ML17265A171

Insp Rept 50-244/97-12 on 971117-980104.Violations Noted. Major Areas Inspected:Licensee Operations,Engineering,Maint, & Plant Support.Licensee Maintained Adequate Security & Safeguards Program

ML17265A171
Person / Time
Site:	Ginna
Issue date:	02/09/1998
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:
Shared Package
ML17265A169	List: ML17265A168 ML17265A171
References
50-244-97-12, NUDOCS 9802200151
Download: ML17265A171 (57)

See also: IR 05000244/1997012

Text

. U.S. NUCLEAR REGULATORYCOMMISSION

REGION I

License No.

DPR-18

Report No.

50-244/97-1 2

I

Docket No.

50-244

Licensee:

Facility Name:

Location:

Rochester Gas and Electric Corporation (RGKE)

R. E. Ginna Nuclear Power Plant

'1503 Lake Road

Ontario, New York 14519

Inspection Period:

November 17, 1997 through January 4, 1998

Inspectors:

Approved by:

P. D. Drysdale, Senior Resident Inspector

C. C. Osterholtz, Resident Inspector

L. J. Prividy, Senior Reactor Engineer

P. R. Frechette, Physical Security Inspector

G. C. Smith, Senior Physical Security Inspector

J. C. Jang, Senior Radiation Specialist

D. M. Silk, Senior Emergency Preparation Specialist

L. T. Doerflain, Chief.

Projects Branch

1

Division of Reactor Projects

98022001.M

980209

PDR

ADOCK 05000244

8

PDR

EXECUTIVE SUMMARY

R. E. Ginna Nuclear Power Plant

NRC Inspection Report 50-244/97-12

This integrated inspection included aspects of licensee operations, engineering,

maintenance,

and plant support.

The report covers a 7-week period of resident inspection.

In addition, it includes the results of announced inspections by a regional security

specialist, and an engineering specialist.

~Oerations

The licensee's effort to reduce the number of operator workarounds and challenges during

the outage was successful.

The operator workaround program had been appropriately

implemented to identify plant deficiencies as workarounds or challenges.

The safety evaluation performed to bypass channel two average reactor coolant system

temperature

(Tave) from the rod control system was satisfactory.

The licensee's intention

to reconfigure the channel two temperature detectors during the next refueling outage was

considered appropriate.

Operator performance in response to the trip of both feedwater heater drain pumps was

good.

Improved technical specification (ITS) requirements were properly interpreted and

actions were taken in a timely manner.

The licensee considered that an instantaneous trip

signal was generated

by the heater drain tank low level switch, given that no abnormal

indications were observed

in pump performance throughout the rest of the'nspection

period.

Operators observed during a training scenario displayed a knowledge deficiency regarding

plant conditions that should automatically trip reactor coolant pumps (RCPs).

However,

the instructor identified the deficiency and conducted good on the spot remediation training

for correction.

The licensee effectively evaluated plant modifications for training needs.

The assigned

training methods for educating operations personnel appeared

appropriate.

Maintenance

Observed maintenance

and surveillance activities were performed in accordance with

procedural requirements.

Plant equipment received adequate post maintenance testing

prior to its return to service.

Good personnel and plant safety practices were observed.

With the exception of testing on the B-emergency diesel generator, the as-found and as-left

test data met the expected performance values and the specified acceptance

criteria stated

in the Updated Final Safety Analysis Report.

The licensee effectively identified and resolved problems with the hydrogen side seal oil

cooler.

The addition of a service water isolation valve for the cooler was considered

an

appropriate modification.

Executive Summary (cont'd)

Mechanical maintenance

personnel improperly entered out-of-specification test data into

two preventive maintenance

procedures for the 8-emergency diesel generator,

and certified

the data as satisfactory without consulting with maintenance management.

The failure to

comply with the administrative requirements of nuclear directive ND-MAI,administrative

procedure A-1603.5, and maintenance

procedure M-15.1M is a violation of 10 CFR 50,

Appendix 8, Criterion V (VIO 50-244/97-12-01).

~En ineerin

System engineering provided adequate technical support to resolve problems in the

auxiliary feedwater system.

The licensee's commitments made in the 10 CFR 50.54(f) response letters concerning

licensing and design basis'activities were being appropriately implemented.

Two EDG performance parameters that could impact engine operability were not

incorporated into the licensee's test procedures.

The need to incorporate additional

operability limits requires additional review. The inspectors willfurther evaluate the EDG's

critical performance parameters,

and the need to incorporate them into the licensee's test

procedures for operability considerations

(IFl 50-244/97-12-02).

Plant Su

ort

The licensee maintained an adequate security and safeguards

program.

The conduct of

security activities met licensee commitments and NRC requirements.

Security facilities and

equipment were well maintained and reliable.

Security procedures were being properly

implemented, security staff knowledge, performance and training were acceptable.

Security organization and administration, and quality assurance

programs were adequate to

ensure effective implementation of the program.

The lock and key program was reviewed

and determined to be implemented in accordance with the requirements of the Security

Plan.

TABLEOF CONTENTS

EXECUTIVE SUMMARY

~

II

TABLE OF CONTENTS

IV

I. Operations

01

02

05

08

Conduct of Operations ....... ~.............

~......

1

01.1

General Comments..................

1

01.2

Summary of Plant Status ... ~..... ~....................

1

Operational Status of Facilities and Equipment ....................

2

02:1

Operator Workarounds and Challenges ....................

2

02.2

Average Reactor Coolant System Temperature

(Tave) Swings.....

3

02.3

Simultaneous Trip of Both Feedwater Heater Drain Pumps ....... 4

Operator Training and Qualification ......

~ .. ~.........

~ .,......

5

05.1

Licensed Operator Simulator Training ...... ~..............

~ 5

05.2

Outage Modification Training....... ~......

~ ~...

~ ~......

~ 5

Miscellaneous Operations Issues

~ .. ~....... ~........ ~.... ~.... 6

08.1

(Closed) LER 97-002: Loss of 34.5 KV Offsite Power Circuit 751,

Due to External Cause, Results in Automatic Start of "B"

Emergency

Diesel Generator ....................

6

08.2

(Closed) LER 97-004: Radiation Monitor Alarm, Due to Higher than

Normal Radioactive Gas Concentration, Results in Containment

Ventilation Isolation......

~ . ~.......,.......'

~.........

6

08.3

(Closed) LER 97-005: Undetected Unblocking of Safety Injection

Actuation SignaI While at Low Pressure

Condition, Due to Faulty

Bistable, Resulted in Inadvertent Safety Injection Actuation Signal

. 6

08.4

(Open) LER 97-006: Verification of Boron Concentration Not

Performed Due to Misinterpretation of Event Sequence,

Resulted in

Condition Prohibited by Technical Specifications .........

~ ~... 7

08.5

(Open) LER 97-007: Reactor Trip Instrumentation Would Have

Been in a Condition Prohibited by Technical Specifications ..

~ ~... 7

I. Maintenance

I

M1

M2

M3

Conduct of Maintenance........... ~....... ~.......

M1.1

General Comments on Maintenance Activities..........

M1.2

General Comments on Surveillance Activities

Maintenance and Material Condition of Facilities and Equipment ..

M2.1

Main Turbine Hydrogen Side Seal Oil Cooler Repair

Maintenance Procedures

and Documentation

M3.1

Emergency Diesel Generator (EDG) Preventive Maintenance

Procedures

t

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

.8

8.8.8.9.9

10

10

III. Engineering........... ~...................

E1

Conduct of Engineering ~..............

E1.1

General Comments.............

E1.2

System Engineering

E1.3

Licensing and Design Basis Activities

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

12

12

12

12

14

IV

Table of Contents (cont'd)

E2

ES.

Engineering Support of Facilities and Equipment

~ '15

E2.1

Emergency Diesel Generator (EDG) Test Parameters

and

Acceptance Criteria ....... ~........... ~...... ~...... 15

Miscellaneous Engineering Issues

.. ~.........................

16

E8.1

(Closed) Violation 50-244/96-06-02: Inadequate Safety Evaluation

Regarding Stroke Time Change for MOV-4616 .. ~...........

16

E8.2

(Updated) Unresolved Item 50-244/96-06-04:

Service Water

System Reliability Optimization Program (SWSROP) Issues ...... 17

E8.3

(Updated) Unresolved Item 50-244/97-201-02:Valve Testing

Issues Regarding Certain CCW and Sl valves ~.... ~.........

18

IV. Plant

RS

.. 19

.. 19

Miscellaneous RP&C Issues......................

~ .

R8.1

(Closed) IFI 50-244/97-06-03: Potential Signal Loss of

Meteorological Monitoring System ......... ~....

Miscellaneous

EP Issues .. ~......................

~

~

P8.1

(Closed) IFI 50-244/96-01-03: Call Out Drills.......

Conduct of Security and Safeguards Activities

S1.1

Security Program Review

Status of Security Facilities and Equipment.........

~

~ ..

S2.1

Review of Facilities and Equipment

Security and Safeguards

Procedures

and Documentation ...

S3.1

Program and Procedure.Implementation

Security and Safeguards Staff Knowledge and Performance

.

S4.1

Personnel Performance......... ~...........

~

Security and Safeguards Staff Training and Qualifications

S5.1

Training and Qualification (T&Q) Records Review

Security Organization and Administration ........ ~.....

S6.1

Management Support of Security...............

