ML17312B569
| ML17312B569 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 07/21/1997 |
| From: | NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION IV) |
| To: | |
| Shared Package | |
| ML17312B566 | List: |
| References | |
| 50-528-97-19, 50-529-97-19, 50-530-97-19, NUDOCS 9707230126 | |
| Download: ML17312B569 (94) | |
See also: IR 05000528/1997019
Text
ENCLOSURE 2
U.S. NUCLEAR REGULATORY COMMISSION
REGION IV
Docket Nos.:
License Nos.:
Report No,:
Licensee:
Facility:
Location:
Dates:
Team Leader
Inspectors:
Approved By:
50-528
50-529
50-530
NPF-51
50-528/97-1 9
50-529/97-1 9
50-530/97-1 9
Arizona Public Service Company
Palo Verde Nuclear Generating Station, Units 1, 2, and 3
5951 S. Wintersburg Road
Tonopah, Arizona
May 19 through June 19, 1997
W. P. Ang, Senior Reactor Inspector, Engineering Branch
P. A. Goldberg, Reactor Inspector, Engineering Branch
W. J. Wagner, Reactor.Inspector,
Engineering Branch
M. F. Runyan, Reactor Inspector, Engineering Branch
D. B. Periera, Reactor Inspector, Engineering Branch
J. W. Clifford, Project Manager, Office of Nuclear Reactor
Regulation
C. A. VanDenburgh,
Chief, Engineering
Branch
Division of Reactor Safety
ATTACHMENT:
Supplemental
Information
'P707230i26
9'7072k
ADOCK 05000528
6
TABLE OF CONTENTS
EXECUTIVE SUMMARY
~
~
~
III
Report Details
.
III. Engineering
E1
Conduct of Engineering
E1.1
System Reviews
E1.2
E1.3
Condition Reports/Disposition Requests....
E1.4
Surveillance of non-Technical Specification Equipment
E1.5
Independent
Safety Engineers ..
E1.6
10 CFR 50.59 Safety Evaluations and Screenings
E2.2
Facility Conformance to License Conditions and Design
Documents ..............
E2.3
Resolution of Recent Plant Events
.
~ . ~............
Basis
...
1
~
~
1
~
7
...8
....8
....9
... 10
... 19
... 21
E7
Quality Assurance
in Engineering Activities .....................
30
E7.1
Engineering Self Assessments....................
30
E8
Miscellaneous
Engineering
Issues
32
E8.1
(Closed) Violation 50-529/96010-01 ..... ~....... ~....... 32
E8.2
(Closed) Licensee Event Report 50-528/96-175 and 96-200 .... 33
X1
Exit Meeting Summary ..
~ .. ~..............................
35
1
e
EXECUTIVE SUMMARY
Palo Verde Nuclear Generating Station, Units 1, 2, and 3
NRC Inspection Report 50-528/97-19; 50-529/97-19; 50-530/97-19
An inspection team consisting of NRC Region IV inspectors
and the Office of Nuclear
Reactor Regulation Project Manager, performed an inspection at the Palo Verde Nuclear
Generating Station on May 19 through June 19, 1997.
The team reviewed the licensee's
engineering activities to evaluate the effectiveness of the engineering
organization in
performing routine and reactive siteactivities, including the identification and resolution of
technical issues and problems.
The team also ascertained that the licensee was
implementing
a safety evaluation program that conformed to 10 CFR 50.59.
The team found that the licensee's
engineering organization performed good routine and
reactive engineering
in support of operations
and maintenance.
fnrnineerinf
~
All seven of the design modifications reviewed by the inspection team had proper
10 CFR 50.59 screenings/evaluations
and post-modification testing requirements.
Applicable drawings and procedures
were updated accordingly (Section E1.1.1).
Allfive of the deficiency work orders reviewed by the team were adequately
prepared
(Section E1.1.3).
All five design calculations reviewed by the team were accurate and complete
(Section E1.1 e4).
All eight operability determinations
reviewed by the team were performed
appropriately.
In each case, engineering
provided
a detailed discussion of the
degraded
condition and provided an adequate
evaluation of the operability
implications.
Where necessary,
calculations were included to support the
determination of operability (Section E1.2).
Each of the 23 condition reports/disposition
requests reviewed by the inspection
team represented
a quality effort, in which the problem was clearly stated, the
investigation deterrriined a cause,
and the corrective actions were appropriate to the
discrepancy.
Licensee" engineering was providing good support to plant operations
and maintenance
through the condition report/disposition request process
(Section E1.3),
Documentation for three of the seven design modifications reviewed by the team
had minor inconsistencies
that were clarified by the licensee (Section E1.1.1).
er vI'
Only one safety-related temporary modification was outstanding
during the
inspection.
The inspectors concluded that the licensee controlled temporary
modifications in an excellent manner (Section E1.1.2).
jf
i
t
l
f
0
e
The independent
safety engineering
group met the function, composition; and
responsibilities required by the technical specifications.
In addition, the
assessments
and recommendations
of this group appeared to be of high quality
(Section E1.5).
~
Procedure
93AC-ONS01, "10 CFR 50.59 Screenings
and Evaluations," was
conservative with respect to the scope of activities to be addressed
by
However, the inspection team identified that other plant
administrative procedures
contained inconsistent guidance that could result in not
performing safety evaluations. for all changes to the facility as described
in the
licensing basis.
Nevertheless,
the licensee's
overall program for implementation of
10 CFR 50.59 was generally conservative
and well understood
by the licensee's
staff (Section E1.6).
The licensee was performing good self assessments
of the implementation of the
requirements of 10 CFR 50.59, but was still in the process of correcting identified
problems (Section E1.6).
System engineers were proactive and effective in providing quality engineering
resolution of technical issues of site activities.
System engineers
provided excellent
engineering support in the troubleshooting
and root-cause determinations
of the
May 31, 1997, reactor trip (Section E2.1).
~
.
The design basis in the Updated Final Safety Analysis Report sections for the
essential cooling water system and the essential chilled water system was
accurately maintained (Section E2.2).
The inspection team identified that the licensee had incorrectly deleted
a Updated
Final Safety Analysis Report required procedure for assuring continued spray pond
system cooling capability beyond 26 days after a loss-of-coolant accident without
performing a 10 CFR 50.59 safety evaluation.
However, the licensee's
engineering
self assessment
had previously identified this condition on May 7, 1997.
This was
identified as a noncited violation (Section E2.2).
The extent and scope of a procedural deficiency that led to a water hammer event
in the Unit 3 containment spray system was not adequately
evaluated
and corrected
to preclude the root cause of the event from recurring,
Specifically, plant
operational procedures
were not reviewed for confusing "if/then" procedural steps
that could be misinterpreted by plant operators.
-This failure was identified as a
corrective action violation (Section E2.3.1).
Six of 20 main steam safety valves that were found to have liftsetpoints outside
the +/- 3 percent technical specification tolerances prior to the recent Unit 3
refueling outage were not reported to the NRC as required.
Although a licensee
analysis of the as-found conditions determined that the design basis had not been
exceeded,
the failure of multiple trains of a safety system is required to be reported
in accordance
with 10 CFR 50.73 (Section E2.3.2).
i
~
The plant material condition and housekeeping
were very good (Section E2.4).
The licensee performed
a good engineering self assessment.
Although the self-
assessment
report was not issued until the last onsite day of the NRC team
inspection, discussions
with licensee personnel
and review of condition reports
confirmed that the self assessment
identified strengths
and weaknesses
of the
engineering organization similar to those identified hy the NRC team (Section E7.2).
Plant Su
ort
~
The licensee's engineering self assessment
identified that approximately
80 commitments to the emergency
plan had been deleted without a 10 CFR 50.59
safety evaluation being performed prior to the emergency plan procedures
being
revised.
This item will be followed as a followup item pending further evaluation
(Section E2.2).
e
Report Details
III. Engineering
E1
Conduct of Engineering
E1.1
S stem Reviews
The team reviewed plant modifications (permanent
and temporary), deficiency work
orders, and engineering calculations associated
with three safety-related systems to
evaluate the effectiveness
of the engineering organization
in performing routine and
reactive site activities.
The three systems reviewed were the essential chilled water
system, essential cooling water system, and the essential spray pond system.
In
addition, the team also reviewed engineering activities associated
with recent
containment spray system water hammer events.
E1.1.1 Permanent
Plant Modification Review
a.
Ins ection Sco
e 37550
The team reviewed the seven permanent plant modification requests
listed in the
Attachment to verify their conformance with applicable installation and testing
requirements.
Specific attributes included: 10 CFR 50.59 safety evaluations,
post-
modification testing requirements,
applicable drawing changes,
updates to the final
safety analysis report, inclusion of necessary
training, and field installation.
In
addition, the team reviewed Procedure
81DP-OEE10, "Plant Modifications,"
Revision 0, to determine the scope of the licensee's
modification process.
b.
Observations
and Findin s
The team determined that the plant modification procedure provided adequate
control for equivalency replacements,
maintenance
modifications, paper change
modifications, and design modifications.
The team noted that the procedure
required a review of the 10 CFR 50.59 safety evaluation as part of "use-as-is" and
"repair" dispositions for material-related problems.
The team found that all seven
modifications had proper 10 CFR 50.59 screenings
and evaluations.
In addition, the
team found that post-modification testing requirements
were adequate to assure
component operability.
The team verified that affected drawings and procedures
were updated
in accordance with the modification packages..
The team verified that
the physical'installations of the modifications associated with Work Orders 696842
and 785094 were consistent with the description in the modification package.
During the review of the seven design modification packages,
the team discussed
the following observations
regarding the documentation for three of the
modifications.
~
Design modification Work Orders 00721193 and 889006 for Unit 2, Train A,
changed the setpoint of a flow transmitter in the essential spray pond
system.
The instrumentation provided continuous flow indication and a
differential flow alarm to detect
a pipe break by comparing the supply and
return flows in the closed-loop system.
The licensee stated that historically
the indication of Unit 2 return flow had been higher than the supply flow.
The modification revised the span of the supply transmitter so that the
indication of the return flow would agree with the indication of the supply
flow.
In the work order, the licensee had concluded that the material used for
internally coating the carbon steel pipe had potentially failed due to lack of
adhesion
and poor selection for spray pond piping application.
The licensee
was concerned that the flapping and possible separation of the lining close to
the process measurement
of the flow element was providing an erroneous
flow profile.
Upon further evaluation, the licensee concluded that this flow
condition had existed since original startup and appeared to be st'able and
not degrading.
However, the team noted that the licensee had not
determined the root cause of the large difference between the supply and
return flow. Rather, they had only determined that the difference was not
caused by calibration or instrument malfunction.
In further discussions,
the
licensee stated that the original root cause stated in the modification was
incorrect because
the coating was not becoming loose and flapping.
The
team noted that the modification to the supply transmitter allowed the supply
and return flow to agree,
The team reviewed Condition Report/Disposition
Request 2-6-0163, dated
September
3, 1996, which reported that during the performance of the
quarterly ASME Section XI surveillance test, the Unit 2, Train A, spray pond
pump produced
a flow of 16,300 gpm.
While at 16,300 gpm, the pump met
the minimum design basis flow requirement, the pump was declared
inoperable because
the minimum surveillance test flow rate acceptance
criteria was 16,700 gpm.
