ML16342A752
| ML16342A752 | |
| Person / Time | |
|---|---|
| Site: | Diablo Canyon  |
| Issue date: | 04/05/1999 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML16342A751 | List: |
| References | |
| 50-275-99-03, 50-275-99-3, 50-323-99-03, 50-323-99-3, NUDOCS 9904120267 | |
| Download: ML16342A752 (52) | |
See also: IR 05000275/1999003
Text
ENCLOSURE
U.S. NUCLEAR REGULATORYCOMMISSION
REGION IV
Docket Nos.:
License Nos.:
Report No.:
Licensee:
Facility:
Location:
Dates:
Inspectors:
Approved By:
50-275
50-323
DPR-82
50-275/99-03
50-323/99-03
Pacific Gas and Electric Company
Diablo Canyon Nuclear Power Plant, Units 1 and 2
7 ~/~ miles NW of Avila Beach
Avila Beach, California
January 24 through March 6,1999
David L. Proulx, Senior Resident Inspector
Dyle G. Acker, Resident Inspector
David E. Corporandy, Resident Inspector
Linda J. Smith, Chief, Project Branch E
ATTACHMENT: Supplemental Information
'P904i20267 990405
ADQCK 05000275
8
I
EXECUTIVE SUMMARY
Diablo Canyon Nuclear Power Plant, Units 1 and 2
NRC Inspection Report No. 50-275/99-03; 50-323/99-03
This inspection evaluated aspects of licensee operations, maintenance,
engineering, and plant
support.
The report covers a 6-week period of resident inspection.
~oerationa
The planning, preparations, and execution of the two draindowns of the Unit 1 reactor to
reduced inventory conditions were generally conducted in a conservative manner.
Licensee contingencies and compensatory actions were appropriate to the
circumstances
(Section 01.2).
. In Mode 6, while pressurizing the primary relief tank with nitrogen during the draindown
to midloop, operators did not have a full understanding of its effect on reactor vessel
level. As a result, reactor vessel level dropped approximately 2 feet in an uncontrolled
manner, and water flowed into the steam generator tubes.
No procedural limits were
exceeded
(Section 01.2).
The first example of a noncited violation of Technical Specification 6.8.1.a. for failure to
properly implement a procedure, involved the draindown to midloop (AR A0479457).
The "Mid Loop Trouble" alarm was not enabled to alert operators of reactor vessel
refueling level high or low, as required (Section 01.2).
With the exception of minor performance and communications problems, which
occurred during performance of the initial steps of refueling, all parties involved in the
fuel load performed well. Performance during core alterations was improved in that
procedure and performance concerns identified in Refueling Outage 2R8 were corrected
for Refueling Outage 1R9 (Section 01.3).
Clearance performance during Refueling Outage 1R9 improved as compared to
previous outages.
A sampling of clearances that the inspectors examined revealed only
one minor error.
In addition, the licensee identified fewer significant clearance errors.
than during Refueling Outage 2R8, indicating that corrective actions have improved
clearance performance (Section 01.4).
Operators failed to revise the risk assessment
of performing the residual heat removal
(RHR) system flush during power operation when they elected to include removal of the
boric acid storage tanks from service.
Operators understood that the boric acid storage
tanks were of low risk significance and, because
of,weak knowledge of the on-line
maintenance
risk assessment
procedure, believed that a revision of the risk assessment
was unnecessary.
Subsequent
evaluation of the risk associated
with this activity
confirmed the risk was low. (Section 04.1).
Operating procedures were not conservative with respect to monitoring spent fuel pool
temperature since increased temperature monitoring was not required with a full core
offload in the spent fuel pool. Operators continued to monitor the Unit 1 spent fuel pool
temperature every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. As a result, following an inadvertent trip of Spent Fuel
Cooling Pump 1-2, the pump trip went undetected for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> until a spent fuel pool high
temperature annunciator alarmed (Section M1.3).
Maintenance
The first example of a noncited violation of Technical Specification 6.8.1.a. for failure to
properly preplan maintenance was identified during the initial draindown of the Unit 1
reactor to midloop (AR A0476823).
Isolation of the nitrogen overpressure for the
primary relief tank resulted in reactor vessel level perturbations (Section 01.2).
The second example of a noncited violation of Technical Specification 6.8.1.a. for not
properly preplanning maintenance,
which was associated with replacing a relay that
provided Phase A containment isolation capability (AR A0478430), was identified. The
relay was removed without adequate
precautions or consideration for the effect on plant
equipment.
As a result, the operating spent fuel pool cooling pump tripped from service
without operator knowledge (Section M1.3).
~
A noncited violation of Technical Specification 6.8.1a. for failing to provide a procedure
appropriate to the circumstances
(AR A0479274) was identified. In this instance, the
procedure used to restore the 500 kV offsite power source provided vague guidance for
positioning the main turbine protective trip switches.
In addition, lack of a questioning
attitude on the part of operators restoring the 500 kV power contributed to the trip signal,
partial loss of offsite power, and inadvertent diesel engine generator (DEG) start.
Operator response
in restoring shutdown and spent fuel pool cooling following the loss
of 500 kV power was good (Section M1.4).
~ 'ollowing the failure of DEG 1-1 to reach rated voltage within its acceptance
criteria,
troubleshooting to determine the cause of the problem was generally thorough and
identified a suspect voltage regulator.
Troubleshooting appropriately considered vendor
recommendations
and collected data and the number and frequency of tests exceeded
requirements (Section M1.5).
~En ineerin
~
The prompt operability assessment
associated
with fibrous material in fire stops in
containment in both units, while technically sound, was not timely given the potential
safety significance of inoperable containment recirculation sumps.
The operability
question of the containment recirculation sumps was identified in October 1998.
However, the prompt operability assessment
was not completed until February 1999
The inspectors identified a deficiency in the operability process, specifically, the "issue
needing validation to determine the impact on operability" portion. The licensee had
missed two opportunities to perform a prompt operability assessment
in December 1998
when forced outages had occurred in each unit (Section E1.1).
On January 14, 1998, a violation of 10 CFR 50.59 resulted because the licensee
implemented a design change and failed to submit a license amendment for a change to
the facilitythat involved an unreviewed safety question.
The NRC, however, is
exercising enforcement discretion in accordance with Section VII.B.6 of the enforcement
policy and is refraining from issuing a Notice of Violation. The licensee changed the
configuration of the 230 kV offsite power source from dependence
on Morro Bay for
operability to dependence
on load tap changing transformers and capacitor banks.
Corrective actions for previous 10 CFR 50.59 violations sufficiently addressed
this issue.
The design change improved the reliability of the 230 kV system (Section E1.2).
Plant Su
ort
The second example of a noncited violation of Technical Specification 6.8.1.a for failure
to followprocedure resulted when chemists failed to sample the chemical and volum'e
control system demineralizer prior to placing it in service (NCR N0002084).
This error
resulted in a significant chloride intrusion into the reactor coolant system and caused the
Equipment Control Guideline limit to be exceeded.
In addition, the controls for the
purchase, control, and dedication of resins for nonsafety-related applications were
deficient. The licensee performed a detailed root cause analysis and corrective actions
addressed
the issues appropriately (Section R1.1).