Quality Assurance in Security and Safeguards Activities

S7.1

Quality Assurance Effectiveness ..... '..

Miscellaneous Security and Safeguards

Issues

S8.1

(Closed) Violation E97-339: Failure to Maintain an Ade

Vehtcle Barrier ~.........................

the

~

~ 19

.. 20

.. 20

.. 20

20

.. 22

.. 22

.. 23

.. 23

.. 24

.. 24

~ . 24

.

~ 24

.. 25

.. 25

.. 26

.. 26

.. 27

PS

S1

S2

S3

S4

S5

~

~

~

~

~

~

~

~

S6

S7

SS

~

~

~

~

~

~

~

quate

~

~

~

~ 27

S Up port

I

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~ I

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

~

V. Management Meetings........'..."............

X1

Exit Meeting Summary ...............

L2

Review of UFSAR Commitments ........

.. 28

.. 28

.. 28

ATTACHMENTS

Attachment

1 - Partial List of Persons Contacted

- Inspection Procedures

Used

- Items Opened, Closed, and Discussed

- List of Acronyms Used

Re ort Details

I. 0 erations

01

Conduct of

Operations'1.1

General Comments

Ins ection Procedure

IP 71707

The inspectors observed plant operations to verify that the facility was operated

safely and in accordance with licensee procedures

and regulatory requirements,

This review included tours of the accessible

areas of the facility, verification of

engineered safeguards feature (ESF) systems operability, verification of proper

control room and shift staffing, verification that the plant was operated in

conformance with the improved technical specifications (ITS) and appropriate action

statements for out-'of-service equipment were implemented, and verification that

logs and records accurately identified equipment status or deficiencies.

Operator

performance throughout the inspection period was good.

01.2

Summa

of Plant Status

The plant was nearing the end of a refueling outage and in MODE 4 at the beginning

of the inspection period.

MODE 3 was entered at 6:12 a.m. on November 17,-

1997, and the plant was heating up in preparation for a reactor startup.

During the

heatup, a steam leak occurred on the A-steam generator steam flowtransmitter.

Containment was temporarily evacuated,

and the leak was isolated'in approximately

25 minutes.

On November 18, 1997, the licensee discovered that significant erosion had

occurred in the main feedwater discharge valves.

The licensee subsequently

performed an engineering evaluation that determined the valves were still able to

perform a main feedwater isolation if required.

The licensee indicated that the

valves would be refurbished during the 1999 refueling outage.

MODE 2 was

entered at 3:43 a.m. on November 19, 1997, and the re'actor went critical at

7:10 a.m. the same day.

MODE 1 was entered at 6:24 a.m. on November 20, 1997. The turbine was

manually tripped on the initial attempt to bring it on line due to an inability to

maintain condenser vacuum.

A vacuum leak was subsequently discovered on

the A-condenser hotwell manway.

The leak was repaired and the turbine was

successfully placed on line at 3:28 p.m. the same day.

The plant attained

100 percent power at 6:16 p.m. on November 24, 1997.

The rod control system

was maintained in the manual mode until December 19, 1997, to prevent

inadvertent rod motion due to the effects of primary temperature streaming (see

section 02.3).

'Topical headings such as 01, M8, etc., are used in accordance with the NRC

standardized reactor inspection report outline.

Individual reports are not expected to

address

all outline topics.

On November 25, 1997, both feedwater heater drain pumps simultaneously tripped

(see section 02.3).

Reactor power was reduced below 50 percent due to axial flux

differential. The A-heater drain pump was restarted about five hours later.

The

B-heater drain pump was restarted on November 26, 1997, in conjunction with a

power increase.

The plant returned to 100 percent power at 8:00 a.m. that

morning (see section 02.3).

On November 28, 1997, the licensee made a four hour report in accordance with

10 CFR 50.72 after operations personnel discovere'd that the main turbine hydrogen

side seal oil cooler was leaking oil into the plant's cooling water discharge canal

(see section M2.1). The leak was isolated and repaired, and the cooler was

returned to service on December 18, 1997.

02

Operational Status'of Facilities and Equipment

02.1

0 erator Workarounds and Challen

es

a.

Ins ection Sco

e (71707)

>,,~ ~

T

The inspectors reviewed the status of operator workarounds and challenges before

and after the refueling outage.

b.

Observations and Findin s

Prior to the refueling outa ge the licensee had six operator workarounds and nineteen

operator challenges incorporated in their program. After the outage, the numbers

were reduced to two workarounds and fourteen challenges.

Among the

'orkarounds eliminated were drifting condenser vacuum indication (pressure

transmitter tubing replaced), unreliable core exit thermocouple indication (system

replaced), and unreliable recirculation flowfor the B-auxiliary feedwater pump

(controller replaced).

The two workarounds remaining after the outage were:

~

Auxiliary building service water (SW) isolation valves must be locally

throttled open when restoring SW isolation; and,

~

The A-condensate booster pump is not equipped with an undervoltage trip.

Following a loss of bus 12A, it would be necessary to trip the pump prior to

restoring the bus.

The licensee indicated that the remaining two workarounds were currently being

evaluated for resolution.

The inspectors were previously concerned that some plant equipment deficiencies

were not being fully evaluated for operator workarounds (see IR 50-244/97-06).

The inspectors sampled several control room deficiencies for inclusion into the

operator workaround program (such as the average temperature bypass discussed

in

section 02.2).

No instance was identified during the current inspection where a

plant deficiency had not been properly evaluated.

3

c.

Conclusions

The inspectors concluded that the licensee's effort to reduce the number of operator

workarounds and challenges during the outage was successful

~ The operator

workaround program had beeri appropriately implemented to identify plant

deficiencies as workarounds or challenges.

02.2

Avera

e Reactor Coolant S stem Tem erature

Tave Swin s

a.

Ins ection Sco

e (71707)

The inspectors reviewed the licensee's

response to noted spiking in channel two

Tave.

b.

Observations

and Findin s

Following the plant startup and attainment of 100% power on November 24, 1997,

control room operators noted spiking on temperature instrument Tl-402 (Tave

channel two), and on TI-406 (delta T channel two). Operations personnel

subsequently maintained the rod control system in the manual mode to prevent

inadvertent rod motion. This anomaly had occurred before (see IR 50-244/96-12),

but was not severe enough to prevent placing the rod control system in automatic.

The spiking appeared to be related to reactor core age and was agg'ravated by the

locations of the reactor coolant system (RCS) temperature detectors.

Both

resistance temperature detectors (RTDs) for channel two were installed in

approximately the same location in the A-RCS loop. The other three channels have

RTDs located on opposite sides of the RCS piping, so when RCS fluid temperature

variations occurred, they tended to average out.

The licensee performed a safety evaluation (SEV-1113) to bypass the channel two

Tave input from the rod control system.

Channel two can be bypassed from the rod

control system by placing Tave defeat switch (T-401A) in defeat.

The safety

evaluation concluded that it was acceptable to bypass channel two since the Tave

defeat switch would bypass the rod control system, but not channel two's input to

the reactor protection system.

The licensee also considered it more desirable to

have rod control maintained in automatic for a faster response to plant transients.

Channel two was bypassed

and the rod control system was returned to the

automatic mode on December 19, 1997.

The licensee indicated that the channel two RTDs would be reconfigured to be

consistent with the other channels during the 1999 refueling outage.

The licensee

also identified that the channel two bypass would be considered an "operator

challenge" in accordance with the operator workaround program.

Conclusions

The inspectors concluded that the safety evaluation performed to bypass channel

two Tave from the rod control system was satisfactory.

The licensee's intention to

reconfigure the channel two temperature detectors during the next refueling outage

was appropriate.

02.3

Simultaneous Tri of Both Feedwater Heater Drain Pum

s

80

Ins ection Sco

e (71707)

The inspectors reviewed the licensee's response to a simultaneous trip of both

feedwater heater drain pumps.

b.

Observations and Findin s

On November 25, 1997, both feedwater heater drain pumps inexplicably tripped

with the plant at 100 percent power.

Control room operators reduced reactor

power to less than 90 percent within ten minutes.

However, reactor core axial flux

"penalty minutes" were being accrued in accordance with ITS 3.2.2, "Nuclear

Enthalpy Rise Hot Channel Factor," because

preconditioning requirements for

control rods restricted their being withdrawn more than three steps per hour.

Operations personnel reduced reactor power to less than 50 percent in accordance

with ITS 3.2.2. A total of 90 penalty minutes were accumulated.

The licensee

generated

an ACTION Report (97-2053) to address the heater drain pump trips, and

maintained plant power below 50 percent for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to eliminate the accrued

axial flux penalty minutes (ITS 3.2.2 prohibits operation above 50 percent until less

than 60 penalty minutes have been accrued during the previous 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />)

~

Troubleshooting activities revealed no obvious cause for the heater drain pump

trips. However, instrumentation and control (l&C) personnel considered that a

heater drain tank low level trip signal may have been inadvertently actuated by plant

personnel while moving heavy equipment in the vicinityof the pumps at the time.

The trip was activated by a mercury switch that could have instantaneously

generated

a trip signal if "bumped" or vibrated.

IKC personnel inspected the switch

and adjusted its alignment to increase the angle in which the switch sits to minimize

the possibility of inadvertent actuation.

The A-heater drain pump was restarted on

November 25, 1997, with test equipment installed and no abnormalities were

noted.

