ML17250A994
| ML17250A994 | |
| Person / Time | |
|---|---|
| Site: | Ginna  |
| Issue date: | 09/08/1989 |
| From: | Mccabe E NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I) |
| To: | |
| Shared Package | |
| ML17250A993 | List: |
| References | |
| 50-244-89-18, NUDOCS 8909210239 | |
| Download: ML17250A994 (34) | |
See also: IR 05000244/1989018
Text
ENCLOSURE
1
U.S.
NUCLEAR REGULATORY COMMISSION
.
REGION I
Docket/Report
No.
50-244/89-18
Licensee
No.
Licensee:
Rochester
Gas
and Electric Corporation
49 East Avenue
Rochester,
Facility:
R.
E. Ginna Nuclear
Power Plant
Location:
Ontario,
Inspection
Conducted:
June 26-30,
1989; July
17
August 24,
1989
Inspectors:
Approved by:
~Summar:
N.
S. Perry,
Resident Inspector,
Ginna
P.
D. Drysdale,
Reactor
Engin.oer,
Region I,
R. A. Laura,
Resident Irspector,
Nine Mile Point
E.
C.
McCabe, Chief,
eactor Projects
Section
3B
9/e/sV
Date
Areas Ins ected:
Special
inspection
(107
hou> s) of May and June
1989 events
(Table
1
hich occurred during the annual refueling outage
and subsequent
plant start-up.
Results:
Adequacy of control of modifications (Sections
10,
11,
12) and of
non-safety,
non-plant personnel
work which could adversely
impact plant safety
(Section 7) is in question.
Failure to follow procedures
produced
a safety
injection signal
(Section 3).
The licensee did not implement effective cor-
rective actions for failure to perform weekly rodding of boric acid tank level
bubbler tubes (Section 5).
There was
a failure to obtain
a grab
sample of the
containment
atmosphere
as required (Section 9).
An independent verification
deficiency was noted (Section 8).
A waste
gas release
performed outside the
specified time limit (Section
4) and incorrect setting of intermediate
range
detector trip setpoints
(Section
6) were evaluated
as being of minimal safety
significance.
S909210239
S90912
ADOCK 05000244
0
I,
~
~
TABLE OF CONTENTS
PAGE
1
Persons Contacted....................................................
1
2.
Introduction.
3.
Unanticipated
Safety Injection Signal
(93702).
2
4.
Waste
Gas Release
(93702)
.
.
.
.
. ..
. ..
. ...
.
.............
2
5.
Cleaning of Boric Acid Tank Sensing
Lines (93702)...... .............
3
6.
Intermediate
Range Detector Trip Setpoints (93702)...................
3
7.
Main Generator
Current Transformer Sliding Links (93702).............
4
8.
Average Temperature
Channel
403 Sliding Link (93702).............
~ ~ ..
5
9.
Containment Radiation Monitors R-10A, 11,
12 (937C2).
5
10.
Safety Injection System Recirculation Valves (93702).................
6
ll.
Safety Injection System Modifications (37702,
37828).
12.
ASS/AMSAC Modification (37702, 37828)................
7
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
11
13.
Exit Interviews......................................................
12
~ p
I
DETAILS
Persons
Contacted
During this inspection period,
inspectors
held discussions
with and inter-
viewed operators,
technicians,
engineers
and supervisory level personnel.
The following people were
among those contacted:
R. Baker, Electrical Engineer
J. Bergstrom,
Nuclear Engineer
D. Berry, Shift Supervisor
J.
Bodine, Nuclear Assurance
Manager
D. Filkins,
8 Chemistry Manager
T. Harding, Modification Support Coordinator
G. Hermes,
Engineer,
Nuclear Safety Licensing
- T. Marlow, Superintendent,
Ginna Support Services
A. Morris, Maintenance
Manager
M. Ruby, Shift Supervisor
T. Schuler,
Operations
Manager
- S. Spector,
Plant Manager,
Ginna Station
J. St. Martin, Corrective Acticn Coordinator
- J. Widay, Superintendent,
Ginna Production
G. Wrobel,
Manager. of Nuclear Safety
and Licensing
All persons listed above attended
the interim exit meeting
on June
30,
1989.
- Attended the supplemencal
exit meeting
on August 24,
1989.
Introduction
Within a five week period priot to, during,
and after start-up
from the
1989 annual
refueling outage,
Ginna experienced
several
problems
(see
Table 1).
Most of these
were related to recent modifications
and system
lineups.
The
1989 refueling outage
was 74 days
long and included the
ten-year inservice inspection
( ISI), extensive
work, and
plant modifications.
This special
NRC inspection
examined
ten events
(Table 1), all of which were licensee identified, to assess
licensee
per-
formance,
especially determination of root causes
and corrective actions,
and to determine if programmatic
weaknesses
caused
the high number of
events.
In particular,
the design
change
and modification programs
and
processes
were examined.