Re ort Details
Summa
of Plant Status
Unit 1 began this inspection period at 100 percent power.
Unit 1 began coasting down for the
end of the fuel cycle on February 3, 1999, and was at 93 percent power on February 7. On
February 7, Unit 1 was shut down to commence Refueling Outage 1R9.
Unit 1 was in Mode 5
(Cold Shutdown) at the end of this inspection period.
Unit 2 operated at essentially 100 percent power during this inspection period.
I. ~Oerations
01
Conduct of Operations
01.1
General Comments
71707
The inspectors visited the control room and toured the plant on a frequent basis when
on site, including periodic backshift inspections.
In general, the performance of plant
operators reflected a focus on safety, evidenced by self- and peer-checking.
Operator
use of three-way communications continued to improve, and operator responses
to
alarms were usually observed to be prompt and appropriate to the circumstances.
01.2
Midloo 0 erations
Unit 1
a.
Ins ection Sco
e 71707
The inspectors observed the licensee's performance related to draining the Unit 1
reactor coolant system to reduced inventory. This inspection included:
(1) review of
training, procedures, and safety assessments,
(2) plant tours, (3) interviews, and (4)
observation of on-shift personnel.
b.
Observations and Findin s
General
During Refueling Outage 1R9, the licensee drained the reactor coolant system to
midloop on two occasions to install and remove reactor coolant loop nozzle dams, which
supported steam generator eddy current inspection.
The midloop operations were
performed with fuel in the reactor vessel.
Most significantly, the steam generator nozzle
dams were installed shortly after the Unit 1 reactor shutdown, when the decay heat load
was high. The inspectors determined that this was a risk significant configuration.
-2-
Plannin
and Pre arations
Technical Specifications required only one DEG, one source of offsite power, and one
RHR pump to be operable with the plant in Mode 5 (cold shutdown).
However, the
licensee determined that additional safety systems would be made available because of
the increased risk when in reduced inventory. Procedures
OP A-2:II "Reactor Vessel-
Draining the Reactor Coolant System to the Vessel Flange - with Fuel in the Vessel,"
Revision 20, and OP A-2:III,"Reactor Vessel - Draining to Half Loop/Half Loop
Operations with Fuel in the Vessel," Revision 20, required many systems in excess of
those required by the Technical Specifications to be available (e.g., two sources of
offsite power, two DEGs, two RHR pumps, and containment closure).
Other
contingencies included stationing operators at the intake structure near the auxiliary
saltwater pumps and in the auxiliary building near the RHR pumps to recover these
important systems,
if necessary.
In addition, the licensee staged a senior reactor operator at the radiological control
access point to screen work to ensure that midloop operations would not be impacted.
The outage safety plan for Refueling Outage 1R9 also required operators to receive
simulator training on reduced inventory operations, including the offsite power sources
to be protected, so work that could impact midloop operations would not be performed.
The inspectors concluded that the planning, preparations, and contingencies showed
'ppropriate sensitivity to effective implementation of refueling activities. On February
10, the inspectors independently verified that these contingencies were satisfactorily in
place prior to commencement of the reactor coolant system draindown.
~Hot Midloo
On February 12, 1999, the licensee commenced the draindown to midloop with a high
decay heat load. During this draindown, the narrow-range reactor vessel refueling level
indication system (RVRLIS) diverged from the wide-range RVRLIS system several times
by more than 4 inches, such that operators had to stop the draindown and direct
technical maintenance personnel to filland vent the RVRLIS detectors.
During one such divergence, operators checked the nitrogen overpressure
of the
primary relief tank. Procedure OP A-2:II required the pressure to be set at 3 psig;
however, operators discovered that the pressure read 0 psig and inspected the nitrogen
supply lineup. Operators determined that the nitrogen supply was inadvertently isolated,
as specified in Clearance 60376, for maintenance unrelated to the midloop operations.
Operators wrote an action request (AR) to enter this item into the corrective action
program.
. Following identification that the nitrogen was isolated, operators quickly cleared the tags
and opened the nitrogen system isolation valves.
Restoring the nitrogen overpressure
to the primary relief tank resulted in a sudden and uncontrolled level drop of 2 feet. The
level decrease
stopped at 111 feet, which was significantly above midloop (107 feet,
~ 8 inches) but was neither controlled nor understood by the operators.
The manager in
charge halted the draindown to midloop until an investigation was completed and the
cause of the level perturbations and sudden drop was understood.
The licensee
-3-
determined that the level dropped because
the nitrogen overpressure
pushed water into
the empty steam generator tubes.
Procedure OP A-2:II, Section 4.4, required operators to review the clearance and
jumper logs to identify any work that could impact reduced inventory operations, prior to
commencing the draindown.
Since this step had been previously signed off as
completed satisfactorily, the inspectors were concerned about the thoroughness
of this
review. The licensee determined that Clearance 60376 had not yet been listed as an
active clearance when operators reviewed the clearance log. Consequently, the
licensee reverified each of the prerequisites, including any clearances that were in the
process of being hung but were not yet active, and recommenced the draindown.
Because Clearance 60376 was initiated without reviewing its impact on RVRLIS and
midloop operations, this maintenance activity was not properly reviewed for the
circumstances.
This licensee-identified deficiency is the first example of a violation of
Technical Specifications 6.8.1.a for failure to properly preplan maintenance.
However,
this Severity Level IVviolation is being treated as a noncited violation, consistent with
Appendix C of the Enforcement Policy. This violation is in the corrective action program
as AR A0476823 (50-275/99003-01).
Following resolution of the RVRLIS issues, the licensee completed the draindown. The
inspectors noted that the rest of the evolution, including installation of nozzle dams and
refill of the reactor coolant loops, was completed satisfactorily and in a conservative
manner.
Second Midloo
On March 4, operators commenced a second draindown to midloop to remove the
steam generator nozzle dams.
The licensee instituted similar contingencies and
preparations as with the hot midloop. Decay heat load was significantly less than the
earlier midloop condition in that one-third of the fuel had not been irradiated following
core reload and the reactor had been shut down for approximately
1 month. Therefore,
engineers determined that the second draindown to midloop had less risk significance
than the first. The inspectors verified that a sampling of the prerequisites had been
satisfactorily completed.
During the draindown, with RVRLIS level stabilized at 109 feet, the inspectors
questioned whether operators had enabled the "Mid Loop Trouble" alarm.
Procedure OP A-2:III,step 6.1.1, required the operators to verify that the narrow range
RVRLIS level alarms had been enabled.
Operators had previously enabled both the
"RVRLIS High/Low"and the "Mid Loop Trouble" alarms.
These annunciators provided
operators with warnings to prevent RVRLIS level from being too high such that it would
impact personnel remo'ving nozzle dams or too low such that vortexing of the reactor
water inventory could impact the operating RHR system.
However, prior to
commencement of draindown, operators inadvertently disabled the "Mid Loop Trouble"
alarm by setting up operating bands using the plant process computer select function.
-4-
Procedure OP A-2:III,Section 4.5.1, permitted operators to establish operating bands
using the plant process computer select function in addition to enabling the
normal-range RVRLIS level alarms.
Operators were not aware that using the plant
process computer select function could effect the narrow-range RVRLIS system.