Both heater drain pumps were returned to service on November 26, 1997,

when the plant was returned to 100% power. The heater drain pumps ran normally

throughout the rest of the inspection period.

C.

Conclusions

The inspectors concluded that operator performance in response to the heater drain

pump trips was good.

ITS requirements were properly interpreted and actions were

taken in a timely manner.

The licensee's suspicion that an instantaneous trip signal

was generated

by the heater drain tank-low level switch appeared

likely, given that

no abnormal indications were observed

in pump performance throughout the rest of

the inspection period.

05

Operator Training and Qualification

~

~

05.1

Licensed 0 erator Simulator Trainin

80

Ins ection Sco

e (71707)

1

I,

The ins'pec'tors observed-aisimulator training scenario for licensed operators.

b.

Observations

and Findin s.

The inspectors observed

a simulator training scenario for licensed operators

conducted on December 19, 1997. The scenario included a degradation of offsite

power such that an underfrequency condition caused an automatic reactor trip.

'his

underfrequency condition should also automatically trip the reactor coolant

pumps (RCPs).. However, this automatic trip failed to actuate and the RCPs

remained running. The operating crew did not identify that the RCPs should be

tripped.

The instructor stopped the scenario and provided remedial training for the

operating crew on expected conditions for degraded grid frequency.

The scenario

was then restarted and the operating crew successfully mitigated the casualty.

Conclusions

The inspectors concluded that the observed crew displayed a knowledge deficiency

regarding plant conditions that should automatically trip RCPs.

However, the

instructor identified the deficiency and conducted good on the spot remediation

training for correction.

05.2

Outa

e Modification Trainin

a.

Ins ection Sco

e (71707)

The inspectors reviewed the licensee's training methods for plant modifications

installed during the refueling outage.

b.

Observations and Findin s

All plant modifications that were installed during the refueling outage were reviewed

by a licensed operator curriculum committee to evaluate the training needs. 'The

committee consisted of the operations manager, one licensed operator from each

shift, and one representative from training. Classroom training was conducted on

significant modifications, such as the reactor protection system channel ¹2

resistance temperature detector (RTD) module replacement, while simulator training

was conducted for modifications that directly impacted licensed operator duties,

such as the core exit thermocouple panel replacement

(see IR 50-244197-11).

Other training methods for less significant modifications included control room

required reading letters, notification letters, and shop briefings.

In all, training was

conducted on eighteen modifications for operations personnel.

~

C.

Conclusions

08

\\

The inspectors concluded that the licensee effectively evaluated plant modifications

for training needs.

The assigned training methods for educating operations

personnel appeared

appropriate.

T

'

Miscellaneous Operations Issues,

't

08.1

Closed

LER 97-002: Loss of 34.5 KV Offsite Power Circuit 751

Due to External

Cause

Results in Automatic Start of "B" Emer enc

Diesel Generator

082

LER 97-002 was submitted to the NRC on August 19, 1997, after the B'-EDG

automatically started. following a loss of offsite power circuit 751. The loss

occurred when a raccoon climbed a power distribution pole and caused

a short

circuit (see IR 50-244/97-06). The LER noted that the plant operated

as designed,

and that offsite circuit 751 was returned to.service when its protective relays were

reset.

The inspectors concluded that:the LER adequately described the event, and

appropriately addressed

the root causes

and corrective actions.

This LER is closed

(LER 97-002).

Closed

LER 97-004: Radiation Monitor Alarm Due to Hi her than Normal

Radioactive Gas Concentration

Results in Containment Ventilation Isolation

LER 97-004 was submitted to the NRC on November 24, 1997, after an automatic

isolation of containment ventilation occurred during removal of steam generator

inserts (see IR 50-244/97-11). The LER noted that the containment radiation

monitor alarm setpoint was only about one percent of the ITS limit, and that

radiation levels were slightly escalated

in containment due to the presence of a

defective fuel assembly.

The LER indicated that future refueling outage preparation

activities would specifically review the 'potential need to revise radiation monitor

setpoints based on RCS activity. The inspectors concluded that the LER adequately

described the event, and appropriately addressed

the root causes

and corrective

actions.

This LER is closed (LER 97-004).

08.3

Closed

LER 97-005: Undetected Unblockin

of Safet

In'ection Actuation Si nal

While at Low Pressure Condition

Due to Fault

Bistable

Resulted in Inadvertent

Safet

In ection Actuation Si nal

LER 97-005 was submitted to the NRC on December 1, 1997, after an inadvertent

automatic safety injection actuation signal was generated while performing a plant

safeguards

logic test (see IR 50-244/97-11). The B-EDG and two service water

pumps started, as designed; there was no actual injection as the rest of the systems

were out of service for the outage.

The LER indicated that the signal was generated

by a failed pressurizer pressure bistable.

The bistable was replaced arid calibrated,

08.4

and the logic tests were successfully completed.

The inspectors concluded that the

LER adequately described the event, and appropriately addressed

the root causes

and corrective actions.

This LER is closed (LER 97-005).

0 en

LER 97-006: Verification of Boron Concentration Not Performed Due to

Misinter retation of Event Se

uence

Resulted in Condition Prohibited b

Technical

LER 97-006 was submitted to the NRC on December 3, 1997, after the licensee

discovered that an ITS requirement to verify boron concentration following an

inoperability of the source range audible count rate may not have been performed

within the four hour time requirement.

The LER indicated that operations and

maintenance

procedures were inadequate

in assuring the operability of the audible

count rate. monitor.and would be reviewed and changed to ensure operability during

calibration and while in MODE 6. The LER also noted that there were no opera'tional

or safety consequences

attributed to the delayed boron concentration verification

since no core alterations or reactivity additions occurred while the audible count rate

was inoperable.

However, after issuing the LER, the licensee determined that

control room operators did not declare the audible count rate instrument inoperable

at the proper time, and that a revision to the LER would be necessary to identify

additional operator training in this area as a further corrective action.

This LER will

remain open pending a revision by the licensee and subsequent

NRC review (LER

97-006).

08.5

0 en

LER 97-007: Reactor Tri

Instrumentation Would Have Been in a Condition

Prohibited b

Technical S ecifications

LER 97-007 was submitted to the NRC on December 17, 1997, after the licensee

discovered that there was no requirement in instrumentation and control procedures

to place the neutron flux low range trip circuitry in the tripped condition for a power

range channel removed from service for physics testing in MODE 2 as required by

the ITS. The licensee made the discovery while in MODE 3, and thus prevented any

ITS discrepancy.

In addition, the licensee determined that a similar problem with

the high range trip circuitry occurred iri 1988, but was not reported to the NRC in

accordance with 10 CFR 50.73. That condition was corrected at the time;

however, that instance was also reported in this LER. The LER concluded, that the

uniqueness of the original design for placing neutron flux trip circuitry into a tripped

condition had not been emphasized

in procedures.

The LER indicated'that

instrumentation procedures would be revised and that training would be conducted

to ensure the neutron flux low range trip circuitry would be placed in the tripped

condition when required by the ITS. The licensee indicated that a revision to the

LER was necessary to correct a typographical error, and to identify additional

corrective actions to improve the documentation of specific instrument functions

that become inoperable when a channel is removed from service.

This LER will

remain open pending the licensee's revision and subsequent

NRC review

(LER 97-007).

If. Maintenance

M1

Conduct of Maintenance

h

M1.1

General Comments on Maintenance Activities

a.

Ins ection Sco

e 62707

The inspectors observed portions of plant maintenance activities to verify that the

'orrect parts and tools were utilized, the applicable industry codes and technical

specification,requiremen'ts

were satisfied, adequate

measures

were in place to

ensure personnel safety and prevent damage to plant structures, systems,

and

components,

and tb ensure that equipment operability was verified upon completion

of post maintenance testing.

b.

Observations and Findin s

The inspectors. observed all or portions of the following work activities:

~

Main turbine hydrogen seal oil'cooler reinstallation; observed on

December 17-18, 1997 (see section M2.1).

~

B-AFW pump recirculation flow controller replacement and pbst maintenance

testing; observed on December 29-30, 1997.

c.

Conclusions

a

The-inspectors concluded that the observed maintenance activities were performed

in accordance with procedural requirements.

Equipment received adequate

post-

maintenance testing prior to its return to service.

Good personnel and plant safety

practices were observed during the maintenance work.

M1.2

General Comments on Surveillance Activities

a.

Ins ection Sco

e 61726

'he inspectors observed one surveillance test to verify that an approved procedure

was in use, procedure details were adequate, test instrumentation was properly

calibrated and used, technical specifications were satisfied, testing was performed

by knowledgeable personnel, and test results satisfied acceptance

criteria or were

properly dispositioned.

9

b.

Observations

and Findin s

The inspectors observed portions of the following surveillance activity:

~

PT-16Q-B, "AFW Pump B - Quarterly;" observed on December 30,

1997

c.

Conclusions

The inspectors'confirmed that the procedure used was current and properly

followed. The shift supervisor properly authorized the surveillance work to proceed.

The licensee confirmed the qualifications of all surveillance test personnel involved

in the test.. The as-'found and as-left test data met the expected performance values

and the specified acceptance

criteria stated in the Updated Final Safety Analysis

Report.

M2

IVlaintenance and Material Condition of Facilities and Equipment

M2.1

Main Turbine H dro en Side Seal Oil Cooler Re air

a.

Ins ection Sco

e (62707)

The inspectors reviewed the licensee's response to a leak in the main turbine

hydrogen side seal oil cooler.

b.