Specific attention
was given to the'ecent
modi-
fications of the Safety Injection System
and the
ATWS (Anticipated Transi-
ent Without Scram) Mitigation System Actuation Circuitry (AMSAC).
Related
operational
and preoperational
problems
led to a reactor trip and
a plant
shutdown.
~ f
~
\\ ~ '
Unantici ated Safet
Injection Si nal
With the plant shut down,
and while performing the Plant Safeguard
Logic
Test
on May 18,
1989,
an unanticipated
Safety Injection (SI) signal oc-
curred.
During review of plant response,
control
room personnel
noted
a
containment ventilation isolation signal
should
have
been generated,
but
was not.
The licensee attributed the unanticipated
SI signal to lack of detailed
procedural
guidance.
Technicians
were accustomed
to placing bistables
in
the tripped condition prior to insertion of a test signal.
However, the
Plant Safeguard
Logic Test procedure did not instruct technicians
to trip
the bistables
in this case.
The technicians,
after questioning
the proce-
dure step
and getting
no additional direction,
assumed tripping the bi st-
ables
was intended
and caused
the SI signal
by placing the bistables
in
trip.
The licensee attributed the cause to procedure
inadequacy,
provided
clarification to the technicians,
and the Plant Safeguard
Logic Test was
satisfactorily completed.
The
NRC concluded that the proximate cause of
the unanticipated
SI was failure to literally follow procedures.
This
violates Technical Specification 6.8. 1, which requires
procedures
for sur-
veillance and test of safety related
equipment to be established,
imple-
mented,
and maintained.
Other than the importance of literally following
procedures
for safety systems,
there
was
no safety significance to this SI
signal.
Most safeguards
equipment
was out of service
and the test is only
performed with the plant shutdown (50-244/89-13-06).
The licensee
determined that the failure of the SI signal to generate
a
containment ventil'ation isolation signal
was due to a wire missing from
the logic circuitry.
The wire was missing
due to a system modification
not yet completed.
The licensee
concluded that failure of containment
ventilation isolation to occur
was
an expected result considering
the in-
progress modification.
Post-modification testing
was adequate
to insure
the containment ventilation isolation signal functioned
as required.
The
modification was subsequently
completed
and successfully tested.
The in-
spectors
concluded that licensee
review of failure of the SI signal to
generate
a containment ventilation isolation signal
was thorough
and
ap-'ropriate.
Minimal safety significance
was attributed to the absence
of
the ventilation isolation signal
since operability of that isolation was
not required at the time.
The inspectors
had
no further questions
regard-
ing this item.
Waste
Gas
Release
On May 29,
1989, the waste
gas decay tank was
sampled at 6:43 a.m.
and
a
release
permit was initiated.
The release
was initiated at 8:40 p.m.
and
completed at 1:57 a.m.
on May 30,
1989.
The tank was isolated per proce-
dure from the time of the
sample
through the release.
Additionally, the
release
was monitored by radiation monitors
and
no alarms
were received.
Technical Specification Table 4. 12-2 requires
the sample to be taken with-
in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> prior to the release.
In this case,
the release
was initiated
approximately
14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> after the tank was sampled.
The release
was later
than expected
due to operations
personnel
being unavailable to perform the
release
while they were controlling plant start-up.
The error
was identi-
fied during the licensee's
normal permit review.
No similar late releases
were identified.
The licensee
counseled
personnel
involved and informed
all shift supervisors
of the event
and the need to verify strict compli-
ance with technical
specifications.
At the close of the inspection period
the licensee
was reviewing the release
process.
Because
the tank was isolated
from the time of the
sample
through the re-
lease,
and
no additional radioactivity was introduced to the tank prior to
release,
and the release
was monitored,
the release
was within release
limits on radioactivity.
This apparent violation (50-244/89-18-01)
had
minimal safety/environmental
significance,
and licensee
corrective actions
were assessed
as acceptable.
Cleanin
of Boric Acid Tank Sensin
Lines
On June
7,
1989, the licensee
discovered that Periodic Test PT-21, Clean-
ing Boric Acid Tank Sensing
Lines,
was not performed
as required
on June
1,
1989.
The sensing
lines are cleaned
weekly as preventive
maintenance
to ensure operability of the level instruments
by removing any boron
build-up in the level bubbler tubes. 'n this case,
the boric acid tank
level indication remained
and there
was
nu safety significance to
the missed weekly cleaning.
PT-21 also was not performed
when required
on
Octuber 21,
1988.
Corrective
action taken included altering the schedule
for'"performing PT-21 to weekly on Thursday rather than Friday to allow for
timely verification of completion.
Although there
was
no safety significance to the missed weekly cleaning in
this instance,
the failure to adequately
correct
a previously identified
problem indicates
a weakness
in the oversight
and assurance
of quality.
10 CFR 50, Appendix B, Criterion XVI requires correction of conditions
. adverse
to quality.