The team noted that the condition
report/disposition
request recommended
that the system flow be increased
by increasing the orifice size.
Although the report stated that the licensee
could not determine the root cause for the reduced flow condition, the report
concluded that the single most likely contributing component resulting in low
flow was pump degradation
and the second largest contributor was the
increase
in system resistance
caused
by corrosion of the carbon steel piping.
In accordance
with the recommendation
of Condition Report/Disposition
Request 2-6-0163, design modification Work Order 785094, dated
January
14, 1997, replaced the orifice plate in Train A of the spray
pond
system with a larger orifice plate in order to increase'the flow in Train A.
i
The modification was applicable to Train A in all three units.
The
modification stated that Train A flow was historically lower than Train B and
the cause of the reduced flow was due partially to the design of Train A,
which had a longer run of pipe than Train B. Nevertheless,
the licensee
'ndicated
that they did not know the actual root cause of the degradation of
Train A flow.
The team reviewed Condition Report/Disposition
Request 3-7-0003, dated
January 6, 1997, which documented
that the system flow was low for the
Unit 3 spray pond Train A pump.
In this condition report/disposition
request,
the licensee concluded that the cause of the low flow condition was a
combination of changing the method of recording flow data and the
instrument re-span of the supply flow transmitters.
The team noted that the
reason for this low flow differed from the root causes
documented
in
Condition Report/Disposition Request 2-6-0163.
However, the team
concluded that the low flow conditions were different than that identified
previously and that the licensee's corrective actions were appropriate for the
identified condition.
The team also noted that by increasing the orifice plate
. size, the Train A flow was increased
such that the surveillance test flow
requirements
could be met.
In addition, the team noted that the licensee
was addressing
the spray pond piping corrosion problem since 1995 by using
zinc phosphate
as a corrosion inhibitor and planed to perform a system flush
with zinc oxide at high concentrations.
This was being performed to reduce
carbon steel piping corrosion by providing a protective coating on the piping
and to improve flow conditions.
~
Work Order 736534, dated December 10, 1995, raised the setpoint of
the spray pond pump discharge temperature
alarm from 87 degrees
F to
105 degrees
F for the three units,
The setpoint was increased
because
the licensee determined by analysis that the previous setpoint would be
reached shortly after a loss-of-coolant-accident
and, therefore, would not be
available to provide an alarm if the spray pond system did not perform as
designed.
The design basis limitfor the pump discharge temperature was
110 degrees
F, which was based on the temperature limitof the emergency
diesel generator coolers.
In the modification, the licensee stated that the
new alarm setpoint of 105 degrees
F had enough maigin for operator.
response
prior to reaching the design basis limitof 110 degrees F...
The team was concerned that increasing the alarm setpoint was a
nonconservative
action because it allowed the operators
less time to perform
the required actions to prevent the spray pond temperature from reaching the
design basis limit. The team also noted that the licensee had not determined
how long it would take for the pump discharge temperature to increase from
ll
105 degrees
F to the design temperature
and if there would be adequate
time for the operators to perform the required actions.
In response to this
concern, the licensee determined that there would be a minimum of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />
before the design temperature
was reached.
The team acknowledged that
this amount of time provided adequate
time for the operators to perform the
required actions.
c.
Conclusions
The team found that all seven modifications reviewed had proper 10 CFR 50.59
screenings
and safety evaluations, post-modification testing requirements were
adequate,
and drawings and procedures
had been updated accordingly.
The team
also noted several documentation
inconsistencies
in three of the seven modification
packages that the licensee subsequently
resolved.
E1
~ 1.2 Tem orar
Plant Modification Review
a.
Ins ection Sco
e 37550
The team noted that the licensee did not have any temporary modifications installed
on the three systems selected for review during this inspection.
Therefore, the
team reviewed one temporary modification that was installed on another safety-
related system.
Specific attributes reviewed by the team included the
10 CFR 50.59 safety evaluations
and the license impact reviews.
b.
Observations
and Findin s
The team found that there were only six open temporary plant modifications open
during this inspection.
There were none for Unit 1, three for Unit 2 and three for
Unit 3.
Five of these temporary modifications were on nonsafety-related
systems.
The one safety-related temporary modification was installed in Unit 2 and was
closed and converted to permanent design status by initiation of a design master
work order during the, inspection.
This conversion was accomplished
in accordance
with applicable plant procedures
addressing
The team reviewed the safety-related,
Temporary Modification TMOD 2-96-SE-003,
which. reduced excessive
noise in the low power range of Channel
D of the Unit 2
excore nuclear instrument.
The noise reduction was accomplished
by the
installation of two ferrite beads to the logic input cabling.
The team found that the
modification had the proper safety evaluations,
license impact review, operability
evaluations,
and that the post-modification testing requirements were properly
specified.
The licensee evaluations of Temporary Modification TMOD 2-96-SE-003
concluded. that there was no operability concern and no change was required to the
technical specifications.
Conclusions
Based on the review of this one temporary safety-related modification and the low
number of open temporary modifications, the team concluded that the temporary
plant modification program was in conformance with plant procedures
and being
properly managed.
E1.1.3 Deficienc
Work Order Review
a.
Ins ection Sco
e 37550
The team reviewed the five deficiency work orders listed in the Attachment and
reviewed Administrative Procedure
81DP-OCD13, "Deficiency Work Order,"
Revision 10.
The team discussed
some of the deficiency work orders with
appropriate
licensee personnel.
b.
Observations
and Findin s
The team determined that the licensee used deficiency work orders to authorize
"repair," "use-as-is," "rework," or "scrap" of plant systems, structures or
components,
which were in a condition not supported
by any engineering,
design
basis, or design output document.
The team found that the five deficiency work
orders reviewed had comprehensive
10 CFR 50.59 screenings
and/or safety
evaluations.
In four of the five deficiency work orders, the team concluded that the
dispositions were appropriate,
as well as, inspection and testing requirements.
The
team had questions
regarding only one work order.
The licensee used Deficiency Work Order 00661874 to disposition an industry
concern regarding potential gearbox disengagement
of Limitorque HBC motor-
operated butterfly valves similar to those used at Palo Verde.
The licensee had
been informed by a Technical News Report (Operating Event Report 0052593) that
a spine adapter had disengaged
from the drive sleeve in a Limitorque HBC gearbox
at the Beaver Valley Nuclear Power Plant.
Limitorque had informed the licensee that
the possibility existed for the HBC spline adapter to become disengaged
from the
drive sleeve at Palo Verde.
The licensee initiated Condition Report/Disposition
Request 9-4-0033, which affected 23 motor-operated
butterfly valves in each unit
for a total of 69 valves.
In a Limitorque HBC valve, the spline adapter is keyed to the drive sleeve spline and
can separate
in situations where the valve stem is oriented below horizontal or
under seismic conditions where excessive vibrations are present.
If the spline
adapter,
key, and drive sleeve spline form a tight interference fit, this problem will
not occur.
However, if the fit is loose, the key can become disengaged
and the
valve willfail in its existing position.
The existence of the interference fit can be
verified only by disassembly
and a visual check is not sufficient to determine the
degree of tightness.
-,<<
The licensee informed the team that they were aware of the problem and had
inspected
all 69 motor-operated
valves as part of the licensee's
NRC Generic Letter 89-10 program and had verified the interference fit for those valves.
However, the licensee also considered that a secondary mechanism was desirable
to preclude spline adapter disengagement.
The licensee attempted to modify the
valves by inserting a spacer between the spline adapter and the pointer cap, but
abandoned
this plan after determining that the dimensional tolerances of the
gearbox were too unpredictable.
After considering many options, the licensee
developed
a modification to install setscrews
in the spline adapter to prevent the
key and spline adapter from sliding on the valve stem, thus, preventing
disengagement.
The licensee intended to install this modification only on those
HBC gearboxes that did not have or could not be reworked to have an acceptable
interference fit.
The licensee had scheduled
installation of the proposed modification (or verification
of an interference fit) on the HBC gearboxes
in all three units over the next 2-3
years as a secondary
measure for precluding spline adapter disengagement.
In the
interim, stopgap measure, the licensee applied Loctite Compound 290 to the spline
adapter keys to lessen the chance of disengagement
of the key. This activity was
covered under the deficiency work order disposition to Work Order 00661874.
The
licensee appeared
to take adequate
precautions to preclude migration of the Loctite
into the process fluid and only a few drops were applied on each keyway.
Loctite 290 has a quick cure time of about 3 minutes and excess compound was
quickly removed.
The team noted that the spline adapter, key, and drive sleeve spline had to be at
least snug tight for the Loctite compound to form a bond that would provide
resistance to the movement of these parts under load.
The team acknowledged
that the Loctite application was probably better than doing nothing, but was
concerned that the licensee may be using it as a justification for lowering the
priority (and, thus, pushing back the installation timetable) of the tightness
verification or setscrew modification.
Subsequent
discussions with licensee
personnel indicated that.the licensee did not intend to low'er the priority for
tightness verification or setscrew modification.
As a result, the team concluded
that, given the low occurrence
rate of this failure mechanism,
no further followup of
this issue was necessary.
C.
Conclusions
The team concluded that the five deficiency work orders that the team reviewed
were adequately
prepared.
E1.1 4 Review of En ineerin
Calculations
a.
Ins ection Sco
e 37550
The team reviewed the five engineering calculations listed in the Attachment
associated
with the three selected systems, to determine that:
,6
4
~
Required technical, design verification, and independent
design reviews were
performed;
~
Design information was correctly used for setpoint calculations;
~
Calculational and analytical methodology complied with regulatory
requirements,
licensee design guides, license commitments, and industry
practices.
~
Calculational assumptions
were technically reasonable;
~
Open or verification-pending items in the calculations were satisfactorily
resolved or properly identified and tracked for future resolution.
b.
Observations
and Findin s
The team found that the five calculations reviewed were accurate and complete.
The calculation assumptions
were technically reasonable
and the required reviews
were. performed.
c.
Conclusions
The reviewed calculations were accurate, the assumptions
were technically
reasonable,
and the required reviews were performed.
E1.2
0 erabilit
Determine ions
a.
Ins ection Sco
e 37550
The team reviewed the eight operability determinations
listed in the Attachment that
were performed by engineering
in support of operations.
b.
Observations
and Findin s
The team found that the eight operability determinations were appropriately
performed by engineering.
In each case,.the
engineer:provided
a detailed discussion
of the degraded
condition and provided an adequate
evaluation of the operability
implications.
Where necessary,
calculations were included to support the
determination of operability.
c.
Conclusions
Licensee engineering adequately performed the eight operability determinations that
were reviewed by the team.
Licensee engineers
provided good support for
operations by means of the operability evaluations.
0
f
t
0
E1.3
Condition Re orts Dis osition Re uests
a.
Ins ection Sco
e 37550
The team reviewed 23 condition reports/disposition
requests that involved the spray
pond system, essential water, and the chilled water system.
The condition report/
disposition requests
reviewed by the team are listed
~n the Attachment.
b.
Observations
and Findin s
The team found that each of the reviewed condition reports/disposition
requests
represented
a quality effort, in which the problem was clearly stated, the
investigation determined
a cause,
and the corrective actions were appropriate to the
discrepancy.
