ML17059B645
| ML17059B645 | |
| Person / Time | |
|---|---|
| Site: | Nine Mile Point  |
| Issue date: | 07/17/1997 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML17059B644 | List: |
| References | |
| 50-220-97-05, 50-220-97-5, 50-410-97-05, 50-410-97-5, NUDOCS 9707290167 | |
| Download: ML17059B645 (44) | |
See also: IR 05000220/1997005
Text
U.S. NUCLEAR REGULATORY COMMISSION
REGION
I
Docket Nos.:
50-220; 50-410
Report No.:
97-05; 97-05
Licensee:
Niagara Mohawk Power Corporation
Facility:
Nine Mile Point
Location:
Oswego, New York
Dates:
I
March 10 - April 18, 1997
Inspectors:
L. S. Cheung, Sr. Reactor Engineer
Electrical Engineering Branch, DRS
'R. A. Skokowski, Resident Inspector
Projects Branch No. 5, DRP
Approved by:
illiam H. Ruland, Chief
Electrical Engineering Branch, DRS
9707290167
970717
ADQCK 05000220
8
TABLE OF CONTENTS
PAGE NO.
E1
Conduct of Engineering ................ ~.................
~
~
~
~
~
~
1
E1.1
E1.2
E1.3
Unit 1 Motor-Operated Valve Hot Short Issues .........
~ ..
Unit 2 Motor-Operated. Valve Hot Short Issues ......"...
~ ..
Inadequate
Isolation of Unit 2 Remote Shutdown Panel Control
Circuits from the Control Room
.
~
~
~ ..
~
~ ..
~ . ~... ~,
. ~...
~
0
1
5
9
E8
Miscellaneous
Engineering
Issues (92903)
. ~... ~....... ~..........
~ .
12
E8.1
E8.2
E8.3
E8.4
E8.5
E8.6
E8.7
E8.8
(Closed) Unresolved Item 50-410/95-24-02
.
(Closed Unresolved Item 50-220/96-13-04
(Closed) Unresolved Item 50-410/96-14-01
(Closed) Unresolved Item 50-220/96-15-01:
(Updated) Unresolved Item 50-410/96-15-01
(Closed) Violation 50-220/95-24-01
(Closed) LERs 50-410/96-15 and 96-15-01
(Closed) LERs 50-220/96-10 and 96-10-01
12
15
15
15
15
15
15
16
E9
UFSAR Reviews
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
1 6
X1
Exit Meeting.......................
PARTIAL LIST OF PERSONS CONTACTED .......
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
1 6
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
1 7
0
EXECUTIVE SUMMARY
Nine Mile Point Units
1 and 2
NRC Inspection Report Nos. 50-220; 50-410/97-05
This engineering inspection was conducted:
1) to review licensee's corrective actions
following their identification that certain motor-operated
valves (MOV) in the safe
shutdown systems at both Units
1 and 2 were vulnerable to valve damage
caused
by fire-
induced hot shorts during a postulated control room fire; 2) to assess
licensee's
performance
in response to their identification, on two separate
occasions, that isolation
switches were not provided for Unit 2 Division I and II emergency diesel generator
(EDG)
service water outlet valves; 3) to review licensee's corrective actions in resolving the issue
associated
with Unit 2 Agastat GP relay service lives; and 4) to close out several
previously identified inspection items and licensee event reports (LER).
Encnineerinq
~
The licensee's review in 1992 failed to identify that certain motor-operated
valves in
Unit 1 shutdown cooling systems were vulnerable to valve damage
caused
by a fire-
induced hot short. The licensee's review at that time was narrow in scope
in that it
restricted the potential damage to the valve motor only and did not include potential
mechanical damage to the valve by the excessive torque of the valve motor.
~
The licensee revisited the 1992 review following a request by the NRC and
identified that two safe shutdown MOVs in Unit 1 were vulnerable to valve damage
caused
by a fire-induced hot short during a postulated control room fire. The
damage of any one of these two valves could cause the Unit 1 shutdown cooling
system to be inoperable.
This condition constituted
an apparent violation of 10 CFR 50.48(b).
~ 'fter identifying the multiple wiring number and termination point errors in Unit,1
valve repair procedures,
the licensee promptly revised the affected procedures
and
initiated a corrective action to preclude recurrence,
This condition constituted
a
non-cited violation, consistent with Section VII.B.1 of the NRC Enforcement Policy.
The licensee identified similar MOV problems (hot short issues)
in Unit 2 shutdown
cooling system and the reactor core isolation cooling (RCIC) system.
The licensee
promptly corrected the deficient conditions following their identification.
However,
these conditions constituted
an apparent violation of Unit 2 operating license No.
NPF-69, Item 2.G, Fire Protection Program.
The licensee's failure to identify and correct the deficient conditions at Units
1 and
2 (valves vulnerable to hot short issues) during the 1992 review constituted
an
apparent violation to 10 CFR 50, Appendix B, Criterion XVI, Corrective Action,
which requires conditions adverse to quality are promptly identified and corrected.
On two separate
occasions,
the licensee initiated good efforts in identifying the
discrepancies
within the control circuitry (lack of isolation switches for short-to-
ground protection) for Unit 2 EDG service water outlet valves.
The licensee's
actions to minimize EDG's unavailable time during the repairs were also good.
However, this deficient condition could have caused
a loss of cooling water to the
EDGs during a control room fire and adversely affected the safe shutdown of the
plant from the remote shutdown panel
~ This condition constituted
an apparent
violation of Unit 2 operating license No. NPF-69, Item 2.G, Fire Protection Program.
A weakness was identified in the licensee's reportability evaluation for
discrepancies,
as evidenced by the numerous questions from the inspectors
and
excessive time required for the licensee to determine that the above condition was
reportable under 10 CFR 50.72.
The licensee's
program for calculating the service lives of Unit 2 normally energized
Agastat relays was poor.
Calculation methods were not based
on sound
engineering judgement.
The licensee was in the process of revising the program
and developing
a better calculation method.
The original unresolved
item is closed.
A new unresolved
item is open for this issue.
Three previously identified unresolved items and one violation were closed.
Re ort Details
I. En ineerin
E1
Conduct of Engineering
E1.1
Unit 1 Motor-0 crated Valve Hot Short Issues
a.