The Ginna Quality Assurance
Manual, Section
16,
Corrective Action, Paragraph
2.0, requires,
in part, that the licensee
identify, report and correct conditions adverse
to quality, that Ginna
Station correct conditions adverse
to quality,
and that the Plant Opera-
tions Review Committee
(PORC)
recommend interim corrective actions.
Cor-
rective actions for failing to perform weekly rodding of boric acid tank
level bubbler tubes
on October 21,
1988 were inadequate
to prevent recur-
rence
on June
1,
1989.
This is an apparent violation (50-244/89-18-02).
Intermediate
Ran
e Detector Tri
Set pints
During the start-up
on June
1-2,
1989 the two intermediate
range detector
high level trips were set at 32 percent
and
40 percent current equivalent
of rated power.
Procedure P-l, Reactor Control
and Protection
System,
specifies
a trip setpoint of 25 percent of rated
power.
The inspectors
noted that trip setpoint accuracy is not assured until a calorimetric has
been performed
and the 25 percent trip setpoint cannot
be accurately
set
before start"up after refueling.
In this case,
there
was little safety significance
since the trip is
blocked when above
10 percent reactor
power, the trip does not provide
a
primary safety function (it is
a backup to the power range detector trip),
and credit is not taken for the trip in the licensee's
accident analysis.
The licensee
determined that they were not in compliance with P-1,
and is
evaluating resetting
the intermediate
range trip setpoint at an earlier
point during initial plant start-up.
The inspectors
had
no further con-
cerns.
This apparent violation (50-244/89-18-05) is considered
an iso-
'ated
instance for which appropriate corrective action. has
been initiated
and which has minimal safety/environmental
significance.
Main Generator
Current Transformer Slidin
Links
While placing the main generator
on the grid during plant start-up
on
May
30, 1989, the generator
breaker
was closed.
It immediately tripped open,
resulting in a main turbine trip.
Since reactor
power was less
than
50
percent,
approximately
17 p-rcent,
no reactor trip occurred.
All turbine
trip responses
functioned properly.
Licensee investigation
revealed that six sliding links in the generator
current transformer were incorrectly open.
During the
1989 refueling out-
age, offsite
RGEE personnel
conducted
maintenance
and testing of the main
transformer.
That work was not controlled by plant management.
The cog-
nizant substation
crew supervisor
stated that the cause of the links being
out of position could not be determined
since
some activities performed
were not specifically procedurally controlled.
During discussions
with
the licensee
on August 24,
1989, the
NRC was informed that the gasket
con-
dition indicated the enclosure
had not been
reopened
since the work in
question.
This indicated that the mispositioning occurred
during the
authorized
work.
This is the second
example of non-safety-related
equipment outside the
plant impacting plant operation;
a substation
breaker
bushing failure
caused
a loss of offsite power on July 16,
1988.
In that case,
the bush-
ing failure was attributed to low cooling oil level with the level
stuck high.
The
NRC concluded that the control over electric
power system
equipment
needs to be addressed
by licensee
management.
Absent information on electric power breaker maintenance
controls
and cor-
rective actions,
and absent
information showing adequate
control
and cor-
rective actions
on deficiencies
such
as the sliding link mispositioning,
these conditions appear to violate
10 CFR 50, Appendix A, Criteria
1 and
17 requirements for assuring that electric power systems will satisfac-
torily perform their safety function (50-244/89-18-07).
4
Aver a
e
Tem erature
Channel
403 Slidin
Link
On June
13,
1989,
the licensee identified that the average
temperature
channel
403 sliding link was inadvertently left open following an align-
ment.
Instrumentation
and Control (I&C) technicians
had opened
the link,
performed
an alignment
and failed to return the link to the closed posi-
tion as specified in Calibration Procedure
CP-7,
T AVG and
DELTA T Align-
ment at 70 Percent
Power or Greater,
Loop B, Unit 1,
Channel
3.
This link
is located in a cabinet in the back of the control
room.
The average
tem-
perature
instrument is safety-related
and provides inputs to the reactor
protection
system.
The safety significance of the link being out of posi-
tion was minimal; it functions to connect the correction for lead resist-
ance
changes
due to temperature
changes.
The error introduced did not
affect system operability.
The inspector
found that the
IKC technicians
had
an independent verifier
reviewing status of the links.
However,
the procedure
lacked
a second
signo'ff provision for documentation
of the independent verification.
Plant management
acknowledged that procedure.
were previously identified
as weak.
A Procedure
Upgrade
Program in process
includes reworking all
procedures.
Licensee
management
committed to have two independent
tech-
nicians initial each critical step regarding
equipment status
as
an in-
terim measure until the Procedure
Upgrade
Program is completed.
I
The inspectors
concluded that the licensee's
policy on independent verifi-
cation
needs
to be reviewed
by licensee
management
to determine whether
the second
check is sufficiently independent
of the first.
The licensee
cotmfritted to further define the independent verification process.