In some cases,
the level of documentation
was not sufficient for an
independent
reviewer to discern all ramifications of the problem or the thought
processes
used within the disposition.
However, in each of these cases,
licensee
engineers
were able to resolve all concerns.
C.
Conclusions
Licensee engineering
provided good support to plant operations
and maintenance
through the condition report/disposition
request process.
E1.4
Surveillance of non-Technical
S ecification E ui ment
a.
Ins ection Sco
e 37550
The team reviewed surveillance test procedures to verify that equipment for
systems that were not covered by technical specifications were being maintained
reliable and operable.
This included equipment for station blackout, Regulatory
Guide 1.97 instrumentation,
anticipated transient without a scram equipment,
and
the safety parameter display system.
b.
Observations
and Findin s
The team found that there were no design changes
or modifications made during
the last 2 years to the three systems selected that involved nontechnical
specification equipment.
The team verified that the licensee had proper controls for
ensuring, operability of these systems or portions of the systems when not
controlled directly by the requirements of'the technical specifications.
The team
found that these controls. included Administrative Procedure
80DP-OCC01 for
configuration management
of process computer software, which included
equipment for station blackout, anticipated transient without a scram equipment,
and the safety parameter display system.
instrumentation requirements were addressed-in
the Post-Accident Monitoring
Instrumentation Topical 'Report..
c.
Conclusions
The team concluded that the licensee had adequate
procedures
to maintain
equipment and systems, that were not covered by technical specifications, to
ensure system reliability and operability.
E1.5
Inde endent Safet
En ineers
a.
Ins ection Sco
e 37550
The team interviewed independent
safety engineers within the licensee's
Nuclear
Assurance
Operations Department to determine whether they were accomplishing
the functions described
in the technical specifications.
The team attended
a
meeting of the independent
safety engineers
and reviewed completed Nuclear
Assurance
Evaluation Reports to confirm that required independent
safety
engineering verifications were being performed.
b.
Observations
and Findin s
The team determined that the independent
safety engineers
examined, plant
operating events,
NRC issuances,
industry advisories,
and other sources of
operating experience
information.
Based upon those examinations, the independent
safety engineers
made and satisfactorily tracked to completion detailed
recommendations
for improving plant safety.
The team determined that seven full-time engineers were dedicated
as independent
safety engineers.
Each member had at least a bachelor's
degree
in engineering
or a
related science and at least 2 years of professional
level experience
in his field as
required by the technical specifications.
The team noted that the licensee reorganized the independent
safety engineering
organization
in 1994.
What previously had been
a separate
Independe<<t
Safety
Engineering Group had been dissolved, with the independent
safety engineers
being
absorbed
into the Nuclear Assurance
Operations Department (i.e., quality assurance
group).
Independent
safety engineers were assigned to one of four sections within
the department
(engineering,
maintenance,
operations,
plant support).
Each
independent
safety engineer reported through a section leader and department
leader to the Director of Nuclear Assurance.
The team attended
a meeting of independent
safety engineers
on June 4, 1997 and
noted that the meeting served
a large administrative function with little collective
~ discussion of technical issues.
Nevertheless,
the team interviewed two independent
safety. engineers,
both of whom appeared
knowledgeable of the functions and
responsibilities of the position.
C
Conclusions
The licensee's
independent
safety engineers
met the function, composition, and
responsibilities
as required in the technical specifications.
The assessments
and
recommendations
of this group appeared to be of high quality.
10 CFR 50.59 Safet
Evaluations and Screenin
s
lns ection Sco
e
37001
The team reviewed the licensee's
10 CFR 50.59 program guidance,
7 screenings
that concluded that a safety evaluation was not required, and 31 safety evaluations.
The screening
and safety evaluations were associated
with permanent
and
temporary modifications to the plant and procedures,
and licensing document
change requests.
In addition, the team reviewed the licensee's self assessments
of
their 10 CFR 50.59 program and of the quality of completed screening
and safety
evaluations.
Observations
and Findin s
Administrative Re uirements
The licensee's
screening
and safety evaluation process for changes to the facility
was controlled by Administrative Procedure
Screening
and Evaluations."
The procedure specified the responsibilities
and the
methods for determining if facility changes,
procedure changes,
and development
and performance of special tests and experiments could be made without prior
Commission approval.
The procedure
also specified qualification requirements for
personnel who were authorized to perform screening, evaluations,
and reviews in
the 10 CFR 50.59 process.
The procedure
required
a comprehensive
description of the change, such that
an independent
reviewer could understand
what, why, where, and how the
change would be done.
Screenings, are performed to determine whether or not a
10 CFR 50.59 evaluation was required.
The procedure defined the scope of
documents that were considered for screening
and potentially for evaluation as
licensing basis documents.
These documents
included the Updated Final Safety
Analysis Report (including the Combustion Engineering Standard Safety Analysis
Report), the Operating License, the Safety Evaluation Report, and correspondence
in
separate
letters to/from the NRC and Arizona Public Service Company that were
referenced
in the Safety Evaluation Report.
The inspectors noted that this scope
exceeded
the minimum requirements of 10 CFR 50.59; therefore, the team
considered this a strength. in the licensee's program.
Administrative Procedure
93AC-ONS01 provided screening criteria for facility
changes
by using four questions that were amplified in the procedure.
If the results
of the screening concluded that a safety evaluation was not required, the procedure
required that a detailed justification be provided for all "no" answers.
If the results
10
of the screening
concluded that one or more of the screening criteria were met, the
process
required
a safety evaluation to determine if the change constituted
an
unreviewed safety question.
The team had the following observations
relating to
Procedure
93AC-ONS01 and discussed
them with the licensee:
(1)
The procedure
required that the safety evaluation explain the application of
criteria to determine why the change may or may not be implemented with
no effect on nuclear safety.
This implied that the 10 CFR 50.59 evaluation
was a safety standard,
as opposed to a determination whether or not prior
Commission approval is required for a proposed
change;
(2)
The procedure
called for determining if the proposed
change
"required" a
technical specification change,
as opposed to addressing
whether or not the
proposed
change "involves" a technical specification change.
While the
team did not find any situations for which this wording affected the outcome
of a safety evaluation, this difference in wording provided the potential for
missing the intent of the rule, which was to have the technical specifications
reflect the actual plant design and limiting conditions;
(3)
The licensee used several different terms in the specific safety evaluation
questions for defining the scope of the safety evaluation.
For example, the
safety evaluation questions
used the terms "licensing basis," "quality-related
equipment," and "equipment that has a discernible impact on. nuclear safety
or hazard of radioactive release" to define the scope of the evaluation.
Although the team did not identify any safety evaluations that were limited
due to these inconsistencies,
the potential exists for misinterpretation of the
scope of the safety evaluation.
(4)
The procedure only considered
dose to the public (10 CFR Part 100) in its
consequences
evaluations,
as opposed to also considering the dose
consequences
to those onsite (10 CFR Part 20). Although the team did not
identify any instance where this would have changed the outcome of a
screening
or safety evaluation, the potential exists for not meeting the full
intent of 10, CFR 50.59.
During the inspection, the licensee:provided'a
draft change to
Procedure
93AC-ONS01 that, when implemented, would resolve these concerns.
The team identified that safety evaluations were not required for certain
changes that were identified as "paper only" changes.
Administrative
Procedure
81DP-OEE10 defined these changes
as those that change design
documents to reflect the current plant physical configuration.
For example,
Work Order 00696862 updated
a technical manual that was referenced
in work
procedures to allow plugging a percentage
of esseritial chilled water heat
exchanger tubes to a specified value that was within the bounds of a revised
calculation.
The work order; stated that because
the change.was
a paper change
only, a 10 CFR 50.59,screening/evaluation
was not required.
Although the team
determined that this specific change did not require a safety evaluation, the team
11
was concerned that this process constituted
a 'pre-screening'f
changes,
and could
potentially inhibit performing a formal screening
as specified in Administrative
Procedure
In evaluating this "paper only" change process, the team
identified several administrative procedures that permitted such
'pre-screenings'ithout
evaluating the change against the screening criteria specified in
Administrative Procedure
In further evaluating this concern, the team determined that Administrative
Procedure
81DP-OEE10, "Plant Modifications," discussed
criteria to be used in
determining whether or not a screening was required for "paper only" changes.
The
criteria was, "... [c]ould the change affect the conclusions
reached
in the Updated
Final Safety Analysis Report/Design
Basis about the design, function or method of
performing the function of a structure, system or component described
in the
Updated Final Safety Analysis Report/Design
Basis, or does the change affect
technical specifications?"
The screening criteria contained
in Administrative
Procedure
93AC-ONS01 included:
(1)
Any change to the description of a structure, system or
component which may alter its design, function, or method of
performing its function as described
in the Updated Final
Safety Analysis Report, including Combustion Engineering
Standard Safety Analysis Report, or other Licensing Basis
document either by text, drawing, or any other information
which could have been relied upon by the NRC in granting Palo
Verde's licenses to operate.
(2)
Any change to any structure, system or component not explicitly
described
in the Updated Final Safety Analysis Report which may
affect or alter the function of any structure, system
o'r component
that is explicitly described
in a licensing basis document.
This
includes consideration of changes to systems not classified as safety
related if they have a potential for impacting nuclear safety.
(3)
Any change to any structure, system or component for which credit is
taken in Chapter 6 or Chapter 15 safety analyses
and for which all
allowed outage times, permissible mode conditions, or permitted
reductions in,redundancy
are not specified in the technical
specifications.
(4)
Any change
in plant configuration while work.is in progress.
(5)
Changes to structure, systems or components,
which could affect
topical issues.
(6)
Any change which could potentially impact plant safety.
This
includes consideration of the plant design requirements,
intended or
unintended
operation of equipment, potential failure modes of
component,
human errors, and plant conditions.
12
f
(7)
Specific review of Generic Letter 95-02 when considering analog-to-
digital instruments and control system replacements.
(8)
A change
in the design basis or licensing basis of the plant to make it
agree with the as-built plant may constitute
a change
in the facility
and, thus, require a "Yes" response
and an Evaluation even though no
physical change
is to take place.
(9)
And, if the as-built condition of the plant is to be changed to agree
with the licensing basis, an evaluation may not be required.
Therefore, the team concluded that the criteria used in Administrative
Procedure
81DP-OEE10 did not fully consider the criteria required for a screening
as required in Administrative Procedure
93AC-ONS01 such that the potential existed
for an inadequate
screening of "paper only" changes.
However, the team did not
identify any procedure
changes that would have required a safety evaluation to be
performed as a result of this 'pre-screening'rocess.
The team identified a second example of the potential for prescreening
of changes.
Administrative Procedure
01DP-OAP01, "Procedure Process,"
used
a flow chart
with questions for determining if a procedure
change constituted
an "intent
change."
The identification of an "intent change" required a screen of the
procedure change against the criteria in Administrative Procedure
The questions
in Administrative Procedure
01DP-OAP01 require determinations
regarding whether the proposed
change involved:
~
Changing the objective or purpose of the procedure
~
Causing
a system or component to be used in a manner outside the design
basis
Change the sequence
of activities or methods described
in the Updated Final
Safety Analysis Report
~
w
Limitthe ability of the structure, system or component to perform its safety
function
~
Alter current licensing/design
basis acceptance
criteria
Procedure
93AC-ONS01 required the performance of a safety evaluation for a
change to a procedure that is outlined, summarized,
or completely described in the
licensing basis; therefore, the team concluded that the criteria used in the two
procedures
were=inconsistent.
