteristi.cs
and was not validated for Unit 3 actual configuration. The licensee
indicated that V&V simulator testing: in conjunction with post
modification testing, provided adequate assurance that the ICS would
function as designed.
c. Conclusion
ICS modification installation procedures were completed and the
procedure 50.59 evaluations -were adequate. The post-modification test
plan did not test all design system equipmentfunctions, but was
considered adequate by the inspectors. Further followup inspection of
the test plan and post modification testing will be conducted under IFI
50-287/96-20-O8, ICS Post Modification Testing.
ii. Translation of ICS Functional Requirements into Software Specifications
a. Inspection Scope
The inspectors reviewed the -software requirements specification to
verify that software functional and performance characteristics were
correctly translated from the ICS design basisspecification. The
translation consisted of conversion of system functional requirements
into logic diagrams-that were then translated into computer codes for
the ICS control. modules.
b. Observations and Findings
The licensee developed Scientific Apparatus Manufacturers Association
(SAMA) logic block flow diagrams from the ICS design basis
specification. The SAMA logic diagrams defined the ICS functional
requirements and served as the software requirements specification and
software design description for the software used in the ICS control
modules. The SAMA diagrams were adequate for these purposes.
However, the inspectors initially noted that the SAMA logic diagrams did
not thoroughly specify the functional and performance characteristics of
Enclosure 2
31
the software. The inspectors also noted that there did not appear to be
traceability between the software functions depicted in the SAMA logic
diagrams and the ICS design basis document. In addition, the software
V&V plan did not clearly identify which tests were to be used to
validate each software requirement. As a result, the lack of
traceability to software requirements could contribute to incomplete
validation of the software functional and performance requirements.
In response to these comments, the licensee had an independent
assessment of the ICS design basis specification performed by an outside
contractor. During January 29 and 30, 1997, the inspectors reviewed the
contractor's report and found that similar concerns were identified.
The inspectors also reviewed the completed independent assessment of the
ICS control module software. The inspectors reviewed the licensee's
corrective actions for both of these independent assessments and found
the concerns were adequately addressed.
c. Conclusion
The inspectors determined that the software requirements
specification/software design description was initially incomplete and
that there was poor traceability to the ICS specification or to software
validation d.ocumentation. This limited the capability to independently
verify the translation of system functional requirements into software
coding which implemented the ICS functions. The capability to
independently verify the coding and.logic would provide assurance that
the system would function correctly. Based on the additional review,
the inspectors concluded that the licensee's corrective actions to the
independent assessments ha.d adequately addressed these concerns.
ii.i. Software Configuration Management
,a.
Inspection Scope
The inspectors reviewed the licensee's software configuration management
program as described in the Software and Data Quality Assurance (SDQA)
Plan to verify that software changes were properly controlled. The
inspector also reviewed an ICS control module program verification
procedure and calibration procedure to verify that controls existed to
ensure that the proper revision of the software was downloaded.into the
ICS control modules and that the downloaded software was the same as the
controlled copy.
b. Observations and Findings
The inspectors noted that the licensee's SDQA Plan contained a short
description of the software configuration management process, but that
it did not specify formal controls or procedures for managing the.
software change process during the software development. In reviewing
the licensee's software configuration management process,*the inspectors
Enclosure 2
32
noted that the licensee maintained an appropriate level of access
control to the controlled version of the software and maintained a
complete history of. software revisions. Each software revision was
assigned a revision number and the date of the revision was recorded.
The software revision list also includes a brief description of the
changes associated with each revision. The inspectors noted that each
software program header contained a-complete list of revisions and a
description of the changes -associated with each revision. The inspector
did not identify any deficiencies in the software revision lists or
program headers.