The in-
spectors
had
no further questions
about this specific occurrence.
The
weakness identified does,
however, reinforce the concerns
generated
about
procedure
adequacy
and adherence
elsewhere
in this report.
Containment Radiation Monitors R-10A
11
12
On June
16,
1989,
the licensee identified that radiation detectors
R-10A,
11,
12 for the containment
atmosphere
were not returned to service pro-
perly after routine calibration.
The detectors
were
removed
from service
for calibration
and
was obtained
on June
14,
1989 at 8:30
a.m.
After the calibrations
were completed
on June
15,
1989 at 4:30 p.m.,
the detectors
were not restored to their required condition.
Another grab
sample of the containment
atmosphere
was not obtained
because it was as-
sumed that the monitors were continuously monitoring the containment at-
mosphere.
On June
16,
1989 at 12:57 a.m.,
the licensee
discovered that
the radiation detectors
were aligned for continuous recirculation,
which
samples
ambient air.
The inspectors
reviewed CP-211, Calibration and/or Maintenance of
Channel
R-11 (Containment Particulate),
and found that the restoration
section contained
inadequate
instructions.
The procedure
required notifi-
cation to operations
and
assumed Administrative Procedure
A-52.4, Control
of Limiting Conditions
For Operating
Equipment,
would properly restore
the
system.
The licensee
issued
a procedure
change to provide step-by-step
restoration to service instructions.
Long term correction involves re-
writing all maintenance
procedures
as part of the Procedure
Upgrade Pro-
gram.
'echnical
Specification
3. 1.5. 1. 1 requires that, with Reactor
Coolant Sys-
tem (RCS) temperature
greater
than
350 degrees
Fahrenheit,
two of the
listed leak detection
systems,
including one system sensitive to radio-
activity, shall
be in operation.
Since the R-10A, 11,
12 radiation moni-
tors were not placed
back in service,
the licensee
did not have
any leak
detection
system sensitive to radioactivity in operation.
Technical
Specification
3. 1.5.1.2 allows
a system sensitive to radioactivity to be
provided grab
samples of the containment
atmosphere
are ob-
tained
and analyzed at least
once every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />,
Oue to the inadequate
restoration,
the containment
atmosphere
was not sampled for about
32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br />.
Although the safety significance of this event
was low because
the con-
tainment
was not purged during this tirrp period, the inspectors
concluded
that there
was
an apparent violation of Technical Specification
3. 1.5. 1. 1:
the
RCS temperature
was greater
than
350 degrees,
no system sensitive
to'adioactivity
was in operation,
and the compensatory
action of drawing and
analyzing
a grab
sample of the containment
atmosphere
at least every
24
hours
was not accomplished
(50-244/89-18-03).
Safet
Injection
S stem Recirculation Valves
On .brune
19,
1989, the control
room shift foreman identified that two of
the three Safety Injection (SI) system recirculation valves were out of
their required position.
The licensee
commenced
a shutdown until SI sys-
tem recirculation flow was restored
to the specified value by throttling
these
valves
from locked fully open to locked approximately
80 percent
shut.
During the
1989 refueling outage,
the licensee
implemented
an SI modifi-
cation which required throttling the recirculation valves to obtain the
desired
performance characteristics
(see
section
11).
Prior to this modi-
fication, the valves were required to be locked full open.
The inspectors
found that, during post modification testing,
the recirculation valves
were throttled to approximately
80 percent shut,
and this change
in re-
quired position
was not incorporated into the applicable
SI system lineup
procedures (i.e., S-30. 1, S-16.A).
Licensee
management
and the security department
investigated
to determine
how the valves were mispositioned
and were unable to determine
the cause.
These valves were procedurally controlled under
a locked valve list and
a
key is required to unlock the valves.
Several
members
in the operations
staff were
unaware of the change
in required position of the recirculation
valves.
Station
management
stated
the reason
why the valves were out of
~ ~
I
position is still under investigation.
The inspectors
concluded that the
impact of the modification was neither properly communicated
from engi-
neering
and the test group to operations
nor followed to resolution.
Administrative Procedure
A-52.2, Control of Locked Valve and Breaker Oper-
ation, required
two of the three
SI recirculation valves to be throttled.
On June
19,
1989, all three
SI recirculation valves were found in the full
open position.
This is another
example of the violation cited in Section
ill of this report (50-244/89-18-04).
Subsequently,
the licensee
determined that, if the SI system automatically
initiated while the recirculation valves were out of position, the re-
quired SI core delivery flow would have
been attained.
This is due to
a
20 percent error in the conservative direction
made during the SI flow
transmitter calibration.
Although the licensee
thought they were in an
unanalyzed
condition regarding
the valves out of position,
they later de-
termined they were not due to sufficient flow always being available.
The
NRC concluded that, although the violation did not result in inability to
meet design
requirements, it represented
an unacceptable
practice.