As mentioned previously, the team'did not identify
any procedure changes that were not appropriately screened
as a result of the
inappropriate
use of "intent only" changes.
13
1
0
The licensee acknowledged
the team's concerns
and stated that they had a program
underway to reevaluate their use of criteria in multiple procedures that affected the
10 CFR 50.59 screenings
and safety evaluations.
b.2
Screenin
s and Evaluations
The team reviewed 7 sreenings to determine if safety evaluations were required.
The team determined that the licensee had appropriately screened
the proposed
changes.
The team also reviewed 31 safety evaluations with the following
comments or observations:
The team considered that 24 of the 31 evaluations reviewed contained the
appropriate information to conclude that no unreviewed safety question
existed.
For 5 of the 7 remaining evaluations, the team needed additional information
beyond that provided in the safety evaluations to understand
how the
licensee concluded that no unreviewed safety question existed.
The team
noted that this level of documentation
was not consistent with the guidance
of Administrative Procedure
The procedure stated that the
safety evaluation would provide sufficient explanation so that a qualified
reviewer could draw the same conclusion based on the information provided.
This concern had been previously identified in the licensee's
internal audits
'ver
the past 3 years (see Section b.3 of this report).
Despite this
weakness,
the team did not identify any safety evaluations that would have
resulted in a determination that an unreviewed safety question existed.
In
addition, the licensee had taken corrective action for this concern by
conducting training in November 1996 on the weaknesses
they had
identified through their own audits.
Evaluation Lo
96-00017 - This change involved an interpretation of the
operability requirements for the post-accident
sampling system. The change
provided an interpretation that only the primary instrumentation could be
used to determine system operability, and that alternate instrumentation was
not appropriate.
The team considered this interpretation to be noteworthy in
that it was conservative,
and that the safety evaluation appropriately
concluded that the change did not involve an unreviewed safety question or
a change to the technical specifications.
Evaluation Lo
96-00014- This safety evaluation involved an extension of
the peak fuel rod burnup associated
with fuel handling accidents.
The team
was concerned that the licensee had not performed a 10 CFR 50.59 safety
evaluation for a change
in the method of calculating the source-term. for the
fuel handling accident analysis.
The evaluation stated that Updated Final
Safety Analysis Report, Section 15.7.4.1.3, used
a different method (i.e.,
Regulatory Guide 1.25) to calculate the-amount of radioactive gasses
released
during a fuel handling accident than was currently used by the fuel
vendor (Asea Brown Boveri Combustion Engineering).
Specifically,-the
14
0
0
vendor used
a computer code called FATES, which was the method specified
in ANSI/ANS-5A - 1982, "American National Standard for Calculating the
Fiactional Release of Volatile Fission Products from Oxide Fuel Elements.",
The evaluation justified this use of the FATES computer code based on the
NRC's approval of this method at another licensee and the vendor's letter,
which stated that the use of the FATES code was acceptable for use at Palo
Verde.
The team concluded that a 10 CFR 50.59 safety evaluation was required for
the change
in analysis methodology described
in the Updated Final Safety
Analysis Report and did not agree that the approval of the use of this
computer code for another licensee applied to the Palo Verde licensing basis.
The team noted that the vendor's letter, dated January 15, 1996, stated that
the vendor's evaluation was suitable for reference in a 10 CFR 50.59 safety
evaluation performed by Palo Verde.
This appeared to support the team's
concern that a 10 CFR 50.59 safety evaluation should have been performed
before the FATES computer code was used.
The vendor's letter also stated
that:
Asea Brown Boveri Combustion Engineering Nuclear
Operations
(ABB CENO) used the FATES code with the
ANS 5A model in 1991... in conjunction with the
implementation of a 52 MWD/kgU peak rod average
burnup at Palo Verde Nuclear Generating Station.
Asea
Brown Boveri Combustion Engineering Nuclear
Operations concluded that the dose consequences
were
bounded
by the initial analysis of record (Updated Final
Safety Analysis Report initial analysis using Regulatory
Guide 1.25) and, therefore, the Palo Verde Nuclear
Generating Station Updated Final Safety Analysis
Report statements
concerning the dose calculation were
not changed.
The licensee indicated that, although the FATES computer code was used to
generate the source term for the fuel ha'ndling accident analysis, the Updated
Final Safety Analysis Report use of Regulatory Guide 1;25 remains bounding.
Therefore, the licensee concluded that there was no need to update the
Updated Final Safety Analysis Report to reflect the actual analysis methods
of record.
Although the current Updated Final Safety Analysis Report may
be bounding, the team pointed out that 10 CFR 50.71(e) requires that the
information included in the Updated Final Safety Analysis Report contains the
latest material developed.
The licensee also provided Condition Report/
Disposition Request 9-6-0010, which stated:
"... the current analyses of record for Palo Verde
Nuclear Generating Station fuel handling accidents have
not used the methods described
in Reg. Guide 1.25.
Additionally, the assumptions
of Reg Guide 1.25 no
15
longer apply to Palo Verde Nuclear Generating Station
as fuel burnup now exceeds
the limits in Reg.
Guide 1.25.
Methods currently in use have been
approved
by the NRC for use by [another licensee]."
The licensee identified that the original staff licensing safety evaluation
report for the Combustion Engineering Standarrl Safety Analysis Report
Design, NUREG-0852, Section 4.2, "Fuel System Design," as referenced
in
the Palo Verde licensing safety e'valuation report, NUREG-0857, specifically
referenced
use of the:FATES code.
However, the team concluded that this
section of the safety evaluation report applied to the material properties and
analysis of fuel centerline melt limit, and not for use in generating the source
term for fuel handling accidents
in the Chapter 15 fuel handling accident
analyses.
At the conclusion of the inspection, the licensee was still
researching
documents for applicable evaluations.
This issue will be
followed as an unresolved
item pending completion of the licensee's review
of additional evaluations (50-528;-529;-530/9719-01).
b.3
Licensee Self-Assessments
Administrative Procedure
93AC-ONS01 required that the Department Leader,
Nuclear Regulatory Affairs, annually evaluate the overall performance of
10 CFR 50.59 screenings
and evaluations.
The team verified that this
evaluation was performed, and reviewed the Significant Root Cause Investigation,
Condition Report/Disposition
Request 9-6-Q417, that documented
these findings.
The team also reviewed 6 months of reports (October 1996 to April 1997) of a
special nuclear assurance
evaluation program, which assessed
the adequacy of
the 10 CFR 50.59 program by reviewing the completeness
of approved screenings
and safety evaluations.
Although these licensee evaluations concluded that the
licensee's performance
in implementing their 10 CFR 50.59 program improved from
1995 to 1996, these assessments
also concluded that the program was not
improving further.
Deficiencies identified in subsequent
assessments
further
indicated that the licensee's
Level
1 program goals were not being met.
Based on
the licensee's criteria of requiring 95 percent of all screenings
and safety
evaluations to contain no technical errors (defined by a set of 14 different criteria),
the licensee concluded -that the quality of their 10 CFR 50.59 screenings
and safety
evaluations were inadequate.
The NRC team's questions
and concerns regarding the licensee's implementation of
the requirements. of 10 CFR 50.59 reflected some of the same concerns identified
by the licensee's
line and independent
assessments.
C.
Conclusions
The team found that the 10 CFR 50.59 screenings
and safety evaluations provided
substantive
information that supported the licensee's conclusions.
Although the
guidance contained
in the licensee's
administrative procedures
contained
inconsistencies
with respect to the requirements of 10 CFR 50.59, the licensee had
16
I ~
0
0
0
t
,ll
corrective actions in place to address these weaknesses.
The licensee's
administrative procedure for 10 CFR 50.59 screenings
and safety evaluations
had a
broad scope and provided adequate
guidance for performing safety evaluations.
The team identified several minor procedural weaknesses
that could result in not
appropriately screening changes to the facility as described
in the licensing basis;
however, the team did not identify any examples where a safety evaluation had not
been performed as required.
The licensee's
overall program for implementation of
10 CFR 50.59 was generally conservative
and well understood
by most of the
licensee's staff. The licensee had performed strong, self-critical assessments
of
their 10 CFR 50.59 program:and identified significant issues with specific issues
and programmatic concerns that affected the ability of the licensee to improve their
performance.
E2
Engineering Support of Facilities and Equipment
E2.1
En ineerin
Su
ort
Ins ection Sco
e 37550
The team evaluated the extent and quality of engineering involvement in site
activities by reviewing condition reports and interviewing eight system engineers.
Interview topics included management
expectations
for system engineers,
use of
in decision making, and training regarding system
interrelations.
In addition, the extent and effectiveness
of the site engineering
communications with other departments,
such as maintenance,
operations,
and
corporate engineering were discussed
and evaluated.
The team performed
walkdowns of the spray pond system and the chilled water system with the
systems engineers.
The team evaluated engineering
involvement with the resolution of technical issues
selected from recent plant events or routine work documents.
Also, the team
evaluated the extent of backlogged
engineering work.
b.
Observations
and findin s
The team observed
good engineering involvement in site activities based on reviews
of events and personnel interviews.
The team noted that the system engineers
were involved in identifying and resolving technical issues affecting the plant.
The
system engineers discussed with the team how they interfaced with operations,
maintenance,
and design engineers to resolve problems.
Approximately 50 percent
of the system engineers interviewed stated that they routinely held monthly system
meetings with maintenance,
design engineering,
and operations to update system
status and planned modifications.
The rest of the system engineers individually
contacted their system counterparts to update system status.
During the interviews, the team determined that the system engineers were
knowledgeable
of their systems
and modifications to their systems.
For example,
during the system walkdown of the essential chilled water system, the system
17
engineer was able to answer all the inspector's questions concerning system
operability and maintenance
requirements,
post-maintenance
testing requirements,
and acceptance
criteria. All system engineers
interviewed were able to discuss past
modifications, recent plans or changes for their system, and future expectations for
their system.
System engineers typically requested
the probabilistic risk
assessment
group to perform a risk assessment
prior to performance of scheduled
maintenance
on their systems.
The team also noted good system engineering
performance subsequent
to the
Unit 3 reactor trip that occurred on IVlay 31, 1997.
The trip was caused
by the
incorrect crimping of two terminal board leads and a missing jumper on the reactor
protection system.
The team noted that a similar event had occurred on May 19,
1997.
Although the licensee's troubleshooting
and investigation efforts could not
precisely determine the root cause of the initial event, during troubleshooting for the
May 31, 1997, event, the licensee's system engineer and instrumentation
and
control technicians were able to determine the cause of the problem.
C.
Conclusions
The team concluded that the system engineers were effective in providing quality
engineering resolution of technical issues.
System engineers were knowledgeable
of their assigned
systems.
The team concluded that the system engineers
provided
excellent support in the troubleshooting
and root-cause determination of the
May 31, 1997, reactor trip.
E2.2
a.
Facilit
Conformance to License Conditions and Desi
n Basis Documents
Ins ection Sco
e
While performing the inspections discussed
in this report, the team reviewed
applicable sections of the Final Safety Analysis Report that related to the selected
plant systems.