Ins ection Sco
e
On November 1, 1996, Niagara Mohawk Power Corporation (NMPC) identified that
two motor-operated
valves (MOV) in the shutdown cooling system were vulnerable
to valve damage if a fire-induced hot short (short circuit between control wiring and
a power source) bypass the control, limit and torque switches during a postulated
control room fire. The licensee promptly notified the NRC of this event and issued
a
Licensee Event Report (LER). The inspectors reviewed the licensee's corrective
actions in response to their identification of this issue.
b.
Observations
and Findin s
Back round
On February 28, 1992, the NRC issued Information Notice (IN) 92-18, "Potential for
Loss of Remote Shutdown Capability During a Control Room Fire," to alert all
operating licensees to conditions found at several reactors that could result in the
loss of capability to maintain the reactor in a safe shutdown condition in the unlikely
event that a control room fire forced reactor operators to evacuate the control room.
The control room fire could cause hot shorts that could bypass the control
switches, torque switches, and limit switches of the MOV control circuits, and
initiate spurious operations of the MOVs which were required for safe shutdown.
These spurious operations could cause the valve motor to be continuously
energized,
resulting in excessive torque and current, causing mechanical damage to
the valve or electrical damage to the motor.
In response
to IN 92-18, the licensee issued Deviation/Event Report (DER) 1-92-Q-
0881 on March 17, 1992, to determine its applicability to Unit 1.
Because of their
narrow scope of review and a misinterpretation that spurious maloperations
were
limited to functional failure only, the licensee failed to identify and correct the
potential problem of valve damage
(mechanical damage due to excessive torque
from the valve motor) at that time.
The Event
During a recent (October 7, 1996) MOV inspection by the NRC, the licensee was
requested to revisit their review of IN 92-18.
The licensee reviewed the 1992
disposition of DER 1-92-Q-0881, recognized potential valve damage
in spite of
thermal overload protection, and identified that two valves in the shutdown cooling
system could be damaged
mechanically if a fire-induced hot short bypasses
certain
control, limit and torque switches of the valves.
These two valves, IV 38-01 and IV
38-13, were normally closed, were both inside the drywell, and were in the
common suction and the common discharge paths of the shutdown cooling system.
Any one valve that became inoperable would cause the shutdown cooling system to
be inoperable.
Subsequently,
the licensee issued
LER 96-10 on December 2, 1996,
to report this issue to the NRC. The licensee also noted that the circuit breakers for
these two valves, IV 38-01 and IV 38-13, had been administratively locked open
'since'April 12, 1995, because
of an unrelated modification (for 10 CFR 50,
Appendix J water seal issue).
This administrative control (circuit breakers locked
open) would preclude spurious maloperations
of these valves during a control room
fire. The licensee also issued, on February 28, 1997, Supplement
1 to the LER.
Supplement
1 included the result of the root cause evaluation.
The licensee
attributed the root cause for not identifying these problems earlier (during the 1992
review) to be a misinterpretation that the effects of the spurious operations were
limited to functional failures (electrical failure of the valves), without the assessment
of mechanical failure. The licensee also acknowledges that NMPC personnel failed
to recognize, at that time, that valve actuators could develop sufficient thrust to
mechanically damage the valves.
/
Review of the LER
The inspectors reviewed the LER, including Supplement
1, and found the LER
properly described the event.
The inspector agreed with the licensee for the root
cause of the event.
Short term corrective actions taken by the licensee included:
1) performing
additional detailed reviews for all other motor-operated
valves in the safe shutdown
systems,
including the hot shutdown system, and found that the other valves were
not affected; 2) starting promptly a similar review of Unit 2 motor-operated
valves
in the safe shutdown system and found many valves that were susceptible to this
fire-induced hot short issue, as discussed
in Section E.2 of this report.
Long term corrective actions planned by the licensee included: 1) revising Appendix
R safe shutdown analysis in the FSAR to require that the valve breaker be locked
open to preclude spurious maloperation,
by May 30, 1997; 2) training by December
31, 1997, of NMPC technical staff of the details of this LER to preclude future
occurrences
of inadequate
failure mode effect analyses
relative to motor-operated
valve spurious actuations.
The inspectors determined that the licensee's short-term and long-term corrective
actions for'this event to be appropriate.
The inspector also determined that for the
period from March 3, 1983, when the 10 CFR 50 Appendix R program was
implemented to April 12, 1995, when the circuit breakers for motor-operated
valves
IV 38-01 and -13 were administratively locked open, Unit 1 was in apparent
violation of 10 CFR 50.48(b) as follows:
3
10 CFR 50.48(b) requires, in part, that all nuclear power plants licensed prior to
January
1, 1979, shall satisfy the applicable requirements
of Appendix R to 10 CFR 50, Section III.G, including the requirements of Section III.L, alternative and
dedicated shutdown capability, which, according to the NRC's response
to Question
5.1.3 for Generic Letter 86-16, applies to the alternative safety shutdown option
under Section III.G, as follows:
Although 10 CFR 50.48(b) does not specifically include Section III.Lwith Sections
III.G, J, and 0 of Appendix R'as a requirement applicable to all power reactors
licensed prior to January
1, 1979, the Appendix, read as a whole, and the Court of
Appeals decision on the Appendix, Connecticut
Li ht and Power, et al. v. NRC, 673
F2d. 525 (D.C. Cir1982), demonstrate
that Section III.Lapplies to the alternative
safe shutdown option under Section III.G if and where that option is chosen by the
licensee.
The alternative shutdown capability had been chosen by the licensee (two
alternative shutdown panels were provided)
~ Appendix R,Section III.L.5 requires
that equipment and systems comprising the means to achieve and maintain cold
shutdown conditions shall not be damaged
by fire; or the fire damage to such
equipment and systems shall be limited so that the systems can be made operable
and cold shutdown can be achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.- Materials for such repairs
shall be readily available on site and procedures
shall be in effect to implement such
repairs.