Upon the inspectors'uestioning,
operators determined that Procedure OP A-2:III,Step
6.1.1, had not been fullyimplemented.
The shift foreman initiated AR A0479457 to
enter this item into the corrective action system, and the control operator restored the
"Mid Loop Trouble" alarm to operation.
The draindown and refill of the reactor coolant
loops was completed without further incident. The failure to enable the "Mid Loop
Tr'ouble" alarm prior to draindown is the first example of a violation of Technical Specification 6.8.1.a for failure to followprocedure.
However, this Severity Level IV
violation is being treated as a noncited violation, consistent with Appendix C of the
Enforcement Policy. This violation is in the corrective action program as AR A0479457
(50-275/99003-02).
Conclusions
The planning, preparations, and execution of the two draindowns of the Unit 1 reactor
coolant system to midloop were generally conducted in a conservative manner.
Licensee contingencies and compensatory actions were appropriate to the
circumstances.
The first example of a noncited violation of Technical Specification 6.8.1.a. for failure to
properly preplan maintenance was identified during the initial draindown of the Unit 1
reactor to midloop (AR A0476823).
Isolation of the nitrogen overpressure for the
primary relief tank resulted in reactor vessel level perturbations.
In Mode 6, while
pressurizing the primary relief tank with nitrogen during the draindown to midloop,
operators did not have a full understanding of its effect on reactor vessel level. As a
result, reactor vessel level dropped approximately 2 feet in an uncontrolled manner, and
water flowed into the steam generator tubes.
No procedural limits were exceeded.
The first example of a noncited violation of Technical Specification 6.8.1.a. for failure to
properly implement a procedure, involved the draindown to midloop (AR A0479457).
The "Mid Loop Trouble" alarm was not enabled to alert operators of reactor vessel
refueling level high or low, as required.
Refuelin
Activities
Ins ection Sco
e 71707
On February 27, 1999, the inspectors observed refueling activities in the control room,
fuel building, and containment.
These activities included handling and movement of the
fuel assemblies from the spent fuel pool to the upender and from the upender to the
final core location, control room monitoring of required parameters,
reactor engineering
calculations of inverse count rate ratio, and monitoring of fuel location for accountability
-5-
requirements.
The inspectors reviewed Procedures
OP B-8DS2, "Core Loading,"
Revision 21, and PEP R-8DS2, "Core Loading Sequence,"
Revision 1, which contained
the procedure requirements for these activities.
Observations and Findin s
Ultrasonic inspection of the reactor pressure vessel outlet nozzles was required to be
complete prior to beginning fuel load. Ultrasonic inspection of the reactor pressure
vessel nozzles was completed several hours ahead of time, which created an
opportunity to begin fuel load earlier than scheduled.
Lighting, tools, and other
equipment and prerequisites for fuel load had not been prestaged.
Consequently, the
opportunity to start fuel load ahead of time passed.
Communication of status, duration,
and level of effort to complete these activities was, at times, not clearly communicated.
The operations shift foreman appropriately delayed the start of fuel load until
prerequisite items were verified to be complete.
Senior managers were promptly
informed of the communication problem and intervened in a timely manner to alleviate
the problem.
During performance of the initial steps of Procedure PEP R-8DS2, Fuel Assembly AA83
was raised out of the spent fuel pool rack prior to unloading Fuel Assembly BB04 from
the upender inside of the containment, which was contrary to management
expectations.
The control room operators immediately recognized this and informed the
shift foreman.
The shift foreman briefly suspended
further core load to make sure that
the involved parties understood the management expectations.
The inspectors
observed a significant portion of the fuel load activities. Other'than the minor
performance issue described above, the fuel load activities observed by the inspectors
were accurately performed in a deliberate manor.
During the last Unit 2 refueling outage, a violation was identified for failing to restore the
source range detector high flux at shutdown alarm, as instructed in the core load
procedures.
Complex instructions and failing to clearly specify the person responsible
for completing the actions were identified as contributing causes.
For this Unit 1
refueling outage, each action was clearly defined in the procedure, and a specific
individual was assigned responsibility for completing the actions.
The core loading
procedures required that criticality be calculated after the first 13 fuel assemblies are
loaded next to their applicable detector and for each fuel assembly added thereafter.
Procedure OP B-'8DS2, step 5.7.7, states "Criticalityis indicated when the inverse count
rate ratio approaches
zero, and if the straight line determined by the last two Inverse
count rate ratios for a ~res ondin
detector indicates that criticality could occur if the next
twelve (12) or less fuel assemblies
are loaded." The inspectors observed the reactor
engineers verify source range detector count rates and calculate the inverse count rate
ratio. Work was satisfactorily accomplished
in a timely manner to support fuel load
activities.
The inspectors observed the refueling senior reactor operator directing the fuel handling
operations in containment.
The refueling senior reactor operator maintained good
supervision over the activities, maintained communications with the control room and
4
M
-6-
the personnel in the fuel building, provided clear directions to the crane operator and
other observers, verified the correct core location using the fuel movement tracking
sheets, monitored the load on the manipulator crane, and confirmed the proper
indicating lights and Z-Z tape position.
The inspectors also observed that the foreign material exclusion area controls around
the reactor cavity and the spent fuel pool were effective.
Conclusions
With the exception of minor performance and communications problems, which
occurred during performance of the initial steps of refueling, all parties involved in the
fuel load performed generally well. Performance during core alterations was improved,
in that procedure and performance concerns identified in Refueling Outage 2R8 were
corrected for Refueling Outage 1R9.
01.4
Clearance Performance
a.
Ins ection Sco
e 71707
92901
During Unit 2 Refueling Outage 2R8, operators committed a number of significant
clearance errors.
These errors were discussed
in NRC Inspection Report
50-275; 323/98-07, and a violation was issued for several examples of failing to properly
implement the clearance procedure.
Because of this deficient performance, the
inspectors evaluated the clearance order implementation during Refueling Outage 1R9
to determine the effectiveness of'the previous corrective actions.
The evaluation
included walkdowns of several clearances
and reviews of licensee-identified issues.
b.
Observations and Findin s
The inspectors walked down several clearance orders.
Of these clearances,
the
inspectors identified one minor error. On February 12, 1999, the inspectors identified
that tags hung for maintenance on breakers associated with the control rod drive motor
generator sets were man-on-line tags while the clearance called for caution tags.
The
breakers were in the correct position, and the tags were hung on the correct
components; therefore, personnel and equipment safety were not jeopardized.
Personnel initiated an event trend record to document this occurrence, and the
operations director issued a shift order to remind operators to verify that the proper type
.
of tag was hanging, as well as the correct component and position. The inspectors
noted that the clearances walked down were otherwise satisfactory.
In addition, the inspectors reviewed clearance issues identified on nine ARs. One
AR Addressed a man-on-line tag hung on the wrong switch. A second AR discussed
an
issue that involved several tags being removed with work in progress.
The rest of the
ARs discussed administrative violations of procedures.
In comparison, during Refueling
Outage 2R8, the licensee committed eight errors that the inspectors considered
significant; each incident involved a lack of tagging protection while work was in
progress.
The licensee initiated numerous corrective actions as docketed in the
0
-7-
response to NRC Inspection Report 50-275; 323/98-07.