To address the concern of a lack of formal controls, the licensee had
placed the finalized revision of the ICS control module software in the
same control program used for engineering calculations. This provided
for a more formal method to control software revisions and.also resulted
in a more detailed explanation of software changes. Also, the licensee
stated that additional procedural controls required the verification of
ICS control module software against the controlled copy after any
maintenance actiVities.
c. Conclusion
The inspectors concluded that the licensee did not implement-a good
software engineering practice of establishing a software configuration
management plan or procedural controls.for managing software changes
made during the software development process. However, inclusion of the
ICS software in the engineering calculation control program provided
adequate configuration management controls.
iv. Software Verification and Validation
a. Inspection Scope
The inspectors reviewed the licensee's V&V program and preliminary V&V
results to verify that the ICS control modules software met the function
and performance requirements contained in the ICS design basis
specification and the SAMA logic diagrams. The V&V in conjunction with
post-modification testing were the major elements for assurance that the
ICS would pe.rform as designed.
b. Observations and Findings
At the time of the inspection, the final validation results were still
being documented. As previously discussed, there was poor traceability
.maintained during the software development: therefore, a thread audit
could not be performed. The licensee performed a verification of the
ICS control module software prior to integrating the hardware with the
software. In addition, a contractor performed an independent
verification of the source code and a comparison to the functional
requirements contained in the SAMA logic diagrams. The inspectors noted
Enclosure 2
33
that the licensee did not appear to have performed unit testing of the
software prior to integrating the software and hardware.
Although the source code Verification identified that there were errors
in the SAMA logic diagrams, no independent verification of the logic was
performed. The potential.for SAMA logic diagram errors and the poor
traceability between the V&V and software development indicated that the
licensee did not perform a rigorous verification of the software
requirements specification prior to writing the ICS control module
software.
After integrating the hardware and software, validation testing was
performed by the contractor using a V&V simulator that simulated inputs
to the ICS control modules. The validation was accomplished by
operating .the V&V simulator through various evolutions expected during
plant operations. Although the design simulator provided assurance that
the ICS would perform as designed.for the simulated conditions, there
were aspects of the simulator which challenged its validation as a
design verification tool.
As previously noted, the V&V simulator used
software modeled for Unit 1 and was not validated for Unit 3 actual
configuration. Additionally, the V&V simulator response was based on
anticipated plant conditions and only verified the associated software
and hardware performance. SAMA logic diagram and software errors
related to unanticipated plant conditions would not be identified. The
licensee stated that they would use their standard testing and
troubleshooting methods during post modification testing to identify and
correct ICS control module software errors.
The inspectors rev-iewed the contractor's final V&V report and noted that
the licensee had addressed all of the problems identified during the
software verification. However, the actual resolution of the problem
was difficult to determine because the resolution comments in the V&V
report only stated that the code was revised. In addition, the
inspectors noted that there was no description of the potential impact
of the software change resolution on the overall software program.
There was no requirement for a verification or regression testing of the
revised code. As discussed previously, to .address these concerns, the
licensee placed the finalized revision of the ICS software.in the same.
control program used for engineering calculations. Coding changes were
screened for potential effects on ICS operations: however, the inspector
did note that the effect on other plant procedures, particularly ICS
calibration procedures, was.not included in the screening. The licensee
stated they would consider adding such a review for future software
revisions.
c. Conclusion
The inspectors noted weaknesses in the licensee's software V&V related
to poor traceability between V&V and software development and no
independent verification of the SAMA logic diagram after indications
Enclosure 2
34
that errors existed. Following discussion with the licensee on these
issues, the licensee performed an independent verification of .the ICS
design. Based on the inspectors' review of the licensee's corrective
actions to the concerns identified in the independent review, the
inspectors concluded that the software development and V&V concerns
initially identified were .adequately addressed. The i.nspectors
identified no examples where operation or fault of the ICS would impact
the capability to safely shutdown the plant during any operating mode
condition.
v. 10 CFR 50.59 Unresolved Safety Question Evaluation
a. Inspection Scope
The inspectors reviewed the licensee's 10 CFR 50.59 evaluation to
determine if the licensee addressed digital equipment failures,
including software common mode failure considerations, as described'in
NRC Generic Letter (GL) 95-02, in addition to determining if an
unreviewed safety question (USQ) was' involved with this modification.