During the period from March 3, 1983, to April 12, 1995, the licensee did not have
written evidence, including repair procedures that if valves IV 38-01 and -13 were
damaged
mechanically due to a fire-induced hot short during a postulated control
room fire, the damaged
valves could be repaired and still achieve the cold shutdown
function within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
Therefore this condition constituted an apparent violation
of 10 CFR 50.48(b). (EEI 50-220/97-05-01)
Review of Re air Procedures
The inspectors reviewed two P&IDs (piping and instrumentation diagram) for two
systems:
C-18017-C for the emergency cooling system, Revision 46; and C-
18018-C for the reactor shutdown cooling system, Revision 23 to identify the
motor-operated
valves (MOV) that were used for hot and cold shutdown following a
postulated control room fire. The inspectors also reviewed the elementary wiring
diagrams for valves IV 38-01, IV 38-13, IV 39-05, -06, -07, and -08, and did not
identify any deficiencies.
The inspectors also reviewed Damage Repair Procedure
N1-DRP-GEN-004, "Emergency Damage Repair for Fire Zones C2 and C3" Revision
3, dated April 25, 1995.
This procedure was used to repair valves IV 38-01 and-
13 following a postulated control room fire. The licensee also checked the
procedure steps against the wiring diagrams for errors.
The licensee found several
steps containing wire numbers and termination point errors, which could hamper
valve repair process if left uncorrected.
The licensee promptly issued an immediate
PCE (procedure change evaluation) to correct these errors.
The licensee also issued
DER 1-97-0682 on March 12, 1997, to document this issue.
The corrective action
for this DER included expanding the procedure reviews to include the other four
repair procedures.
Additional errors were identified in three of the procedures
reviewed.
Subsequently,
the licensee issued additional PCEs to correct the
identified errors.
All four repair procedures
had not been actually used, therefore,
no hardware (repair) errors had been involved.
The licensee attributed the apparent
cause for these errors to be a failure to perform
verification of written documentation
by the procedure writer. The licensee also
stated that all these repair procedures
were special procedures
and had never been
used before.
To eliminate other possible errors, the licensee planned to perform a complete
walkdown of all five repair procedures
and label all accessible wires (for better
identification of wire numbers and termination numbers).
The licensee stated that
these corrective actions would be completed by July 1, 1997.
The inspector's
review of the resolution of DER 1-97-0682 indicated that these actions had been
documented
and tracked by the DER.
The inspectors determined that the completed and planned corrective actions for
this procedure deficiency were appropriate.
However, failure to establish
acceptable
repair procedures
constituted
a violation of 10 CFR 50, Appendix B,
Criterion V, "Instruction, Procedures,
and Drawings," which requires activities
affecting quality to be prescribed by documented
instructions, procedures,
or
drawings of a type appropriate to the circumstances.
However, this licensee-
identified violation is being treated as a Non-cited Violation, consistent with Section
VII.B.1 of the NRC Enforcement Policy.
Conclusion
In response to NRC Information Notice 92-18, the licensee issued
a DER (DER 1-92-
Q-0881) in 1992 to document their review for its applicability to Unit 1.
Because of
their narrow scope of review (restricting to potential electrical damage to the motor
only), the licensee failed to identify and correct at that time the potential problem of
valve damage
(mechanical damage due to excessive torque from the valve motor)
due to a fire-induced hot short.
During a recent MOV inspection, the NRC had asked the licensee to revisit their
review of IN 92-18.
The licensee's
re-review identified that two valves in the
shutdown coolin'g system could subject to mechanical damage,
due to high torque
'rom the valve motors, if a fire-induced hot short bypasses
certain control and
torque switches of the valves.
The licensee also noted that the circuit breakers of
the two affected valves had been administratively locked open since April 12,
1995, because
of an unrelated modification.
Locking the circuit breakers open
would preclude maloperations of these valves during a control room fire. The
licensee attributed the root cause for not identifying these problems earlier (during
5
the 1992 review) to be a misinterpretation that the effects of the spurious operation
were limited to functional failure (electrical failure of the motors), without the
assessment
of mechanical valve failure due to excessive torque.
The licensee also
acknowledges that NMPC personnel failed to recognize at that time (during the i
1992 review) that valve actuators could develop sufficient thrust at stall to damage
the valves.
The inspectors concluded that during the period from March 3, 1983, when the 10 CFR 50 Appendix R program"was implemented to April 12, 1995, when the circuit
breakers for the affected two valves were administratively locked open, Unit 1 was
in apparent violation of 10 CFR 50.48(b).
The inspectors concluded that the licensee's failure to identify these potential valve
damages
(during a postulated control room fire) during the 1992 review constituted
an example of an apparent violation of 10 CFR 50. Appendix B, Criterion XVI,
Corrective Action, which requires conditions adverse to quality such as failures,
malfunctions, and nonconformances,
to be identified and corrected promptly.
(EEI 50-220/97-05-02)
The inspectors'eview of LER 96-10, including Supplement
1 to the LER, indicated
that the LER properly described the event.
The inspectors concurred with the
licensee for the root cause of the event.
The inspector determined that the
licensee's short-term and long-term corrective actions, in response to this event,
were appropriate.
A non-cited violation was also identified in the area of valve repair procedures.
Unit 2 Motor-0 crated Valve Hot Short Issues
Ins ection Sco
e
On December 17, 1996, and January
15, 1997, the licensee identified that multiple
MOVs in the shutdown cooling system and the RCIC system were vulnerable to
v'alve damage if a fire-induced hot short bypass the control, limit and torque
switches during a postulated control room fire. The licensee subsequently
notified
the NRC of this event and issued
LER 96-15.
The inspectors reviewed the
licensee's corrective actions in response to their identification of this issue.
Observation
and Findin s
In response
to NRC IN 92-18, the licensee conducted
an applicability review in
1992 to determine whether similar problems existed at Unit 2. The licensee issued
DER 2-92-0-1056 on March 25, 1992, to document the review process
and review
results (disposition).
At that time, the licensee considered that the examples
provided in IN 92-18 only applied to MOVs of which thermal overload protections
were bypassed.
Since the thermal overload protections for Unit 2 were not
bypassed,
the licensee concluded at that time that IN 92-18 did not affect Unit 2
operation.
0
Shutdown Coolin
S stem Motor-0 crated Valves
Following Unit 1 engineering identification that two motor-operated
valves in the
shutdown cooling system were susceptible to valve damage caused
by a fire-
induced hot short during a postulated control room fire, NMPC management
questioned
Unit 2 engineering whether similar conditions existed on the Unit 2
design.