Safet
Injection
S stem Modificatior.s~Engineerin
Work Re vest
EWR-38~81
The Safety Injection (SI) system modifications were designed
to increase
the piping size for the
pump recirculation lines
and replace
three
SI re-
circulation valves.
The increase
in recirculation flow for the SI
pumps
was to reduce the likelihood that
pump damaae
might occur if operated
against
deadhead
pressure f)r an extended
time.
The recirculation flow
was-4esigned
to be increased
from approximately
35
gpm to 100
gpm for a
single
pump.
A new flow gauge
(FI-916, 0-350
gpm) was installed to allow
direct reading of the recirculation
and test flows.
Engineering
aspects
of the system design modifications were completed
by
the corporate
engineering
group.
Installation
was performed
by the modi-
fication project construction
group during the
1989 refueling outage.
System instrumentation
was adjusted
and calibrated
by the site
ILC depart-
ment during the outage.
Prior to plant start-up, modification functional
testing
was performed by the Results
and Test group with recirculation
flow set at
100
gpm through
each recirculation valve.
During plant startup after the
1989 refueling outage,
operational
system
testing
was performed with RCS pressure
greater
than
1000 psig.
The re-
sults indicated that the modified system
was unable to produce the SI flow
delivery to the reactor
as specified
by the
FSAR injection flow curve.
The SI system
was reconfigured to throttle two of the SI recirculation
valves to 35-50
gpm (approximately
80 percent closed) to achieve accept-
able recirculation flow and the required injection flow.
System recircu-
lation flow was established
by monitoring the
new flow gauge,
FI-916.
An
Engineering
Change Notice
(ECN 3881-16)
was issued
by the responsible
engineer to authorize
a revision of the system preoperational
test speci-
fication (MET-024) to require the recirculation valves to be throttled.
The system lineup sheets
required the recirculation valves to be Locked
Open
(LO) because
the modification was not carried through to change
the
position of these
valves from LO to throttled or locked/throttled.
Ap-
proximately three
weeks after the plant was operating,
a Procedure
Change
Notice (PCN) was written to change
the designated
position of the SI
pump
recirculation valves to throttled.
Since the operations shift supervisor
knew the valves were full open,
the
pumps were declared
due to
inability to confirm required SI injection flow and
a technical specifi-
cation
LCO was .entered
on June
19,
1989.
A reactor
shutdown
was begun.
The recirculation valves were reconfigured to the designated throttled
position,
and normal operation
resumed.
During the monthly SI system operational
surveillance test
on June
21,
1989, inconsistent
and unrepeatable
flow results
were obtained with the
recirculation valves throttled to 80 percent shut,
The test results indi-
cated flows from 50 to 70
gpm on several trials.
The reactor
was manually
shut
down after the SI pumps were declared
due to the inability
to obtain repeatable
flow rates.
During the efforts to analyze
the incon-
sistent flow results,
the
RG&E modification desi~n consultant
(NUS Coro.)
informed the engineering
group that the Flow Transmitters
(FTs) in the SI
injection piping may be calibrated incorrectly for the ins'.alled
Flow
Elements/orifices
(FEs).
Available vendor information indicated that the
flow transmitters
could be matched with several different orifice designs
(with different calibration characteristics),
but no specific information
was available
on the orifices installed in the SI system
(FT-924/FE-924
&
FT-925/FE-925).
The orifices were removed
and found to be of a design
with a calibration curve different from the one tte plane
has
used
since
1972-.
The curve error resulted in the actual
SI injection flow being ap-
proximately 20 percent greater
than the indicated flow.
Engineering per-
sonnel installed
a
new orifice design which provided more accurate
FE/FT
calibration data.
On June 24,
1989,
the SI system
was retested
with the
SI system recirculation valves fully open.
The required reactor delivery
curves were met with SI recirculation flow at the original design value
for the modified system (approximately
100
gpm each with two pumps
run-'ing).
Site operations
participated
in SI modification preoperational
testing
and
signed verification steps
in the test procedure
which reconfigured (i.e.,
throttled) the recirculation valves.
No related information was entered
into the control
room logs, the operations
required reading
program, or
other plant notifications.
The
ECN was issued
by the responsible
engineer
to allow throttling of the recirculation valves,
but operations
was not on
distribution and did not receive
a copy.
Approximately three
weeks trans-
pireB before
a
PCN was initiated to change
the valve lineup sheets
to re-
flect locked throttled recirculation valves.
No interim drawing change
was
made
by the liaison engineer to reflect the correct throttled position
of the recirculation valves.
There was
no indication that the liaison
engineer
was
made
aware of the change in the valves'ositions
or that he
was aware of the existence of the
ECN.
This demonstrated
a lack of ef-
fective communication
between corporate
and onsite groups.
C i
Engineering did not have verifiable information on the exact design of the
original injection flow orifices.
Design information from the original
construction
plans listed the orifice sizes only.
According to the ven-
dor, different orifice shapes
could have
been
used with the specific
FT
model installed.