Although the ICS is categorized as a nonsafety-related system, it
provides inputs for various primary system setpoints and indications for
primary system parameters. The system is identified in the UFSAR and is
referenced in accident mitigation descriptions.
b. Observations and Findings
The inspectors noted that the responses to the standard USQ
determination questions in the 50.59 evaluation had incomplete
explanations. For example, on page 12 the statement "The instruments
being installed are at least equivalent to those currently installed."
did not include any explanations as to why the ICS control modules were
equivalent. On page 14,. when discussing the self-checking feature.
.
there was no discussion of whether a failure of this feature could-cause
an ICS control module to stop functioning needlessly and the impact on
margin of safety or malfunction of a different kind. On page.29, Loss
of Coolant Flow, was the statement that a LOCA is managed by the
Emergency Core Cooling System and the ICS does not play a major part in
.its mitigation. This did not discuss the response of the ICS nor did it
discuss the difference in possible response from the previous ICS. On
page 42, the first question states, "The failure modes of the new.ICS
are not more severe or more likely'than those currently analyzed or
submitted-in response to NUREG-0737." There was no documentation to
support this conclusion.
There was no mention of failure modes or how those failure modes would
be detected. The licensee stated that read back of the ICS control.
module output would be sufficient to detect internal failures. The
licensee was also in the process of performing a Failure Modes and
Effects Analysis (FMEA) for the .ICS control module. A failure of an
analog memory module, used to retain ICS statepoint data when an.ICS
Enclosure 2
35
control module fails, was annunciated in the control room. This
annunciation provided early warning to the operator to prevent unstable
ICS operation in the event of an ICS module failure after an analog
memory module failure. The inspector noted'that ICS reliability and
availability requirements were not specified in the ICS design
documents. The licensee stated these values would be determined through
their Maintenance Rule program.
An additional weakness of the 50.59 evaluation was the licensee's
analysis of the effect of the new ICS on accidents analyzed in Chapter
15 of the UFSAR. This review was limited to a review of the discussions
of ICS response in Chapter 15 of the UFSAR and did not include review -of.
the accident analysis assumptions or the basis for those assumptions..
Because of the summary nature of Chapter 15, insufficient detail existed
to determine if the ICS modification would have affected an underlying
accident analysis assumption or basis. For example, there was no
discussion of the response of ICS to a Steam Generator Tube Rupture in
Chapter 15. However, the licensee determined that because the ICS does
not directly affect steam generator tube integrity, there was no adverse
effect on this accident sequence due to the ICS modification. Further,
the licensee used vague language in describing the effect of ICS on
accidents analyzed in Chapter 15. For example, the discussion on
Startup Accident and Rod Withdrawal at Rated Power did not conclude .the
ICS responses would be similar. The fact.that the ICS modification
could cause a different ICS response from that assumed in the accident
analysis could result in an USQ determination. As a result of the
inspectors concern in this area, the licensee stated that available
accident analysis information would be reviewed.to ensure completeness
of the 50.59 evaluation. The licensee stated that they would document
this review in a revision to the approved 50.59 evaluation.
By internal memorandum dated February 171997, the licensee stated that
the original design information available and the original FSAR and
associated supplements had been reviewed. Based on this review, the
licensee had concluded that the ICS modification did not impact any
accident analysis assumptions. The inspectors reviewed this internal
memorandum and found the licensee had adequately addressed the
inspectors' concern.
c. Conclusion
The inspectors concluded the 50.59 evaluation USQ determination question
- explanations were weak. However, the additional review conducted by
licensee had adequately addressed the inspectors' concerns.
Enclosure 2
36'
E8
Miscellaneous Engineering Issues (92903)
E8.1 (Open) VIO 50-270/96-13-10:
Failure to Perform Adequate 10 CFR 50.59
Evaluation
This violation was identified during a review of the completed
modification ONS-22975, Replace HPI Check Valves 2HP-126, 2HP-127, 2HP
152. and 2HP-153.. The review of the modification identified the lack of
a fatigue analysis. During this inspection period, the inspector
reviewed the corrective actions for identification and evaluation of the
modifications for Unit 2. The evaluations for Unit 2 were completed
prior to unit startup. The inspector did not identify any weaknesses or
deficiencies. This item is closed for Unit 2 but remains open for Unit
1 and Unit 3. Unit 1 and Unit 3 evaluations are to be completed prior
to startup of each unit.