The inspectors concluded that,
although the licensee achieved significant improvement in performance of clearances
because
of these corrective actions, further improvement in this area is still necessary.
C.
Conclusions
Clearance performance during Refueling Outage 1R9 improved as compared to
previous outages.
A sampling of clearances that the inspectors examined revealed only
one minor error.
In addition, the licensee identified fewer significant clearance errors
than during Refueling Outage 2R8, indicating that corrective actions have improved
clearance performance.
04
Operator Knowledge and Performance
04.1
RHR S stem Flush
Ins ection Sco
e 71707
The inspectors witnessed the flush of the RHR system, including the probablistic risk
assessment
to support the evolution.
Observations and Findin s
On February 3, 1999, operators performed a flush of the Unit 1 RHR system in
preparation for plant cooldown during upcoming Refueling Outage 1R9. The licensee
previously performed this evolution following plant shutdown so that when RHR was
initiated, the chemistry of the reactor coolant system would not be adversely affected.
Prior to the flush, the probablistic safety assessment
group evaluated the evolution with
respect to risk. The RHR system flush required isolation of the RHR system, which
rendered the system inoperable for the low pressure safety injection mode of operation
and required entry into a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> shutdown action statement for approximately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />
total for each train. The engineers noted that removing each RHR train from service to
support the flush was not risk significant when evaluated using industry guidelines.
The
shift foreman reviewed and approved this safety assessment
prior to commencement
of
the RHR system flush.
In preparation for the flush, operators reviewed Procedure OP B-2:V, "RHR - Place in
Service During Plant Cooldown," Revision 17, and noted that the procedure required
several flow paths to be established simultaneously.
Procedure OP B-2:V directed the
user to flush water from the RHR system by draining to the radwaste system while filling
from the refueling water storage tank. To maintain refueling water storage tank levels,
the procedure required the transfer of water from the boric acid storage tanks.
In
addition, boric acid storage tank inventory would be maintained via the makeup system.
Operators determined that control of the evolution would be optimized if fewer flow
paths were in service simultaneously.
Therefore, the shift foreman determined that
boric acid storage tank levels would not be maintained while the evolution was in
0
-8-
progress.
The boric acid storage tanks would be refilled once the evolution was
completed.
Performing Procedure OP B-2:V in this alternative manner required
operators to declare the boric acid storage tanks inoperable and enter a 72-hour
shutdown action statement.
At the start of the RHR system flush, operators performed a briefing and entered the
applicable limiting conditions for operation.
Following commencement
of the RHR
system flush, the inspectors reviewed the approved probablistic safety assessment.
The inspectors noted that the probablistic safety assessment
included the RHR system
.
as unavailable but did not recognize the inoperability of the boric acid storage tanks.
The shift foreman stated that the boric acid storage tanks were not risk significant and
need not be evaluated.
The shift foreman noted that Procedure AD7.DC6, "On-Line
Maintenance Risk Assessment,"
Revision 2, contained a matrix of the risk significant
s'ystems and that the boric acid storage tanks were not included in this matrix.
In
addition, the boric acid storage tanks were not modeled in the on-line computer program
for risk assessment.
However, the inspectors noted that Procedure AD7.DC6, Section 6.5, required a
two-step approach to on-line risk assessment.
The first step was a probablistic safety
assessment
using the plant computer and the matrix.
In addition, Procedure AD7.DC6,
Attachment 9.5, required a deterministic approach to assess
safety significance.
This
section was based on defense-in-depth
of the critical safety functions referenced
in the
emergency operating procedures.
Procedure AD7.DC6, Section 6.5, was developed to
ensure operators did not cause an inadvertent total loss of safety function and violate
the Technical Specifications by removing multiple nonrisk significant systems from
service.
The inspectors discussed the deterministic assessment
required by
Procedure AD7.DC6 with the operating crew and identified that the crew was not
cognizant of this element of safety assessment.
Operators then performed the
deterministic review and determined that the configuration of having one RHR pump
inoperable coincident with the boric acid storage tanks being inoperable was allowed by
procedure and was nonrisk significant.
The inspectors discussed this issue with the Operations Director. The Operations
Director evaluated the operator knowledge of Procedure AD7.DC6 and identified that
most of the other operating crews were similarly unfamiliar with the two-step approach
to risk assessment.
The operations department conducted "just-in-time" training on the
specifics of Procedure AD7.DC6 for each of the operating crews. The inspectors
concluded that this training sufficiently addressed
the concern with the RHR flush and
the lack of revision of the risk assessment.
Conclusions
Operators failed to revise the risk assessment
of performing the RHR system flush
during power operation when they elected to include removal of the boric acid storage
tanks fro'm service.
Operators understood that the boric acid storage tanks were of low
risk significance and, because
of weak knowledge of the on-line maintenance
risk
assessment
procedure, believed that a revision of the risk assessment
was
unnecessary.
Subsequent
evaluation of the risk associated
with this activity confirmed
the risk was low.
e
M1
Conduct of Maintenance
M1.1
Maintenance Observations
a.
Ins ection Sco
e 62707
The inspectors observed all or portions of the following work activities:
Work Order R0170936, Component Cooling Water Heat Exchanger 1-2, clean
and inspect seawater side
Install steam generator nozzle dams to support eddy current testing.
b.
Observations and Findin s
The inspectors concluded that each of these work activities was performed satisfactorily.
M1.2
Surveillance Observations
Ins ection Sco
e 61726
Selected surveillance tests required to be performed by the Technical Specifications
were reviewed on a sampling basis to verify that:
(1) the surveillances were correctly
included on the facilityschedule; (2) technically adequate procedures existed for the
performance of the surveillances; (3) the surveillances had been performed at a
frequency specified in the Technical Specifications; and (4) test results satisfied
acceptance
criteria or were properly dispositioned.
The inspectors observed all or portions of the following surveillances:
STP M-81A
Diesel Engine Generator Inspection (Every Refueling Outage),
Revision 13
STP M-9L
Diesel Generator Shutdown Lockout Relay Test, Revision 21
STP M-86G
NUREG 0737: Charging System (Suction) Leak Reduction and
Leak Check of Charging Pumps Suction, Revision 16
b.
~
Observations and Findin s
The inspectors concluded that each of these surveillance activities was performed
satisfactorily.
0
M1.3
Loss of S ent Fuel Pool Coolin
-10-
Ins ection Sco
e 62707 92902
The inspectors evaluated the licensee response
to AR A0478430 and Quality
Evaluation Q0012110,, which identified an inadvertent loss of spent fuel pool cooling.
Observations and Findin s
On February 25, 1999, at 5:06 p.m., operators received the Unit 1 "Spent Fuel Pool
Level/Temp" annunciator in the control room. Upon checking the plant computer,
operators recognized that the alarm resulted from an elevated temperature of 125 F in
the spent fuel pool. The shift foreman dispatched a nuclear operator who noted that the
local temperature gauge for the spent fuel pool indicated 126'F. The nuclear operator
found that Spent Fuel Pool Pump 1-2 was not operating as required and rest'arted the
pump. Since the cause of the trip was unknown at this time, the shift foreman directed
hourly checks of Spent Fuel Pool Pump 1-2 to ensure continued operation.