Observations and Findin s

On November 28, 1997, the licensee discovered that the hydrogen side seal oil

cooler had developed

a leak. Security personnel noticed what appeared to be oil in

the low flow regions of the plant's cooling water discharge canal.

Operations

personnel subsequently discovered the leak and isolated'the cooler.

The licensee

generated

an ACTION Report (97-2064) to address the issue.

The licensee also

reported this event in accordance with'10 CFR 50.72 section b.2.vi. The cooler

was sent off site to a contractor facility.for repair, and it was discovered that a tube

to tubesheet joint leak had developed inside the cooler.

During the time the

hydrogen side seal oil cooler was isolated and removed, the air side seal oil cooler

provided oil flowto the hydrogen side.

After the cooler was repaired, it was reinstalled on December 17-18, 1997. A

service water isolation Valve for the cooler was also installed so the cooler could be

isolated without the use of blank flanges.

The cooler was returned to service on

'ecember

18, 1997.

10

The inspectors concluded that the licensee effectively identified and resolved

problems with the main turbine hydrogen side seal oil cooler.

The addition of a

service water isolation valve for the cooler was an appropriate modification.

M3

Maintenance Procedures

and Documentation

M3.1

Emer enc

Diesel Generator

EDG Preventive, Maintenance Procedures

a.

Ins ection Sco

e

(62707)'he

inspectors reviewed two work packages

used for the annual preventive

maintenance

on the A- and 8-EDGs that was accomplished during the recent 1997

refueling outage.

b.

Observations and Findin s

I

After the recent 1997 refueling outage; the inspectors reviewed outage work order

packages ¹19603808and ¹19603809,which were used for preventive

maintenance

on the A- and 8-EDGs.

The inspector's review followed the final

approval by maintenance supervision and their verification that all work specified in

the packages was completed satisfactorily.

Each package contained an official

record copy of procedure M-15.1M, ".A or 8 Diesel Generator Mechanical Inspection

and Maintenance."

This procedure provided detailed instructions for preventive

maintenance

on several diesel sub-systems

such as cooling water, fuel oil,

lubricating oil, and compressed

air; as well as inspections of engine components

such as the crankshaft, cylinder heads, valves, etc.

Following the mechanical

inspections, the procedure directed post-maintenance

and pre-operational testing to

verify that all maintenance was satisfactory before returning each EDG to service.

Step 5.20.1 of M-15.1M required technicians to record the firing temperature

and

pressure for each cylinder while the en'gine was operated and after it reached "full

load." The procedure also required that technicians record the difference between

the highest and lowest firing pressures

and clearly specified an acceptance

criteria

that this difference not exceed 150 psi maximum.

On November 4, 1997, cylinder

firing pressures

were taken during the performance of periodic test PT-12.2,

"Emergency Diesel Generator B." However, the actual difference between the

highest and lowest engine firing pressure was 160 psi, which the technicians

recorded and verified as acceptable.

All engine performance data in M-15.1M,

including the out-of-specification firing pressures,

was signed off by the technician

who took the data, and was also accepted

as satisfactory by a mechanic foreman.

Contrary to a note in procedure M-15.1M, the technicians recorded the out-of-

specification data as acceptable without contacting the appropriate maintenance

manager.

I

'11

The inspector also reviewed engine data taken during a previous refueling outage

when the B-EDG firing pressures

were obtained on May 3, 1996, using procedure

M-15.1M. During that test, the difference between the highest and lowest firing

pressure was recorded as 170 psi and signed off as satisfactory by the individual

taking the data, and also by a mechanic foreman.

The inspector further noted

several other recent instances during routine diesel diagnostic testing where this

parameter exceeded

150 psi on both the A- and B-EDG engines.

The inspectors discussed the out-of-specification data with the EDG system

engineer, who stated that the 160 psi pressure differential was primarily a concern

for engine balance and did not represent an operability limit. He also indicated that

'he out-of-specification data was discussed with the maintenance technicians during

the test.

However, neither the maintenance technicians or the system engineer

initiated an ACTION Report to address the discrepancy,

and a formal engineering

evaluation was not documented for the acceptability of the data.

The inspectors reviewed the licensee's administrative requirements pertaining to

procedure adherence.

Nuclear Directive ND-MAI,"Maintenance," established.

requirements for the execution of the licensee's maintenance

program, and assigned

responsibilities for program implementation.

ND-MAIcontained requirements to

document unexpected problems, and to refer any deficiencies to appropriate

supervision for resolution and disposition.

The directive also required that

deficiencies be reported in accordance with the licensee's

Correctiv'e Action

Program.

Administrative procedure A-1603.5, "Work Order Execution," specified

requirements for maintenance technicians to perform'procedures

as required and to

contact the appropriate maintenance

manager when unexpected conditions were

encountered.

Administrative procedure A-503, "Procedure Adherence

Requirements," contained requirements for the proper use of and adherence to plant

procedures.

However, this procedure appeared to contain a weakness,

in that no

specific instructions were provided to require that procedures

be adhered to as

written, and provided no other guidance to technicians on how to document out-of-

specification test data, or how to document the basis for the acceptability of out-of-

specification data prior to returning safety-related equipment to service.

The inspector discussed the out-of-specification data with the cognizant design

representative

(Fairbanks Morse) for the EDGs, who indicated that 10 to 20 psi

above the limitspecified in the vendor's technical manual did not represent

a

serious operating condition or an operability limitfor the engines (see section E2.1).

Nevertheless,

the inspectors were concerned that on two separate

occasions

maintenance technicians and foremen recorded out-of-specification test data in a

maintenance

procedure for safety-related equipment, and certified the data as

acceptable without contacting maintenance management

as required by procedures

ND-MAIand A-1603.5, and without resolving the discrepancy through the

Corrective'Action Program prior to returning the B-EDG to service.

~

'

'12

c.

Conclusions

The inspectors concluded overall that the annual preventive maintenance

on the A-

and B-EDGs was performed satisfactorily.

However, the licensee did not properly

adhere to the administrative requirements of procedures

ND-MAIand A-1603.5 to

properly comply with all procedure instructions, to resolve maintenance

discrepancies

through the Corrective Action Program, and to consult with

maintenance management when unexpected conditions are encountered

are a

violation of 10 CFR 50, Appendix B, Criterion V, "Instructions, Procedures,

and

Drawings" (VIO 50-244/97-12-01).

In addition, administrative procedure A-503

was weak in that it did not clearly delineate management expectations for the

appropriate actions by maintenance technicians when out-of-specification data is

obtained that is contrary to procedure requirements.

E1

Conduct of Engineering

E1.1

General Comments

Ins ection Procedure

IP 37550.

'The inspectors reviewed engineering 'areas that included 1) the activities of the

engineering and technical support groups, including the role of the system engineer

in monitoring system performance and taking corrective actions for improvements;

2) the licensing and design basis activities associated with Rochester Gas and.

Electric's (RGS.E) commitments made in response to the NRC 10 CFR 50.54(f)

letter; and 3) RGRE's corrective actions regarding open items from a previous

engineering inspection (IR 50-244/96-06) and the Ginna plant design inspection

performed earlier in 1997.

E1.2

S stem En ineerin

80

Ins ection Sco

e (37550)

The inspector reviewed the preferred auxiliary feedwater (AFW) system and the

standby auxiliary feedwater system (SAFW) by conducting system walkdowns and

discussing with the system engineer the most recent system performance report,

and his involvement with several ACTION Reports for resolving equipment

problems.

t

Observations

and Findin s

The system engineer, who is responsible for the AFW and SAFW systems,

is also

assigned responsibility for the containment spray and spent fuel pool cooling

systems.

He had been assigned these responsibilities within the past year and was

familiar with the various procedures

required to perform these responsibilities.

The

inspector observed that the system engineer was aware of plant change request

(PCR)97-061 performed during the last refueling outage to improve the AFW

system design concerning two relays that were powered from a non-safety bus for

automatic starting of the three AFW pumps on a steam generator lo-lo level signal.

This system enhancement

was identified in the Ginna plant probabilistic safety

assessment

(PSA). The relays are now powered from a safety-related instrument

bus.

Although prior to implementation of PCR 97-061 the steam generator (SG) water

level lo-lo channels had been powered from nonsafety-related

Bus D, Technical

Specifications (TS) acknowledged this design feature and required that this logic

train be declared inoperable (per TS 3.3.2) if Bus D were unavailable.

However,

from a safety perspective, other means*existed at Ginna to automatically start the

AFW pumps, such as opening of the main feedwater pump breakers (which would

be a consequence

of the loss of offsite power), or a safety injection actuation

signal.

Also, AFW makeup and cooling to the SG's is not required for the first

10 minutes of a design basis event, allowing time for manual action if needed.

Therefore while significant with respect to being a primary actuation signal the

total.loss of actuation signal was considered to be a very low probability event.

Regarding the performance of major equipment in the AFW system, the system

engineer interacted well with the testing personnel who perform and oversee the

inservice testing of pumps, valves, and heat exchangers.

For example, the system

engineer was adequately following a potential backleakage

problem with SAFW

system check valves (9704B, 9705B) associated with the D-SAFW Pump.

Also,

the system engineer was closely following actions needed to resolve operational

problems with the B-AFW pump recirculation flow valve (4310) which was

identified as one of the plant "Operator Workarounds."