E8.2
(Closed)fURI 50-270/96-13-09:
RCS Piping Socket Weld Failure
This URI involved a failure of a downstream socket weld on Valve 2HP
491. The weld was removed and transferred offsite for evaluation. The
evaluation has been completed and reviewed by the inspector. The
failure mechanism was identified as being fatigue related. Accordingly,
the licensee has committed to a fatigue analysis program. Based on the
implementation of a fatigue analysis program, this URI is closed.
E8.3 (Open) VIO 50-269/96-17-09: LPSW Modification Did Not Meet ASME Code
NDE Requirements
This violation concerned 8 welds on Unit 1/2 LPSW piping that did not
have proper NDE performed. Prior to the Unit 2 start-up from a recent
forced outage, the inspectors verified-that the affected piping welds
were satisfactorily hydrostatically tested per Procedure
TN/0/A/9749/MM/01M. Procedure to Install MM ONOE-9749 and Hydro Test a
Portion of LPSW Piping. This violation remains open pending review.of
associated root cause corrective actions.
E8.4 (Closed) EEI 50-270,287/96-16-05: Failure to Properly Install MSSV
Spindle Nut Cotter Pins
This issue involved several missing and incorrectly installed main steam
safety valve (MSSV) spindle nut cotter pins which could have resulted in
the affected MSSVs failing to -reseat and complicate recovery actions
from some plant transients. Following the associated predecisional
enforcement conference, this issue was dispositioned (by NRC letter
dated December 23, 1996) as Severity Level.IV Violation EA 96-478-01014:
Failure to Follow Procedure and Properly Install MSSV Spindle Nut Cotter
Pins. Accordingly, EEI 50-270,287/96-16-05 is administratively closed.
With respect to unit restart, the inspector verified that modifications
were made to remove MSSV fork levers, spindle nuts, and cotter pins on
all three units.
Enclosure 2.
37
V. Management Meetings
X1
Exit Meeting Summary
The inspectors presented the inspection results to members of licensee
management at the conclusion of.the inspection on February 12. 1997. The
licensee acknowledged the findings presented.
The inspectors asked the licensee whether any materials examined during the
inspection should be considered proprietary. No proprietary information was
identified.
Partial List of Persons Contacted
Licensee
E.
- Burchfield, Regulatory Compliance Manager
D. Coyle, Systems Engineering Manager
T. Coutu, Operations Support Manager
C. Curry, Test Coordinator
T. Curtis. Operations Superintendent
J. Davis. Engineering Manager
R. Dobson, Oconee Nuclear Station Engineering
W. Foster, Safety Assurance Manager
.J.
Hampton, Vice President, Oconee Site
S. Hollinsworth, Operations ShiftManager, Oconee Nuclear Station
D. Hubbard, Maintenance Superintendent
R. Lingle, Oconee Nuclear Station Operations
C. Little, Electrical Systems/Equipment Manager
B. Peele, Station Manager
J. Smith, Regulatory Compliance
NRC
D. LaBarge, Senior ProjectManager, NRR
J. Lazevnick, Senior'Electrical Engineer,NRR
D. Thatcher, Section Chief, Electrical Engineering Branch, NRR
Inspection Procedures Used
IP 71750:
Plant Support Activities
IP 71707:
Plant Operations
IP 61726:
Surveillance Observations
IP 62707:
Maintenance Observations
IP 37551:
Onsite Engineering
IP 60710:
Refueling Activities
IP 61701:
Complex Surveillance
IP 37550:
Engineering
IP 93702:
Onsite Response to Events
IP 92901:
Followup-Plant Operations
- aEnclosure 2
IP
9902:38.