Following
restart of the pump, spent fuel pool temperature gradually returned to the normal
temperature of 100 F.
The licensee determined from operator logs taken on February 25 that Spent Fuel Pool
Pump 1-2 was running at approximately 11 a.m, with a spent fuel pool temperature of
100'F.
Upon search of plant records, the licensee determined that Relay CIAX-H
(associated with the Containment Phase A isolation signal) had been replaced that day.
One of the purposes of the control circuit for Relay CIAX-His to trip the spent fuel pool
cooling pumps during an accident to prevent overloading of the DEGs. Since
Relay CIAX-Hhad been removed at approximately
1 p.m., the licensee concluded that
spent fuel pool cooling had been lost for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.
Engineers determined that the heatup
rate was approximately 6'F per hour and that the time to boil the spent fuel pool was
approximately 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />.
Upon review of Work Order 60444, the inspectors noted that the clearance associated
with the procedure contained no precautions or limitations to notify operators of th'e trip
of the spent fuel pool cooling pump when removing Relay CIAX-H. Had this precaution
.been in place, operators could have immediately restarted Spent Fuel Pool Pump 1-2,
preventing the inadvertent heatup of the spent fuel pool. Because this precaution was
not in the clearance associated with Work Order 60444, this maintenance activity was
not appropriately preplanned for the circumstances.
The failure to properly preplan the
replacement of Relay CIAX-His the second example of a violation of Technical Specifications 6.8.1.a.
However, this Severity Level IVviolation is being treated as a
noncited violation, consistent with Appendix C of the Enforcement Policy. This violation
is in the corrective action program as AR A0478430 and Quality Evaluation Q0012110
(50-275/99003-01).
The inspectors noted that a contributing cause to the event was the inadequate
monitoring of the spent fuel pool. As of February 18, the Unit 1 core was fullyoffloaded,
which significantly increased the heat load of the spent fuel pool. No control room
indications or controls of spent fuel pool pumps or spent fuel pool temperature/level
existed at Diablo Canyon.
However, operators continued to check spent fuel pool
-11-
parameters
every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, even though the heat load in the spent fuel pool had
increased.
The inspectors concluded that, with monitoring every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, margin
existed for operators to take action prior to boiling in the spent fuel pool, since the time
to boil was 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />.
In addition, with the spent fuel pool temperature alarm set at
125'F, operators had sufficient time to restore spent fuel pool cooling prior to fuel pool
temperature exceeding the design basis limitof 140 F. However, the inspectors
concluded that failing to frequently monito'r spent fuel pool temperature following a full
core off-load was an example of nonconservative operation.
Following the loss of spent fuel cooling event of February 25, the licensee revised
Procedure B-8DS1, "Core Unloading," Revision 21, to require checks of the operating
spent fuel pump and spent fuel pool temperature every 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> while the core was
offloaded.
The inspectors concluded that this procedure change was appropriate.
Conclusions
The second example of a noncited violation of Technical Specification 6.8.1.a. for not
properly preplanning maintenance,
which was associated
with replacing a relay that
provided Phase A containment isolation capability (AR A0478430), was identified. The
relay was removed without adequate precautions or consideration for the effect on plant
equipment.
As a result, the operating spent fuel pool cooling pump tripped from service
without operator knowledge.
Operating procedures were not conservative with respect to monitoring spent fuel pool
temperature since increased temperature monitoring was not required with a full core
offload in the spent fuel pool. Operators continued to monitor the Unit 1 spent fuel pool
temperature every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. As a result, following an inadvertent trip of Spent Fuel
Cooling Pump 1-2, the pump trip went undetected for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, until a spent fuel pool
high temperature annunciator alarmed.
Unit 1 Loss of 500 kV and DEG Start
Ins ection Sco
e 61726 92902
t
The inspectors evaluated the licensee response to a Unit 1 turbine trip signal that
occurred on March 3, 1999, while the unit was in Mode 6.
Observations and Findin s
On March 3, while Unit 1 was in Mode 6, in parallel with the preparations being made to
test the Bus G auto transfer to DEG 1-2, the main turbine oil and condensate
systems
were being returned to service.
At approximately 3 p.m., a turbine trip signal caused the
auto-transfer of the Unit 1 electrical buses from the 500 kV offsite auxiliary power source
to the 230 kV offsite startup power source.
Vital Bus G did not transfer because
its
startup feeder breaker was in the "Test" position in preparation for DEG 1-2 surveillance
testing, as specified in Procedure M-13G, "4 kV Bus G Non-Sl Auto-Transfer Test,"
Revision 16A. DEG 1-2 automatically started and the bus loads stripped, as designed
for a loss of offsite power. As a consequence,
RHR Pump 1-1 tripped (pump providing
shutdown cooling), as well as Spent Fuel Pool Pump 1-2. The loads did not sequence
-12-
onto Bus G because
no safety injection signal was present.
Operators responded
promptly to restart RHR Pump 1-1 within 39 seconds and Spent Fuel Pool Pump 1-2
within approximately 5 minutes. After stabilizing the plant, the operators paralleled
DEG 1-2 to startup power, then unloaded, separated,
and secured DEG 1-2.
Prior to restoring the 500 kV auxiliary power to Unit 1, Operations investigated the event
to gain a basic understanding of its cause.
At the beginning of the refueling outage on
February 7, Unit 1 electrical buses were transferred to the 230 kV startup power, and
the unit was separated from the grid. Subsequently, auxiliary power was restored for
backfeeding in accordance with Procedure OP J-2:V, "Backfeeding the Unit from the
500 kV System," Revision 3B, and electrical buses were transferred back to the 500 kV
auxiliary power., Part of Procedure OP J-2V applies administrative tagouts to disable
turbine protection related trips that could open the 500 kV generator output breakers.
At
this time, operators properly disabled turbine thrust bearing wear trip along with other
On February 13, electrical buses were'transferred
to startup power, and the 500kV
transformer banks were cleared for outage-related
maintenance.
On February 25,
maintenance was completed, and operators were assigned to restore the 500 kV
auxiliary power.
During the restoration, operators used Procedure OP J-2:I, "Main'and
Aux Transformer Return to Service," Revision 9, to restore the 500 kV power.
Procedure OP J-2I specifically directs placing the transformer protection switches in
service but is vague about positioning the other turbine trip protection switches.
In the
absence of specific guidance, the operators erroneously placed the thrust bearing wear
trip in service.
The failure to properly implement procedures for restoring the 500 kV
electrical power is a violation of Technical Specification 6.8.1a because of its impact on
safety-related equipment.
This Severity Level IVviolation is being treated as a noncited
violation, consistent with Appendix C of the NRC Enforcement Policy. This violation is in
the corrective action program as AR A0479274 and Nonconformance Report N0002089
(50-275/99003-03).
Also, the licensee investigated the cause of the high thrust bearing wear trip. Various
turbine and generator related oil pumps were being restored and tested throughout the
day. Because the main turbine thrust bearing trip nozzle assembly had not yet been
aligned, the thrust bearing was in a position that caused the trip oil pressure to rise
above its trip setpoint when the auto-.stop oil system was pressurized by the pump
starts.