The team specifically reviewed Section 9.2.2.1, "Essential Cooling
Water Systems," Section 9.2.5, "Ultimate Heat Sink," and Section 9.2.9.2,
"Essential Chilled Water Systems," of the Final Safety Analysis Report.
The team
also interviewed licensee personnel
and reviewed plant procedures
and calculations
to determine if the in-plant systems were consistent with the description in the Final
Safety Analysis Report.
b.
Observations
and Findin s
The team found that maintenance
of the design basis in the Final Safety Analysis
Report sections for the essential cooling water system and the essential chilled
water system was-very good, in that the team did not find any discrepancies
in,the
two sections.
The team also reviewed Section 9.2.5.1.1.C of the Final Safety Analysis Report for
the spray pond system, which stated that procedures for assuring continued cooling
capability beyond 26 days were available,
The licensee indicated that the
18
~
~
r'
0
requirement to have procedures
in place to ensure continued capability of the
ultimate heat sink was required for compliance with Regulatory Guide 1.27.
The
regulatory guide required 30 days of ultimate heat sink inventory without makeup.
Since the licensee's
ultimate heat sink.was designed for 26 days of water
inventory, the licensee was committed to have an analyzed alternate means of
complying with the 30-day requirement by identifying other sources of water and
having'rocedures
in place to ensure the alternate water source could be delivered
to the spray ponds.
The team noted that Emergency Procedure
EPIP-56, "Ultimate
Heat Sink Emergency Water Supply," Revision 5, contained the information
supporting the licensee's commitment to Regulatory Guide 1.27.
When the team requested
a copy of the procedure,
the licensee indicated that it had
been deleted approximately
1 year ago.
In addition, the licensee indicated that their
self assessment
had previously identified this discrepancy
in Condition
Report/Disposition
Request 9-7-Q257, dated May 7, 1997., The engineering self
assessment
(Audit 97-005) had identified that procedures
were not in place to
replenish the ultimate heat sink.
Upon investigation, the licensee had determined
that the emergency planning department
had performed
a total conversion of the
emergency
plan procedures
and revised several emergency plan manuals during the
first half of 1996.
In April 1996, nine commitments, which were applicable to the
ultimate heat sink backup water sources,
were inactivated without performing a
10 CFR 50.59 safety evaluation when the commitments were inactivated.
In
addition, some of the instructions for obtaining a backup water supply were not
transferred into the new procedures
during the procedure conversion process,
due
to the inactivation of the commitments.
The team reviewed the licensee's corrective actions for the condition report, which
included revisions to Procedures
16DPOEP14 and 16DP-OEP15 and reinstatement of
the commitments concerning backup water sources for the emergency spray ponds.
The failure to perform a 10 CFR 50.59 safety evaluation when these commitments
concerning the backup water source for the emergency spray pond were deleted
was a violation of 10 CFR 50.59.
However, the licensee identified this violation
and took appropriate corrective action by revising the applicable procedures to
include the deleted commitments.
The violation was not a repeat of a previous
violation and did not appear to be willful. This non-repetitive, licensee-identified
and
. corrected violation is being treated as a noncited violation, consistent with
Section VII.B.1 of the NRC Enforcement Policy (50-528;-529;-530/9719-02).
The team noted that Condition Report/Disposition Request 9-7-Q257 also identified
that approximately 80 commitments to the emergency plan had been deleted
without a 10 CFR 50.59 safety evaluation being performed prior to the emergency
plan procedures
being revised.
At the time of this inspection, the licensee had-
not completed the corrective actions. for this aspect of the condition report.
19
i
The team noted that the licensee's
planned corrective actions included reviewing
all the emergency planning commitments that were inactivated during the procedure
reduction process to determine whether commitments were still contained
in the
emergency
plan, the procedures,
and the Final Safety Analysis Report.
The due
date for completion of these corrective actions was August 25, 1997.
The
licensee's
deletion of emergency
plan commitments and corrective actions will be
reviewed during future NRC inspections.
This was identified as a followup item for
further inspection by NRC emergency
preparedness
inspectors (50-528; -529;
-530/971 9-03).
Conclusions
The team concluded that the licensee had adequately
maintained the design basis of
the essential cooling water system and the essential chilled water system in the
Final Safety Analysis Report.
The team identified a noncited violation for a licensee-
identified deletion of a procedure specified in the Updated Final Safety Analysis
Report without performing a 10 CFR 50.59 evaluation.
The licensee also identified
that approximately 80 commitments had been deleted from the emergency
plan
without performing a 10 CFR 50.59 safety evaluation.
E2.3
Resolution of Recent Plant Events
E2.3.1 Containment
S ra
S stem Water Hammer Events
Ins ection Sco
e 37550
The team reviewed the licensee's
response to two water hammer events that had
occurred in the past 2 years.
The events involved a series of water hammers that
occurred in the Unit 2 containment spray system during the period July 21-26,
1995, and a water hammer in the Unit 3 containment spray system on April 25,
1997.
In selecting these events for review, the team sought to determine the
effectiveness of the licensee's
engineering staff in response to an unscheduled
occurrence
and support of plant operations.
Within this framework, the team
evaluated the licensee's damage assessment
of the events and actions taken to
prevent recurrence.
'.
Observations
and Findin s
1995 Water Hammer Event
Train A of the Unit 2 containment spray system experienced
several water hammer
events during the period of July 21-26, 1995.
These events occurred during
evolutions associated
with startup of Unit 2 from a refueling outage.
A total of
approximately six water hammer events occurred during this period, several of
which were the result of the troubleshooting
efforts.
During the events, licensed
operators
heard loud banging sounds
and observed
pipe vibrations.
The sounds
and
vibrations quickly subsided
and the pump and system ran smoothly after each
event.
The licensee determined that an excessive
amount of air was present in the
20
IJ
system on the discharge
side of the pump.
The licensee postulated that on pump
starts an air bubble collapsed
and sent a pressure wave from the discharge side of
the pump through the pump and back to the refueling water tank on the suction
side.
The licensee initiated Condition Report/Disposition
Request 2-5-0256 to investigate
these events. The licensee did not observe any damage during a piping system and
pipe support wa!kdown of the suction and discharge sides of the pump.
The
inspectors noted that this examination was performed by a design engineer on
July 28, 1995.
The examinations were visual and were performed from deck level
without using scaffolding or the removal of piping insulation (which covers most of
the piping in this system).
Based on visual observations
of piping displacement that occurred during the
events, the licensee performed
a piping system computer stress analysis.
This
analysis predicted potential damage to two snubber supports that provided axial
support to the system piping.
CH-142 and CH-424 were manually
stroked and determined to have not been damaged
during the events.
The licensee
concluded that the piping displacements
had been overestimated
by the operators
and that the actual pipe stresses
had been less than those calculated in the stress
analysis.
The licensee determined that the root cause of the water hammer event was the
lack of a procedure detailing how the containment spray system should be vented
following an outage or system maintenance.
In response,
Operational
Procedure 40OP-9SI02, "Recovery from Shutdown Cooling to Normal Operating
Lineup," Revision 9, was revised to add guidance for venting the system.
At the
conclusion of these efforts, the licensee had determined the root cause of the
events, had taken efforts to preclude recurrence
by providing procedural guidance
for venting the containment spray system during return to service, and had
determined that the system had not been damaged
and remained operable.
1997 Water Hammer Event
Train A of the Unit 3 containment spray system experienced
a water hammer event
on April 27, 1997,
when the pump was started for a surveillance test following a
system outage.
During the event, operators heard a slamming noise that quickly
subsided.
The pump and system ran smoothly after initial plant startup.
The licensee initiated Condition Report/Disposition Request 3-7-0216 to investigate
the event.
As in 1995, the licensee postulated that the root cause of the water
hammer was excessive
air in the discharge sections of the piping. The piping had
not been adequately vented following the Unit 3 refueling outage.
Step 4.3.9 of
Operational Procedure 40OP-9SI02, which provided the venting steps added in
response to the 1995 water hammer event, had not been performed by the licensed
operators.
This procedural step was prefaced with a conditional clause stating that
the venting needed to be'performed "... if Safety Injection Train A is being
restored from an outage/maintenance
condition."
The operators
had incorrectly
21
~
~
concluded that the venting steps were not needed
because the system had been
surveillance tested and run in certain modes.
However, the previous-operating
modes had not involved the entire system piping, some portions of which contained
a sizable volume of air. As corrective action, the licensee revised Operational
Procedure 40OP-9SI02 to remove the conditional statements
preceding the venting
actions in Step 4.3.9 and to require venting during any system recovery effort.
As in 1995, a design engineer performed
a deck level inspection of the system and
supports
and found no signs of damage.
Because
no visual observations
of piping
deflection were available, the licensee did not attempt to perform a stress analysis.
The licensee concluded that the Unit 3 event of 1997 was bounded
by the 1995
event.
No snubbers
were exercised following this event.
The team conducted
a walkdown of the affected containment spray piping in Unit 3
and did not note any evidence of damage other than several places where the piping
insulation was slightly crushed.
The team reviewed the licensee's operability
evaluations for both the Unit 2 and Unit 3 events and determined that the
evaluations were reasonable.
- The team reviewed the licensee's corrective actions for the events.
As previously
mentioned, the licensee determined that the second event was caused
by the failure
to vent the system following restoration due to a confusing conditional statement
in
the procedure.
The team was concerned that the licensee had not considered the
applicability of this procedural deficiency to other plant operational procedures.
In
response
to this concern, the licensee reviewed several other similar procedures
and
identified many instances of similar conditional clauses
and one example where
following the procedure would not have resulted in a satisfactory system vent.
This
latter example occurred in the same operational procedure involved in the water
hammer events (Operational Procedure 40OP-9SI02, Steps 4.3.4.13 and 5.3.4.13).
As an additional corrective action, the licensee initiated a condition
report/disposition
request to determine whether conditional statements
in plant
procedures
could be similarly misinterpreted
and result in the nonperformance
of
necessary
plant evolutions.
$0 CFR Part 50, Appendix B, Criterion XVI, "Corrective Action," requires that
measures
shall be established to assure that conditions adverse to quality are
promptly identified and corrected.
In the case of significant conditions adverse to
quality, the measures
shall assure that the cause of the condition is determined
and
corrective action.taken,to;preclude
repetition.
The failure to identify and evaluate
the adequacy of the conditional statements
in other operational procedures
is a
violation (50-528;-529;-530/9719-04).
During review of the water hammer events, the team noted a potential
inconsistency
in the licensee's technical specifications.
Technical Specification 4.6.2.1.c, requires the licensee to check that the level in the
containment spray piping is at least 115-feet every 31 days.
This check is.
performed in'the control room using a remote indicator of a differential pressure
sensing unit on the containment spray piping downstream of the containment spray
22
r
1
containment isolation valve, which is normally closed.
This check is performed to
ensure that the containment spray piping is filled sufficiently to provide timely
delivery of spray water to the containment
and to preclude system disturbances,
such as a water hammer, that could result from the presence
of excessive
air in the
system.
Because the containment isolation valve is closed during the surveillance,
the level in the containment spray piping does not provide assurance
that the piping
upstream
(pump side) of the containment isolation valve is filled with water.