However, the inspector

noted that the deficiency identified in the existing ACTION Report (AR) 97-1117

was a repeat occurrence similar to two previous failures (ARs 97-0153 and

97-0635) concerning this valve which was an indication of past ineffective

corrective actions.

During discussions related to system engineer training and the planning and

prioritization of work, it was apparent that the AFW system engineer recognized the

need to learn more detail regarding his systems while also trying to perform other

tasks assigned,

such as the UFSAR verification and design basis documentation

projects (see section E1.2).

~ ~

'14

Conclusions

System engineering was providing adequate technical support in taking corrective

actions to resolve problems in the AFW system.

Licensin

and Desi

n Basis Activities

Ins ection Sco

e (37550)

The inspector reviewed the status of the*licensing and design basis activities

committed to in RG&E's response of February 7,1997, to the NRC request for

information pursuant to 10 CFR 50.54(f),

~

Observations

and Findin s

RG&E updated their 50.54(f) response

in a letter dated September 30, 1997,

wherein they indicated that the UFSAR,verification project would be completed by

October 1998 and then followed by the design basis documentation

(DBD) project

to be completed in December 2001. The licensee planned to utilize the system

engineers for the detailed reviews needed for these projects, thereby retaining the

knowledge and insights from their reviews and better equipping them for their daily

work. The DBD project is to include all high and medium risk significant systems

which actually totaled 16 systems compared to 14 systems mentiohed in RG&E's

February 7, 1997, response letter. The licensee indicated that some low risk-

significant systems, such as the AFW system, may also be included in the DBD

project.

The inspector noted that several UFSAR verification project guidance documents

had been issued by the project coordinator: 1) "UFSAR Verification Project

Administiative Guideline;" 2) "UFSAR Verification Deviation Processing Guideline;"

and 3) "UFSAR Verification Review Process

and Computerized Database

Guideline."

While the system engineers had been trained on the Use of these documents to

perform system reviews, the computerized database to collect the changes from the

reviews was not yet operational.

A line-by-line review of the UFSAR was planned.

Such a review had been done for the AFW and safety injection (Sl) systems, but all

comments and changes were still in hard-copy format. The UFSAR verification

project was scheduled to proceed in parallel with the, validation of all other design

basis source documents so that an electronic link of these source documents to a

living UFSAR could be accomplished by October 1998 for use during the DBD

project.

With their completion of the service water safety system functional inspection

(SSFl) and the NRC design team inspection of Ginna, RG&E noted in the updated

response letter of September 30, 1997, that they had completed the commitment to

perform two SSFls in 1997.

RG&E indicated that they would perform a SSFI of the

AFW system in 1998.

c.

Conclusions

"15

RG&E was adequately implementing commitments made in the 10 CFR 50.54(f)

response letters concerning licensing and design basis activities.

E2

Engineering Support of Facilities and Equipment

E2.1

Emer enc

Diesel Generator

EDG Test Parameters

and Acce tance Criteria

a 0

Ins ection Sco

e (37551)

b.

The inspector reviewed maintenance

and test procedures used by the licensee to

perform post-maintenance

and ITS surveillance testing of the EDGs.

Observations

and Findin s

Periodic test procedures PT-12.1, "Emergency Diesel Generator A," and PT-12.2

"Emergency Diesel Generator B," contained the principal tests used to demonstrate

operability of both EDGs.~ These procedures were normally used for the monthly

surveillance test of each diesel as required by ITS section 3.8.1, but they are also

performed following significant maintenance when an operational performance test

is required to restore the diesel to service.

The test acceptance

criteria relating to

engine operability included critical performance parameters

such as total power

output, engine exhaust temperatures,

generator voltage and frequency, automatic

alignment to its associated

safeguards

bus, etc.

PT-12.1 and PT-12.2 were both

performed at 2000 + 50, -0 kilowatts (KW) to ensure that the operability tests are

performed above the upper band of the continuous rating defined in the ITS (1950

%50 KW).

The criterion for a maximum 150 ps'i differential between the highest and lowest

peak firing pressure was contained in the maintenance instructions of the EDG

vendor's technical manual (VTD-A0152-4004), and was specified as a limitthat is

applicable to the engine at full rated load (1950 KW). Maintenance procedures

M-15.1M, "A or B Diesel Generator Mechanical Inspection and Maintenance," also

defined EDG "fullload" as 1950 a50 KW. Since the engine firing pressures

recorded in procedure M-15.1M were specified for the engine's full load, the

acceptance

criteria did not match the test conditions required for PT-12.1 and

PT-12.2. The licensee acknowledged that the acceptance

criteria were

not'ppropriate

for the test conditions and subsequently initiated a procedure change

notice (PCN 97-2874) to delete the firing pressure data from procedure M-15.1M.

The inspectors contacted the diesel vendor/design representative

(Fairbanks Morse)

who stated that owner's of these'engines

should take corrective actions when the

- difference between the highest and lowest firing pressures

exceeded 200 psi.

However, the licensee did not have any procedure or test restrictions on operation

above a 200 psi differential, and data from recent engine diagnostic tests indicated

that value had been exceeded

on several occasions.

The design representative

also

stated that the maximum peak firing pressure for these engines shouldnever exceed

I

e

I

'16

2000 psig under any circumstances.

The licensee was unable to identify any

vendor document where this specification was stated; however, based upon the

design representative's

statement, the inspector considered that this value could

represent an operability limitthat was not recognized in the licensee's procedures,

and that no instructions to operators or test personnel were provided to avoid

exceeding that value.

The licensee indicated that peak firing pressures

in excess of

1900 psig have been observed on some cylinders during tests at high loads.

The

instrument gage used by the licensee to record this parameter was not part of a

calibration program.

Since the gage was not calibrated, the licensee could not

confirm that any cylinder had not exceeded

a firing pressure of 2000 psig; however,

there had not'been any signs of engine damage from the results of preventive

maintenance

inspections and diagnostic tests performed in recent years.

C.

Conclusions

ES.

The inspectors concluded that the appropriate acceptance

criteria for two EDGE

performance parameters that could impact engine operability were not incorporated

into the licensee's test procedures.

The inspectors could not determine if the limits

of the unmonitored parameter limits had been exceeded;

however, the need to

incorporate additional operability limits requires additional review. The inspectors

willfurther evaluate the EDGE's critical performance parameters,

and the need to

incorporate them into the licensee's test procedures for operability considerations.

Therefore, this will remain an inspector follow-up item (IFI 50-244/97-12-02).

Misceifaneovs Engineering Issues

E8.1

Closed

Violation 50-244 96-06-02: Inade uate Safet

Evaluation Re ardin

Stroke

Time Chan

e for MOV-4616

This violation was issued because the licensee had not adequately evaluated the

safety impact of the stroke time change for the auxiliary building service water

isolation valve (MOV-4616). Specifically, the valve had'been modified such that its

original stroke time of approximately 30 seconds was changed to approximately

120 seconds without fully evaluating the effects of this change on the performance

of the service water system to function under design basis conditions.

Corrective

actions included: 1) revising procedures

IP-SEV-1, "Preparation, Review, and

Approval of Safety Reviews," and IP-SEV-2, "Preparation, Review, and Approval of

Safety Evaluations;" 2) training plant personnel regarding the revised procedures

and the need to perform an increased scope of evaluation, especially when the plant

changes involve a safety related system and are beyond the level of detail of the

UFSAR; 3) restoring the valve stroke time to 30 seconds during the 1997 refueling

outage; and 4) in the longer term, compiling a controlled document available to plant

personnel to explicitly document all variables (stroke time, flow rate, etc.) that are

assumed

in the Accident Analysis chapter of the UFSAR.

The inspector verified that the revisions to procedures

IP-SEV-1 and IP-SEV-2 had

been issued and that appropriate training of plant personnel regarding these

procedures

had been conducted.

The inspector also verified that PCR 95-096,

'17

Revision 1, had been implemented in November 1996 to restore the MOV-4616

stroke time to approximately 30 seconds.

The actual valve stroke time recorded

during the post modification test procedure PT-2.3, "Safeguard Motor Operated

Valve Operation," was between 29 and 30 seconds.

The inspector noted that the

licensee work in compiling a document of all variables used in the UFSAR Accident

Analysis chapter was partially'complete and was scheduled for completion by

March 1, 1998, according to Item O'R05598in the licensee's Commitment and

Action Tracking System (CATS). Based on these actions, this item is closed.

U dated

Unresolved Item 50-244 96-06-04: Service Water S stem Reliabilit

0 timization Pro ram

SWSROP

Issues

This item was opened to identify the need for follow-up inspection in several areas:

1) the SWSROP should be revised to reflect the current SW system configuration;

2) the licensee had not fullyevaluated the 1993, 1994, and 1995 data regarding

heat exchanger performance tests; 3) several licensee-identified errors in the 1993

and 1994 component cooling water (CCW) heat exchanger test reports regarding

the effect of plugged tubes had not been corrected; and 4) the licensee's

CCW heat

exchanger performance calculations had,not-accounted

for possible macrofouling in

the SW side of the heat exchanger.

'

The licensee developed the SWSROP as an engineered

program largely in response

to the concerns identified in Generic Letter (GL) 89-13, "Service Water System

Problems Affecting Safety-Related Equipment."

Some of the folloW-up areas in this

open item, such as the need to update the SWSROP, had been noted during a

December 1994 self-assessment

that was performed to determine the status of

actions taken to resolve the, open items from a 1991 NRC Service Water System

Operational Performance Inspection.