After understanding the basic steps that led to the Unit 1 trip, on-the-spot
procedure changes were made to incorporate the specific instructions outlined in
Procedure OP J-2:V to disable turbine protection related trips that could potentially open
the 500 kV breakers.
Operators used the revised procedures to restore 500 kV power.
Approximately 3~/~ hours elapsed from the time of loss of 500 kV auxiliary power until its
restoration.
The inspectors agreed with the assessment
that procedure deficiencies led to the
misalignment of the thrust bearing trip switch and contributed to the turbine trip.
However, the inspectors concluded that the operators who performed the procedure
should have clarified the unclear procedure guidance before positioning trip circuits.
Operations personnel subsequently reviewed similar electrical restoration procedures,
and several changes were made to clarify vague guidance on positioning trip circuits.
0
-13-
Also, the licensee identified a weakness
in the sequence
of steps for performing the
auto-transfer test.
Procedure M-13G requires that the Bus G startup feeder breaker be
racked into the "Test" prior to simulating the loss of 500 kV auxiliary power. Subsequent
steps in the procedure instruct the operators to start RHR Pump 1-2, which is powered
by Bus H, since the Bus G RHR pump willbe stripped off the bus and not automatically
restarted.
Operators concluded that Procedure M-13G could be improved by placing
the step to start the other RHR pump prior to the step to rack the Bus G startup feeder
breaker into the "Test" position.
Conclusions
A noncited violation of Technical Specification 6.8.1a. for failing to provide a procedure
appropriate to the circumstances
(AR A0479274) was identified. In this instance, the
procedure used to restore the 500 kV offsite power source, in this instance, provided
vague guidance for positioning the main turbine protective trip switches.
In addition,
lack of a questioning attitude on the part of operators restoring the 500 kV power
contributed to the trip signal, partial loss of offsite power, and inadvertent DEG start.
Operator response
in restoring shutdown and spent fuel pool cooling following the loss
of 500 kV power was good.
Failure of DEG 1-1 to Pass Time-to-Rated Volta e Test
Ins ection Sco
e 61726
The inspectors evaluated the response to Quality Evaluation Q0012109 and associated
AR A0478728, which described the failure of DEG 1-1 to reach rated voltage within the
13-second acceptance
criteria limitduring a performance test.
Observations and Findin s
During a timed start of DEG 1-1 on February 27, 1999, the DEG took 20.4 seconds to
reach 4160 volts. This exceeded the test acceptance
criteria of 13 seconds and was
considered to be a valid Maintenance Rule functional failure of DEG 1-1. During the
timed start, engineers observed that voltage increased to approximately 2000 volts,
hesitated for approximately 6 seconds, then rapidly rose to the required 4160 volts.
During a normal DEG start, excitation voltage is initiallysupplied to the motor generator
windings until a point of approximately 2700 volts. At approximately 2700 volts, the K3
relay opens to allow the voltage regulator to control the voltage increase to 4160 volts.
Below 2700 volts, the voltage regulator is inefficient. Without the aid of the excitation
voltage, the DEG would be unable to reach its rated 4160 volts within the required 13
seconds.
The engineers conducting the test remembered that a similar problem had occurred in
August/September
1998 and that part of the corrective action involved replacing the K3
relay. Consequently, the engineers decided to replace the K3 relay before resumption
of testing.
The engineers who decided to replace the K3 relay did not realize at this time
that DEG 1-1 was the same DEG that had the K3 relay replaced in September 1998.
-'14-
Prior to retesting DEG 1-1, engineers reviewed a troubleshooting guide provided by
Besler Electric, the manufacturer of the exciter and the voltage regulator.
In order to
gather more information to monitor symptoms, two Windowgraf recorders were installed
to monitor generator output v'oltage, DC field voltage and current, relay actuation
voltage, and transformer current. The inspectors considered the use of the additional
test monitoring equipment to be a prudent measure but opined that the licensee had
missed an additional opportunity to diagnose the problem by replacing the K3 relay prior
to resumption of testing. The licensee bench tested the removed K3 relay and
determined that the K3 relay behaved normally during its bench tests.
Following installation of the Windowgraf recorders, from February 28 through March 4,
five tests were performed with no additional failures.
DEG 1-2 was monitored to obtain
the same test data as for DEG 1-1 as a benchmark.
Test data for the five DEG 1-1
tests and the DEG 1-2 test were similar; consequently, the licensee considered DEG 1-1
to be operable.
Since the additional test data was not sufficient to measure all of the
voltage regulator control card parameters,
the licensee replaced the voltage regulator
control card.
Seven successful tests were performed subsequent
to the voltage
regulator card replacement.
Because of the failures on DEG 1-1 in August 1998 and February 1999, DEG 1-1 was
being tested weekly in accordance with Technical Specification requirements.
As of the
end of the inspection period, the licensee had only two more Technical Specifications
tests to be conducted on the accelerated frequency of once per week versus monthly.
However, the troubleshooting plan recommended that the accelerated
testing be
continued for an additional ten instrumented tests beyond that required by the Technical
Specifications.
Conclusions
Following the failure of DEG 1-1 to reach rated voltage within its acceptance
criteria,
troubleshooting to determine the cause of the problem was generally thorough and
identified a suspect voltage regulator.
Troubleshooting appropriately considered vendor
recommendations,
and collected data and the number and frequency of tests exceeded
requirements.
M8
Miscellaneous Maintenance Issues (92700)
M8.1
Closed
Violation 50-275/97003-04:
failure to take adequate corrective actions to
correct deficiencies in the painting program.
This violation was issued as a result of an improperly painted governor valve linkage on
Turbine-Driven AuxiliaryFeedwater Pump 1-1. On February 28, 1997, the licensee
declared Turbine-Driven Auxiliary Feedwater Pump 1-1 inoperable because
the paint on
the governor valve linkage could potentially impair its movement.
Subsequently,
the
licensee issued Licensee Event Report 50-275/97-004-01
to describe this event.
-15-
The issues discussed
in the licensee event report were discussed
in NRC Inspection
Report 50-275; 323/97-03 and in the violation response letter dated June 18, 1997. The
inspectors verified the corrective actions described in the violation response letter and
licensee event report to be reasonable
and complete.
Closed
Licensee Event Re ort50-275/97-004-01:
Technical Specification 3.7.1.2not
met because of paint applied to auxiliary feedwater pump turbine governor linkage
because
of personal error.
Closure of this followup item is discussed
in Section M8.1.
Conduct of Engineering
Fibrous Material in Containment
Ins ection Sco
e 37551
The inspectors evaluated the corrective actions related to AR A0477669, which
discussed the potential for fibrous material in containment to impact the operability of
the containment recirculation sumps.
Observations and Findin s
On October 22, 1998, upon review of an operating experience report from another
facility, the licensee identified the potential for fibrous material in fire stops of vertical
cable trays to impact containment recirculation sump operability. The engineers were
concerned that this fibrous material could be transported to the containment
recirculation sumps, clog the sumps, and cavitate the operating RHR pumps during the
recirculation phase of a design basis accident.
The licensee initiated AR A0477669 to
enter this item into the corrective action program.
As-built drawings did not have sufficient detail to identify the exact location or quantity of
this fibrous material.