An initial evaluation by Unit 2 engineering
indicated that similar problems
existed in the shutdown cooling mode of the residual heat removal (RHR) system.
At Unit 2, there were two sh'utdown cooling trains (two pumps and two heat
exchangers)
sharing
a common suction path, containing 2RHS" MOV-112 and -113
in series.
At that time, the power supply circuit breaker for 2RHS" MOV-113 was
administratively controlled in the open position.
Therefore, this valve was not
vulnerable to the hot short problem.
However, the power supply breaker for
2RHS" MOV-112 was closed, and was susceptible to the hot short problem, if the
fire-induced hot short bypassed
the control, limit and torque switches.
The licensee
also found that 2RHS "MOV-112 had sufficient torque that could cause mechanical
damage to the valve.
Subsequently,
the licensee notified the NRC of this issue on
December 17, 1996, and issued
DER 2-96-3379 to document this deficiency.
Since the opening of 2RHS" MOV-112 was required for the plant to achieve cold
shutdown, the inspectors determined that the above condition constituted
an
example of an apparent violation of the Unit 2 operating license as follows:
Nine Mile Point Unit 2 operating license No. NPF-69, Item 2.G requires the licensee
to implement and maintain in effect all provisions of the approved fire protection
program as described
in the Final Safety Analysis Report (FSAR) for the facility.
Nine Mile Point Unit 2 FSAR, Section 9B.8.2, which is part of the approved fire
protection program, states that the main control and relay rooms fire protection
analysis postulates
a fire in the main control or relay rooms that necessitates
evacuation of the main control room and verifies that capability for safe shutdown
of the plant exists from the remote shutdown room and other local control stations
outside the main control or relay rooms.
This analysis was based
on the
assumptions
which include that a single, spurious maloperation,
in addition to the
loss of all automatic signals, is considered for evaluation purposes for components
controlled from the main control room.
Section 9B.8.2.2 of the FSAR identified that
the cold shutdown under these conditions could be achieved within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
In
addition, Unit 2 FSAR Section 9B.8.2-4, Conclusion, states that necessary
administrative procedures,
operating instructions, and operator training are provided
for the main control and relay rooms fire event.
However, the operating conditions described below was not based
on the above
assumptions:
As of December 17, 1996, a potential fire-induced hot short in the control circuit of
shutdown cooling motor-operated
valve NRHS "MOV-112, which is located in the
common suction path inside the drywell, could cause damage to the valve and
prevent the shutdown. cooling system from achieving its cold shutdown function
within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
Specifically, the fire-induced hot short could bypass the valve
0
7
k
control, limit, and torque switches, and the excessive torque generated
by the
motor could cause mechanical damage to the valve, making the valve inoperable.
At that time, there. was not written evidence, including administrative procedures
and operating instructions, that the potentially damaged
valve could be repaired and
still achieve cold shutdown within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (EEI 50-410/97-05-03).
'Following the identification of the above deficiency, the licensee promptly
deenergized
the control circuits for valve 2RHS "MOV-112 and administratively
controlled its power supply circuit breaker in the open position during normal plant
operation, to preclude spurious operation during a control room fire. Two other
motor-operated
valves (2RHS "MOV-142 and -149) in the shutdown cooling system
also had their control circuits deenergized,
and their power supply circuit breakers
administratively controlled in the open position.
These two valves were used to
flush the stagnant water upstream of the residual heat removal heat exchanger
and
to provide pre-warming of piping system before the start of shutdown cooling.
Reactor Core Isolation Coolin
RCIC Motor-0 crated Valves
During the review of the preliminary LER 96-15, which was intended to report the
condition discussed
above, Unit 2 Station Operations Review Committee (SORC)
questioned
Unit 2 engineering if the RCIC system motor-operated
valves (MOV)
were subject to the same deficiency.
The results of Unit 2 engineering's
reviews indicated that there were multiple motor-
operated valves in the RCIC system that were vulnerable to the fire-induced hot
short problem.
These valves included 2ICS" MOV-121, -126, -128. A failure of any
of these valves would render the RCIC system inoperable.
On January
15, 1997,
the licensee notified the NRC of these deficient conditions.
The licensee also issued
DER 2-97-0118 to docu'ment and track the resolution of this deficiency.
Because
an inoperable
RCIC system, at that time, would cause the remote shutdown panel
to be unable to provide a safe shutdown path, the licensee entered
a seven-day
LCO (limiting condition for operation) on January
15, 1997, in accordance
with Unit
2 Technical Specification Section 3.3.7.4.
- The licensee immediately contracted
Generic Electric (GE) to conduct an analysis for an alternate success
path using
safety relief valves (SRV) in the automatic depressurization
system (ADS) mode in
conjunction with the RHR system, the "Pseudo LPCI" path.
The GE analysis results
indicated that hot shutdown could be achieved by manually reducing the reactor
vessel pressure through ADS and the Pseudo
LPCI paths.
The licensee also issued
the applicable procedures for using the alternate safe shutdown path.
Subsequently,
the licensee exited the seven-day
LCO on January 22, 1997.
The
Pseudo
LPCI paths consisted of two (redundant)
loops.
Each loop took suction from
the suppression
pool through manual valves, passed through the RHR heat
exchanger,
and injected coolant into the reactor vessel through the recirculation
line. The licensee stated that appropriate. sections of the Unit 2 fire protection
program (FSAR Section 9B) would be updated to incorporate the alternate shutdown
path when the RCIC system was inoperable following a postulated control room fire.
Review of Unit 2 LER 96-15
The licensee issued
LER 96-15 on January
16, 1997, to report the two issues
(potential shutdown cooling system MOV damages
damages) to the NRC. The licensee also issued Supplement
1 to LER 96-15 on
March 27, 1997, to include the result of their root cause evaluation.
The licensee
'attributed the root cause of the design deficiencies to be a failure to fully evaluate
hot short vulnerability of safe shutdown valves by the design organizations
(the
Architect Engineer) responsible forthe initial plant design.
The licensee also
attributed that the root cause for not identifying these deficiencies during the 1992
evaluation
(in response
to IN 92-18) was a mindset that information contained
in IN 92-18 was outside the design basis of NMP Unit 2.
The short term corrective actions taken by the licensee was prompt as discussed
in
various parts of this report (Section E1.2.b).