The
new orifices installed were the
same
size
and had
the
same flow characteristics,
but had
a different shape
which was able to
provide more accurate calibration data.
The revised data were used to
confirm that FSAR-required injection flow was met with the recirculation
valves fully open
as originally designed.
The inspectors
questioned
the original engineering
department
assumption
that the modified SI system could be reconfigured with recirculation
valves throttled nearly closed
and 35-50
gpm as indicated
on FI-916.
FI-916 is not a linear gauge
and there is no incremental
mark at 35 gpm.
The inspectors
checked the calibration data for FI-916 and it was noted
that FI-916 was least accurate
in the low range where the initial incre-
mental
markings are
spaced at 25
gpm and where the gauge is more non-
linear.
This item is not being separately
pursued.
It is, however,
an-
other indication of lack of thorough design control
o+ field changes
to
modifications.
The
new recirculation valves
had to be throttled to approximately
80 per-
cent shut to achieve
measured
flows in the 35
gpm range.
The responsible
engineer
stated that these
valves were not designed to be throttled in
this region because
of the
unknown consequences
from flow instabilities
induced
by
a two piece
stem
and disc.
Also, the long zerm consequences
from high velocity flow were not
known for a nearly cl)sed valve.
This
question
on the part of the responsible
engineer also
showed ex',stence
of
failure to thoroughly review and resolve
a field change to a modification.
Inasmuch
as the valves did not remain throttled, this issue is not being
separately
addressed.
It is, however,
another pertinent input in consi-
dering the extent of the modification control problem.
The joint modification follow group is constituted primarily to verify
that
a modification is complete
and ready for installation in the plant.
All activities associated
with preparing
a design
package
are usually com-
pleted in time for the construction,
and for site training and operations
groups to prepare
documents
required to integrate
the modification into
plant operations.
The modification follow group provides the primary in-
terface for all principal groups dealing with the design, installation,
testing,
and operation of a modification.
The formal business
of the
group is completed
when turnover to the site groups begins.
The inspec-
tors concluded that this happens
too early in the modification process,
because
of the ongoing
need for design engineering
involvement in modifi-
cation installation, testing,
and initial operation,
and because
of the
need for more effective communication
between
the modification follow
group members.
10
Site Administrative Procedures,
A-301 series,
Control of Station Modifi-
cations,
allow informal turnover of control of plant modifications.
Also,
turnover punchlists
were found to be unofficial, uncontrolled
documents
without binding requirements
on the parties
who produce
them.
Group man-
agers
are responsible
for resolving punchlist items before final system
turnover,
but there is no accountability
system for ensuring that punch-
list items are resolved to the satisfaction of the parties
involved.
This
condition increases
the possibility of missing the transfer of design in-
formation and/or required action items.
Acceptance
of a plant modification is accompli shed
by the
modification'esign
coordinator
and liaison engineers
who do not have defined design
responsibility for modifications.
Most of the system design
and testing
information is accepted
from corporate
engineering
and the Results
and
Test
(R&T) group.
The
R&T group does not participate
in the preparation
of operations
procedures
which may be developed
from or affected
by opera-
tional testing.
Operations
does not always participate fully in
preopera-'ional
or operational
acceptance
testing.
In this case,
the inspectors
found
no effective operations participation in SI modification functional
testing.
SI operational
procedures
were developed after the modification
follow group closed out formal activities early in the modification in-
stallation process.
Information given to operations
during modification
training was based
upon
a system configuration with fully open recircula-
tion valves
Most operations
personnel
assumed
the valves
should always
be open.
They did not functionall'y participate
in the system testing
and
modification field change
processes.
TheWiaison engineer is responsible
for issuing interim drawing changes
to
the plant system
P&IDs in a timely manner
so that control
room operators
are informed of changes
to system
and component configurations while P&ID
changes
are in progress.
The interim drawing changes
for the SI system
were reviewed.
One SI system
P&ID (33013-1262)
had
been
used to indicate
system
changes for three
separate
P&IDs (33013-1261,
-1262,
and -1266).
Although the changes
were not complex, the areas
of the SI system
on each
plan were represented
differently and the potential for misunderstanding
was clear.
No administrative controls were found to effectively control
this practice
and the liaison engineer
stated that this case
was not in
accordance
with standard practice at Ginna Station.
This drawing change
control inadequacy
was assessed
as another indicator of inadequate
overall
control of modifications.
The Ginna Quality Assurance
Manual, Section
3, Confi uration Control,
Paragraph
2.3, requires,
in part, that Ginna Station prepare
or revise
plant procedures
or documents
as necessary
to reflect modifications.
Pro-
cedures
requiring SI recirculation valves to be verified full open were
not revised to require the valves to be throttled in accordance
with the
design
change.
This is an apparent violation (50-244/89-04).