Based on discussions with personnel that performed repairs on fire
stops, the licensee surmised that vertical cable tray fire stops consisted of fibrous
materials known as Kaowool or Marinite. Because of the lack of sufficient detail,
engineers could not initiallydetermine if the fibrous material was installed in
jet-impingement zones or subject to the effects of high energy line breaks.
Based on
the unknown status of the fibrous material, engineers coded this AR As an "issue
needing validation to determine the impact on operability" and did not perform a prompt
The prompt operability assessment
was scheduled for
performance during Refueling Outage 1R9 in February 1999.
On February 20, 1999, during Refueling Outage 1R9, the licensee inspected the Unit 1
containment to determine the exact location and quantity of fibrous material. The
licensee evaluated or removed the fibrous material the Unit 1 containment located in jet
impingement zones.
The inspectors reviewed the licensee action with respect to Unit 1
and concluded that the action was satisfactory.
On February 20,'he licensee performed a prompt operability assessment
for Unit 2.
Although the licensee did not inspect Unit 2, the licensee noted that both units were
reasonably similar. Ten specific postulated pipe break locations on Unit 1 had
significant fibrous material that could potentially be released
in a jet-impingement zone.
Engineers evaluated the operability of the Unit 2 containment recirculation sumps based
on the Unit 1 information, using accepted transport phenomena calculations.
The
engineers determined that, although the net positive suction head of the RHR pumps
was decreased,
adequate
margin for operability existed.
The inspectors reviewed the
Unit 2 operability assessment
and determined it was satisfactory.
Although the inspectors concurred with the technical merit of the containment
recirculation sump operability assessments,
the inspectors questioned the timeliness of
these evaluations.
The inspectors noted that the operability of the sumps directly
impacted safety and was considered risk significant. Generic Letter 91-18, "Resolution
of Degraded and Nonconforming Conditions and Operability," stated that the timeliness
of operability issues should be commensurate
with the safety significance.
However,
the licensee had two missed opportunities to inspect the containment structures for
fibrous material.
Both Units 1 and 2 sustained forced outages in December 1998, yet
licensee management deferred resolution of this issue until Refueling Outage 1R9.
Conclusions
The prompt operability assessment
associated with fibrous material in fire stops in
containment in both units, while technically sound, was not timely, given the potential
safety significance of inoperable containment recirculation sumps.
The operability
question of the containment recirculation sumps was identified in October 1998.
However, the prompt operability assessment
was not completed until February 1999.
The inspectors identified a deficiency in the operability process, specifically, the "issue
needing validation to determine the impact on operability" portion. The licensee had
missed two opportunities to perform a prompt operability assessment
in December 1998
when forced outages had occurred in each unit.
Modifications to the 230kV Offsite Power S stem
Ins ection Sco
e
The inspectors reviewed the modifications to the offsite power system to address
equipment reliabilityconsiderations and the divestiture of the Morro Bay Power Plant
(Morro Bay) by Pacific Gas and Electric.
Observations and Findin s
The 230 kV offsite power system at Diablo Canyon and the capabilities and
configuration of Morro Bay were described in detail in the Final Safety Analysis Report,
Section 8.2, "Offsite Power System," Revision 11, dated November 1996. The Final
Safety Analysis Report described various configurations of Morro Bay and the effect of
such configurations on the reliability of offsite power at the site. Additionally, the Final
Safety Analysis Report provided information and references to plant procedures that
addressed
contingency actions.
These contingency actions would need to be
-17-
accomplished at Diablo Canyon in the event of equipment failures or outages at Morro
Bay in order to ensure adequate voltage for safety-related equipment.
In late 1997, the licensee began proceeding with modifications that would eliminate the
dependence
of the Diablo Canyon units on Morro Bay. These modifications replaced
the existing startup transformers with load tap changing transformers and added shunt
capacitors to eliminate the need for Morro Bay. These modifications resulted, in part,
from the uncertainty associated with the economic viabilityof Morro Bay in a
deregulated electrical environment that began in January 1998.
In mid-February 1998,
the licensee completed all of the planned modifications associated
with the 230 kV
offsite power system and subsequently divested itself of Morro Bay.
Allof the changes to the facilityand the divestiture of Morro Bay were conducted without
prior approval by the NRC. The screening evaluations conducted by the licensee for the
modifications concluded that the modifications to the offsite power system and the
divestiture of Morro Bay did not constitute an unreviewed safety question and, therefore,
did not require prior NRC approval.
However, based on the questions raised by agency
inspectors, the licensee initiated a management
meeting with the NRC on December 22,
1997, and described the changes that had been made.
As a result of the issues raised
at that meeting, the licensee submitted a license amendment request to the NRC
(Pacific Gas and Electric Letter DCL 98-008, dated January 14, 1998) seeking approval
for the changes that had been implemented.
The license amendment request described
the modifications to the offsite power system and the elimination of the dependence
of
the facilityon Morro Bay. In the submittal, the licensee asserted that the new
configuration represented
a safety improvement at the facilityon the basis of the
assumed superior reliability characteristics of the new equipment.
The inspectors noted that 10 CFR 50.59 states, in part, that a proposed change, test, or
experiment shall be deemed to involve an unreviewed safety question if the possibility of
an accident or malfunction of a different type than any evaluated previously in the safety
analysis may be created.
Further, the inspectors determined that the addition of the
load tap changing transformers along with the shunt capacitors in lieu of the
dependence
on Morro Bay constituted a change to the facilityas described in the Final
Safety Analysis Report and that this change introduced the possibility of a malfunction of
a different type than had been previously analyzed (e.g., the load tap changers may fail
to adjust as required for changes
in voltage or passive failure of the shunt capacitors).
Thus, the inspectors determined that the
10 CFR 50.59 evaluation was inadequate and
that these changes had resulted in an unreviewed safety question.
After consultation with the Director, Office of Enforcement, the NRC is exercising
enforcement discretion in accordance with VII.B.6 of the Enforcement Policy and
refraining from issuing a Notice of Violation. Discretion is appropriate because
of:
(1) confusion surrounding the determination of whether the change constituted an
unreviewed safety question, (2) the similarity to other issues previously cited for which
corrective actions have been taken and are sufficiently broad to address this violation
(EA 98-364), and (3) the apparent improvement in grid reliability that resulted from the
change (50-275; 323/99003-04).
-18-
c
Conclusions
On January,
14, 1998, a violation of 10 CFR 50.59 resulted because the licensee
implemented a design change and failed to submit a license amendment for a change to
the facilitythat involved an unreviewed safety question.
The NRC, however, is
exercising enforcement discretion in accordance with Section VII.B.6of the enforcement
policy and is refraining from issuing a Notice of Violation. The licensee changed the
configuration of the 230 kV offsite power source from dependence
on Morro Bay for
operability to dependence
on load tap changing transformers and capacitor banks.
Corrective actions for previous 10 CFR 50.59 violations sufficiently addressed
this issue.
The design change improved the reliability of the 230 kV system.
Miscellaneous Engineering Issues (92700, 92903)
E8.1
Closed
Licensee Event Re ort 50-275/95-013-02 and -01: component cooling water
system may have operated outside of its design basis
Because of the limited capacity of the auxiliary saltwater system combined with
increases
in the calculated heat load to the component cooling water system, the
component cooling water system may have operated outside of its design basis.