The long-term corrective action was to
provide training to the engineering
support staff, on LER 96-15, to preclude
improper evaluation of NRC Information Notices in the future.
The licensee
expected to complete this training by September 30, 1997.
The inspectors reviewed LER 96-15, including Supplement
1, and concluded that
the LER appropriately described the event.
The root causes
and corrective action
discussed
in the LER were determined to be appropriate.
Violations
The inspectors determined that before a successful
alternate safe shutdown path
was fully established
and proceduralized,
the potential loss of the RCIC system due
to a potential valve damage caused
by a fire-induced hot short following a
postulated control room fire constituted another example of an apparent violation of
Unit 2 operation license No. NPF-69, Item 2.G, Fire Protection Program, is as
follows:
As described
in Section E1.2(b) of this report, Unit 2 fire protection analysis for
c'ontrol room fire protection was based on the assumptions
which include that a
single, spurious maloperation,
in addition to the loss of all automatic signals, is
considered for evaluation purposes for components
controlled from the main control
room.
Section 9B.8.2.2 of the FSAR identified that the hot shutdown under these
conditions could be achieved within 10 minutes.
However, the operating conditions described below were not based
on the above
assumptions:
As of January
15, '1997, a potential fire-induced hot short in any one of the control
circuits of multiple motor-operated
valves (2ICS" MOV-128, -121, and -126) could
prevent the RCIC system from achieving its hot shutdown function within 10
minutes.
Specifically, the fire-induced hot short could bypass the valve control and
limit switches and the motor torque switch, and the excessive torque generated
by
the motor could cause mechanical damage to the valve, making the affected valve
The RCIC system would be inoperable when any one of the multiple
motor-operated
valves was inoperable
(EEI 50-410/97-05-04).
The inspectors
also determined that the licensee's failure to identify, during the
'1992 review in response to IN 92-18, that the shutdown cooling motor-operated
valve 2RHS" MOV-112 and multiple motor-operated
valves (2ICS" MOV-128, -121,-
and -126) in the RCIC system were susceptible to mechanical damage when their
control circuits were subjected to a fire-induced hot short during a postulated
control room fire, constituted an apparent violation of 10 CFR 50, Appendix B,
Criterion XVI, Corrective Action, which requires conditions adverse to quality, such
as failures, malfunctions, and nonconformances
to be identified and corrected
promptly.
The licensee failed to identify the deficient conditions at that time
because
a mindset existed at NMPC that the information contained
in IN 92-18 was
outside the design basis of the plant (EEI 50-410/97-05-05).
Conclusion
On two separate
conditions, the licensee had identified that there were motor-
operated valves in the shutdown cooling system (for cold shutdown) and in the
RCIC system (for hot shutdown) that were vulnerable to valve damage when
subjected to a fire-induced hot short during a postulated control room fire.
The inspectors concluded that these deficient conditions 'constituted two examples
of an apparent violation of the Unit 2 operation license No. NPF-69.
The inspectors also concluded that the licensee's failure to identify the above
deficient conditions, during the 1992 review in response to IN 92-18 cohstituted
an
apparent violation of 10 CFR 50, Appendix B, Criterion XVI, Corrective Action,
which requires conditions adverse to quality, such as failures, malfunctions, and
nonconformances
to be identified and corrected promptly.
Inade
uate Isolation of Unit 2 Remote Shutdown Panel Control Circuits from the
Control Room
Ins ection Sco
e
On two separate
occasions
during the week of April 7, 1997, the licensee identified
deficient condition within the control circuitry for the Unit 2 emergency diesel
generator
(EDG) service water valves.
The inspectors assessed
the licensee's
performance
in response to the associated
events.
Included in the
inspectors'ssessment
were discussions with the on-duty station shift supervisors
(SSSs),
operations
and licensing department management,
and system and design
engineers.
0
Observations
and Findin s
Service Water Valves Vulnerable to Short-to-Ground
Dama
e
During a review of an operating experience report from another facility regarding
a
deficiency that could potentially result in damage to plant EDGs during the
'performance of the alternate shutdown procedure,
NMPC identified a different
deficiency that could damage both Division I and II EDGs during a control room fire.
Specifically, the licensee identified that the remote shutdown panel (RSP) control
circuits for EDG service water outlet valves 2SWP"MOV66A and 668 were not
completely isolated from the control room.
Therefore, during a postulated control
room fire, the potential existed that a short-to-ground
in the control circuits could
result in a loss of control power to 2SWP" MOV66A and 668.
This deficiency
placed the plant in a condition outside the design basis, as described
in Unit 2 fire
protection program.
On April 7, 1997, the licensee notified the NRC in accordance
with 10 CFR 50.72.
Additionally, the SSS declared the RSP inoperable
and entered
a seven-day
LCO per Technical Specifications (TS) 3.7.4.b.
The licensee
documented
the deficiency in DER 2-97-1092.
This deficiency is discussed
below.
Although the additional fuses were in place, because
of lack of isolations, portions
of the control circuits for 2SWP" MOV66A and 668, located in the control room,
would have remained connected to RSP even after the transfer switches were
operated.
Therefore,
a short-to-ground within the control room could result in
blowing the fuses at the RSP panel, rendering the valves inoperable.
Since a loss of
off site power (LOOP) is postulated
in conjunction with a control room fire, the loss
of 2SWP" MOV66A and 668 would cause
a loss of cooling water to both EDGs.
This could cause
a station blackout condition and adversely affect the safe
shutdown capability of the plant from the RSP.
The inspectors reviewed DER 2-97-1092, and discussed
related issues with the
SSS.
The inspectors considered the licensee identification of the deficiency to be
good, and the immediate actions taken to address the deficiency were appropriate.
however, the deficient condition described above constituted
an apparent violation
of Unit 2 operation license No. NPF-69, item 2.G, Fire Protection Program, as
follows:
Nine Mile Point Unit 2 FSAR Section 98.8.2.3, which is part of the approved fire
protection program, states that in case of a fire in the main control or relay rooms,
the design modifications necessary to maintain availability and controllability of
systems required for safe shutdown and to prevent spurious maloperations
included
the provision of disconnect switches outside the main control or relay rooms for
certain safe shutdown equipment, which included two motor-operated
valves
2SWP" MOV-66A and B.