The inspectors noted that the Technical Specification 4.5.2.b.2 surveillance
requirements for the emergency core cooling subsystems,
require a monthly venting
of a system high point vent to demonstrate
a solid system with no air bubbles.
Since similar venting of the containment spray system is not required, the fillstatus
of the system remains untested
during the operating cycle.
The licensee stated that
the reason for the difference in the surveillance requirements
between the
containment spray and the emergency
core cooling systems
is that the containment
spray system does not have an interface with a high pressure
source and, therefore,
is not considered to have as great a potential to have intrusion of dissolved gases.
However, the team was concerned that incomplete system venting upon startup of
the containment spray system could result in air in the system that could remain
undetected
and contribute to abnormal system stresses
and performance over time.
The lack of a surveillance requirement to periodically assure that the containment
spray system is adequately filled and vented was identified as an inspection
followup item (50-528;-529;-530/9719-05)
and will be further discussed
by the
inspectors with the Office of Nuclear Reactor Regulation.
C.
Conclusions
The team concluded that the licensee had reasonably determined that Unit 2 and 3
containment spray systems remained operable subsequent
to the water hammer
events in 1995 and 1997.
However, the licensee failed to consider the applicability
of the root cause of these events to other operational procedures.
As a result,
other potentially confusing procedure steps were not identified and corrected.
This
inadequate
corrective action is a violation of 10 CFR Part 50, Appendix 8,
Criterion XVI, "Corrective Action."
E2.3.2 Unit 3 Main Steam Safet
Valves LiftSet pints
a.
Ins ection Sco
e 37550
The team reviewed the licensee's engineering evaluations
and corrective actions for
6 of the 20 main steam safety valves and one of four pressurizer'safety
valves that
were found to have liftsetpoints outside their technical specification tolerances
during the recent Unit 3 refueling outage.
23
Observations
and Findin s
Licensee Event Report 94-02, dated April 13, 1994, reported that 7 of the 20 main
steam safety valves tested on Unit 3 had setpoints outside their technical
specifications lifttolerances (+/-
1 percent at that time) during the March 1994
refueling outage.
Twelve other licensee event reports dating back to 1988 reported
similar conditions in all three Palo Verde units.
On May 16, 1994, the licensee
obtained
NRC approval for an amendment to Technical Specification 3.7.1.1 for all
three Palo Verde units to increase the main steam safety valve liftsetpoint tolerance
to +/- 3 percent.
Similarly, the same amendment
increased the Technical Specification 3.4.2.2 pressurizer code safety valve liftsetpoint tolerance to
+3 percent and -1 percent.
The team noted that Condition Report/Disposition
Request 3-7-0056 reported that
6 of the 20 main steam safety valves and one of the four pressurizer safety valves
were found to have liftsetpoints outside the +/- 3 percent technical specification
tolerances
on February 11, 13, 14, and 15, 1997, prior to the recent Unit 3
refueling outage.
A Trevitest of the six valves determined the liftsetpoints to be
+3.2 percent, +3.2 percent, +3.7 percent, +4.4 percent,
+ 5.0 percent, and
greater than 6 percent (valve did not lift) of their required liftsetpoints.
At the time
of the discovery, the control room was notified of the conditions, five valves were
reset to their required setpoint, and the valve that did not liftwas gagged
and
declared inoperable.
The team also noted that Condition Report/Disposition Request 3-7-0148 reported
on March 17, 1997, that one of the four pressurizer code safety valves that were
shipped offsite for as-found testing and refurbishment,
had a liftsetpoint that was
-1.2 percent lower than the technical specification required setpoint.
As part of the corrective actions for Condition Report/Disposition
Requests 3-7-0056 and 3-7-0148, the licensee performed an analysis of the as-
found conditions of the main steam safety valves and pressurizer code safety valves
to determine if their design basis had been exceeded.
The licensee analyzed
a loss
of condenser
vacuum event using worst case operating conditions during the past
Unit 3 operating cycle and the as-found setpoints of the valves.
The licensee
determined that the design basis had not been exceeded
during the past unit
operating'ycle.
The'team reviewed the results of the analysis, which
demonstrated. that the highest secondary
peak pressure was 1395.86 psia, w'hich
was only 1.14 psia less than the allowed 110 percent of the secondary
design
pressure
(1397 psia)..
~
.
~
The team discussed the licensee corrective actions for the a'-found liftsetpoint
discrepancies
with the system engin'eer, who indicated that the main steam safety
valves that were found out-of-tolerance were replaced with valves that had been set
to their technical specification-required'-setpoints.'he
system engineer also
indicated that the out-of-tolerance valves that were removed had been shipped to
an offsite test facility to attempt to determine the root cause of the out-of-tolerance
24
0
1
0
condition.
The team noted that Condition Report/Disposition
Requests 3-7-0056
and 3-7-0148 had been closed based
on replacement of the valves and the design
basis analysis that had been performed.
However, when questioned
about the
results of the root-cause
evaluation, the licensee indicated that the evaluation had
not been completed and that Condition Report/Disposition
Request 3-7-0056 had
been erroneously closed.
The team noted that the licensee's reportability evaluation for Condition
Report/Disposition
Request 3-7-0056 determined the condition to be not reportable
due to fact that the design basis was not exceeded.
In response to the team's
questions,
the licensee performed an additional reportability evaluation and
subsequently
determined that the out-of-tolerance conditions of the main steam
safety valve's liftsetpoints was reportable under 10 CFR 50.73 (a)(2)(vii). The
licensee indicated that a licensee event report, including the results of the root
cause evaluation and the corrective actions would be submitted.
The failure to
report the six Unit 3 main steam safety valves as-found liftsetpoints being outside
their technical specification tolerances was a violation of 10 CFR 50.73 (a)(2)(vii)
(50-530/971 9-06).
Conclusions
The licensee had performed appropriate design basis evaluations
and immediate
corrective actions after finding 6 of the 20 main steam safety valves and one of the
pressurizer safety valves outside their technical specification tolerances
in Unit 3.
The failure to report this condition to the NRC within 30 days as required by
10 CFR 50.73(a)(2)(vii) is a violation.
S stem Walkdowns
Ins ection Sco
e 37550
The team performed walkdowns of the following systems with associated
system
engineers
and maintenance
engineers:
~
-
Unit 3 spray pond
~
Unit 3 containment spray
~
Unit'3 essential chilled water
Observations
and Findin s
The team found the systems to be installed and maintained in accordance with
applicable system drawings and procedures
during the visual walkthrough
inspection of the systems.
The material condition of the plant in all areas was very
good.
For.example, very few deficiency.tags were evident and no signs of
damaged
equipment were noted.
Ladders, chains, and other temporarily-staged
equipment were properly secured..
No leaks, debris, material storage problems,
transient combustible materials were seen and lighting was adequate.
Overall, plant
housekeeping
was very good.
25
0
1
0
0
c.
Conclusions
In the ar'eas reviewed by the team, plant material condition and housekeeping
were
very good.
E6
En ineerin
Or anization
E6.1
Engineering Indicators
The following information is:tracking information for the engineering
organization.
The inspectors
have summarized the information obtained from the licensee over
the last three years and provided an indication of the trend.
This information is
collated here for future use and information. Any adverse trends or questions
have
been discussed
in separate
sections of this inspection report.
E6.1.1 Engineering Organization
~
Size and Stability of Engineering Organization - The licensee's
engineering
. organization has been relatively stable in the last 3 years.
The number of
engineers
in the engineering organization
is as follows:
5/97
327
9/95
362
9/94
356
Number of System Engineers:
Over the past 3 years, the number of system engineers
has held steady
at 19,
Number of Design Engineers:
5/97
155
9/95
191
9/94
148
~
Number and'Function of Maintenance
Engineers
- The number of
maintenance
engineers
has decreased
in the following manner:
5/94
66
5/95
64
5/96
63
4/97
56
The function of maintenance
engineers
is to support the maintenance
needs
of the site to ensure safe, reliable, efficient operation is achieved.
The
licensee's management
expectations
are as follows:
26
~
Maintenance
engineer's
are active members of the maintenance
teams
~
Maintenance
engineers
resolve basic issues rapidly, as close to the
point of initiation as possible.
The maintenance
engineer should
involve expertise
in other organizations to resolve complex,
programmatic, or specialized technical issues.
Average Experience
Level of Engineering Staff:
1994
13.6 years
1995
14.6 years
1996
16.1 years
Average Engineering Overtime (percent)
94
Design
4.0
System
3.2
Maintenance
7.0
95
96
4.6
1.4
2.2
1.3
9.2
0.2
Percent of Engineering Work Accomplished by Contractors (percent of total
engineering payroll):
1994
49.4
1995
45.4
1996
17.4
E6.1.2
Engineering Support
Operability Determinations Performed by Engineering:
1995 42 total, engineering involved in the majority of these
1996
66 total, engineering involved in 28 (42 percent)
1997
16 to date, engineering involved in 16 (100 percent)
Percent of System Engineer's Time in the Field - Through licensee survey,
the team determined that the average time spent in the field by system
engineers was estimated to be 20 percent with 10 percent of that time
performing walkdowns.
The licensee stated that this estimate varied with
system requirements, for example, mechanical systems required more time in
the field, whereas electrical and instrumentation and controls systems
required less time in the field. The licensee stated that no trend data for time
spent in the field was available, but presumed it to be steady.
Condition Reports/Disposition
Requests
Generated
by Engineering:
1994
2623 total, engineering initiated 607 (23 percent)
1995
2852 total, engineering initiated 410 (14 percent)
27
J
1996
3096 total, engineering initiated 355 (11 percent)
1997
1506 to date, engineering initiated 168 (11 percent)
~
Size and Scope of Engineering Backlog - The main components
of the
engineering
backlog tracked by the licensee are as follows:
Condition Reports/Disposition
Requests
still open at the end of the year:
1994 - 968 of 2623
1995 - 523 of 2810 "
1996 - 620 of 3096
Deficiency Work Orders carried over from previous year:
1995 - 65
1996 - 112
1997 - 189
Design Modification Work Orders available to be worked on during year:
1994
176
1995
752
1996
786
1997
542
t
E6.1.3
Engineering Work Processes
~
Description of Modification process:
The team reviewed the licensees modification process
and determined that
the majority of the modifications were performed in accordance
with
Procedure
81DP-OEE10, "Plant Modifications," Revision 0. This was a
new-modification procedure with an effective date of January
15, 1997.
This procedure applied to equivalency changes,
maintenance
or minor
modifications, design modifications and paper change only changes.
In
addition, the procedure
applied to setpoint or instrument range changes
and software changes that
required approved design output documents to
be changed.'tems
outside *of the scope of this procedure included
material changes
related to equivalency modifications, nuclear fuels
-
-
- 'issues related.to the modification process,
item procurement specification
change notices, and temporary modifications.
In addition, the team
rev'iewed Procedure
81DP-ODC13, "Deficiency Work Order," Revision 10,
which was applicable for authorizing repair, use-as-is, rework or scrap of
plant systems, structures or components,
which were in a condition that
was not supported by any engineering,
design basis, or design output
documents.
Number of Permanent
Modifications Implemented:
28
f
0
0
The licensee completed 78 permanent modifications in 1994, 188 in 1995,
156 in 1996, and at the time of this inspection had completed 80 in 1997.