P
r
11
ATWS/AMSAC Modification
En ineerin
Work Re vest
EWR-4230
AMSAC is
Plant Owner's
Group system
upgrade
designed
to
comply with the
ATWS rule of 10'FR 50.62.
The system is designed to in-
itiate auxiliary feed flow and trip the main turbine when turbine header
pressure
exceeds
40 percent of full power turbine header
pressure
and
a
loss of main feed flow is anticipated.
AMSAC mitigates plant transient
consequences if no reactor trip occurs.
The
AMSAC modification was installed
and functionally tested.
Acceptance
testing
was accomplished prior to plant start-up
by
R&T and
I&C personnel.
During plant startup
on June
1,
1989,
the system
was placed into operation
with reactor
power at approximately
53 percent
and turbine header
pressure
greater
than
40 percent.
When
AMSAC was "unblocked" to bring it on-line,
the main turbine tripped.
The reactor also tripped since
power was
greater
than
50 percent.
Once again,
the inspectors
concluded that the modification follow group
had completed its business
too early.
During the modification follow
group ..eetings,
uncontrolled
and unofficial design information drafted
on'G&E
title block drawing paper
was distributed to the site operations
and
training departments.
These drawings were
AMSAC logic diagrams
which con-
tained incorrect design information.
They were
used
by site groups to
develop onerating
procedures
and training packages
for the modification.
This condition is another
example of inadequate
design control.
The
AMSAC responsible
engineer
stated that
he often distributed uncon-
troDed and/or unverified design
information for general
purposes
and did
not know specifically what it was
used for, or if it was
used for any of-
ficial purpose.
In this case,
he did not know he was putting out incor-
rect logic information.
The responsible
engineer
also stated that
RG&E
purchased
the design
package
for the
AMSAC and that corporate
engineering
had
no real direct need for the system logic.
There does not appear to
have
been
any licensee
engineering effort to ensure that the system con-
figuration matched
the
system, logic.
This is another
example of inade-
quate design control.
The site
I&C group participated
in AMSAC operational
testing.
Technicians
reportedly understood that,
when the test procedure
removed the conditions
which initiated the trip signals,
the relays would maintain
a trip signal
if the system
was deactivated
before allowing the
200 second timer to run
out.
The test procedure did not require
a 200 second wait time to permit
the trip signals to clear.
The operating
procedure
assumed
the system
was
clear of any trip signals.
The procedures
were inadequate
because
the
test procedure
did not leave the system in the configuration the operating
procedure
assumed it to be in. It also left the system in a configuration
that could not be cleared
by resetting
the
system at the time specified
by
the operating procedure.
l
12
The AMSAC operations
procedure
was generated
as
a
PCN to procedure 0-1.2,
titled
Plant from Hot Shutdown to. Full Load,
and was sent to the Plant
Operations
Review Committee
(PORC) without going through the normal pre-
PORC process
defined by Adminis'trative Procedure
A-601.2, Procedure
Con-
trol - Permanent
Changes, (i.e., without the specified technical
reviews
and approvals).
PORC did not perform
a technical
review of this proce-
dure.
The inspectors
and the licensee
concluded that the operating
and
logic error s probably would not have
been detected
in the normal
pre-PORC
process.
NRC review also concluded that,
since the
18C department
under-
stood the problem of leaving the
system with a trip signal
locked in, the
error could have
been identified and associated
problems prevented prior
to system operation if 18C and operations
had communicated effectively.
Operations
did not participate in the preoperational
acceptance
testing to
the extent necessary
to fully understand
that the assumed
system logic was
wrong.
Current
system drawings were not used during the preparation of
the operational
procedure for AMSAC.
The system construction
drawings
were not part of any formal design
package
given to operations.
The opera-
tional procedure
was developed
from the incorrect
system logic and from
operating information made avai'.able
from the designer.
Corporate engi-
neering did not normally review operations
procedures.
In addition, engi-
neering drawings were not normally being
used to verify or validate
changes
to operating
procedures.
No formal check of the validity of the
system logic was performed
by the plant operations
group.
The Ginna guality Assurance
Manual, Section
3, Confi uration Control, Para-
graph 2.3, requires,
in part, that Ginna Station prepare or revise plant
procedures
or documents
as necessary
to reflect modifications.
Procedures
incorporating
changes
due to the
AMSAC modification were not revised
as
necessary
to reflect proper operation of the modified system.
This is
another
example of the apparent violation (50-244/89-04)
described
in Sec-
tion
11 of this report.
Exit Interviews
An interim exit interview was held with the licensee
on June
30,
1989.
After subsequent
information development
and review, another exit inter-
view was held with the licensee
on August 24,
1989.
That second exit in-
terview was held primarily to emphasize
the seriousness
with which the
NRC
regarded
the design control
inadequacies
identified in thi s report.
'
TABLE 1
Date
May 18,
1989
Event
Containment ventilation isolation signal
not generated
during safety injection actuation
due to missing wire.
May 29,
1989
Release
of waste
gas outside
12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Technical Specifica-
tion limit.