0
11
As of April 7, 1997, disconnect switches (isolation) located outside the main control
room were not provided to the control circuits for these two valves as necessary to
prevent spurious maloperations.
These two valves controlled the cooling water
supplies to emergency diesel generators
EG1 and EG3.
Because of this lack of
isolations,
a potential short-to-ground
in certain parts of the control circuits during a
control room fire could render the associated
valves inoperable.
(EEI 50-410/97-05-
'06)
To address this deficiency, f4MPC completed Design Change N2-97-049 to add
transfer switch contacts to isolate the RSP from the control circuits for
2SWP" MOV66A and 66B, located in the control room.
The inspectors reviewed
portions of this design change,
including the associate
10 CFR 50.59 applicability
review, and found them appropriate.
Additionally, the design change was discussed
with the responsible
engineers, with no concerns identified.
During implementation
of the design change, the inspectors observed that the licensee properly entered TS
limiting conditions for operations
(LCOs) for the EDGs and the service water
system, and performed appropriate post-modification testing.
Additionally, the
licensee's actions to minimize EDG unavailability, during the design change
implementation, was considered
good.
Additional Deficient Condition
On April 11, 1997, during the post-modification testing for the design change to the
2SWP" MOV66A control circuit, the licensee discovered
eleven drawing
discrepancies.
These discrepancies
consisted of both editorial and deviations
between the drawing and plant configuration, and were documented
in DER 2-97-
1136.
Nine of the eleven discrepancies
were minor in nature, including several
typographical errors, which were to be resolved with the closeout of the design
change.
However, two discrepancies
involved a wire that jumpered one of the
contacts associated
with the RSP transfer switch, and a lifted lead.
The
combination of the jumper and the lifted lead effectively voided the protection that
the transfer switch was to provide the RSP control circuit for 2SWP" MOV66A.
The SSS informed the inspectors of these discrepancies
at 4:34 p.m..
Subsequently,
the inspectors discussed
the discrepancies
in detail with the SSS and
was satisfied that only the jumper and lifted lead impacted the operation of the RSP
or other equipment.
The resident inspectors
also verified that the applicable TS
LCOs for the affected equipment were being implemented.
The initial reportability determination made by the SSS, as indicated on the DER
reviewed by the resident inspector the evening of April 11, 1997, was that the
event was only reportable under 10 CFR 50.73 (a 30-day written report).
The
resident inspectors questioned
the SSS as to why this event was not reportable
under 10 CFR 50.72 (a one-hour telephone notification) for a condition outside
design basis, as was the case on April 7. Subsequently,
the SSS included the
General Manager of Operations,
and eventually the Licensing Manager into the
discussion.
At 6:58 p.m., NMPC determined that the event was reportable under
10 CFR 50.72 for a condition outside the design basis, and notified the NRC at 7:37
12
p.m. Although NMPC eventually determined the event was reportable under 10 CFR 50.72, the inspectors considered their evaluation to be weak.
This weakness
was evidenced
by. the numerous questions from the inspectors
and excessive time
required by the licensee to determine that the event was reportable under 10 CFR 50.72.
'The licensee corrected the wiring discrepancies
under a work order.
Additionally,
the licensee compared the as-installed configuration to plant drawings for five other
valve control circuits associated
with the RSP.
No additional discrepancies
were
identified during this comparison.
The inspectors considered the licensee's
actions
taken to correct the discrepancies
and the performance of the precaution checks for
similar discrepancies
to be appropriate.
However, this failure to meet the design
basis was considered the second example for the apparent violation of Unit 2
operation license No. NPF-69, item 2.G, as discussed
above.
(EEI 50-410/97-05-06)
C.
Conclusions
On two separate
occasions,
during the week of April 7, 1997, NMPC identified
discrepancies
within the control circuitry for the Unit 2 Division I and II EDG service
water outlet valves.
These discrepancies
could have caused
a loss of cooling water
to the EDGs during a control room fire and adversely affect the safe shutdown of
the plant from the RSP.
The licensee's identification of the discrepancies
and the
actions to minimize EDG unavailability time during the repairs were good.
However,
on both occasions,
the plant failed to meet the design basis, as described
in the
Unit 2 Fire Protection Program, and were considered
additional violation of Unit 2
operation license No. NPF-69, item 2.G. Also, a weakness was identified in the
licensee's reportability evaluation for discrepancies
identified on April 11, as
evidenced
by the numerous questions from the inspectors and excessive time
required for the licensee to determine that the event was reportable under 10 CFR 50.72.
E8
Miscellaneous Engineering Issues (92903)
.
E8.1
'Closed
Unresolved Item 50-410 95-24-02:
This item pertained to the calculations
of the service lives of Unit 2 Agastat relays.
During the November 1995 inspection
when this item was identified, the licensee stated they had performed various aging
calculations using test data from Southwest
Research
Institute Report 04-1738-
001, the measured temperatures
at the relay locations, and the mechanical
activation energy of 0.84 eV. Their calculations indicated that the service lives of
the normally energized
(NE) Agastat GP relays in the control building were greater
than 14 years.
The licensee also stated that they had a preventive maintenance
program in place to replace the relays before their service lives expired.
Since all Agastat GP relays at Unit 2 were located in mild environment areas, they
were not covered by Unit 2 environmental qualification (EQ) programs.
13
Review of Rela
Service Life Calculations
During this inspection, the inspectors reviewed the licensee's
program for
calculating the service lives of normally energized relays and the program for relay
replacement.
The licensee had developed
Nuclear Engineering
Report NER-2E-007,
entitled, "Agastat Relay Service Life." This document was used by the licensee to
calculate the service lives of all NE Agastat GP relays and to schedule the
replacement of those relays.
The inspectors reviewed Revision
1 of this document, dated March 10, 1997, and
noted the following:
Section 4.2.1 discussed
a Grand Gulf document,
No. 04-1738-001, entitled, "Grand
Gulf Nuclear Station Test Report for Agastat Relays," dated'December
1988.
Based
on the Grand Gulf test, the licensee established two sets of curves, designated
as
Attachment 1, "Ambient Temperature
vs. Coil Temperature,"
and Attachment 2,
"Coil Temperature
vs. Relay Service Life." The licensee also stated
in this section,
that: "the ambient temperature
surrounding the relay and the inside coil temperature
were the two key elements in determining the service life of the relay; the Grand
Gulf document established
these relationships
based
on actual thermal aging tests.