The licensee stated that maintenance
modifications started being tracked
during 1996.
Permanent
Modifications Planned for Next Outage:
The licensee compiled a list of permanent modifications planned for the next
outage for each of the three Units.
For Unit 2's seventh refueling outage
scheduled to start September
6, 1997, the licensee has planned 33 design
modifications and 58 maintenance
modifications.
The preliminary plans for
Unit 1's seventh refueling outage are 65 design modifications and 17
maintenance
modifications.
The preliminary plans for Unit 3's seventh
refueling outage are 42 design modifications and 15 maintenance
modifications.
Number of Safety Evaluations Performed:
The number of 10 CFR 50.59 safety evaluations performed during the past
three years has remained quite constant.
The licensee performed 332
evaluations
in 1994, 373 in 1995, 300 in 1996, and 95 through April 1997.
Number of Operating Experience Information Issues Evaluated:
1995
133
1996
125
1997
34
E7
Quality Assurance in Engineering Activities
E7.1
En ineerin
Self Assessments
a.
Ins ection Sco
e 37550
The team discussed
engineering self assessments
with the licensee to determine the
number and scope of engineering self assessments
performed over the past 3 years,
and the organization'erforming these self assessments.
b.
Observations
and Findin s
, The licensee provided the following engineering self assessment
information to the
team.
Year
Nuclear Assurance
~En ineerin
1997
3 completed, 4 planned
5 completed,
6 planned
1996
13
29
(
0
1995
1994
The licensee stated that some self assessments
were joint engineering
and nuclear
assurance
audits.
The subject areas for the engineering self-assessments
in 1997
were as follows:
Engineering Team Inspection/Safety
System Functional Inspection - Completed-
Audit 97-005.
Engineering portion of INPO assessment
- Completed.
Steam Generator program evaluation - Completed.
Unit 3 Cycle 7 Fuel Design - Completed.
Effective Implementation of the Maintenance
Rule - Completed.
Licensing/Design
Bases Maintenance
Process
Validation.
Design Change Process
Benchmarking
- Fuel - Planned.
Design Engineering support of in field work - Planned.
Accredited Engineering Support Personnel Training Program - Planned.
Instrument Out of Tolerance - Planned.
Vendor Technical Manual - Planned.
The licensee performed an engineering self-assessment
(Audit 97-005) in April and
May 1997 that evaluated engineering's
ability to perform routine and reactive site
activities.
The audit report was issued on the last onsite day of the team
Inspection.
As such, the team was able to discuss with the licensee the results of
the audit, and read the report; however, the team did not have time to validate and
perform a detailed review of the self assessment.
The NRC team noted that the
findings were generally consistent with those identified by the team.
The self-
assessment
report noted that engineering was effective in performing routine and
reactive site activities, but individual performance
regarding technical rigor, follow-
through, and attention-to-detail
needed improvement.
The self assessment
noted
that the process to maintain design basis manuals and calculations up-to-date was
partially effective.
The Self Assessment
Audit Report 97-005 determined several strengths
in the
engineering
area.
These strengths were as follows:
30
i
The systems reviewed by the self assessment
team were satisfactorily
operated
and maintained.
Engineering communicated
and interfaced well with its customers.
Modifications were performed well, particularly those with involvement by
the projects group.
Individual knowledge in the engineering,
operations,
and maintenance
areas
was very good.
The Self Assessment
Audit Report 97-005 determined several areas for
improvement in the engineering
area.
These areas of improvement were as follows:
~
Design and Licensing Basis Maintenance
- The design basis manual contained
errors, inconsistencies,
and items needing clarification when compared to the
Updated Final Safety Analysis Report and Safety Analysis Basis Document.
The licensee identified ten examples of design and licensing basis errors, and
inconsistencies.
Although the audit did not identify any safety significant issues, the total
number of issues identified indicated that management
attention was needed
to improve personnel performance.
The licensee classified the personnel
issues
in the following categories with condition report totals provided in
parenthesis;
technical rigor (7), follow-through (11), and attention-to-detail
(3).
In general, the team agreed with the engineering self-assessment
findings.
Corrective actions and root-cause
evaluations
in the two areas of improvement, and
the condition reports generated
by the licensee for specific self-assessment
findings,
were still being developed
during the time of the NRC inspection.
c.
Conclusions
The team concluded that the licensee performed good engineering self assessments
with meaningful findings.
Miscellan'eous'Engineering
Issues (92903)
E8.1
Closed
Violation 50-529 96010-01:
This violation involved the failure to provide
adequate
grounding for a 480/120 volt regulating transformer located in the Train B
dc equipment room.
The licensee failed to meet the electrical separation
requirements of Section III.G.2
for the control room, in that both Trains A and B of the safe shutdown capability
were located inside-of. the control room.
For a postulated control room fire, the
licensee used an alternative safe shutdown method, which required actions and
equipment installed in the Train B dc equipment room. A fire in the Train B dc
31
equipment room resulted in a control room fire. Therefore, both trains of equipment
relied upon to shut down the reactor during a postulated fire were exposed to the
potential of receiving fire damage.
Fire damage to both shutdown trains would have
resulted in the inability of the operators to safely shutdown the plant.
The failure to
provide adequate
grounding for the transformer, and the resulting related fires as
described
in NRC Inspection Report 50-528;-529;-530/96-10,
demonstrated
that
both trains of safe shutdown equipment were exposed tn the potential of receiving
fire damage.
A predecisional
enforcement:conference
was conducted
on August 1, 1996, in the
NRC's Region IV office, Arlington, Texas.
At the conference,
the license
representatives
agreed that a failure to comply with electrical grounding design
requirements of IEEE 142, as committed to in the Palo Verde Final Safety Analysis
Report, had occurred during plant construction,
and that this constituted
a violation
of 10 CFR Part 50, Appendix B, Criterion III, but disagreed with the NRC's
contention that the licensee had violated NRC's fire protection requirements.
Based
upon review of information developed during the inspection and the information that
was provided during the conference,
the NRC decided not to issue
a citation against
the requirements of Appendix R. The NRC concluded that information regarding the
reason for the violation, the corrective actions taken and planned to correct the
violation and prevent recurrence was already adequately
addressed
on the docket in
Licensee Event Report 96-01, and Revision
1 to this licensee event report.
The team reviewed Licensee Event Report 96-01, discussed
in Section E8.2 of this
report, and the licensee's corrective actions for the reported condition.
The team
determined that the licensee took appropriate corrective actions to address the
violation associated
with the electrical grounding problem.
This violation is closed.
Closed
Licensee Event Re ort 50-528 96-175 and 96-200;
This item involved
Licensee Event Report 96-01 that documented
a condition were inappropriate
grounding of equipment resulted in a condition outside the design basis of the plant.
On April 6, 1996, the licensee determined that the fire in Unit 2 on April 4, 1996,
was associated
with a condition outside the design basis of the plant.
The
condition existed in all three units where a fault in either regulating transformer in
the Train A or B dc equipment room could cause
a fire in the equipment room and
the control room.
The apparent cause of the fire was a short/failure of the hot lead
to ground at the 100 foot control building transformer winding between terminals
one and two of Transformer 2E-QBB-V02. The existing design for this power circuit
did not utilize a ground at this point or any point within the transformer; therefore,
the fault propagated
through the building grounding system.
As an interim corrective action, the licensee established
fire watches and issued a
night order for heightened
awareness
of the situation.
The licensee's investigation
for inappropriate grounding of low voltage power distribution systems was initiated
and identified 12 components
(per unit) requiring modifications.
On April 6, 1996,
the license investigation team concluded that the Unit 2 fire on April 4, 1996,
was associated
with a condition outside the design basis of the plant and a
32
i
1-hour 10 CFR 50.72 notification was made.
On April 5, 1996, the licensee
performed
a walkdown of the fire damage
and adjacent equipment and determined
that damage was confined to the Emergency Lighting Uninterruptible Power
Supply 2E-QDN-D84, Junction Box 2EZ3ANKKJ15, Essential Lighting Isolation
Transformer 2E-QBB-V02, and adjoining cables.
The licensee was committed to IEEE Standard
142, Section 1.6.1, "Grounding of
Industrial and Commercial Power Systems," which required that a grounded system
have a conductor grounded
at the neutral point of a transformer.
Contrary to this
requirement the essential lighting isolation transformers were not grounded at
neutral points of the transformers.
The licensee determined that the root cause of failure for the essential lighting
isolation transformer was the loss of mechanical bonding of the varnish insulation
material within %e third harmonic choke, thereby, allowing. normal transformer
vibration to result in delamination of the transformer core.
The root cause for the
secondary fire (control room) was determined by the licensee to have been an
incorrect grounding scheme
used in the transformer secondary circuits.
Licensee Event Report 96-001-01 identified the following licensee corrective actions
that were taken to address this event:
A broadness
review for appropriate grounding in 120V dc circuits was
conducted.
Twelve components
(limited to regulating transformers, battery
supplies and inverters) per unit were identified that required modifications for
electrical circuit protection and/or grounding.
Actions completed on May 2,
1996.
A "vertical slice" review of 125V dc and 480V ac and above power
distribution systems was expected to be completed by the end of June
1996.
Actions completed on July 25, 1996.
A temporary modification was developed to restore power to Essential
Lighting Distribution Panel 2E-QBN-D84. Action completed on April 5, 1996.
Restoration completed on April 30, 1996.
Repaired the fire damaged
equipment in Unit 2. Actions completed on
April 25, 1996.
Modifications, in all three units, to ensure circuitry protection and proper
grounding have been completed on the two emergency lighting
uninterruptible supply and essential lighting isolation transformer in each unit.
Actions completed on June 5, 1996.
33
(I
0
~
Two instrument power supply regulating transformers
in each of Units
1 and
2 were modified to provide proper circuit protection and would be modified
during the next refueling outage in Unit 3. Actions completed for Unit 1 on
October 10, 1996, and for Unit 3 on March 12, 1997.
Actions scheduled
for Unit 2 completion during next outage in September
1997.
~
Testing on the shunts currently installed in the 125V dc power circuit from
the Emergency Lighting Batteries E-QDN-F01 and F02 t'o the control room
emergency lighting uninterruptible power supply.
Actions completed on
August 6, 1996.
~
An evaluation was being performed to determine what the safety
significance of the design inadequacy was prior to 1992.
Since the raceway
configuration was not changed
since 1992, the safety significance was not
readily apparent.
Actions completed on September 25, 1996.
~
Design modifications to permanently install fuses near the batteries to
provide proper protection for these cables,
Actions completed on
September
25, 1996.
The team reviewed the licensee's corrective actions and determined that they were
reasonable.
This licensee event report is closed.
V. Management Meetings
X1
Exit Meeting Summary
The team leader and the engineering branch chief presented
the inspection results
to members of licensee management
at the conclusion of the inspection on
June 19, 1997.
The licensee discussed
the team findings and acknowledged the
findings presented.
The team leader asked the licensee whether any materials
examined during the inspection were proprietary.
No proprietary information was
identified.