As noted in Inspection Report (IR)

50-244/96-06,the

licensee had performed poorly in addressing the many open

items identified during the December 1994 self-assessment,

with the major

technical issues being related to heat exchanger performance testing.

In response to the NRC request included in IR 50-244/96-06regarding

specific plans

to complete the initial GL 89-13 service water heat exchanger thermal performance

test program, the licensee submitted on January 31, 1997, their plans for

completing this test program. After completing the review and evaluation of all

prior test data that spanned from 1992 to 1996, the licensee considered it

necessary to perform additional performance tests in 1997 on the standby AFW

pump room coolers, the containment recirculating fan coolers (CRFC), the CRFC

motor coolers, the diesel generator jacket water heat exchangers

and lube oil

coolers, and the CCW heat exchangers.

The initial test program for the spent fuel

pool heat exchanger was considered to be complete.

The inspector considered that

the licensee was appropriately evaluating the 1997 thermal performance data for

the-aforementioned

heat exchangers to establish test and/or cleaning frequencies

for inclusion into the preventive maintenance

(PM) systems.

However, establishment of PM frequencies was not yet complete for several

reasons.

For example, the licensee considered that another thermal performance

I

'18

test willbe warranted for the CCW heat exchangers

during the 1999 refueling

outage.

After review of the 1997 CCW heat exchanger test data, the licensee

noted that the A-CCW heat exchanger had a much higher tube fouling than the "B"

CCW heat exchanger.

It appeared that the B-CCW heat exchanger was receiving

more service water flowthan the A-CCW heat exchanger.

The licensee issued

ACTION Report 97-2149 (Dec'ember 12, 1997) to confirm this assumption and to

evaluate this variation in fouling'for its impact on the capability of the A-CCW heat

exchanger.

The licensee noted, and the inspector agreed, that immediate

operability was not a concern since both CCW heat exchangers

were cleaned after

the testing, and the service water temperature at this time was well below the

design basis limitof 80'F.

The licensee sponsored

a safety system functional inspection (SSFI) of the SW

system from March 31 to May 15, 1997 which was performed by an independent

contractor (Sargent and Lundy):. This SSFI resulted in about a 100 new action items

added to the licensee's CATS. In addition to issues related to heat exchanger

performance testing and revision of the SWSROP, comments were made regarding

the need to update'the SW system hydraulic flow model since it under predicted

flows in some cases.

= The licensee indicated that this work was being done in-

house and was scheduled for completion by the end of January 1998.

.This item willremain open pending:

1) the revision of the SWSROP to reflect the

current SW system configuration; 2) the completion of the initial thermal

performance test program for the safety related heat exchangers

c6oled by service

'ater and the establishment of test and/or, cleaning frequencies for them; and (3)

confirmation that the action items from the 1997 SW system SSFI, such as

updating the SW system hydraulic flow model, are being adequately resolved

E8.3

U dated

Unresolved Item 50-244 97-201-02:Valve Testin

Issues

Re ardin

Certain CCW and Sl valves

The specific valve leakage testing concerns were described in Sections E1.2.2.2(d)

and E.1.3.2.2(f) of the Ginna plant design team inspection report 50-244/97-201.

The inspector reviewed these issues with the licensee and cognizant NRR personnel.

URI 97-201-02remains

open pending clarifications of the original inspection

findings among the NRC Office of Nuclear Reactor Regulation (NRR), Region I, and

the licensee concerning the following valves:

~ ~

Regarding the CCW check valves (753ASB) that form the high/low pressure

boundary valves in RCP thermal barrier cooling supply line, the team

considered that these valves should be added to the Ginna Inservice Test

(IST) Program with a leakage testing requirement (i.e., classified as category

A valves).

RGSE sent a letter to the NRC dated November 3, 1997,

clarifying their position to include these valves in the IST program with a

closure verification test and a commitment to add a test connection needed

to perform this test for the 1999 refueling outage.

The licensee reasoned

that leakage testing should not be required since these valves were not

considered to be pressure isolation valves, and since the licensee had

0

periodically tested the relief valves (758A&B)that protect the associated

CCW piping from overpressure.

The inspector verified that 758A&Bhad

been satisfactorily tested during the recent and past refueling outages.

Accordingly, further NRC review of the information regarding the testing of

753A&Bis required.

Regarding the. suction valves (MOVs 896A&B)from the refueling water

storage tank (RWST) to the safety injection (Sl) &. containment spray (CS)

pumps and the valves (MOVs 897 & 898) in the Sl pump recirculation line to

the RWST, the team considered that these valves should have a leakage

.testing requirement in the IST program.

The team considered these valves

comparable to those used as examples in NRC Information Notice 91-56,

"Potential, Radioactive Leakage to Tank Vented to Atmosphere," which

described a'otential leakage path for post-loss of coolant accident (LOCA)

radioactivity to atmosphere through closed emergency core cooling system

(ECCS) pump recirculation valves which were not leakage tested.

The

inspector verified that Revision

1 to the licensee's

IST program added these

valves to be leak tested.

However, in light of possible conflicting information

included in a previous decision regarding leakage testing of similar valves at

another nuclear facility (NRR Memorandum dated May 15, 1995, in response

to Task Interface Agreement 94-22 regarding the H.B. Robinson facility),

further NRC review of information regarding the testing of these MOVs is

required.

No clarifications were needed regarding the check valve (854) in the suction line to

the residual heat removal (RHR) pump from the RWST. The Ginna design team

considered that this valve should be back-flow tested and that a closure verification

test was adequate

(i.e., leakage testing not required);

RG&E agreed to include a

closure verification test in the IST program.

Also, the design team considered that

the containment isolation valves (MOVs 860A,B,C,&D) in the containment spray

system should be leak tested.

RG&E agreed to add an IST leak test requirement to

these MOVs and did leak test these valves satisfactorily'during the recent refueling

outage.

IV. Plant Su

ort

.R8

Miscellaneous RP&C Issues

R8.1

Closed

IFI 50-244 97-06-03:Potential

Si nal Loss of the Meteorolo ical

Monitorin

S stem

In July 1997, inspectors noted a discrepancy between the delta temperature

indication at the site's meteorological tower and in the control room. At that time,

the licensee suggested that the different indications might have been caused by a

signal loss from the tower to the control room. The licensee subsequently

examined its systems and concluded that any actual signal loss would not effect the

control room indications since the system operated with a digital signaI processor.

Reading discrepancies

between the meteorological monitoring tower and the control

C

0

e

'0

room were due to the data processing time (about 2-5 seconds) prior to generating

a readout in the control room.

Based upon the licensee's actions to adequately

resolve this issue, this item is closed (IFI 50-244/97-06-03).

P8

Miscellaneous

EP Issues

P8.1

Closed

IFl 50-244 96-01-03:Call Out Drills

IF 50-244/96-01-03was

opened on May 8, 1996, due to inspector concerns

that the licensee was not able to accomplish all of their response

goals when

performing emergency plan call out drills. Previously conducted drills had

exhibited communications difficulties, and an inability to notify the required

responders within one hour.

On December 8, 1997, the licensee conducted

an off hours unarm'ounced drill with the following objectives:

Demonstrate that the RG&E notification process can notify the required one

hour responders.

Demonstrate that the required one hour responders

can actually respond to

their emergency response facilities.within one hour.

Demonstrate the ability to shift command and control from.the Ginna Control

Room to the Technical Support Center.

All one hour response

positions were staffed within sixty minutes of the

classification of the event and the technical support center assumed

command and

control of the emergency within fiftyminutes of event classification.

The inspectors

concluded that the licensee met the drill objectives and conducted

a successful drill.

'herefore,

this item is closed (IFI 50-244/96-01-03).

S1

Conduct of Security and Safeguards Activities

S1.1

Securit

Pro ram Review

aO

Ins ection Sco

e (81700)

Determine whether the conduct of security and safeguards activities met the

licensee's commitments in the NRC-approved security plan (the Plan) and NRC

regulatory requirements.

Areas inspected were:

access authorization program;

alarm stations; communications; protected area access control of personnel,

packages

and material, and vehicles.

b.

Observations

and Findin s

Access Authorization Pro ram: The inspectors reviewed implementation of the

Access Authorization (AA) program to verify implementation was in accordance

with applicable regulatory requirements and Plan commitments.

The review

included an evaluation of the effectiveness of the AA procedures,

as implemented,

II

0

21

and an examination of AA records for ten individuals.

Records reviewed included

both persons who had been granted and had been denied access.

The AA program,

as implemented, provided assurance that persons granted unescorted

access did not

constitute an unreasonable

risk to the health and safety of the public.

Alarm Stations:

The inspectois observed operations in both the Central Alarm

Station (CAS), and the Secondary Alarm Station (SAS). This observation included

alarm response,

post turnover, and interviews with'the alarm station operators. The

alarm stations were equipped with appropriate alarms, surveillance and

communications capabilities and were continuously manned by knowledgeable

operators.. No single act could remove the plants capability for detecting

a threat

and calling for assistance

because the alarm stations were sufficiently diverse and

independent.

The Central Alarm Statidn (CAS) did not contain any operational

activities that could interfere with the execution of the detection, assessment

and

response functions.,

Communications:

Both alarm stations were capable of maintaining continuous

intercommunications, communications with each security force member (SFM) on

duty, and calling for.assistance

from both on and offsite organizations.