Attachment
1 provided the relationships between ambient temperature
and coil
temperature
based on Grand Gulf's actual test results."
Attachment 2 consisted of
three curves, providing the relationships between the relay coil temperatures
and
the expected
service lives, for 24 Vdc, 125 Vdc, and 120 Vac relays.
Attachment
1 indicated that for ambient temperature
above 86
F, the coil temperature
and the
ambient temperature
had a linear relationship.
However, for ambient temperature
below 86
F, the coil temperature
stayed above 186
F.
In Section 4.2.2, the licensee used another means to estimate the relay coil
temperatures.
The licens'ee used thermography
readings,
aiming at the target relay,
and added 40
F. The licensee claimed that the result represented
the relay coil
inside-temperature.
Typically, the 'temperature of the energized relay coil and that
of the relay base differed substantially.
In addition, the relay coil was covered by a
thick plastic cover.
Therefore, it was not clear that the thermographic
reading
represented
the temperature of which part of the relay.
This method was not based
on actual testing, and the result was in conflict with Attachment
1 described
in
Section 4.2.1, which was in the same document.
The licensee calculated the service life of 120 Vac relays E31A-K029B and K024B
in panel
2CEC "PNL642, relays 3X-2HVCA05, 42X-HVCA02, 42X-HVCA05, 3-
2HVYA16, and 3-2-2HVRA90, in panel 2CEC" PNL859, using the thermographic
reading method to.be 40 years.
However, if the Attachment
1 method was used,
the calculated service life would be 10 years.
There was a 30-year-life difference
for the same relays.
The inspector concluded that the licensee's calculations for the
relay service life were unacceptable.
0
0
14
Review of Rela
Failure Re orts
The inspector also. reviewed two DERs (DER 2-96-2038, dated August 28, 1996;
DER 2-97-0391, dated February 12, 1997).
Both DERs documented
problems due
to failed, normally-energized
relays.
The licensee later sent th'ese failed relays to
PECo Energy Laboratories in Valley Forge, Pennsylvania,
for testing to determine the
'root cause.
The test results, as documented
in PECo report No. 9700406, dated
April 2, 1997, indicated that all relays had brittle, cracked relay coil bobbins,
indicating excessive thermal'aging,
The licensee calculated the service lives for
these two relays, using thermography
reading, to be 12 years and 15 years.
Again,
if the Attachment
1 method was used, the service lives for both relays would be 10
years.
If these relays were replaced within 10 years, relay failure could have been
avoided.
Licensee's
Corrective Actions
The licensee stated that they had contracted
PECo Laboratories to perform more
tests and to establish
a more reliable methodology to determine the relay coil
temperatures
based
on measured
ambient temperatures.
Ori April 28, 1997, the
licensee transmitted, for the inspector's review, a preliminary schedule for
developing
a new methodology to calculate all Unit 2 NE Agastat relay service lives.
This schedule
indicated that they could complete the new calculations, based on the
test results from independent
laboratories
(PECo Laboratories), by June 30, 1997.
On a telephone call on June 2, 1997, the licensee stated that the PECo test report
was just completed and was being reviewed by the licensee.
The licensee also
stated that they would start promptly to establish the new calculation methodology.
During the inspection, the inspectors emphasized
the importance of replacing the
safety-related
relays on time to prevent relay failures due to over-aging, because
all
of these relays perform important functions, including initiating reactor trip, starting
and stopping engineered
safety feature pumps, and opening and closing important
valves for accident mitigation.
Since relay failure normally could not be detected
until the system testing following the failure, common mode failure could result if
over-aged relays were not replaced on time.
The inspector asked the licensee why the Attachment
1 method was not used in
their calculations, but did not get a satisfactory answer.
However, the licensee did
state that:
1) they intended to replace all normally energized safety-related Agastat
relays, that had not been previously replaced, by the next refueling outage, even if
the new calculated service lives were greater than 13 years; 2) for second round
relay replacement,
all normally energized
and safety-related Agastat relays would be
scheduled for replacement within a 10 year interval even if the calculated service
lives were longer.
The inspectors considered this replacement
schedule acceptable.
The original item is closed:
However, the relay service life calculation issue remains
unresolved
pending further NRC review of licensee's corrective actions. (URI 50-
41 0/97-05-07)
15
Closed Unresolved Item 50-220 96-13-04:
This item pertained to hot short
vulnerability of Unit 1 shutdown cooling motor-operated
valves IV 38-01 and -13.
The details of this.issue and the licensee's corrective actions were discussed
in
Section E1.1 of this report.
This item is closed.
Closed
Unresolved Item 50-410 96-14-01:
This item pertained to hot short
vulnerability of three motor-operated
valves (2RHS" MOV-112, -142, and -149) in
the Unit 2 shutdown cooling system.
The details of this issue and the licensee's
corrective actions for this issue were discussed
in Section E1.2 of this report.
This
item is closed.
Closed
Unresolved Item 50-220 96-15-01:
This item pertained to the motor-
operated valves that were vulnerable to fire-induced hot short damage during a
control room fire. For Unit 1, the detail and the resolution was discussed
in Section
E1.1 of this report.
Therefore, this item is closed.
U dated
Unresolved Item 50-410 96-15-01:
For Unit 2, the design basis for their
fire protection program only postulates
a single maloperation (involving mechanical
valve damage)
during a postulated control room fire. The design basis assumptions
regarding multiple hot short scenarios were not discussed
in the fire protection
program.
Region
I will request the Office of Nuclear Reactor Regulation
(NRR) to
conduct
a review of this issue.
Therefore, this item remains open pending review
results from NRR.
Closed
Violation 50-220 95-24-01:
pertained to inadequate
corrective actions for
replacing over-aged,
normally energized Agastat GP relays and for replacing
commercial-grade Agastat time-delay relays.
During this inspection, the inspector
reviewed the licensee's corrective action taken to resolve these two issues,
including the licensee's
expanded
review of Wyle Laboratories
EQ test reports.
Corrective actions were discussed
in NMPC letters NMPIL1035, dated February 22,
1996, and NMPIL1066, dated April 29, 1996, in response to the Notice of
Violation. The inspector determined that the licensee's corrective actions were
adequate to prevent recurrence.