34
I
I
ATTACHMENT
SUPPLEMENTAL INFORMATION
PARTIAL LIST OF PERSONS CONTACTED
Licensee
C. Langstrom, Mechanical System Engineer
E. Sterling, Nuclear Assurance
Operations Department Leader
J. Harnden, Senior Engineer, Nuclear Assurance
B. Blackmore, System Engineer
M. Radspinner,
Design NSSS Section Leader
S. Daftuar, Senior Engineer
D. Oakes, Inservice Testing Section Leader
C. Corcoran, Senior Engineer
H. Miyahara, Senior Engineer
D. Visco, Senior Engineer, Nuclear Assurance
L. Elliott, Instrumentation
and Control System Engineer
M. Hodge, Mechanical Design Section Leader
C. Lewis, Reactor Protection System Engineer
R, Smith, Nuclear Assurance Audit Team Leader
D. Wheeler, Nuclear Assurance Auditor
R. Younger, Nuclear Assurance
Engineering Department-Leader
M. Afzai, Mechanical Maintenance
Engineer
T. Szumski, Maintenance
Engineer
K. Parrish, Group Leader, Transient Analysis, Nuclear Fuels Management
J. Webb, Senior Engineer, Transient Analysis, Nuclear Fuels Management
R. Stroud, Consultant,
Nuclear Regulatory Affairs
D. Marks, Section Leader, Nuclear Regulatory Affairs
T. Barsuk, Emergency preparedness
Coordinator, Emergency Planning
B. Thiele, Section Leader, Reactor Engineering, Nuclear Fuels Management
M. Winsor, Department Leader, Maintenance
Engineering
M. Powell, Department Leader, Design Engineering
T. Cannon, Department Leader, Specialty Engineering
B. Rash, Department Leader, Systems Engineering
W. Ide, Vice President,
Nuclear Engineering
G. Overbeck, Vice President,
Nuclear Production
R. Fullmer, Director, Nuclear Assurance
R. Buzzard, Consultant,
Nuclear Regulatory Affairs
S. Bauer, Section Leader, Nuclear Regulatory Affairs
A. Krainik, Department Leader, Nuclear Regulatory Affairs
NRC
K. Johnston,
Senior Resident Inspector
I
I
(p,
CL
w
1
0
INSPECTION PROCEDURES USED
37001
37550
92903
10 CFR 50.59 Safety Evaluation Program
Engineering
Followup - Engineering
ITEMS OPENED, CLOSED, AND DISCUSSED
~Oened
50-528; 529;
530/971 9-01
50-528; 529;
530/971 9-02
50-528; 529;
530/971 9-03
Lack of a 10 CFR 50.59 Safety Evaluation for Use of Fates
Computer Code, Section E1.6
Lack of 10 CFR 50.59 Safety Evaluation for the Deletion of
Spray Pond Replenishment
Procedure
Required by the
UFSAR, Section E2.2
IFI
Lack of a 10 CFR 50.59 Safety Evaluation for the Deletion
of Approximately 80 Emergency
Plan Commitments,
Section E2.2
50-528; 529;
530/971 9-04
~
50-528; 529;
530/971 9-05
IFI
Inadequate
Corrective Action for an Inadequate
Operational
Procedure that Caused Two Containment Spray Water
Hammer Events, Section E2.3.1
Potentially Inadequate
Containment Spray System
Technical Specification Surveillance Requirements,
Section
E2.3.1
50-528; 529;
530/971 9-06
Failure to Report Six Main Steam Safety Valves Found Out
of Technical Specification Tolerances,
E2.3.2
Closed
50-529/9610-01
50-528/96-1 75
50-528/96-200
Control Room Fire Caused by Inadequate
Grounding,
Section E8.1
LER
LER 96-01 - Control Room Fire Caused by Inadequate
Grounding, Section E8.2
LER
LER 96-01, Revision
1 - Control Room Fire Caused by
Inadequate
Grounding, Section E8.2
CO
i
f
DOCUMENTS REVIEWED
Plant Procedures
Number
81 DP-OEE1 0
81 DP-ODP1 3
74DP-9CY03
1 6DP-OEP1 5,
73ST-9EW01
EPIP-56
PD-OAP01
Revision
10
0
0
Title
Plant Modifications
Deficiency Work Orders
Temporary Modification Control
Chemistry Control Instruction
System Chemistry Specifications
Technical Support Center Actions
Satellite Technical Support Center Actions
Essential Cooling Water Pumps-Inservice
Test
Ultimate Heat Sink Emergency Water Supply
Administrative Control Program
70DP-OEE01
60DP-OQQ1 9
Condition Reporting
Equipment Root Cause of Failure Analysis
System Engineering
Internal Audits
Modifications
Number
Title
Spray pond flow transmitter problem
Spray pond orifice plate change
Revise specification to revise control valve
'- 'Raise setpoint of 'spray pond pump temperature
alarm
'
n
II
Decrease setpoint of the ECW pump discharge temperature
Spray pond setpoint change from 1000 gpm to 600 gpm
Excess flow check valve bypass
Temporary Plant Modification No. 2-96-SE-003
"Unit 2 ex-core channel
D exhibiting
excessive
noise."
Modification Deficienc
Work Orders
Number
Title
Use-as-is non Q Unistrut
Pitting found on ECSW HX
Evaluate module found in the chiller
Studs found with less than full engagement
Use of Locktite on HBC Gearboxes
Number
1 3-MC-EC-254
1 3-MC-EW-305
1 3-MC-NC-003
EDC 97-00111
13-JC-SP-206
Title
Max Allowable Chilled Inlet Temp for EC Chillers
Essential water system
hydraulic calculation
Nuclear cooling water system heat loads and water requirements
MINET Hydraulic Analysis of the SP System
Essential spray pond pump discharge temperature
instrument
uncertainty and setpoint calculation
13-JP-SP-201
13-JC-EW-204
Essential spray pond flow instrument setpoint and uncertainty
calculation
Essential cooling water pump discharge temperature
instruments
setpoint and uncertainty calculation
Cl
I
0 erabilit
Determinations
¹043
Removal of missile shield for Spray Pond components
¹068
Operability of essential chillers when hot gas bypass valve fails open or fails closed
with EW temperature
above 65F
¹081
Diesel generator/spray
pond operability with diesel genreator aftercooler and lube oil
thermal reliefs failed open
¹110
Operability of EC system with auto makeup function to surge tank disabled
¹144
Essential Spray Pond operability with spray pond cross connect valve inoperable in
closed position
¹153
Operability of B Essential Chiller with refrigerant head pressure control valve in
overridden position
¹157
Operability of the Essential Water system with flow indicator spiking up to 2000
gpm
Condition Re ort Dis osition Re uests
Number
Title
9-4-0302
Essential spray pond susceptibility to pitting
9-4-0080,
Reduction of flow in emergency diesel generator jacket water and lube oil
heat exchangers
9-5-0125
Corrosion found in emergency diesel generator jacket water and lube oil heat
exchangers
2-6-0163
1-5-0062
Spray pond pump train A failed flow test
.
During inspection of the emergency diesel generator heat exchangers
corrosion nodules were found lodged in the spray pond system inlet
tubesheets
3-7-0003
Spray pond pump train A failed flow test
3-6-0185
Interruption of Spent Fuel Pool cooling during post-modification testing
9-6-1371
Piping clearance problems
Cl
1-6-0337
Spray pond cooling to 8 Diesel Generator air intercoolers isolated during
maintenance
9-6-1449
Final Safety Analysis Report discrepancies
3-7-0003
Unit 3 Spray Pond pump "A" low flow
2-7-0008
Unit 2 Spray Pond filter pump flowrate degraded
3-7-0007
Unit 3 ESP "A" Pump inoperable because
of low flow
2-7-0021
"A" Essential Chiller Pumpout Unit Conduit Broken
9-7-0127
Max operating temperatures
used in stress analysis not consistent with
system calculations
2-7-0145
EW "B" pump d/p exceeded
acceptance
criteria
9-7-Q271
Superseded
calculation used to support design change
3-6-0178
Unable to open Unit 3 spray pond cross-connect
valve
9-6-0019
Chillers not operable in spray pond temperature
drops below 49F
9-6-0046
Packing leakoff gland on essential chilled water pump 3-01 out of spec
9-6-0226
M&TE calibration data not recorded
9-6-0380
Foreign material on EC motor cooling refrigerant filters
9-6-0452
Unit 2 EC "B" low refrigerant level
9-6-0778
Unit 1 EC System Reliability Low
9-6-0791
Removal of both trains of shutdown cooling
2-6-0162
Spray Pond Pump "A" low flow
2-6-0163
White paper discussing low spray pond flows
2-6-0028
EC compressor
oil temperatures
high
3-7-0263
At 23:12 on 5/31/97, a reactor trip occurred in Unit 3 from 100 percent
power steady state conditions.
9-7-Q283
Updated Final Safety Analysis Report errors and inconsistencies
are present.
41
1
9-7-0338
The Combustion Engineering Standard Safety Analysis Report is not being
maintained per the requirements of ANSI N45.2.9-1974.
9-7-0275
Sixty-six safety injection design basis manual errors and inconsistencies
were
identified.
9-7-0277
Thirteen Pool Cooling design basis manual errors and inconsistencies
were
identified.
9-7-0274
Two Spray Pond design basis manual errors and inconsistencies
were
identified.
9-7-0266
Two Safety Analysis Basis Documents errors (related to the low pressure
safety injection system) were identified.
9-7-0297
Contrary to ANSI N45.2.11, the method to transmit information for
reconstituted
calculations
is not always successful.
9-7-0281
Independent
Safety Engineering
Group weekly meetings are not being
conducted
and additional management
involvement is needed.
9-7-0280
9-7-0258
Procedure-specified
heatup and cooldown rates for the shutdown cooling
heat exchangers
did not include instrument readability uncertainty.
Emergency operating procedures
parameters for safety injection contain
instrument uncertainty per NFM analysis SA-13-C000-95-004, but these
parameters
do not match those contained
in normal operating procedures
(which match values contained
in the DBMs and Updated Final Safety
Analysis Report).
9-7-0259
The shutdown cooling initiating/securing temperature
and pressure
values
contained
in 40OP-9SIO-2 were different than those contained
in the DBM
and calculation 13-JC-SI-205.
9-7-0233-
Spray pond level calculation did not consider uncertainties
associated
with
chemistry concentration
or the pond maximum/minimum operating
temperature.
9-7-0257
EPIP-56 was canceled with no 10 CFR 50.59 evaluation and the associated
regulatory commitments were not incorporated into the superseding
procedures.
A similar condition exists for other emergency planning
procedures.
9-6-0183
Inadequate work control program for nontechnical specification Regulatory
'uide 1.97'instruments.
4
9-6-0197
UFSAR wording regarding Shift Technical Advisors needs corrected.
I
i
9-6-0243
Trend process does not play an active role in identifying those conditions not
3-7-0148
3JRCEPSV0200
found set outside technical specification tolerance.
3-7-0056
Six main steam safety valves found set outside technical specification
tolerance.
3-7-0050
3JSGEPSV0691
failed to liftduring trevitesting.
Audit Re orts and Self-Assessments
Audit Report 97-005
Engineering Team Inspection/Safety
System Functional
Inspection Audit Report.
Audit Report 96-002
Engineering
and Corrective Action Effectiveness Self
Assessment.
~ ~ .~
t