These

comm'unications capabilities have been enhanced

by the recent acquisition and

installation of a new security channel radio repeater.

Protected Area

PA Access Control of Personnel

and Hand-Carried Packa

es:

The

inspector observed operations at the personnel access portal a number of times

during the course of the inspection.

Positive controls were in place to ensure only

authorized individuals were granted access to the PA. All personnel and hand

carried items entering the PA were properly searched

and the last SFM controlling

access to the PA was in a position to perform this function effectively.

PA Access Control of Material: The inspectors observed material processing

in the

warehouse.

The licensee had positive control measures for all materials entering

the PA. Materials entering the PA were identified, searched

and authorized by the

licensee.

Materials entering the PA via the warehouse were searched

by properly

trained and qualified individuals.

PA Access Control of Vehicles: The inspectors observed security operations at the

vehicle entry point including verification of vehicle authorization and performance of

vehicle searches

prior to entry into the PA. The active land vehicle barrier was

operated in accordance with Plan commitments.

The inspectors concluded that

vehicles were being controlled and maintained in accordance with the Plan and

applicable procedures.

Conclusions

The licensee was conducting its security and safeguards activities in a manner that

protected public health and safety and that this portion of the program, as

implemented, met the licensee's commitments and NRC requirements.

II

e

'22

S2

Status of Security Facilities and Equipment

S2.1

Review of Facilities and E ui ment

a 0

Ins ection Sco

e (81700)

Areas inspected were: Testing, maintenance

and compensatory measures;

PA

detection and assessment

aids; personnel and package search equipment and

vehicle barrier systems.

b.

Observations

and Findin s

Testin

Maintenance and Com ensator

Measures:

The inspectors reviewed

testing and.maintenance

records for security-related equipment and found that

documentation was on file to demonstrate that the licensee was testing and

maintaining systems and equipment as committed to in the Plan. A priority status

was being assigned to each work request and repairs were normally being

completed within the same day a work request necessitating

compensatory

~

measures was generated.

The inspectors reviewed'security event logs and

maintenance work requests generated over the last year.

These records indicated

that the need for compensatory measures was extremely minimal. When

necessary,

the licensee implemented compensatory measures that did not reduce

the effectiveness of the security system as it existed prior to the need for the

compensatory measure.

PA Detection and Assessment

Aids: The inspectors observed the licensee's

performance test of the entire Intrusion Detection System (IDS). Allzones of the

IDS were tested, and generated

appropriate alarms.

The test of the IDS was

accomplished

in accordance with the established testing procedure.

The IDS was

functional and effective. The inspectors observed camera coverage, in the CAS and

SAS, of the entire perimeter, while it was being walked down. The camera

coverage and overlap were very good.

The licensee's assessment

aids were

functional and effective.

Personnel and Packa

e Search

E ui ment: The inspectors observed both the

routine use and the daily performance test of the licensee's personnel and package

search equipment.

All search equipment was observed to perform its intended

function.

C.

Conclusions

The licensee's security facilities and equipment were determined to be well

maintained and reliable, and were able to meet the licensee's commitments and

NRC requirements.

'3

S3

Security and Safeguards

Procedures

and Documentation

S3.1

Pro ram and Proceduie Im lementation

a.

Ins ection Sco

e (81700)

Areas inspected were: security program plans, implementing procedures

and

security event logs..

= b.

Observations and Findin s

Securit

Pro ram Plans:

Since the UFSAR does not specifically include security

program requirements, the inspectors compared licensee activities to the NRC-

approved physical security plan, which is the applicable document.

While

performing "the inspection discussed

in this report, the inspectors reviewed the

licensee's

Plan commitments in Section 5.9, titled "Locks, keys, and related

equipment."

The inspectors determined, based on discussions with security

supervision, procedural reviews and observations, that the Lock and Key controls

were effective, properly maintained, and satisfied the requirements of the Plan.

The inspectors verified that selected changes to the Plan associated with the vehicle

barrier system (VBS), as implemented, did not decrease

the effectiveness of the

Plan.

Discussions with the licensee indicated that the plan was currently being

reviewed and a plan revision would be submitted in accordance with the provisions

of 10 CFR 50.54(p) in the near future.

Securit

Pro ram Procedures:

Review of selected implementing procedures

associated with testing and maintenance

and surveillance of personnel search

equipment determined the procedures were consistent with the Plan commitments,

and were properly implemented.

Securit

Event Lo s: The inspectors reviewed the Security Event Log for the

previous six months;-

Based on this rev'iew, and discussion with security

management, it was determined that the licensee appropriately analyzed, tracked,

resolved and documented safeguards

events.

C.

Conclusions

Security and safeguards

procedures

and documentation were being properly

implemented.

Event Logs were being properly maintained, and effectively used to

analyze, track, and resolve safeguards

events.

Lock and key controls were

effectively maintained in accordance with the Plan.

'4

S4

Security and Safeguards Staff Knowledge and Performance

S4.1

Personnel

Performance'.

Ins ection Sco

e (81700)

Areas inspected were security staff requisite knowledge and capabilities to

accomplish their assigned functions.

b.

Observations

and Findin s

Securit

Force Re uisite Knowled e: The inspectors observed

a number of SFMs in

the performance of their routine duties.

These observations included alarm station

operations, personnel and package access control searches,

and PA patrols.

In

addition, interviews were conducted with SFMs and security management.

Finally,

training records were reviewed (see section S5).

Based on all of the above

activities, it was determined that the SFMs were knowledgeable of their

responsibilities.and

duties, and could effectively carry out their assignments..

Res

onse Ca abilities: The inspectors reviewed the licensee's response strategies,

response

drills and critiques and evaluated feedback to the training department for

lessons learned.

c.

Conclusions

The SFMs adequately demonstrated that they have the requisite knowledge

necessary to effectively implement the duties and responsibilities associated with

their position.

The licensee's response

strategies were adequate.

S5

Security and Safeguards Staff Training and Qualification's

S5.1

Trainin

and Qualification TSQ Records Review

a.

Ins ection Sco

e (81700)

Areas inspected were security training and qualifications and training records.

b.

Observations and Findin s

Securit

Trainin

and Qualifications: The inspectors reviewed training records of

ten SFMs. This review indicated that the security force was being trained in

accordance with the approved TSQ plan.

Trainin

Records:

The inspectors'eview of training records determined that the

records were accurate and contained sufficient information to determine the current

qualifications of the individual.

'f

25

c.

Conclusions

Security force personnel were being trained in accordance with the requirements of

the NRC approved TRQ plan. Training records were being properly maintained.

Finally based upon the findings documented

in paragraph S4, the inspector

determined that the training was effective and provided the security force with the

requisite information needed to effectively implement the Plan.

S6

Security'Organization and Administration

S6.1

Mana ement Su

ort of Securit

a.

Ins ection Sco

e (81700)

Areas inspected were: management support, effectiveness

and staffing levels.

b.

Observations

and Findin s

Mana ement Su

ort: The inspectors reviewed various program enhancements

made since the last program inspection to determine the level of management

support.

These enhancements

included the allocation of resources for the following

activities:

- 24 SFMs successfully completed Certified First Responder Trainin'g

- All supervisors attended enhanced

Supervisor Training

- Members of the security staff have attended operational safeguards

response

evaluation (OSRE) exercises at both FitzPatrick and TVA, in preparation for the

Ginna OSRE

- Replacement of all shotguns with new shotguns

- Acquisition and installation of a new metal detector, and a new photo ID badge

video imaging system

- Procurement of additional training aids to enhance tactical response training

Mana ement Effectiveness:

The inspectors reviewed the management

organizational structure and reporting chain.

Security management's

position in the

organizational structure provides a means for making senior management

aware of

programmatic needs.

Senior management's

positive response to requests for

equipment, training and resources

in general have contributed to the effective

administration of the security program.

gati d

immediately available on shift met the requirements specified in the Plan

'6

C.

Conclusions

The level of management support for the security program was adequate,

and was

evidenced by adequate staffing levels and continued resource allocation to improve

training and equipment to enhance effective implementation of the security

program.

t

S7

Quality Assurance in Security and Safeguards Activities

S7.1

Qualit

Assurance Effectiveness

a.

Ins ection Sco

e (81700)

Areas inspected were;

audit/self-assessment

program, problem analyses, corrective

actions and effectiveness of management controls.

b.

Observations and Findin s

Audit Self-Assessment

Pro ram: -The inspectors reviewed licensee security, access

authorization and fitness-for-duty audit report AINT 1997-0010-JMT,for the audit

conducted during the period August 18, 1997, through September 16, 1997.

Five

ACTION Reports were generated

as a result of the audit. The ACTION Reports

were associated with:

Security training lesson plans found to be out of date;

Required procedure. guidance missing from the Employee Assistance

Program;

Health and Human Services (HHS) certified laboratory and testing facility

statistical summary is provided quarterly vs. monthly, as required;

Safeguards Information Access Authorization List Deficiencies; and

Unable to determine whether security communications and duress alarm

~ equipment is Underwriter's Laboratories (UL) and/or Factory Mutual (FM)

listed as required by NRC Inspection Procedure 81088 "Communications."

None of the findings were indicative of major programmatic weaknesses.

The audit

was enhanced

by the use of technical specialists.

Finally, a review of the responses

to the audit findings indicated that the actions taken to address the findings would

enhance program implementation.

The self-assessment

program was well defined and structured.