This
issue was discussed
in NRC Inspection Report 50-275; 323/98-05.
No new issues were
revealed by the licensee event report.
V.~
R1
Radiological Protection and Chemistry Controls
R1.1
Reactor Coolant S stem Chloride Intrusion
a.
Ins ection Sco
e 71750 92904
The inspectors evaluated the licensee response to AR A0476360, which described an
intrusion of chlorides into the reactor coolant system.
Observations and Findin s
On February 8, 1999, chemistry personnel identified that, on Unit 1, reactor coolant
system chlorides exceeded the Equipment Control Guideline limitof 150 ppb. The
chloride concentration was 770 ppb and increased until a peak of 1060 ppb was
"
reached.
Chemists sampled the in-service chemical and volume control system
deborating demineralizer and identified that the effluent chloride concentration was
1730 ppb. After operators isolated the in-service deborating demineralizer, the chloride
concentration started decreasing and had returned within the specification of 150 ppb on
February 10. Because reactor coolant system chlorides exceeded the limitby a
significant margin, chemists initiated AR A0476360 to enter this item into the corrective
action system.
-19-
Licensee investigation revealed that a chloride based resin was loaded into the
deborating demineralizer for crud burst cleanup.
However, the barrel in the Diablo
Canyon warehouse was labeled with a licensee material tag stating that the resin was
hydroxide based.
The licensee contacted the resin vendor who confirmed that the barrel
contained a chloride based resin.
Normally, when purchasing resin for use in the reactor coolant system, a receipt
inspection program, which included testing of the resin, was implemented to ensure that
the resin contained no detrimental properties.
The licensee procured the resin as
hydroxide based for use in the radwaste processing system.
Because the resin was
procured for a nonsafety-related
function, no receipt inspection was performed.
The
barrel was labeled as an hydroxide based resin. Chemists noted that this resin was
effective in processing radwaste streams and, therefore, recommended
its use in the
No testing or other confirmatory actions were taken when the
chloride based resin was approved for use in the reactor coolant system.
The licensee initiated Nonconformance Report N0002084 because of the potential
consequences
of the chloride intrusion and the concerns with the resin procurement
process.
The inspectors agreed that the process for dedicating radwaste resin for use
in the reactor coolant system was weak in that no testing or other confirmatory actions
were employed.
The licensee also identified several other barriers that should have
prevented this deficiency.
Procedure OP B-1A:XIII,"CVCS Demineralizers,"
Revision 13, step 1.1, specified, in part, that the demineralizer is to be rinsed and
sampled prior to use.
The effluent was to be routed to the liquid holdup tank while
sampling.
In addition, a CAUTIONprior to Section 2 required verification that samples
are taken to determine the effects of the demineralizer on reactor coolant system
chemistry. The failure of licensee personnel to implement the steps of
Procedure OP B-1A:XIIIis the second example of a violation of Technical Specification 6.8.1.a.
This licensee-identified Severity Level IV violation is being treated
as a noncited violation, consistent with Appendix C of the NRC Enforcement Policy.
This violation is in the corrective action program as Nonconformance Report N0002084
(50-275/99003-02).
Forced oxygenation of the reactor coolant system using hydrogen peroxide was in
progress when the chloride intrusion occurred.
The licensee was initiallyconcerned that
the combination of high oxygen and chlorides in the reactor coolant system could result
in the potential for chloride stress corrosion of reactor coolant system components.
The
licensee contacted the Nuclear Steam Supply System vendor who determined, based
on the actual conditions, chloride stress corrosion was unlikely. The inspectors
reviewed the vendor analysis and concluded that it was satisfactory.
The inspectors
also concluded that the root cause analysis and corrective action process addressed
the
issues appropriately.
Conclusions
The second example of a noncited violation of Technical Specification 6.8.1.a for failure
to follow procedure resulted when chemists failed to sample the chemical and volume
control system demineralizer prior to placing it in service (NCR N0002084).
This error
resulted in a significant chloride intrusion into the reactor coolant system and caused the
-20-
Equipment Control Guideline limitto be exceeded.
In addition, the controls for the
purchase, control, and dedication of resins for nonsafety-related applications were
deficient. The licensee performed a detailed root cause'nalysis
and corrective actions
addressed
the issues appropriately.
S1
Conduct of Security and Safeguards Activities
S1.1
General Comments
71750
During routine tours, the inspectors noted that the security officers were alert at their
posts, security boundaries were being maintained properly, and screening processes
at
the Primary Access Point were performed well. During backshift inspections, the
inspectors noted that the protected area was properly illuminated, especially in areas
where temporary equipment was brought in.
V. Mana ement Meetin s
X1
Exit Meeting Summary
The inspectors presented the inspection results to members of licensee management at the
conclusion of the inspection on March 11, 1999. The licensee acknowledged the findings
presented.
The inspectors asked the licensee whether any materials examined during the inspection
should be considered proprietary.
No proprietary information was identified.
0
-1-
ATTACHMENT
SUPPLEMENTAL INFORMATION
PARTIALLIST OF PERSONS CONTACTED
Licensee
J. R. Becker, Manager, Operations Services
W. G. Crockett, Manager, Nuclear Quality'Services
R. D. Gray, Director, Radiation Protection
T. L. Grebel, Director, Regulatory Services
D. B. Miklush, Manager, Engineering Services
D. H. Oatley, Vice President and Plant Manager
R. A. Waltos, Manager, Maintenance Services
L. F. Womack, Vice President, Nuclear Technical Services
INSPECTION PROCEDURES (IP) USED
IP 61726
IP 71707
IP 92700
IP 92902
IP 92904
Onsite Engineering
Surveillance Observations
Maintenance Observation
Plant Operations
Plant Support Activities
Onsite Followup of Written Reports of Nonroutine Events at Power Reactor
Facilities
Followup - Operations
Followup - Maintenance
Followup - Engineering
Followup - Plant Support
Prompt Onsite Response
to Events at Operating Power Reactors
ITEMS OPENED AND CLOSED
~oened
None.
Closed
50-275/97003-04
50-275/97-004-01
50-275/95-013-02
and -01
failure to take adequate corrective actions to correct
deficiencies in the painting program (Section M8.1)
LER
Technical Specification 3.7.1.2 not met because
of paint
applied to auxiliary feedwater pump turbine governor
linkage (Section M8.2)
LER
component cooling water system may have operated
outside of its design basis (Section E8.1)
.
0 ened and Closed
50-275/99003-01
50-275/99003-02
50-275/99003-03
50-275; 323/
99003-04
Improper maintenance clearance preplanning on nitrogen
system during midloop and for relay replacement
(Sections 01.2 and M1.3)
Failure to enable RVRLIS alarm during midloop and failure
to sample demineralizer as required (Sections 01.2
and R1.1)
Inadequate maintenance procedure resulted in partial loss
of offsite power (Section M1.4)
Failure to submit license amendment for changes to 230 kV
offsite power system (Section E1.2)
LIST OF ACRONYMS USED
DEG
IP
NRC
RVRLIS
action request
diesel engine 'generator
inspection procedure
noncited violation
Nuclear Regulatory Commission
Public Document Room
reactor vessel refueling level indication system
violation