May 30,
1989
June
1,
1989
June
1,
1989
June
13,
1989
June
16,
1989
Turbine trip due to current transformer
open links.
Plant trip from 53 percent
power due to AMSAC modification.
Surveillance
PT-21 not performed
as required.
Slide links feeding
one Tavg and Delta
T channel
found open.
Radiation monitors
R-10A, 11,
12 found misaligned to sample
ambient air rather than containment air.
June
16,
1989
Intermediate
range bistables'rip
setpoints
found set at
40 percent
and 32 percent equivalent
power.
June
19,
1989
Safety Injection recirculation valves
1820
B and
C found
locked full open.
June
21,W989
Safety Injection recirculation flow found out of tolerance
with nonrepeatable
resul ts.
~
$
4
~
~ 'Aa
~
~
N
ENCLOSURE
2
POTENTIAL ENFORCEMENT ITEMS
1.
Contrary to Criterion III, Appendix B,
10 CFR 50 and Section
3 of the
Ginna guality Assurance
Manual,
measures
to control design
changes
were
inadequate
for modifications accomplished
during the
1989 refueling out-
age.
Specifically, the following conditions indicate
a breakdown
in de-
sign control:
On June
1,
1989,
when the recently completed
ATWS Mitigating System
Actuating Circuitry modification was placed into operation during
plant star t-up,
and reactor trip resulted.
This was
due to incorrect
system design
information being
used to develop
operating
procedures
and training packages
for the modification.
Further, uncontrolled
and unofficial modification information had
been distributed to the operations
and training departments.
On June
19,
1989,
about three
weeks after the plant had be~~ returned
to operation after the outage during which Safety Injection (SI) sys-
tem mod:fications were accomplished
under Engineering
Work Request
EWR-3881
and Engineering
Change
Notice
ECN 3881-16,
and w'ith two SI
system recirculation valves required to be throttled to 80 percent
closed,
these
valves were fully .open.
This condition was identified
when the procedure
change
notice requiring the valves to be throttled
was identified by the operating shift supervisor
as not being
com-
plied with, and the system line-up sheets
had not been modif ed to
--reflect the positioning change.
Therefore,
the as-prescribed
design
basis
was not correctly translated
into the operating
procedures.
On June
21,
1989, the SI system recirculation flow measuring orifice
design calibration curve was found to be different than the
one the
plant has
been
using since
1971:
Although this error resulted in SI
injection flow being about
20 percent higher than indicated, it also
showed that the design basis recirculation flow was not correctly
translated
into instructions,
procedures,
and drawings, in that the
prescribed recirculation flow valve throtting to 80% shut was in-
appropriate.
As of June
21,
1989,
the modification control series
A-301 procedures
and the informal "punch list" of items to be completed for turnover
of modified systems
to Operations
was found to not require completion
of items necessary
for turnover.
Further,
Operations
was not pro-
perly involved in modification review and approval,
inasmuch
as docu-
ments
(such
as the Engineering
Change Notice which prescribed throttl-
ing of the safety injection recirculation valves)
were not distri-
buted to or required to be reviewed by Operations.
Also, although
Operations
personnel
participated
in testing the SI modification,
'I $
'
a
~
0
4
Pj
cl
Enclosure
2
there
was
no indication of thorough Operations
review of the modifi-
cation prior to and during its accomplishment,
or of Operations
par-
-ticipation in the modification process
to the extent that significant
specified
changes
in safety-related
valve positions
were monitored
and verified complete
by the operating staff.
2.
Contrary to Criteria
1 and
17, Appendix A, 10 CFR 50,
based
on the July
16,
1988 loss of offsite power and the
May 30,
1989 turbine trip, the lic-
ensee
did not exercise
adequate
control over and corrective action for
electrical
power supply distribution equipment.
3.
Contrary to Technical Specification 6.8. 1,
and Criterion V, Appendix B,
10 CFR 50 and Section
5 of the Ginna Quality Assurance
Manual, the Plant Safe-
guards
Logic Test procedure
was not implemented (literally followed) as
prescribed
on May 18,
1989,
and
an unanticipated
safety injection signal
was consequently
generated.
4.
Contrary to Corrective Action Criterion XVI, Appendix B,
10 CFR 50 and
Section
16 of the Ginna Quality Assurance
Manual
requirements
for prompt
identification and correction of conditions
adverse
to quality, corrective
actions for failure to perform weekly rodding of boric acid tank level
bubbler tubes
on October 21,
1988 were ineffective in preventing recur-
rence
on June
1,
1989,
'ontrary
to Technical Specification
3. 1.5. 1. 1,
on June
16,
1989 reactur
coolant
system temperature
was above
350 degrees
Fahrenheit
and
no re-
quired reactor
c )olant leak detection
system sensitive to radioactivity
was'peration,
and the compensatory
requirement for sampling the con-
tainment every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />
was not met.