Self-assessments

were performed in the areas of security operations, access controls, security

systems and training. The licensee performed several self-assessments,

and their

results were well documented.

The data generated was trended, and the results

were well organized.

However, there appeared to be no proceduralized process for

feedback of data generated

by the self-assessment

program.

The benefits of such a

robust self-assessment

program, in terms of program enhancement,

were potentially

negated by this lack of procedural guidance to assure feedback into tlie program.

'7

The licensee agreed to review this portion of the self-assessment

program to

determine if actions were necessary to strengthen this aspect of the program.

Problem Anal ses:

The inspectors reviewed the analyses of data derived from the

self-assessment

program.

The analyses was effective, and problem areas are

trended and identified. Despite the effectiveness of this process,

no proceduralized

feedback system is in place to ensure that resolution to identified problems is

accomplished in all cases.

c.

Corrective Actions: The inspectors reviewed corrective actions implemented by the

liceris'ee in response'to'bo'th

the internal QA audit and in response to the VBS

violation (VIO E97-339).

In both cases, the corrective actions were effective, and

should prevent recurrence of these problems.

F

Effectiveness of Mana ement Controls:

The inspectors observed that the licensee

has a program in place which was effective in identifying, analyzing and resolving

problems.

The corrective actions taken by the licensee,

in response to audit

findings and the VBS violation were adequate

and should prevent recurring

problems.

The. same could be said for the self-assessment

program relative to the

ability of the licensee to identify and analyze problems.

A more proceduralized

methodology for implementing resolution to self identified problems is being

evaluated by the licensee.

Conclusions

The review of the licensee's Audit/Self-Assessment program indicated that the

audits were comprehensive

in scope and depth, that the audit findings were

reported to the appropriate level of management,

and that the program was being

properly administered.

In addition, the corrective actions that were implemented

were effective. The self-assessment

program could be enhanced

by the

.

implementation of a more proceduralized process for ensuring that the results of the

assessments

were effectively used to improve security program implementation.

SS

Miscellaneous Security and Safeguards

Issues

S8.1

Closed

Violation E97-339: Failure to Maintain an Ade uate Vehicle Barrier

a 0

Ins ection Sco

e (TI2515/132)

Areas inspected were the licensee's corrective actions in response to Violation

E97-339.

b.

Observations

and Findin s

Vehicle Barrier S stem VBS: One previously identified violation (VIO E97-339

Failure to Maintain An Adequate Vehicle Barrier) was closed.

The inspectors

reviewed the licensee's corrective actions detailed in their response to the violation,

dated September 15, 1997. Those corrective actions included:

'8

Installation of additional barriers in the areas where openings were identified.

Installation of welded steel plates to prevent removal of cables from their

support poles.

Recalculation of the design bases explosion calculations at distances well

within'the barrier to ensure that proper'protection would be afforded to the

required safe shutdown equipment.

The inspectors walked down the entire VBS, verified the installation of the

additional barriers and welded plates, and reviewed the recalculated design basis

explosive calculations used to determine the safe standoff distances from the VBS

to safety related equipment.

C.

Conclusions

Based upon the inspector's walkdown, as well as a review of the calculations, the

corrective actions were determined to be comprehensive,

effective and fully.

implemented.

This violation is closed (VIO E97-339).

V. Mana ement Meetin s

X1

Exit Meeting Summary

The results of the security inspection were presented

on December 4, 1997, and the

engineering inspection results were presented

on December 17, 1997. After the

inspection period was concluded, the inspectors presented the overall results to members

of licensee management

on January 9, 1998. The licensee acknowledged the findings

presented.

The inspectors asked the licensee whether any materials examined during the inspection

should be considered proprietary.

No proprietary information was identified.

L2

Review of UFSAR Commitments

While performing the inspections discussed

in this report, the inspector reviewed the

applicable portions of the UFSAR that related to the areas inspected.

The inspector

verified that the UFSAR wording was consistent with the observed plant practices,

procedure and/or parameters.

~I

ATTACHMENTI

PARTIALLIST OF PERSONS CONTACTED

Licensee

R. Albrecht

B. Flynn

C. Forkell

G. Graus

A. Harhay

J. Hotchkiss

G. Joss,

R. Marchionda

G. Palmer

P. Polfleit.

T. Porter

R. Ploof

J. Smith

R. Teed

J. Trayner

J. Widay

T. White

G. Wrobel

Training Supervisor

Primary'Systems

Engineering Manager

Electrical Systems Engineering Manager

IRC/Electrical Maintenance Manager

Chemistry 5 Radiological Protection Manager

Mechanical Maintenance Manager

,Results and Test Supervisor

Production Superintendent

Security Operations Coordinator

Emergency Preparedness

Mana'ger

Nuclear Security System Specialist

Secondary Systems Engineering Manager

Maintenance Superintendent

Supervisor, Nuclear Security-

Senior QA Analyst

Plant Manager

Operations Manager

Nuclear Safety 5 Licensing Manager

INSPECTION PROCEDURES USED

IP. 37551:

IP 61726:

IP 62707:

IP 64704:

IP 71707:

IP 71750'P

92903:

IP 92904:

IP 81700:

TI251 5/1 32:

Onsite Engineering

Surveillance Observation

Maintenance Observation

Fire Protection Program

Plant Operations

Plant Support

Follow-up - Engineering

Follow-up - Plant Support

Physical Security Program for Power Reactors

Malevolent Use of Vehicles at Nuclear Power Plants

Attachment

I

ITEMS OPENED, CLOSED, AND DISCUSSED

~Oened

VIO 97-12-01

Failure to Follow Administrative Procedure Requirements

e

IFI 97-12-02

Determine Appropriate Operability Parameters for the EDGs

Closed

VIO 96-06-02;,

Inadequate Safety Evaluation Regarding Stroke Time Change for

MOV-461 6 .

I

VIO E97-'339

LER 97-002

Failure to Maintain an Adequate Vehicle Barrier

Loss of 34.5 KV Offsite Power Circuit 751, Due to External Cause,

Results in Automatic Start of "8" Emergency Diesel Generator

LER 97-004

LER 97-005

LER 97-006

Radiation Monitor Alarm, Due to Higher than Normal Radioactive Gas

Concentration, Results in Containment Ventilation Isolation

e

Undetected Unblocking of Safety Injection Actuation Signal While at

Low Pressure Condition, Due to Faulty Bistable, Resulted in

Inadvertent Safety Injection Actuation Signal

Verification of Boron Concentration Not Performed Due to

Misinterpretation of Event Sequence,

Resulted in Condition Prohibited

by Technical Specifications

LER 97-007

Reactor Trip Instrumentation Would Have Been in a Condition

Prohibited by Technical Specifications

IFI 97-06-03

IFI 96-01-03

Potential Signal Loss of the Meteorological Monitoring System

Call Out Drills

Discussed

URI 96-06-04

URI 97-201-02

Service Water System Reliability Optimization Issues

CCW and Sl System Valve Testing Issues

Attachment

I

3

LIST OF ACRONYMS USED

AFW

AR

ASME

CATS

CAS

CCW

CFR

CRFC

CS

DBD

d/p

ECCS

EDGE

ESF

GL

IDS

IFI

IR

ISI

IST

ITS

KV

KW

LCO

LER

LOCA

MOV

NRC

NRR

OSRE

PA

PCN

PCR

PDR

PM

PORC

PSA

psi

psIg

PT

QA

QC

RCA

RCP

RCS

RG&E

RHR

RP

RPS.C

AuxiliaryFeedwater

ACTION Report

American Society of Mechanical Engineers

Commitment Action Tracking System

Central. Alarm System..

Component Cooling Water

Code of Federal Regulations

Containment Recirculation Fan Cooler

Containment Spray

Design Basis Documentation

differential pressure

Emergency Core Cooling System

Emergency Diesel Generator

Engineered Safety Feature

Generic Letter

Intrusion Detection Systems

Inspector Follow-up Item

Inspection Report

Inservice Inspection

Inservice Test

Improved Technical Specification

Kilovolts

Kilowatts

Limiting Condition for Operation

Licensee Event Report

Loss of Coolant Accident

'otor-Operated Valve

Nuclear Regulatory Commission

Nuclear Reactor Regulation

Operator Safeguards

Response

Exercises

Protected Area

Procedure Change Notice

'lant

Change Request

Public Document Room

Preventive Maintenance

Plant Operations Review Committee

Probabilistic Safety Analysis

pounds per square inch

pounds per square inch gauge

Periodic Test

Quality Assurance

Quality Control

Radiologically Controlled Area

Reactor Coolant Pump

Reactor Coolant System

Rochester Gas and Electric Corporation

Residual Heat Removal

Radiation Protection

Radiological Protection and Chemistry

C

~ g

Attachment

j

~

RTD

RWST

SAFW

SEV

SFM

Sl

SSFI

SW

SWS BOP

Tave

T&Q

The Plan

UFSAR

UL

URI

VBS

VIO

I

4

Resistance Temperature Detector

Refueling Water Storage Tank

Standby Auxiliary Feedwater

Secondary Alarm System

Safety Evaluation

Security Force Members

Safety Injection

Safety System Functional Inspection

Service Water

Service Water System Reliability Optimization Program

Primary Coolant System Average Temperature

Training and Qualific'ation

NRC-Approved Physical Security Plan

Updated Final Safety Analysis Report

'nderwriter's

Laboratory

Unresolved Item

Vehicle Barrier System

Violation

jl