I P 92902:
Followup-Maintenance
3
IP 92903:
Followup-Engineering
IP 40500:
Effectiveness of Controls for Problem Identification and Resolution
Items Opened, Closed, and Discussed
Oened
50-269,270,287/96-20-01
SSF Past Operability (Section 02.2)
50-269.270.287/96-20-02
IFI
Unfiltered Motors (Section M2.1)
50-287/96-20-03
Loss of.RCS Inventory (Section E13)
50-269,270,287/96-20-04
.
Failure to Have RB Material Condition
Closeout Procedure (E1.4)
50-269.270,287/96-20-05
Past Operability of RB Recirculation Flow
Path (Section E1.4)
50-27.0/96-20-06
Failure To Use Procedure Administrative
Hold (Section 08.1)
50-269,270,287/96-20-07
Failure to Complete a Written Safety
Evaluation of Secondary Plant Piping Not
in Accordance With the Piping Code
Referenced in the FSAR (Section 08.1)
50-287/96-20-08
IFI
ICS Post Modification Testing (Section
E2.5i)
EA 96-478-01014
Failure to Follow Procedure and Properly
Install MSSV Spindle Nut Cotter.Pins
(Section E8.4)
Closed
50-270/96-13-09
RCS Piping Socket Weld Failure (Section
E8.2)
50-270/96-17-08
E
Failure to Use Procedure Administrative
Hold (Section 08.1)
50-269,270,287/96-17-01
EEl
Failure to Complete a Written Safety
Evaluation of Secondary Plant Piping'Not
in Accordance With the Piping Code
Referenced in the FSAR (Section 08.1)
50-270,287/96-16-0.5
Failure to Properly Install MSSV Spindle
Nut Cotter Pins (Section E8.4)
Enclosure 2
39
Discussed
50-270/96-13-10
Failure to Perform Adequate 10 CFR 50.59
Evaluation (Section E8.1)
50-269/96-17-09
LPSW Modification Did Not.Meet ASME Code
NDE Requirements (Section E8.3)
List o.f Acronyms
ACB
Air Circuit Breaker
BWST
Borated Water Storage Tank
CFR
Code of Federal Regulations
Component Cooling
CR
Control Room
Control Rod Drive
Combustion Turbine
Duke Power Company
Division of Reactor Safety
Engineering Completion Notice
Escalated Enforcement Item
Emergency Feedwater
Electric Power Research Institute
Engineered Safeguards
F
F
FDW
.
Final Safety Analysis Report
FWP
Feedwater Pump
GL
Generic Letter
GPM
Gallons Per Minute
hp
Horsepower
HD
Heater Drain
High Pressure Injection
In Accordance With
ICCM
Inadequate Core Cooling Monitor
I&E
Instrument & Electrical
IFI
Inspection'Followup Item
Inspection and Enforcement
IR
Inspection Report
IP
Inspection Procedure
KHU
Keowee Hydro Unit
KV
Kilovolt
LDST
Letdown Storage Tank
LCO
Limiting Condition for Operation
Loss of Coolant Accident
.
Low Pressure Injection
Low Pressure Service Water
Enclosure 2
40
MFDW
Main Feedwater
Motor Operated Valve
Maintenance Procedure
MS
Main Steam Line Break
Main Turbine Generator
MVA
Mega Volts-Amps
Megawatts
Non-Cited Violation
NLO,
Non-Licensed Operator
NRC
Nuclear Regulatory Commission
Nuclear Regulation and Research
NSM
Nuclear Station Modification
NSD
Nuclear System Directive
0AC
Operator Aid Computer
Oconee Nuclear Station
One Through Steam Generator
PCB
Power Circuit Breaker
Preventive Maintenance
Problem InvestigationProcess
QA -
Quality Assurance
Reactor Building
RBCU
Reactor Building Cooling Unit
RC.
Reactor Cool'ant
RCW
Raw Coolant Water
Reactor Coolant Pump
Selected Licensee Commitment
Spent Fuel-Pool
S-R
Safety Related
SSF
Safe Shutdown Facility
TS
Technical Specification
Updated Final Safety Analysis Report
Unresolved Item
V
Volts
Violation
VN
Variation Notice
Work Order
Work Request
Enclosure 2