This item is closed,
Closed
LERs 50-410 96-15 and 96-15-01:
This LER pertained to Appendix R fire-
induced hot shorts in remote shutdown system valves.
LER 50-410/96-15
described issued associated with fire-induced hot short potentially rendering valves
unable to perform the intended 10 CFR 50, Appendix R functions during a
postulated control room fire. Supplement
1 to LER 96-15 was issued by NMPC to
provide the root cause and corrective actions not included in the original LER. The
technical details pertaining to the events were described
in NRC Inspection Report
50-410/96-14 and 50-410/97-01.
The original LER, 50-410/96-15 was reviewed in
Inspection Report 50-410/97-01, but since the licensee had yet to complete their
root cause evaluation and determine the subsequent
corrective actions, the LER
review was left open.
The inspectors reviewed the root cause and corrective
16
actions provided in the LER supplement,
and they were determined to be
appropriate.
The details associated
with the root cause
and corrective actions are
provided in Section E1.2 of this report.
Therefore, based
on the inspectors'eview,
LERs 50-410/96-15 and 50-410/96-15-01
are closed.
E8.8
Closed
LERs 50-220 96-10 and 96-10-01:
This LER pertained to Appendix R fire-
'induced hot shorts in shutdown cooling valves.
LER 50-220/96-10 described
issues
associated
with fire-induced.hot shorts potentially rendering valves unable to
perform the intended
10 CFR'50 Appendix R functions during a postulated control
room fire. Supplement
1 to LER 96-15 was issued by NMPC to provide the root
cause and corrective actions not included in the original LER. The technical details
pertaining to the events were described
in NRC Inspection Report 50-410/96-13.
The LER and supplement were found to be timely and to satisfactorily describe the
event.
The inspectors reviewed the root cause and corrective actions provided in
the LER supplement,
and they were determined to be appropriate.
The details
associated with the root cause and corrective actions are provided in Section E1.2
of this report.
Therefore, based
on the inspectors'eview,
LERs 50-220/96-10 and
50-410/96-10-01
are closed.
E9
UFSAR Reviews
A recent discovery of a licensee operating their facility in a manner contrary to the
updated final safety analysis (UFSAR) description highlighted the need for a special,
focused review that compares plant practices, procedures
and/or parameters
to the
UFSAR descriptions.
While performing the inspections discussed
in this report, the inspector reviewed
the applicable portions of the UFSAR that related to the areas inspected.
Nonconformances
with the UFSAR for the unit fire protection program were
discussed
in Sections E1.2 and E1.3 of this report.
The inspector verified that other
reviewed sections of the UFSAR wording were consistent with the observed plant
practices, procedures
and/or parameters.
X1
Exit Meeting
The inspector met with the licensee personnel at the conclusion of the site inspection on
April 18, 1997, and summarized the scope of the inspection and the inspection results.
No
proprietary materials were reviewed during this inspection.
The licensee acknowledged
the
inspection findings at that meeting.
The inspector amended the exit meeting in a telephone
call on June 4, 1997, to Mr. D.
Baker of Niagara Mohawk.
The inspector stated that:
1) the violation that pertained to
Unit 1 repair procedures
would be changed to a non-cited violation; and 2) NRC
management
review resulted in an additional apparent violation 10 CFR 50, Appendix B,
Criterion XVI, Corrective Action, for the motor-operated
valves,,that were vulnerable to the
hot short issue at both Units
1 and 2.
17
PARTIAL LIST OF PERSONS CONTACTED
Licensee
R. Abbott, Vice President
and General Manager - Nuclear
C. Beckham, Manager, Quality Assurance
D. Bosnic, Operations,
Unit 2
J. Burton, Director, ISEG
W. Connolly, QA Audit Supervisor
"
R. Dean, Manager, Unit 2 Engineering
T. Fiorenza, Technical Support
G. Gresock, Licensing Engineer
G. Helker, Unit 2 WC/OMG
A. Julka, Supervisor, Unit 2 Electrical Engineering
M. Kalsi, Unit 2 Electrical Engineering
M. McCormick, Vice President,
Engineering
W. Pisand, Maintenance
Manager, Unit 2
N. Rademacher,
Plant Manager, Unit 1
A. Raju, Unit 2 Electrical Engineering
K. Sweet, Unit 1 Technical Support Manager
R. Tessier, Training Manager
C. Terry, Vice President NSAS
L. Vavra, MATS, Inc.
A. Vierling, General Supervisor,
Fuel and Analysis
C. Wave, Chemistry Manager
G. Whitaker, Engineer,
ISEG
D. Wolniak, Manager of Licensing
W. Yaeger, Unit 1 Engineering Manager
NRC
T. Beltz, Resident Inspector
B. Norris, Sr. Resident Inspector
18
ITEMS OPENED, CLOSED AND DISCUSSED
~Oen ed
50-220/97-05-01
Unit 1 failure to meet 10 CFR 50.48(b) requirements
50-220/97-05-02
Unit 1 failure to identify and correct the MOV deficiency earlier
50-410/97-05-03
Unit 2 failure to meet the fire protection program in achieving
cold shutdown
50-410/97-05-04
Unit 2 failure to meet the fire protection program in achieving
hot shutdown
50-410/97-05-05
Unit 2 failure to identify and correct the MOV deficiencies
earlier
50-41 0/97-05-06
Unit 2 failure to provide disconnected
switches to MOV control
circuits
50-41 0/97-05-07
Unit 2 normally energized Agastat GP relay service life
calculations
50-410/95-24-02
Unit 2 normally energized Agastat GP relay service life
calculations
50-220/96-13-04
Unit 1 shutdown cooling MOVs susceptible to hot short issue
50-410/96-14-01
Unit 2 shutdown cooling h/IOVs susceptible to hot short issue
50-220/96-15-01
Unit 1 MOVs susceptible to hot short issue
50-220/95-24-01
Inadequate
corrective actions for replacing Agastat GP and
time delay relays
LER 50-410/96-1 5
and 96-15-01
LER
Unit 2 MOVs susceptible to hot short issue
LER 50-220/96-10
and 96-10-01
LER
Unit 1 MOVs susceptible to hot short issue
l